performance myth: DoS attacks (2) romania and brazil have disproportionate number of infected hosts other domains have roughly same ratio of infected/total machines