A few months ago there was a research presentation presented on computer security. It touched upon botnets and the presenter gave some data. Below are some summary results based on a 9-day down-sampled spam trace from Hotmail.
One day we plan to start combing through our own data to see if we can find even more granular detail on spammers and their botnets.
How are you grouping botnets together? If it's just by similar subjects this method doesn't work.
I'd also be interested in hearing more about how the researcher correlated an IP address with a specific bot.
If this is based solely on grouping similar messages together it's more an analysis of spam campaigns rather than botnets.