Plaintiffs MICROSOFT CORP. (Microsoft), FINANCIAL SERVICES INFORMATION SHARING AND ANALYSIS CENTER, INC.

. (FS-ISAC) and the NATIONAL AUTOMATED CLEARING HOUSE ASSOCIATION (NACHA), hereby complain and allege that JOHN DOES 1-39 (John Does or Doe Defendants) are controlling a worldwide, illegal computer network, collectively known as the Zeus Botnets, comprised of end-user computers connected to the Internet that Defendants have infected with malicious software. Defendants have used the Zeus Botnets to infect over 13 million computers on the Internet, which were then used to steal over $100 million during the past five years. Defendants control the Zeus Botnets through a sophisticated command and control infrastructure hosted at and operated through Internet domains set forth at Appendix A and the Internet file paths set forth at Appendix C to this Complaint (hereinafter the Harmful Domains) and the Internet Protocol addresses set forth at Appendix B to this Complaint (hereinafter the Harmful IP Addresses) (herein collectively referred to as the Harmful Domains and IP Addresses), as follows: NATURE OF ACTION 1. This is an action based upon: the Computer Fraud and Abuse Act (18 U.S.C.

1030); CAN-SPAM Act (15 U.S.C. 7704); Electronic Communications Privacy Act (18 U.S.C. 2701); trademark infringement under the Lanham Act (15 U.S.C. 1114), false designation of origin under the Lanham Act (15 U.S.C. 1125(a)); trademark dilution under the Lanham Act (15 U.S.C. 1125(c)); the Racketeer Influence and Corrupt Organizations Act (18 U.S.C. 1962(c)); unjust enrichment; trespass to chattels; and common law conversion. Plaintiffs seek injunctive and other equitable relief and damages against Defendants for their creation, control, maintenance, and ongoing use of the Zeus Botnets, which have caused and continue to cause irreparable injury to Plaintiffs, Plaintiffs customers and members, and the general public. THE PARTIES 2. Plaintiff Microsoft Corp. is a corporation duly organized and existing under the

laws of the State of Washington, having its headquarters and principal place of business in 1

Redmond, Washington. Microsoft is a leading provider of technology products and services, including computer software, Internet services, websites and email services. 3. Plaintiff FS-ISAC, Inc. is a non-profit corporation duly organized and existing

under the laws of Delaware, having its headquarters and principal place of business in Reston, Virginia. FS-ISAC is a membership organization comprised of 4,400 organizations including commercial banks and credit unions of all sizes, brokerage firms, insurance companies, payment processors, and over 20 trade associations representing the majority of the U.S. financial services sector. FS-ISAC represents the interests of its financial services industry members in combating and defending against cyber threats that pose risk and loss to the industry. 4. Plaintiff National Automated Clearing House Association is a non-profit

corporation duly organized and existing under the laws of Delaware, having its principal place of business in Herndon, Virginia. NACHA manages the development, administration, and governance of the ACH Network, the backbone for the electronic movement of money and data, and represents more than 10,000 financial institutions via 17 regional payments associations and direct membership. 5. Plaintiffs are informed and believe and thereupon allege that John Doe 1 is the

creator of the Zeus botnet code that, along with the Ice-IX and SpyEye botnet codes, comprise the Zeus Botnets. John Doe 1 goes by the aliases Slavik, Monstr, IOO and/or Nu11 and may be contacted at messaging address bashorg@talking.cc. 6. Plaintiffs are informed and believe and thereupon allege that John Doe 2 is the

creator of the Ice-IX botnet code that, along with the Zeus and SpyEye botnet codes, comprise the Zeus Botnets. John Doe 2 goes by the aliases zebra7753, lexa_mef, gss, and iceIX and may be contacted at Jabber messaging address iceix@secure-jabber.biz and ICQ messaging address 610875708. 7. Plaintiffs are informed and believe and thereupon allege that John Doe 3 is the

creator of the SpyEye botnet code that, along with the Zeus and Ice-IX botnet codes, comprise the Zeus Botnets. John Doe 3 goes by the aliases Harderman or Gribodemon and 2

may be contacted at email and messaging addresses shwark.power.andrew@gmail.com, johnlecun@gmail.com, gribodemon@pochta.ru, glazgo-update-notifier@gajim.org, and gribodemon@jabber.ru. 8. Plaintiffs are informed and believe and thereupon allege that John Does 1 through

3, as creators of the malicious botnet code, have acted in concert with John Does 4 through 39 who have purchased, developed and/or sold such botnet code, and are currently operating or have contributed to the operation of the Zeus Botnets. 9. Plaintiffs are informed and believe and thereupon allege that John Doe 4 goes by

the aliases Aqua, aquaSecond, it, percent, cp01, hct, xman, and Pepsi and may be contacted at messaging addresses aqua@incomeet.com and 637760688. Upon information and belief, John Doe 4 recruits money mules and uses them to cash out stolen account credentials, and operates the Zeus Botnets to compromise account credentials. 10. Plaintiffs are informed and believe and thereupon allege that John Doe 5 goes by

the aliases miami and miamibc and may be contacted at messaging addresses miami@jabbluisa.com, um@jabbim.com, and hof@headcounter.org. Upon information and belief, John Doe 5 is a developer of web inject logic for the Zeus Botnets and has been called on by other Doe Defendants in this case to develop web inject code for Zeus Botnet configuration files (e.g. injecting additional website form fields, such as ATM card number, pin, etc, as described further below). 11. Plaintiffs are informed and believe and thereupon allege that John Doe 6 goes by

the alias petr0vich and may be contacted at email and messaging addresses theklutch@gmail.com, niko@grad.com, Johnny@guru.bearin.donetsk.ua, petr0vich@incomeet.com and 802122. Upon information and belief, John Doe 6 is a primary network administrator for other John Doe defendants in this case, handling most of the tasks relating to Zeus hosting and operations. 12. Plaintiffs are informed and believe and thereupon allege that John Doe 7 goes by

the alias Mr ICQ and may be contacted at messaging address mricq@incomeet.com. Upon 3

information and belief, John Doe 7 is one of the actors in Defendants organization who handles incoming notifications of newly compromised victim information. Upon further information and belief, John Doe 7 is also connected to underground electronic currency exchange services. 13. Plaintiffs are informed and believe and thereupon allege that John Doe 8 goes by

the alias Tank and tankist and may be contacted at email and messaging addresses T4ank@ua.fm, tank@incomeet.com and 366666. Upon information and belief, John Doe 8 works closely with John Doe 6 and is involved in cashing out stolen credentials. 14. Plaintiffs are informed and believe and thereupon allege that John Doe 9 goes by

the alias Kusunagi. Upon information and belief, John Doe 9 is involved in writing and obtaining web inject code. Upon further information and belief, John Doe 9 can likely be contacted at email and messaging addresses T4ank@ua.fm, tank@incomeet.com and 366666. 15. Plaintiffs are informed and believe and thereupon allege that John Doe 10 goes by

the alias Noname. Upon information and belief, John Doe 10 is associated with John Doe 4, operates the Zeus Botnets and can likely be contacted at aqua@incomeet.com and 637760688. 16. Plaintiffs are informed and believe and thereupon allege that John Doe 11 goes by

the aliases Lucky and Bashorg and may be contacted at messaging address 647709019. Upon information and belief, John Doe 11 is a Zeus code vendor and has provided cashiering functions (e.g. initiator of ACH/wire transaction) to other Defendants. 17. Plaintiffs are informed and believe and thereupon allege that John Doe 12 goes by

the alias Indep. Upon information and belief, John Doe 12 is associated with John Does 1, 8 and 11 and can likely be contacted at T4ank@ua.fm, tank@incomeet.com and 366666, 647709019. Upon further information and belief, John Doe 12 operates the latest versions of the Zeus Botnets. 18. Plaintiffs are informed and believe and thereupon allege that John Doe 13 goes by

the alias Mask. Upon information and belief, John Doe 13 is involved in Defendants money mule operations. 19. Plaintiffs are informed and believe and thereupon allege that John Doe 14 goes by 4

the alias Enx. Upon information and belief, John Doe 14 is involved in Defendants money mule operations. 20. Plaintiffs are informed and believe and thereupon allege that John Doe 15 goes by

the aliases Benny, Bentley, Denis Lubimov, MaDaGaSkA, and Vkontake and may be contacted at email and messaging addresses getready@safebox.ru, john.mikle@ymail.com, alexeysafin@yahoo.com, moscow.berlin@yahoo.com, cruelintention@email.ru, bind@email.ru, firstmen17@rambler.ru, benny@jabber.cz, 77677776, 76777776, 173094207, and 45677777. Upon information and belief, John Doe 15 specializes in money mule recruitment of young people going to the U.S., or already in the U.S., on a J1 student visa. Upon further information and belief, John Doe 15 advertizes a cash-out service known as Hot Spot and is believed to work with John Doe 6 on a regular basis. 21. Plaintiffs are informed and believe and thereupon allege that John Doe 16 goes by

the alias rfcid. Upon information and belief, John Doe 16 has purchased and used Zeus Botnet code. 22. Plaintiffs are informed and believe and thereupon allege that John Doe 17 goes by

the alias parik. Upon information and belief, John Doe 17 has purchased and used Zeus Botnet code. 23. Plaintiffs are informed and believe and thereupon allege that John Doe 18 goes by

