Re[2]: [Xitami] Nimda & status 200 message

[Paul Reid]

> the IP's that scan me reverse to clients on ATTBI, which means
> these are mostly corrupted personal machines.

One of these worms prefers "local" IP numbers. The original used
random numbers, but that means vast amounts of around the world
traffic which got noticed quick. A later version prefers IP numbers
"near" itself, flooding a building which is less likely to attract
attention quickly. So most of your hits will be "nearby" IP numbers.

Also: most big servers were patched over a year ago when this worm
flooded the world. Today the most likely infection is a new machine
set up by someone who isn't aware of the issue: "Personal machines".

 -PRR