i don’t know if this would have anything to do with lemmy but it does show that a botnet is likely spreading through some german isp

Not sure if it’s relevant as pretending to be form Germany may be the point here, but “Tor clients” aren’t “from” anywhere you can know, that’s just where the exit node is located.