the alias reronic. Upon information and belief, John Doe 18 was involved in testing and using the merged Zeus/SpyEye code. 24. Plaintiffs are informed and believe and thereupon allege that John Doe 19 goes by

the alias Daniel and may be contacted at messaging address 565359703. Upon information and belief, John Doe 19 was involved in developing Zeus/SpyEye code. 25. Plaintiffs are informed and believe and thereupon allege that John Doe 20 goes by

the aliases bx1, Daniel Hamza and Danielbx1 and may be contacted at email and messaging addresses airlord1988@gmail.com, bx1@hotmail.com, i_amhere@hotmail.fr, daniel.h.b@universityof sutton.com, princedelune@hotmail.fr, bx1_@msn.com, 5

danibx1@hotmail.fr, and danieldelcore@hotmail.com. Upon information and belief, John Doe 20 has purchased and used the Zeus/SpyEye code. 26. Plaintiffs are informed and believe and thereupon allege that John Doe 21 goes by

the alias jah. Upon information and belief, John Doe 21 is associated with John Doe 20. Upon further information and belief, John Doe 21 was involved with the development of the Zeus/SpyEye code. 27. Plaintiffs are informed and believe and thereupon allege that John Doe 22 goes by

the alias Jonni. Upon information and belief, John Doe 22 is associated with John Doe 4 and can likely be contacted at aqua@incomeet.com and 637760688. Upon further information and belief, John Doe 22 specializes in money mule recruitment in the UK. 28. Plaintiffs are informed and believe and thereupon allege that John Doe 23 goes by

the alias jtk. Upon information and belief, John Doe 23 is associated with John Doe 4 and can likely be contacted at aqua@incomeet.com and 637760688. Upon further information and belief, John Doe 23 specializes in money mule recruitment in the UK. 29. Plaintiffs are informed and believe and thereupon allege that John Doe 24 goes by

the alias Veggi Roma. Upon information and belief, John Doe 24 is associated with John Doe 6 and can likely be contacted at aqua@incomeet.com and 637760688. Upon further information and belief, John Doe 24 specializes in money mule recruitment in the UK. 30. Plaintiffs are informed and believe and thereupon allege that John Doe 25 goes by

the alias D frank and may be contacted at messaging addresses d.frank@jabber.jp and d.frank@0nl1ne.at. Upon information and belief, John Doe 25 is involved in hosting Zeus Botnet code. 31. Plaintiffs are informed and believe and thereupon allege that John Doe 26 goes by

the alias duo and may be contacted at messaging address duo@jabber.cn. Upon information and belief, John Doe 26 is involved in hosting Zeus Botnet code. 32. Plaintiffs are informed and believe and thereupon allege that John Doe 27 goes by

the alias Admin2010 and may be contacted at email addresses fering99@yahoo.com and 6

secustar@mail.ru. Upon information and belief, John Doe 27 is involved in purchasing and using the Zeus Botnet code. 33. Plaintiffs are informed and believe and thereupon allege that John Doe 28 goes by

the alias h4x0rdz and may be contacted at email address h4x0rdz@hotmail.com. Upon information and belief, John Doe 28 is involved in purchasing and using the Zeus/SpyEye code. 34. Plaintiffs are informed and believe and thereupon allege that John Doe 29 goes by

the alias Donsft and may be contacted at email address Donsft@hotmail.com. Upon information and belief, John Doe 29 is involved in purchasing and using the Zeus/SpyEye code. 35. Plaintiffs are informed and believe and thereupon allege that John Doe 30 goes by

the alias mary.j and may be contacted at email address mary.j555@hotmail.com. Upon information and belief, John Doe 30 is involved in purchasing and using the Zeus/SpyEye code. 36. Plaintiffs are informed and believe and thereupon allege that John Doe 31 goes by

the alias susanneon and may be contacted at email address susanneon@googlemail.com. Upon information and belief, John Doe 31 is involved in selling PDF exploits to deliver the Zeus/SpyEye code. 37. Plaintiffs are informed and believe and thereupon allege that John Doe 32 goes by

the alias kainhabe and may be contacted at email address kainehabe@hotmail.com. Upon information and belief, John Doe 32 is involved in purchasing and using the Zeus/SpyEye code. 38. Plaintiffs are informed and believe and thereupon allege that John Doe 33 goes by

the alias virus_e_2003 and may be contacted at email address virus_e_2003@hotmail.com. Upon information and belief, John Doe 33 is involved in purchasing and using the Zeus/SpyEye code. 39. Plaintiffs are informed and believe and thereupon allege that John Doe 34 goes by

the alias spanishp and may be contacted at email addresses spanishp@hotmail.com. Upon information and belief, John Doe 34 is involved in purchasing and using the Zeus/SpyEye code. 40. Plaintiffs are informed and believe and thereupon allege that John Doe 35 goes by

the alias sere.bro and may be contacted at email address sere.bro@hotmail.com. Upon 7

information and belief, John Doe 35 is involved in purchasing and using the Zeus/SpyEye code. 41. Plaintiffs are informed and believe and thereupon allege that John Doe 36 goes by

the aliases muddem and mechan1zm and may be contacted at email addresses lostbuffer@hotmail.com and lostbuffer@gmail.com. Upon information and belief, John Doe 36 is involved in purchasing and using the Zeus/SpyEye code. 42. Plaintiffs are informed and believe and thereupon allege that John Doe 37 goes by

the alias vlad.dimitrov and may be contacted at email address vlad.dimitrov@hotmail.com. Upon information and belief, John Doe 37 is involved in purchasing and using the Zeus/SpyEye code. 43. Plaintiffs are informed and believe and thereupon allege that John Doe 38 goes by

the alias jheto2002 and may be contacted at email address jheto2002@gmail.com. Upon information and belief, John Doe 38 is involved in creating injection code to deliver the Zeus/SpyEye code. 44. Plaintiffs are informed and believe and thereupon allege that John Doe 39 goes by

the alias sector.exploits and may be contacted at email address sector.exploits@gmail.com. Upon information and belief, John Doe 39 is involved in selling Adobe Flash exploit code to deliver the Zeus/SpyEye code. 45. Defendants own, operate, control, and maintain the Zeus Botnets through a

command and control infrastructure hosted at and/or operating at the Harmful IP Domains and IP Addresses. The command and control infrastructure hosted and operated at the Harmful Domains and IP Addresses are maintained by the third-party domain registries, hosting companies and website providers set forth at Appendices A, B and C to this Complaint. 46. Plaintiffs are unaware of the true names and capacities of Defendants sued herein

as John Does 1-39 inclusive and therefore sue these Defendants by such fictitious names. Plaintiffs will amend this complaint to allege Defendants true names and capacities when ascertained. Plaintiffs will exercise due diligence to determine Defendants true names, capacities, and contact information, and to effect service upon those Defendants. 8

47.

Plaintiffs are informed and believe and therefore allege that each of the

fictitiously named Defendants is responsible in some manner for the occurrences herein alleged, and that Plaintiffs injuries and the injuries to Plaintiffs customers and members herein alleged are proximately caused by such Defendants. 48. The actions and omissions alleged herein to have been undertaken by Defendants

were undertaken by each Defendant individually, were actions and omissions that each Defendant authorized, controlled, directed, or had the ability to authorize, control or direct, and/or were actions and omissions each Defendant assisted, participated in, or otherwise encouraged, and are actions for which each Defendant is liable. Each Defendant aided and abetted the actions of Defendants set forth below, in that each Defendant had knowledge of those actions and omissions, provided assistance and benefited from those actions and omissions, in whole or in part. Each Defendant was the agent of each of the remaining Defendants, and in doing the things hereinafter alleged, was acting within the course and scope of such agency and with the permission and consent of other Defendants. JURISDICTION AND VENUE 49. This action arises out of Defendants violation of the Federal Computer Fraud

and Abuse Act (18 U.S.C. 1030), CAN-SPAM Act (15 U.S.C. 7704), Electronic Communications Privacy Act (18 U.S.C. 2701), the Lanham Act (15 U.S.C. 1114, 1125(a), (c)), and the Racketeer Influence and Corrupt Organizations Act (18 U.S.C. 1962(c)). Therefore, the Court has subject matter jurisdiction over this action based on 28 U.S.C. 1331. This is also an action for trespass to chattels, unjust enrichment, and conversion. This Court, accordingly, has subject matter jurisdiction under 28 U.S.C. 1367. 50. Defendants have directed acts complained of herein toward the state of New York

and the Eastern District of New York, have utilized instrumentalities located in New York and the Eastern District of New York to carry out the acts alleged in this Complaint, and engaged in other conduct availing themselves of the privilege of conducting business in New York and the Eastern District of New York. 9

51.

In particular, Defendants control a network of compromised user computers

called the Zeus Botnets that Defendants use to conduct illegal activities, thereby causing harm to the Plaintiffs as well as Plaintiffs customers, members and the general public in the Eastern District of New York. Defendants have directed actions at the Eastern District of New York, by directing malicious computer code at computers of individual Internet users located in the Eastern District of New York, infecting those user computers with the malicious code and thereby making the user computers part of the Zeus Botnets. Figure 1 depicts the geographical location of infected user computers in the Eastern District of New York from which Defendants sent spam email propagating the Zeus Botnets. Figure 2 depicts infected computers in the Eastern District of New York from which Defendants requested instructions from known Zeus Botnet command and control servers. Figure 1 - Computers In The Eastern District Of New York Propagating Zeus Botnet

Figure 2 - Zeus Botnet Computers In The Eastern District Of New York

52.

