Well here is part of the answer. SANS has an interesting article tracking down the bots: Who Are Those Bots? – SANS Internet Storm Centre