Most of the attacks are performed from other, already infected sites.