Defendants have undertaken the foregoing acts with knowledge that such acts 10

would cause harm through user computers located in New York, thereby injuring Plaintiffs, their customers, members, and others in New York and elsewhere in the United States. Therefore, this Court has personal jurisdiction over Defendants. 53. Pursuant to 28 U.S.C. 1391(b), venue is proper in this judicial district. A

substantial part of the events or omissions giving rise to Plaintiffs claims, together with a substantial part of the property that is the subject of Plaintiffs claims, are situated in this judicial district. Venue is proper in this judicial district under 28 U.S.C. 1391(c) because Defendants are subject to personal jurisdiction in this judicial district. 54. Plaintiffs Microsoft and NACHA have been directly injured through the activities

alleged herein and bring this action on their own behalf. 55. Plaintiff FS-ISACs members are suffering immediate and threatened injury as a

direct result of the activities alleged herein and there would be a justiciable controversy had the members brought suit themselves. FS-ISAC has associational standing as a representative of its members because (1) multiple FS-ISAC members would otherwise have standing to sue in their own right, (2) the interests the FS-ISAC association seeks to protect in this action are germane to the organizations purpose and (3) as FS-ISAC seeks only equitable relief, neither the claim asserted nor the relief requested requires participation of individual members in this action. FACTUAL BACKGROUND Plaintiffs Products, Services And Reputation 56. Plaintiff Microsoft is a provider of the Windows operating system and the

Outlook, Hotmail, Windows Live and MSN email and messaging services and a variety of other software and services. Microsoft has invested substantial resources in developing highquality products and services. Due to the high quality and effectiveness of Microsofts products and services and the expenditure of significant resources by Microsoft to market those products and services, Microsoft has generated substantial goodwill with its customers, establishing a strong brand and developing the Microsoft name and the names of its products and services into strong and famous world-wide symbols that are well-recognized within its channels of trade. 11

Microsoft has registered trademarks representing the quality of its products and services and its brand, including the Microsoft, Windows, Outlook, Hotmail, Windows Live and MSN marks. 57. Plaintiff FS-ISAC is a trade organization compromised of 4,400 organizations

including commercial banks and credit unions of all sizes, brokerage firms, insurance companies, payment processors, and over 20 trade associations representing the majority of the U.S. financial services sector. It was established by the financial services sector in response to the 1998 Presidential Directive 63, later updated by the 2003 Homeland Security Presidential Directive 7, that requires that the public and private sectors share information about physical and cyber security threats and vulnerabilities to help protect the United States critical infrastructure. (See www.fsisac.com/about/.) Its purpose is to enhance the ability of the financial services sector to prepare for and respond to cyber and physical threats, vulnerabilities and interests.... FS-ISACs activities include actively coordinating and promoting financial industry detection, analysis, and response to cyber security threats. FS-ISAC works closely with various government agencies including the U.S. Department of Treasury, Department of Homeland Security (DHS), Federal Reserve, Federal Financial Institutions Examination Council regulatory agencies, United States Secret Service, Federal Bureau of Investigation, National Security Agency, Central Intelligence Agency, and state and local governments. Financial institutions that are members of FS-ISAC have generated substantial goodwill with their customers, establishing a strong brand and developing their respective names and the names of their products and services into strong and famous world-wide symbols that are well-recognized within its channels of trade. 58. Plaintiff NACHA manages the development, administration, and governance of

the Automated Clearing House (ACH) Network. The ACH is the backbone for the electronic movement of money and data. A critical part of NACHAs mission is to develop and implement a framework for risk management and network enforcement relating to the ACH Network. NACHA also provides resources to support and educate financial institutions and consumers 12

regarding fraud and other forms of abuse of electronic payments systems. NACHA represents more than 10,000 financial institutions via 17 regional payment associations and direct membership. Due to its responsibilities, the high quality and effectiveness of its services and the expenditure of significant resources by NACHA to market its services, NACHA has generated substantial goodwill with its members and the public, establishing a strong name and the names of its services into strong and famous world-wide symbols that are well-recognized within its channels of trade. 59. Defendants, by operating, controlling, maintaining, and propagating the Zeus

Botnets have caused and continue to cause severe and irreparable harm to each Plaintiff, their customers, their members, and the public at large. Computer Botnets 60. In general, a botnet is a collection of individual computers running software

that allows communication among those computers and that allows centralized or decentralized communication with other computers providing control instructions. A botnet network may be comprised of multiple, sometimes millions, of end-user computers infected with the malicious software (malware or Trojan). The individual computers in a botnet often belong to individual end-users who have unknowingly downloaded or been infected by such software that makes the computer part of the botnet. An end-users computer may become part of a botnet when the user inadvertently interacts with a malicious website advertisement, clicks on a malicious email attachment, or downloads malicious software. In each such instance, software code is downloaded or executed on the users computer, causing that computer to become part of the botnet, capable of sending and receiving communications, code, and instructions to or from other botnet computers. 61. Criminal organizations and individual cyber criminals often create, control,

maintain, and propagate botnets in order to carry out misconduct that harms others rights. They use botnets because of botnets ability to support a wide range of illegal conduct, their resilience against attempts to disable them, and their ability to conceal the identities of the malefactors 13

controlling them. The controllers of a botnet will use an infected end-user computer for a variety of illicit purposes, unknown to the end user. A computer in a botnet, for example, may be used to: a. carry out theft of credentials and information, fraud, computer intrusions, or other misconduct; b. anonymously send unsolicited bulk email without the knowledge or consent of the individual user who owns the compromised computer; c. deliver further malicious software that infects other computers, making them part of the botnet as well; or d. proxy or relay Internet communications originating from other computers, in order to obscure and conceal the true source of those communications. Botnets provide a very efficient general means of controlling a huge number of computers and targeting any action internally against the contents of those computers or externally against any computer on the Internet. 62. Plaintiffs bring this action to stop Defendants from controlling, maintaining, and

growing the Zeus Botnets that have caused harm to Plaintiffs, their customers and their members, and to the general public. Defendants control, maintain, and grow the Zeus Botnets through the command and control infrastructure hosted at and operated through the Harmful Domains and IP Addresses described herein and set forth at Appendices A, B and C. The Zeus Botnets 63. The Zeus Botnets primarily carry out theft of account credentials for websites,

particularly online banking websites. The Zeus Botnets primary aim is to infect end-user computers in order to (1) steal the users online account credentials, including online banking credentials, (2) access consumers accounts with the stolen credentials, and (3) steal information from consumers website accounts and steal funds from consumers banking and financial accounts. The creators of the Zeus Botnets malicious code, moreover, collaborate in a common operation to create, distribute, and operate the Zeus Botnets. The resulting harm to Plaintiffs, 14

end-users, financial institutions, government agencies and the general public is the result of a single global criminal operation that controls, operates, and maintains the Zeus Botnets. Defendants Work Together In A Common Operation To Create, Control, And Maintain The Zeus Botnets 64. The Zeus Botnets comprise a family of inter-related botnets known on the

Internet as the Zeus, Ice-IX, and SpyEye botnets. The Zeus, Ice-IX and SpyEye botnets are built on the same software code and infrastructure. Defendant creators whose specific identities are currently unknown have operated in anonymity on the Internet for several years. 65. The Zeus botnet code first emerged in 2007. The Zeus code evolved over

time, becoming more sophisticated and including additional features designed to counter attempts to analyze and disable the botnet. 66. The Ice-IX code, which emerged in May 2011, is built on the Zeus code and

contains enhancements to avoid virus-scanning software. 67. The SpyEye code was originally independent software, but in October 2010

was merged with the Zeus code and, from that point forward, Zeus code and functionality became part of the SpyEye code. Defendants Offer Their Botnet Code For Sale 68. Defendants John Doe 1, John Doe 2, and John Doe 3 have offered their botnet

code for sale on the Internet as builder kits that allow others, including the other Defendants, to easily setup, operate, maintain, and propagate botnets to infect end-user computers, carry out financial theft, send spam email or engage in other malicious activities. Depending on the level of sophistication in particular versions, and the level of support and customization provided, the code may cost as little as $700 or up to $15,000 or more for more comprehensive or tailored versions. These kits contain software that enable other Defendants to generate executable botnet code, configuration files, and web server files that they deploy on command and control servers.

