https://rud.is/b/2012/10/11/diy-zeroaccess-analysis-lesson-1-treat-geoip-results-lightly/
DIY ZeroAccess Analysis Lesson #1 : Treat GeoIP Results Lightly