most of the servers are in covad.net and attbi.com. The others are in san.rr.com and lsan03.pacbell.net. I believe that this could indicate from where it was begun to spread the worm.