15

Defendants Work Together To Operate The Zeus Botnets 69. Plaintiffs are informed and believe and thereupon allege that the common code

and characteristics of the Zeus, Ice-IX, and SpyEye botnets, and evidence regarding specific activities of the Defendants, demonstrate that the Zeus Botnets are controlled by a number of Defendants acting in concert. Upon information and belief, John Does 1-3, the creators of the botnet code, work together with the purchasers, developers and other sellers of the Zeus Botnet code in a continuous and coordinated manner to control, operate, distribute, and maintain the Zeus Botnets. Upon information and belief, the malicious software that Defendants install on end-user machines all share common code and characteristics, and have evolved over time to more closely resemble one another. The three botnets are all available for sale on the same underground internet forums, and are all provided with similar tools and utilities. 70. John Does 4-39 have purchased the Zeus Botnet code and, in concert with the

creators of the code, are operating the Zeus Botnets. Some of the defendants have specialized roles, including: (1) customizing the code, (2) creating web inject code, a delivery mechanism to introduce the botnet code onto victim computers, (3) recruiting money mules as intermediaries to create fraudulent bank accounts to which stolen funds are directed and withdrawn, and (4) acquiring domain names and IP addresses to host the command and control servers. The common characteristics of botnet code used by these Defendants indicate that they are controlled by the same group of Defendants, who are acting in concert. Plaintiffs investigation reveals that the Defendant creators of the botnet code work together with these Defendant operators of the botnets in a continuous and coordinated manner to control, operate, distribute, and maintain the Zeus Botnets. The Zeus Racketeering Enterprise 71. Upon information and belief, John Does 1-39 constitute a group of persons

associated together for a common purpose of engaging in a course of conduct, as part of an ongoing organization, with the various associates functioning as a continuing unit. The Defendants enterprise has a purpose, with relationships among those associated with the enterprise, and longevity sufficient to permit those associates to pursue the enterprises purpose. 16

Upon information and belief, Defendants John Doe 1, John Doe 2, and John Doe 3 conspired to, and did, form an associated in fact enterprise (herein after the Zeus Racketeering Enterprise) with a common purpose of developing and operating a global credential stealing botnet operation as set forth in detail herein. 72. The Zeus Racketeering Enterprise has existed since at least October of 2010,

when John Doe 1 and John Doe 3 merged their respective botnet operations into a single, consolidated global credential stealing botnet. John Doe 2 joined and began participating in the Zeus Enterprise at an unknown date prior to fall of 2011. Other Defendants identified as John Does 4-39 joined and began participating in the Zeus Enterprise at various times thereafter. 73. The Zeus Racketeering Enterprise has continuously and effectively carried out its

purpose of developing and operating a global credential stealing botnet operation since that time, and will continue to do so absent the judicial relief that Plaintiffs request. 74. Both the purpose of the Zeus Racketeering Enterprise and the relationship

between the Defendants is proven by: (1) the consolidation of the original Zeus botnet and the SpyEye botnet; (2) the subsequent development and operation of the enhanced Ice-IX botnet; and (3) Defendants respective and interrelated roles in the sale, operation of, and profiting from the Zeus Botnets in furtherance of Defendants common financial interests. 75. Upon information and belief, Defendants have conspired to, and have, conducted

and participated in the operations of the Zeus Racketeering Enterprise through a continuous pattern of racketeering activity as set forth herein. Each predicate act is related to and in furtherance of the common unlawful purpose shared by the members of the Zeus Racketeering Enterprise. These acts are continuing and will continue unless and until this Court grants Plaintiffs request for a temporary restraining order. 76. Upon information and belief, Defendants have conspired to, and have, knowingly

and with intent to defraud trafficked in thousands of unauthorized access devices in the form of stolen passwords, bank account numbers and other account login credentials through the Zeus Botnets created and operated by Defendants.

17

77.

As set forth in detail herein, Defendants have used the Zeus Botnets to steal,

intercept and obtain this access device information from tens of thousands of individuals using falsified web pages, and have then used these fraudulently obtained unauthorized access devices to steal millions of dollars from individuals accounts. 78. Upon information and belief, Defendants have also conspired to, and have,

knowingly and with intent to defraud, possessed, and do possess, thousands of such unauthorized access devices fraudulently obtained as described herein. 79. Upon information and belief, Defendants have conspired to, and have, knowingly

and with intent to defraud, effected transactions with the stolen unauthorized access devices to receive millions of dollars in payment from individuals bank accounts. 80. Upon information and belief, Defendants have conspired to, and have, executed a

scheme to defraud scores of financial institutions by enabling members of the Zeus Racketeering Enterprise to fraudulently represent themselves as specific bank customers, thereby enabling them to access and steal funds from those customer accounts. 81. Upon information and belief, Defendants have further conspired to, and have,

orchestrated the dispatch of money mules to the United States for the purpose of opening bank accounts using fraudulent identification documents, and then using these fraudulently obtained bank accounts, to receive and withdraw the funds stolen from legitimate bank customers. 82. Each of the foregoing illegal acts were conducted using interstate ACH and/or

interstate and/or foreign wires as described herein, and therefore affected interstate and/or foreign commerce. The Structure Of The Zeus Botnets 83. The Zeus Botnets are made up of two tiers of computers: an Infected Tier,

made up of computers infected with Zeus (Infected Nodes), some of which have been chosen by the botnet operator to perform additional tasks in managing the botnet (Router Nodes), and a Command and Control Tier. This architecture facilitates the distribution of the botnet malware, propagation of the botnet, and obfuscation of the botnet controllers. The tiered

18

architecture of the Zeus Botnets can generally be represented as follows:

84.

The lowest tierthe Infected Tierconsists of millions of infected end-user

computers, of the type commonly found in businesses, living rooms, schools, libraries, and Internet cafes around the world. The Infected Tier performs the botnets daily illicit work. Owners of computers in the Infected Tier are targets of Defendants theft of online credentials, personal information and money from these victims bank accounts. Some computers in this tier, the Router Nodes, are used in some versions of the Zeus Botnets as intermediary computers, relaying communications between different botnet computers and delivering commands and responses among botnet computers. 85. The highest level of the Zeus Botnets architecturethe Command and Control

Tierconsists of specialized computers and/or software (servers). Defendants purchase and/or lease these servers to send commands to control the Zeus Botnets end-user computers that make up the Infected Tier. Defendants Use The Harmful Domains And IP Addresses To Infect And Control End-User Computers And To Steal Information And Money From Victims 86. Defendants rely on the Harmful Domains and IP Addresses to infect the end-

users computers, causing them to become part of the Zeus Botnets. Defendants may use software called a Trojan downloader that installs the malicious botnet software onto the enduser computer. The Defendants store this malicious software on computer servers at the Harmful 19

Domains and IP Addresses. Defendants then mislead Internet users to visit these servers where the users unknowingly download the malicious software. The Harmful Domains and IP Addresses that Defendants use to infect the Internet user computers are identified in Appendices A, B and C with the labels Embedded_js, Infector, Source, Dropzone, and Updater. 87. Defendants method of infection involves sending Internet users unwanted and

unsolicited emails spam emails. These spam emails contain links to one or more of the Harmful Domains and IP Addresses that contain the malicious botnet software. The content of the spam emails misleads Internet users to click on the links, causing the malicious software to be installed on the Internet users computers without their knowledge or consent. Specifically, these spam emails falsely claim to be from Plaintiffs Microsoft, NACHA, financial institutions that are members of Plaintiff FS-ISAC, or from government agencies (such as the IRS), the American Bankers Association, or other companies. The spam emails contain those entities trademarks and contain misleading messages to induce the user to click on malicious links. 88. Defendants have sent emails purporting to be from Plaintiff Microsoft offering a

fake Microsoft Critical Security Update and a fake Update for Microsoft Outlook/Outlook Express, requesting that users click a link. Defendants send spam emails purporting to be from NACHA requesting that the user click a link to purportedly manage a rejected ACH transaction. Other examples include emails: a. purporting to originate from banks and requesting that users click to update their bank information; b. purporting to be from the American Bankers Association and requesting that the user click on a link to view an account statement; c. purporting to be from the IRS and requesting that the user click on a link to download a tax statement; d. purporting to be from DHL or Federal Express and requesting that the user click on a link to confirm a delivery; e. purporting to be an electronic greeting card, inviting users to click on a link to view the card; and f. purporting to be from social media websites, such as Facebook or others, requesting that users click on a link to accept invitations from friends. 20

89.

The links in these emails, when clicked, direct the user to one of the Harmful

Domains and IP Addresses, and result in the infection of the users computer with the malicious software. Defendants send a very large volume of such spam. The monthly averages for spam emails propagating the Zeus Botnets and infringing NACHAs trademarks alone are in the range of one hundred million. At one point in August 2011, such spam emails infringing NACHAs trademarks were as high as 167 million emails in a 24 hour period. By contrast, the normal volume for authentic outbound email messages from NACHA is only 1,500 emails per day. 90. Defendants also use many of the Harmful Domains and IP Addresses to collect

stolen financial account credentials and other confidential information from infected end-user computers. Once account credentials are stolen, they are transferred over the Internet from the Zeus Botnet software on the victim computers to Defendants at the computers associated with these Harmful Domains and IP Addresses. Defendants then use this account information to log into victims accounts and initiate transfers of information or funds from victims online accounts into accounts controlled by Defendants. The Harmful Domains and IP Addresses that Defendants use to collect stolen information and account credentials are identified in Appendices A, B and C with the label Dropzone. 91. Defendants use certain of the Harmful Domains and IP Addresses (identified

with the label Infector, Source or Updater in Appendices A, B and C) to deliver initial or new configurations and target lists to end-user computers. These domains and IP addresses enable the Defendants to control the infected end-user computers once the end-user computers have been infected with the malicious botnet software. These Harmful Domains and IP Addresses house the Zeus Botnets configuration files. 92. The configuration files stored at the Harmful Domains and IP Addresses

contain templates that mimic the websites of virtually all major financial institutions. Defendants have designed these website templates to contain not only the trademarks of major financial institutions, but also identical copies of those financial institutes website content. Most Internet users are unable to tell the difference between a financial institutions genuine 21

website and the website templates used by the Zeus Botnets. 93. The website templates are sent from the Harmful Domains and IP Addresses to

infected end-user computers, and when the end-users attempt to access and use their online banking or other websites, the website templates are presented instead of the genuine website. The end-users believe that they have accessed their online banking website and input their banking credentials (e.g., name, address, account number, password, social security number, and other identifying information) into the website. In fact, the Zeus Botnets have intercepted the end-users banking credentials. The configuration files also contain the domain names and IP addresses to which the stolen information is to be sent back. 94. The computers at the Harmful Domains and IP Addresses also contain spam-

templates or resource files that are delivered from the Harmful Domains and IP Addresses to infected end-user computers. The malicious software on the infected end-user computers use these templates to generate spam email that is then sent either from email accounts accessed from the end-user computers, or sent directly from those computers. The spam is intended to infect other end-user computers and to grow the Zeus Botnets. These spam templates and resource files contain the trademarks of Microsoft, NACHA, American Bankers Association, and FS-ISAC member institutions. 95. The spam templates and resource files also contain other content and messages

designed to deceive Internet users into believing that a spam email is actually coming from Microsoft, NACHA, American Bankers Association, or FS-ISAC member institutions, in order to mislead email recipients into clicking links in the email. The following are examples of Defendants infringement of Microsofts and NACHAs trademarks:

22

96.

