Who got Code Red?
Big question: who gets code red? Big companies? Home users? Web servers? People who know they aren't running IIS?
Host infection plots show some slight diurnal behavior ==> people turning off their “web servers”
Looking deeper shows extreme diurnal behavior, masked in simple plots