it happens often enough and can look like a virus, but it isn't. trying to prove how threats r done