Defendants website templates and spam templates stored on the Harmful

Domains and IP Addresses contain counterfeit copies of the trademarks of Microsoft, NACHA, American Bankers Association, and FS-ISAC member institutions, such as those reflected above. Defendants Use The Harmful IP Domains And IP Addresses To Access End-Users Computers Without Authorization 97. Internet users whose computers are infected with the Zeus Botnets malicious

software are damaged by changes that the Zeus Botnets make to the Windows operating system software, altering the normal and approved settings and functions, destabilizing the system, and forcibly drafting customers computers into the botnet. Once installed on an end-users computer, the Botnets malicious software makes changes at the deepest and most sensitive levels of the computers operating system. The software installs, intercepts and takes unauthorized control of normal Windows processes. The software alters the behavior of various Windows routines by manipulating registry key settings. The software replaces Windows files with files of the same name that contain the malicious software. 98. Once the Zeus Botnets malicious software infects an end-user computer, it turns

the infected computer into the worker of the botnet, performing the day-to-day illegal activity. The malicious code instructs the infected end-user computer to, among other things: (a) hide the malware, (b) lower security settings, (c) contact the command and control servers to retrieve a configuration file containing instructions, including website templates that mimic the websites 23

and trademarks of Plaintiffs, financial institutions or other companies, (d) in connection with other software, generate spam email that infringe Plaintiffs and others trademarks, (e) steal usernames, passwords, and other credentials from the victim, (f) communicate stolen data back to the command and control servers, (f) intercept or carry out transactions without the users knowledge or consent. 99. Upon information and belief, Microsofts customers are usually unaware that their

computers are infected and have become part of the Zeus Botnets. Upon information and belief, even if they are aware of the infection, Microsofts customers often lack the technical resources or skills to resolve the problem, allowing their computers to be misused indefinitely. Even with professional assistance, cleaning an infected end-user computer can be exceedingly difficult, time-consuming, and frustrating. Defendants Use The Harmful Domains And IP Addresses To Steal End-Users Banking Credentials and Personal Information 100. The Zeus Botnets cause injury to Plaintiffs Microsoft, NACHA, and FS-ISAC as

well as Plaintiffs customers and members when the Zeus Botnets steal infected end-users online banking credentials and personal information. 101. Once installed on an end-user computer, the malware detects when an Internet

user navigates to any website specified in the configuration files, particularly online banking websites. Defendants have specified websites ending in .microsoft.com/, Microsofts hotmail.com or live.com email websites, and a variety of online banking sites as targets. For example, when a user visits their online banking website, the malicious software may do one of the following: a. Access the real banking website, but unknown to the user, execute instructions that modify or extend the website. In particular, the Zeus Botnets may cause the website to display extra fields into which users are instructed to type additional sensitive information that is not requested at the legitimate website. For example, the fake versions of the websites may seek information such as ATM PIN, social security number, mothers maiden name, addresses, birthdates and similar information. 24

b. Intercept the request from the users web browser and present the user with a fake website, based on the template, which appears to be the legitimate website; or c. Intercept the request and redirect the user to a different fake website that appears to be the legitimate website. 102. The websites of nearly every major financial institution, Microsoft and a wide

array of other Internet companies have been targeted by the Defendants and the Zeus Botnets in this way. In each case, the website presented to the user is a fake or modified version, which appears very similar to the legitimate website and misuses the trademarks and website content of financial institutions, Microsoft and others. 103. When an Internet user enters his or her account credentials at these websites

e.g., username, password and other additional personal datathe Defendants malicious software collects this data and transmits it over the Internet to command and control servers operated at the Harmful Domains and IP Addresses. The Zeus Botnets code is also able to: (1) inject Defendants own transactions into a victims online banking session and (2) divert funds from a victims banking account via wire or ACH transaction to an account controlled by Defendants. 104. Defendants use the victims account credentials to access victims online

financial or other accounts and steal money and information from such accounts. Defendants often hire money mulesindividuals who travel to different countries, including the United Statesin order to set up bank accounts to receive transfers of stolen funds from the victims accounts. The money mules withdraw funds from the accounts they have set up, keep a percentage for their own payment and transmit the remainder to the Defendants. 105. The malware is specifically designed to allow Defendants to perpetrate this

malicious activity without revealing any evidence of the fraud until it is too late for the user or owners of these websites to regain control over funds or stolen information. For example, the software can re-write on-screen account balances, generate false account statements, hide transactions from the users view and hide itself from antivirus software. 25

Defendants Use The Harmful Domains And IP Addresses To Send Bulk Spam Email 106. Defendants, through the Zeus Botnets and often in connection with other

software, also send, without the users knowledge or permission, unsolicited bulk email (often known as spam). The spam email usually contains links to malicious code that infects further computers adding them to the botnets. The spam may be sent from victims email accounts that Defendants have taken control of using the botnets. Defendants may also send spam email directly from infected end-user computers. 107. In either situation, the configuration files containing spam templates are

retrieved from the command and control servers operating through the Harmful Domains and IP Addresses and downloaded to infected computers, or other computers used to access victim email accounts without authorization. These spam templates work with the email server software to structure the appearance and content of the outgoing spam email messages. As shown in examples reproduced above, the spam templates and resource files contain the trademarks of Microsoft, NACHA and other content designed to mislead the recipients of the spam email into clicking on links in the spam email. Defendants And The Zeus Botnets Severely Injure Microsoft, NACHA and FS-ISACs Financial Institution Members 108. Microsoft is the provider of the Windows operating system, Hotmail email

services, and a variety of other software and services. It has invested substantial resources developing high-quality products and services. Due to the high quality and effectiveness of Microsofts products and services and the expenditure of significant resources to market those products and services, Microsoft has generated substantial goodwill with its customers, has established a strong brand, and has developed its name and the names of its products and services into strong and famous world-wide symbols that are well-recognized within its channels of trade. Microsoft has registered trademarks representing the quality of its products and services and its brand, including the Microsoft, Outlook and Windows marks. Microsofts trademark registrations are attached as Appendix D to this Complaint. 26

109.

NACHA is a non-profit association which manages the development,

administration, and governance of the ACH Network, the backbone for the electronic movement of money and data. NACHA represents more than 10,000 financial institutions via 17 regional payments associations and direct membership. NACHA has developed goodwill with financial institutions, merchants and individual customers and has established NACHAs name as a strong brand in connection with secure, reliable electronic transactions. NACHA has registered trademarks representing the quality of its services and brand, including NACHA, NACHA The Electronic Payment Association and the NACHA logo. NACHAs trademark registrations are attached as Appendix E to this Complaint. 110. FS-ISAC is a non-profit organization, funded entirely by its members, primarily

larger financial services firms, and represents the interests of the financial services sector and financial institution members against cyber and physical threats and risk. FS-ISAC and its financial institution members have made significant investments in developing high-quality, secure online banking and financial services platforms, promoting consumer confidence in those systems and protecting financial institutions and consumers from abuse related to these systems. FS-ISACs members have invested in developing their brands, trademarks and trade names in association with the financial services they offer. Attached as Appendix F to this Complaint are representative trademark registrations of FS-ISACs members injured by the Zeus Botnets. 111. As a provider of online e-mail services such as Hotmail, Microsoft must

maintain spam filters to stop spam from the Zeus Botnets from reaching customers. Microsofts Hotmail systems are the target of a substantial volume of spam from and promoting the Zeus Botnets. The sending of vast amounts of spam email to Microsofts Hotmail email services imposes a burden on Microsofts servers, and requires Microsoft to expend substantial resources in an attempt to defend against and mitigate the effects of this vast amount of spam email. 112. The spam infringes trademarks of Microsoft, NACHA and FS-ISACs financial 27

institution members, thus confusing consumers and deceiving them into installing malicious software. Consumers who have been deceived often become angry or frustrated at Microsoft and NACHA, incorrectly believing them to be responsible for the spam email. Plaintiffs must expend resources attempting to remediate consumer confusion and responding to such confusion. For example, in merely a one year period, NACHA had to expend $624,000 of its limited resources to combating spam abuse and consumer confusion. 113. The websites of Microsoft and FS-ISACs financial institution members are

directly targeted by Defendants and the Zeus Botnets. Defendants steal credentials to access those websites, enabling them to steal personal information from Microsoft users and steal funds from FS-ISACs financial institution members and their customers. Conservatively, since 2007, the Defendants and the Zeus Botnets have stolen $100 million from victims whose online financial accounts are taken over by Defendants. 114. The Zeus Botnets also make use of counterfeit copies of the trademarks of FS-

