I find something like 100 - 500 malware samples a week, so i see it working every day… both the IP block and the install protection, usually i must disable the protection module to be able to download the sample…