
White hats need to look out as well...
> "At this point, we are seeing the scans slow down a bit," he explained. But they have reached "saturation," meaning that all IPv4 addresses have been scanned for this vulnerability. If you find a vulnerable server in your network: Assume it has been compromised."
And the corollary is: if you are a hacker and you find a new server that is vulnerable then it's likely a honeypot.