Mapping out the global infrastructure of attackers is essential in remediating attacks and delivering good news calls. Clues such as language and time zones are helpful, but strong evidence is needed.