ISACs members and Microsoft, including the trade names, logos and website content of those companies, in order to deceive users into inputting their confidential account information. Such activity causes injury to FS-ISAC member institutions and Microsoft by causing consumer confusion and diminishing their brands and goodwill. 115. Further, Microsoft, as a provider of the Windows operating system and Internet

Explorer web browser, must incorporate security features in an attempt to stop account credential theft by the Zeus Botnets from occurring to customers using Microsofts software. In general, the abuse of Microsofts, NACHAs and FS-ISACs members trademarks to defraud consumers in this way injures the Plaintiffs. 116. Microsoft devotes significant computing and human resources to combating

infections by the Zeus Botnets and helping customers determine whether or not their computers are infected and, if so, cleaning them. For example, since 2007 Microsoft has detected 13 million computers infected with some version of the Zeus Botnets. Microsoft has had to expend substantial resources researching the Zeus Botnet software, developing anti-virus filters 28

to combat the Zeus Botnets, responding to consumer complaints and assisting consumers in cleaning their machines, and investigating and prosecuting enforcement action against the Zeus Botnets. CLAIMS FOR RELIEF FIRST CLAIM FOR RELIEF Violation of the Computer Fraud & Abuse Act, 18 U.S.C. 1030 (Microsoft and FS-ISAC) 117. Plaintiffs reallege and incorporate by reference the allegations contained in

paragraphs 1 through 116 above. 118. Defendants (1) knowingly and intentionally accessed Microsofts and FS-ISACs

financial institution members protected computers, (2) knowingly and intentionally accessed Microsofts customers protected computers and Plaintiffs protected computers, and (3) accessed such protected computers without authorization or in excess of any authorization and knowingly caused the transmission of a program, information, code and commands, and as a result of such conduct intentionally caused damage without authorization to the protected computers (18 U.S.C. 1030(a)(5)(A)), and; intentionally accessed the protected computers without authorization, and as a result of such conduct caused damage and loss (18 U.S.C. 1030(a)(5)(C)). 119. Defendants conduct has caused a loss to Microsoft and FS-ISACs financial

institution members during a one-year period aggregating at least $5,000. 120. Plaintiffs Microsoft and FS-ISACs financial institution members have suffered

damages resulting from Defendants conduct. 121. Plaintiff Microsoft seeks injunctive relief and compensatory and punitive

damages under 18 U.S.C. 1030(g) in an amount to be proven at trial. 122. 123. Plaintiff FS-ISAC seeks injunctive relief. As a direct result of Defendants actions, Plaintiffs Microsoft and FS-ISACs

financial institution members have suffered and continue to suffer irreparable harm for which

29

they have no adequate remedy at law, and which will continue unless Defendants actions are enjoined. SECOND CLAIM FOR RELIEF Violation of CAN-SPAM Act, 15 U.S.C. 7704 (Microsoft) 124. Plaintiffs reallege and incorporate by reference the allegations contained in

paragraphs 1 through 116 above. 125. Plaintiff Microsoft is a provider of Internet access service. Microsoft enables

users to access content, including proprietary content, electronic mail, and other Internet services. 126. Defendants initiated the transmission of unsolicited bulk spam e-mail, which are

commercial electronic messages, via the Zeus Botnets, through Microsofts customers computers and through Microsofts computers, which are used in interstate and foreign commerce and communication, to thousands or millions of computers, which are also used in interstate and foreign commerce and communication and are protected computers as defined by 18 U.S.C. 1030(e)(2)(B). 127. By sending messages via the Zeus Botnets, Defendants initiated the transmission

of commercial electronic mail messages to protected computers that contained materially false or misleading header information in violation of 15 U.S.C. 7704(a)(1). 128. Defendants initiated the transmission of commercial electronic messages to

protected computers with actual or fairly implied knowledge that the subject headings of the messages would likely materially mislead recipients regarding the contents or subject matter of the message in violation of 15 U.S.C. 7704(a)(2). 129. Defendants transmitted to protected computers commercial e-mail messages that

did not contain a functioning return electronic mail address or other Internet-based mechanism that recipients could use to contact Defendants and indicate their desire to opt-out of future messages from Defendants, in violation of 15 U.S.C. 7704(a)(3).

30

130.

Defendants initiated the transmission to protected computers of commercial

electronic messages that did not provide: (a) clear and conspicuous identification that the message was an advertisement or solicitation; (b) clear and conspicuous notice of the right to decline to receive future messages; or (c) a valid physical postal address of the sender, in violation of 15 U.S.C. 7704(a)(5). 131. Defendants unsolicited bulk e-mails were sent as part of a systematic pattern and

practice that did not conspicuously display a return electronic mail address by which the recipients could submit to the true sender a reply requesting that no further commercial e-mails be sent to the recipient. 132. As a direct result of Defendants actions, Microsoft has suffered harm in an

amount to be determined at trial. 133. Microsoft is entitled to the greater of actual damages or statutory damages in

accordance with 15 U.S.C. 7706(g)(1)(B). 134. On information and belief, Defendants actions were willful and knowing,

entitling Microsoft to aggravated damages in accordance with 15 U.S.C. 7706(g)(3)(C). 135. As a direct result of Defendants actions, Microsoft has suffered and continues to

suffer irreparable harm for which Microsoft has no adequate remedy at law, and which will continue unless Defendants actions are enjoined. THIRD CLAIM FOR RELIEF Violation Of Electronic Communications Privacy Act, 18 U.S.C. 2701 (Microsoft and FS-ISAC) 136. Plaintiffs reallege and incorporate by reference the allegations contained in

paragraphs 1 through 116 above. 137. Microsofts and Microsofts customers computers and servers and its licensed

operating system are facilities through which electronic communication service is provided to its users and customers. 138. The computers and servers of FS-ISACs financial institution members are

31

facilities through which electronic communication service is provided to its users and customers. 139. Defendants knowingly and intentionally accessed the computers and servers of

Microsoft, Microsofts customers and FS-ISACs financial institution members without authorization or in excess of any authorization granted by Plaintiffs. 140. Through this unauthorized access, Defendants had access to, obtained and altered,

and/or prevented legitimate, authorized access to wire electronic communications, including but not limited to electronic communications while they were in electronic storage in the computers and servers of Microsoft, Microsofts customers and FS-ISACs financial institution members. 141. Plaintiff Microsoft seeks injunctive relief and compensatory and punitive

damages in an amount to be proven at trial. 142. 143. Plaintiff FS-ISAC seeks injunctive relief. As a direct result of Defendants actions, Microsoft and FS-ISACs financial

institution members have suffered and continue to suffer irreparable harm for which they have no adequate remedy at law, and which will continue unless Defendants actions are enjoined. FOURTH CLAIM FOR RELIEF Trademark Infringement Under the Lanham Act 15 U.S.C. 1114 et. seq. (Microsoft, NACHA, FS-ISAC) 144. Plaintiffs reallege and incorporate by this reference each and every allegation set

forth in paragraphs 1 through 116 above. 145. Defendants have used Microsofts, NACHAs and FS-ISACs financial institution

members trademarks in interstate commerce. 146. The Zeus Botnets generate and use counterfeit copies of Microsofts, NACHAs

and FS-ISACs financial institution members trademarks in fake websites and in spam email, including through the software operating from and through the Command and Control Servers operating at the Harmful Domains and IP Addresses. By doing so, Defendants are likely to cause confusion, mistake, or deception as to the origin, sponsorship, or approval of the fake websites and spam e-mail and material promoted through the fake websites and spam e-mail.

32

147.

By using Microsofts, NACHAs and FS-ISACs financial institution members

trademarks falsely in connection with spam e-mail and fake websites, Defendants have caused, and are likely to cause, confusion, mistake, or deception as to the origin, sponsorship, or approval of the e-mail and fake websites generated and disseminated by the Zeus Botnets. By doing so, Defendants have caused, and are likely to cause, confusion, mistake, or deception as to the origin, sponsorship, or approval of the conduct, actions, products and services carried out by or promoted by Defendants and the Zeus Botnets. 148. As a result of their wrongful conduct, Defendants are liable to Plaintiffs for

violation of this provision of the Lanham Act. 149. Plaintiffs Microsoft and NACHA seek injunctive relief and compensatory and

punitive damages in an amount to be proven at trial. 150. 151. Plaintiff FS-ISAC seeks injunctive relief. As a direct result of Defendants actions, Microsoft, NACHA and FS-ISACs

financial institution members have suffered and continue to suffer irreparable harm for which they have no adequate remedy at law, and which will continue unless Defendants actions are enjoined. 152. Defendants wrongful and unauthorized use of Microsofts, NACHAs and FS-

ISACs financial institution members trademarks to promote, market, or sell products and services constitutes trademark infringement pursuant to 15 U.S.C. 1114 et seq. FIFTH CLAIM FOR RELIEF False Designation of Origin Under The Lanham Act 15 U.S.C. 1125(a) (Microsoft, NACHA, FS-ISAC) 153. Plaintiffs reallege and incorporate by this reference each and every allegation set

forth in paragraphs 1 through 116 above. 154. Microsofts, NACHAs and FS-ISACs financial institution members trademarks

are distinctive marks that are associated with Microsoft, NACHA and FS-ISACs financial institution members and exclusively identify their businesses, products, and services.

33

155.

