A method, apparatus and system contain and localize malware propagation. In one embodiment, a security scheme may identify worm traffic that attempts to probe an unused network location. The security scheme may then in conjunction with a routing component, reroute the worm traffic to a contained and localized location. In one embodiment, the contained and localized location is a virtual machine (VM) within a virtualized platform. In other embodiments, the contained and localized location is a computer system on a network.