Reply to post:

it really scans just the local loopback address?

Chocolate fireguard level then, cue malware authors just moving their tools to binding only to active ethernet addresses instead of everything in a really short timeframe.