Worm demographics Who is infected? Based on unique IPs per day Reverse DNS (PTR) lookups 37% failure for CodeRed 60% failure for Nimda Routing registry lookups (ARIN, RIPE, APNIC, etc.) 6% failure for CodeRed 4% failure for Nimda Non-US .net, .com in top 10 translated to country TLD cn.net, t-dialin.net, kix.net, bora.net, hinet.net, etc.