[sharphall]

I second this. Bot activity can even come from legitimate ephemeral residential or office IPs with devices temporarily (hopefully) infected with malware.