Comment by ceejayoz

My suspicion is at least half are unpatched WordPress installs.