The Defendants, through the Zeus Botnets, make unauthorized use of Microsofts,

NACHAs and FS-ISACs financial institution members trademarks. The Zeus Botnets generate and use counterfeit copies of Microsofts, NACHAs and FS-ISACs financial institution members trademarks in fake websites and in spam email, including through the software operating from and through the Command and Control Servers operating at the Harmful Domains and IP Addresses. By doing so, Defendants are likely to cause confusion, mistake, or deception as to the origin, sponsorship, or approval of the fake websites and spam e-mail and material promoted through the fake websites and spam e-mail. 156. By using Microsofts, NACHAs and FS-ISACs financial institution members

trademarks falsely in connection with spam e-mail and fake websites, Defendants are likely to cause confusion, mistake, or deception as to the origin, sponsorship, or approval of the e-mail and fake websites generated and disseminated by the Zeus Botnets. By doing so, Defendants are likely to cause confusion, mistake, or deception as to the origin, sponsorship, or approval of the conduct, actions, products and services carried out by or promoted by Defendants and the Zeus Botnets. 157. As a result of their wrongful conduct, Defendants are liable to Plaintiffs for

violation of the Lanham Act, 15 U.S.C. 1125(a). 158. Plaintiffs Microsoft and NACHA seek injunctive relief and compensatory and

punitive damages in an amount to be proven at trial. 159. 160. Plaintiff FS-ISAC seeks injunctive relief. As a direct result of Defendants actions, Microsoft, NACHA and FS-ISACs

financial institution members have suffered and continue to suffer irreparable harm for which they have no adequate remedy at law, and which will continue unless Defendants actions are enjoined. SIXTH CLAIM FOR RELIEF Trademark Dilution Under The Lanham Act 15 U.S.C. 1125(c) (Microsoft, NACHA, FS-ISAC)

34

161.

Plaintiffs reallege and incorporate by this reference each and every allegation set

forth in paragraphs 1 through 116 above. 162. Microsofts, NACHAs and FS-ISACs financial institution members trademarks

are distinctive marks that are associated with Microsoft, NACHA and FS-ISACs financial institution members and exclusively identify their businesses, products, and services. 163. The Zeus Botnets makes unauthorized use of Microsofts, NACHAs and FS-

ISACs financial institution members trademarks. By doing so, Defendants are likely to cause dilution by blurring and dilution by tarnishment of the Plaintiffs Marks and the Marks of Plaintiffs members. 164. Plaintiffs Microsoft and NACHA seek injunctive relief and compensatory and

punitive damages in an amount to be proven at trial. 165. 166. Plaintiff FS-ISAC seeks injunctive relief. As a direct result of Defendants actions, Microsoft, NACHA and FS-ISACs

financial institution members have suffered and continue to suffer irreparable harm for which they have no adequate remedy at law, and which will continue unless Defendants actions are enjoined. SEVENTH CLAIM FOR RELIEF Violations of the Racketeer Influenced and Corrupt Organizations Act (RICO) 18 U.S.C. 1962(c) (Microsoft, NACHA) 167. Plaintiffs reallege and incorporate by this reference each and every allegation set

forth in paragraphs 1 through 116 above. 168. Beginning in or before October of 2010 and continuing up through the filing of

this Complaint, Defendants John Doe 1 and John Doe 3 were and are associated in fact with the Zeus Racketeering Enterprise and have conducted its affairs through a pattern of racketeering activity, with such conduct and activities affecting interstate and foreign commerce. At various dates thereafter and continuing through the filing of this Complaint, Defendants John Doe 2 and John Does 4-39 also became associated in fact with the Zeus Racketeering Enterprise and have 35

also conducted and participated in its affairs through a pattern of racketeering activity that affects interstate and foreign commerce. Defendants have engaged in an unlawful pattern of racketeering activity involving thousands of predicate acts of wire fraud, 18 U.S.C. 1343, bank fraud, 18 U.S.C. 1344, and fraud and related activity in connection with access devices. 18 U.S.C. 1029. 169. The members of the Zeus Racketeering Enterprise share the common purpose of

developing and operating a global credential stealing botnet operation as set forth in detail above. 170. Defendants have knowingly and with intent to defraud trafficked in thousands of

unauthorized access devices in the form of stolen passwords, bank account numbers and other account login credentials through the Zeus Botnets created and operated by Defendants. As set forth in detail above, Defendants have used the Zeus Botnets to steal, intercept and obtain this access device information from thousands of individuals using falsified web pages, and have then used these fraudulently obtained unauthorized access devices to steal millions of dollars from these individuals accounts, all in violation of 18 U.S.C. 1029(a)(2). 171. Defendants have also knowingly and with intent to defraud, possessed, and do

possess, thousands of unauthorized access devices fraudulently obtained as described above, in violation of 18 U.S.C. 1029(a)(3). 172. Defendants have also knowingly and with intent to defraud effected transactions

with stolen unauthorized access devices to receive millions of dollars in payment from individuals bank accounts, in violation of 18 U.S.C. 1029(a)(7). 173. Also as set forth in detail above, Defendants have executed a scheme to defraud

scores of financial institutions by enabling members of the Zeus Enterprise to fraudulently represent themselves as bank customers, thereby enabling them to access and steal funds from those customer accounts. Defendants have further orchestrated the dispatch of money mules to the United States for the purpose of opening bank accounts using fraudulent identification documents, and then using these fraudulently obtained bank accounts to receive and withdraw the funds stolen from the banks legitimate customers, all in violation of 18 U.S.C. 1344. 36

174.

Each of the violations of 18 U.S.C. 1029(a) and 18 U.S.C. 1344 described

above were conducted using internet communications transmitted by means of wire in interstate or foreign commerce, in violation of 18 U.S.C. 1343. 175. Microsoft and NACHA have been and continue to be directly injured by

Defendants conduct. But-for the alleged pattern of racketeering activity, Microsoft and NACHA would not have incurred damages. 176. Plaintiffs Microsoft and NACHA seek injunctive relief and compensatory and

punitive damages in an amount to be proven at trial. EIGHTH CLAIM FOR RELIEF Conspiracy to Violate the Racketeer Influenced and Corrupt Organizations Act (RICO) 18 U.S.C. 1962(d) (Microsoft, NACHA) 177. Plaintiffs reallege and incorporate by this reference each and every allegation set

forth in paragraphs 1 through 116 above. 178. Beginning in or before October of 2010 and continuing up through the filing of

this Complaint, Defendants John Does 1-39 conspired to associate in fact with the Zeus Racketeering Enterprise and conduct its affairs through a pattern of racketeering activity, with such conduct and activities affecting interstate and foreign commerce. Defendants further conspired to engage in an unlawful pattern of racketeering activity involving thousands of predicate acts of wire fraud, 18 U.S.C. 1343, bank fraud, 18 U.S.C. 1344, and fraud and related activity in connection with access devices. 18 U.S.C. 1029. 179. The members of the Zeus Racketeering Enterprise conspired for the common

purpose of developing and operating a global credential stealing botnet operation as set forth in detail above. 180. Microsoft and NACHA have been and continue to be directly injured by

Defendants conduct. But-for the alleged conspiracy to conduct a pattern of racketeering activity, Microsoft and NACHA would not have incurred damages. 181. Plaintiffs Microsoft and NACHA seek injunctive relief and compensatory and 37

punitive damages in an amount to be proven at trial. NINTH CLAIM FOR RELIEF Common Law Trespass to Chattels (Microsoft, FS-ISAC) 182. Plaintiffs reallege and incorporate by this reference each and every allegation set

forth in paragraphs 1 through 116 above. 183. Defendants actions in operating the Zeus Botnets result in unauthorized access to

the computers of Microsoft, Microsofts customers and FS-ISACs financial institution members and result in unauthorized intrusion into those computers, theft of information, account credentials and funds, and unsolicited, bulk electronic mail being sent to, from or through the computers of Microsoft, Microsofts customers and FS-ISACs financial institution members. 184. Upon information and belief, Defendants intentionally caused this conduct and

this conduct was unauthorized. 185. Defendants actions have caused injury to Microsoft, Microsofts customers and

FS-ISACs financial institution members and imposed costs on Microsoft, Microsofts customers and FS-ISACs financial institution members, including time, money and a burden on the computers of Microsoft, Microsofts customers and FS-ISACs financial institution members. Defendants actions have caused injury to Microsofts and FS-ISACs financial institution members business goodwill and have diminished the value of Microsofts and FS-ISACs financial institution members possessory interest in their computers and software. 186. Plaintiff Microsoft seeks injunctive relief and compensatory and punitive

damages in an amount to be proven at trial. 187. 188. Plaintiff FS-ISAC seeks injunctive relief. As a direct result of Defendants actions, Microsoft and FS-ISACs financial

institution members have suffered and continue to suffer irreparable harm for which they have no adequate remedy at law, and which will continue unless Defendants actions are enjoined. TENTH CLAIM FOR RELIEF Conversion 38

(Microsoft, FS-ISAC) 189. Plaintiffs reallege and incorporate by this reference each and every allegation set

forth in paragraphs 1 through 116 above. 190. Defendants have willfully interfered with and converted the personal property of

