Not every port, but maybe you remember this: http://arstechnica.com/security/2013/03/guerilla-researcher-created-epic-botnet-to-scan-billions-of-ip-addresses/ h

Not every port, but maybe you remember this: http://arstechnica.com/security/2013/03/guerilla-researcher-created-epic-botnet-to-scan-billions-of-ip-addresses/ http://arstechnica.com/security/2013/03/guerilla-researcher-... The article also details an earlier cataloging where a researcher probed 18 ports 3-4 times a day over the ipv4 address space. Tools like ZMap or MASSCAN make it easy for anyone to scan as many ports as they can, but I haven't heard of any worm that systematically tried all 65535 ports of all addresses. Though I would bet a lot of money that an OpenSSH 0day that bypassed all authentication would result in several such worms from multiple actors who already control hundreds of thousands of devices.