OK just a quick update regarding ConfickerC numbers.
I have seen published numbers that are all over the place *cough IBM/ISS cough*.
Over the last 30 hours or so we recorded 9,795,101 raw (not unique IP) http connections to the sinkhole.
As unique IPs go we recorded a total of 1,071,132 unique IPs from with in that 9+M. Now keep in mind, we have to think about DHCP churn, NAT (Firewalls, gateways, proxies, etc) So the number is obviously not a 100% true representation.
Here is what the PER HOUR numbers look like from the sinkhole:
