Yeah, I guess in his experience that scenario is less likely tan it being a c2 endpoint so he made the decision on that. And it turned out to be the correct one and might have prevented this from becoming a much more destructive blaster worm.