Slammer is a really old worm. It exploits this[1] vulnerability so it's not surprising that it's dying off. The entire worm is small enough to fit in a single UDP packet as it just generates random IP addresses, launches itself on UDP port 1434, and if the packets hit a vulnerable windows 2000 server, then the exploit kicks in and we have a new infected host to propogate the worm.

Bearing in mind that the vulnerability exploits a weakness in a very old no longer supported version of Windows, and that the patch came out 9 years ago it's not surprising that slammer activity has decreased.

There are a number of possible reasons for this - for example, maybe there were just a few infected servers and these have been taken offline, or that some form of filtering has been put in place at the ISP or country level so ISS' sensors no longer pick it up, but the reality is we just don't know.

All worms have a shelf life, perhaps slammer's just reached the end of it's one. 8 years isn't a bad run. After all, how many Morris worm infections does anyone see these days?

[1] - http://www.microsoft.com/technet/security/bulletin/MS02-039....