Jim Toole Exploit Quotations

By then, we had already seen the worm about four times and we knew which five IP addresses it was going to go after first. By Sunday morning we were seeing 3200 attacks an hour from machines trying to run the exploit on our box. That's a lot of attacks.

Simple. A new vulnerability came out. The number of IIS 4 servers out there is a lot less than the number of IIS 5 servers. So when the IIS 5 vulnerability was announced, it made sense for the author to adapt his worm for that. People assumed it was a new exploit and it was not.