But many aren't. The author shows Shell Shock code, and even retrieves a UPX packed executable. One could just as easily assume that the mere scans are aggrega

But many aren't. The author shows Shell Shock code, and even retrieves a UPX packed executable. One could just as easily assume that the mere scans are aggregated and sold later. If your HTTP server gives back a file "aws.yml", the URL may just get sold. It's well known that cyber criminals work in an economy with division of labor, and specialize in particular skills.