This counts HTTP requests the gateway's inspection engine blocked for matching a known HTTP-worm signature. Since worms propagate automatically without user interaction, a nonzero count here indicates an infected or scanning host is actively probing or trying to spread through web servers behind this gateway, and it's worth identifying the source IP promptly rather than treating it as routine noise. For example, this counter jumping after an internal workstation gets infected with a worm that scans the internal web server range looking for the same vulnerability it exploited to spread.