My rule of thumb, I use a % formatted string once I do more than one '' + '' concat.
Change this to: `' by *%s*' % attacker`