"it appears that someone (probably the worm author) was trying to be funny and DDoS the counter" - this is one of the reasons why I keep saying the counter should be taken offline.
TonyW | 01.26.06 - 6:05 am | #

Except anyone coming through a proxy will show up the same IP address. You could have thousands of machines setting behind a proxy all showing as one or a small number of IP addresses. The 300K is only a lower bound, the actual number of infected machines is almost certainly higher.
Jonathan Buzzard | 01.27.06 - 5:59 am | #