They will say they are coming form a machine that is turned off. or Multiple attacks from different ips at the same time utilizing the same attacks on different servers.