then, associated with each of these attacks is a unique (or semi-unique) ip address and (faked) user agent.
Such attacks will be executed from a single machine or even small network, in which case the user agent for each entry is generally generically randomized to avoid user-agent-based blacklists.