Microsoft, Microsofts customers and FS-ISACs financial institution members, without lawful justification, as a result of which Microsoft, Microsofts customers and FS-ISACs financial institution members have been deprived of possession and use of their property. 191. Plaintiff Microsoft seeks injunctive relief and compensatory and punitive

damages in an amount to be proven at trial. 192. 193. Plaintiff FS-ISAC seeks injunctive relief. As a direct result of Defendants actions, Microsoft and FS-ISACs financial

institution members have suffered and continue to suffer irreparable harm for which they have no adequate remedy at law, and which will continue unless Defendants actions are enjoined. ELEVENTH CLAIM FOR RELIEF Unjust Enrichment (Microsoft, FS-ISAC, NACHA) 194. Plaintiffs reallege and incorporate by this reference each and every allegation set

forth in paragraphs 1 through 116 above. 195. The acts of Defendants complained of herein constitute unjust enrichment of the

Defendants at Plaintiffs expense in violation of the common law. 196. Defendants accessed, without authorization, computers running Microsofts and

FS-ISACs financial institution members software or computers which otherwise belong to those Plaintiffs. 197. Defendants used, without authorization or license, the facilities of Microsofts and

FS-ISACs financial institution members software and computers which belong to those Plaintiffs to, among other acts, deliver malicious software, steal personal information, account credentials and money, support the Zeus Botnets, infringe the trademarks of Microsoft, NACHA

39

and FS-ISACs financial institution members, deliver unsolicited, bulk e-mail and deceive users. 198. Defendants actions in operating the Zeus Botnets result in unauthorized access to

the computers of Microsoft, Microsofts customers and FS-ISACs financial institution members and result in delivery of malicious software, theft of personal information, account credentials and money, support of the Zeus Botnets, infringement of the trademarks of Microsoft, NACHA and FS-ISACs financial institution members, delivery of unsolicited bulk e-mail and deception of users. 199. Defendants profited unjustly from their unauthorized and unlicensed use of

Plaintiffs software, computers, and/or intellectual property. 200. Upon information and belief, Defendants had an appreciation and knowledge of

the benefit they derived from their unauthorized and unlicensed use of software, computers and/or intellectual property of Plaintiffs. 201. Retention by the Defendants of the profits they derived from their unauthorized

and unlicensed use of software, computers and/or intellectual property of Plaintiffs would be inequitable. 202. Defendants unauthorized and unlicensed use of Plaintiffs software, computers

and/or intellectual property have damaged Microsoft, NACHA and FS-ISACs financial institution members. 203. Plaintiffs Microsoft and NACHA seek injunctive relief and compensatory and

punitive damages in an amount to be proven at trial, and Defendants should disgorge their illgotten profits. 204. 205. Plaintiff FS-ISAC seeks injunctive relief. As a direct result of Defendants actions, Microsoft, NACHA and FS-ISACs

financial institution members have suffered and continue to suffer irreparable harm for which they have no adequate remedy at law, and which will continue unless Defendants actions are enjoined.

40

PRAYER FOR RELIEF WHEREFORE, Plaintiffs prays that the Court: 1. 2. Enter judgment in favor of Plaintiffs and against the Defendants. Declare that Defendants conduct has been willful and that Defendants have acted

with fraud, malice and oppression. 3. Enter a preliminary and permanent injunction enjoining Defendants and their

officers, directors, principals, agents, servants, employees, successors, and assigns, and all persons and entities in active concert or participation with them, from engaging in any of the activity complained of herein or from causing any of the injury complained of herein and from assisting, aiding or abetting any other person or business entity in engaging in or performing any of the activity complained of herein or from causing any of the injury complained of herein. 4. Enter a preliminary and permanent injunction isolating and securing the botnet

infrastructure, including the software operating from and through the Harmful Domains and IP Addresses and placing that infrastructure outside of the control of Defendants or their representatives or agents. 5. Enter judgment awarding Plaintiffs Microsoft and NACHA actual damages from

Defendants adequate to compensate Microsoft and NACHA for Defendants activity complained of herein and for any injury complained of herein, including but not limited to interest and costs, in an amount to be proven at trial. 6. Enter judgment in favor of Plaintiffs Microsoft and NACHA, disgorging

Defendants profits. 7. Enter judgment in favor of Plaintiffs Microsoft and NACHA, awarding enhanced,

exemplary and special damages, in an amount to be proved at trial. 8. Enter judgment in favor of Plaintiffs Microsoft, NACHA and FS-ISAC awarding

attorneys fees and costs, and; 9. Order such other relief that the Court deems just and reasonable.

41

Dated: March 18, 2012 Respectfully Submitted, ORRICK, H RR1NG ON & SUTCLIFFE LLP By: Richard A. Jacobsen 51 West 52nd Street New York, NY 10019 Tel: (212) 506-5000 Fax: (212) 506-5151 Attorneysfor Plaintiffs Microsoft Corporation National Automated Clearing House Association FS-ISAC, Inc.
-

42

APPENDIX A

Appendix A
INTERNET COORDINATING BODY Internet Corporation for Assigned Names and Numbers (ICANN) 4676 Admiralty Way, Suite 330 Marina del Rey, CA 90292-6601 United States

Entity responsible for coordination of the Internets systems of unique identifiers, particularly domain names.

DOMAIN NAME REGISTRIES

Verisign Naming Services 21345 Ridgetop Circle
4th Floor Dulles, Virginia 20166 United States VeriSign Global Registry Services 12061 Bluemont Way Reston Virginia 20190 United States

Harmful Botnet Domain Name 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 1 1. 12. 13. 14. 15. 16. 17. 18. 19. 20.

Type

Whois Email Address

uniterace.corn
update-kb18628311.com vacantitechip.com varioldinnics.com vcstiturnediana. corn vegatorkspeps.com vemaxxlionna.com vendettamenolkreamste.com vensart.net vesryop.com soucker.com strbrst.net xaz6g 1 bc-server.com xldavinchireverce.com xlreservation.com xtrace-upgrade.com xxmagicreservation.com xxxmagicreservation.com yettaillarfic.com youthinktoolovenotneco.com

embeddedjs
dropzone, source updater updater updater updater updater updater dropzone, infector dropzone dropzone, infector dropzone, infector infector infector infector dropzone infector infector updater updater

ivernagalindo@uniterace.com
atrabaja@peru.com do Verisign do Verisign vcstiturnediana.com@privacy.above.com do Verisign do Verisign do Verisign jonuk1m4f279822 1 092b@w86bna54f2 I bffa2ff dl .privatewhois.net perolsp@yahoo.com contactrnyprivateregistration.com meromax@online.ua dimalines@yahoo.com xldavinch@gmail.com revstabl77gmai1 .com do Verisign yarik33@gmail.com xmagicrvgmai I .com repossesseddomain@godaddy.com Iauraboschetti@aol.com

21. 22. 23. 24. 25. 26. 27. 28. 29. 30. 31. 32. 33. 34. 35. 36. 37. 38. 39. 40. 41. 42. 43. 44. 45. 46. 47. 48. 49. 50. 51. 52. 53. 54. 55. 56. 57. 58. 59. 60. 61. 62. 63. 64. 65. 66. 67. 68. 69. 70. 71. 72.

ytjsxkupugwfjpp.com ytpnnmgyj inxrhe.com zlegalsource.com zsearchweb.corn answertels.corn borrownetpowerlimited.com camesd.com cdnsecurehost.com everyyounoeverymecomn.com gedpoiLcom globalwebz.net grz942.corn grz97 1 .com headtickets.com keevegolyn.com marsplus.com nobodyj iomertomcomnet.com taemaidoo.corn talettedible.com themextoneter.corn thescarts.name tokiocitus.com tongomario.com topsecurityplace.com totalexcel.net wwwapps-ups.net tradingcenter.cc trigaproholds.com triplexguard.com tscounter.com tuk-tuk.com tventinypoloret.corn tywinderdamaku.com ufkirankmega.net uilveropoly.corn ukrainewskill.com ultragatewealth.com ultrareservation.com ultrawirereservation corn sepnower.net systrmp.com sfimnakedgirls.com shikalmuna.corn shipportlise.corn silvarnetinn.corn simontfica.com sirnplychasinasis.com
.

infector infector infector infector dropzone updater dropzone, source embeddedjs dropzone, source, infector dropzone dropzone updater updater source dropzone updater updater dropzone, infector updater updater dropzone, infector dropzone, infector dropzone, infector dropzone, infector dropzone infector dropzone, infector dropzone, infector dropzone dropzone, infector infector dropzone, infector updater dropzone, infector infector updater infector infector infector ernbeddedj s infector infector dropzone, infector updater updater updater dropzone, infector dropzone, infector embeddedjs dropzone, infector dropzone, infector updater

skiangpa.net sludential.com smartsecurityadvizor.corn smartsecuritybox.com sneckstrumo.com

ikinybyvetudufy@yahoo.com drawnmccoy@yahoo.com zIega1hotmai1 .com zsearch@yahoo.com adrnin@answertels.com do Verisign perolsp@yahoo.com cadet@fasterrnail.ru nsrm@register.com perolsp@yahoo.com admin@macro-store.com do Verisign adminmacro-store.com gogo@mailti.com do Verisign marsplus@mail 13 .com stingomauro@yahoo.com flip@mailae.com do Verisign do Verisign Iivemeta188@hotmai1.com afrabaja@peru.com meromax@online.ua contact@myprivateregistration.com Iavionamarkus@yahoo.com sdfdsgfdf126.com abuse@cinipac.com j.sanchez00000@gmail.com trip1exg77@ymai1.com nikola@tscounter.com chatchai@twoplussoft.com simonich@inbox.ru do Verisign cxkmgI64f2b6d4097e4cw86bnaS4f2 1 bffa2ff dl .privatewhois.net jaunt@free-id.ru do Verisign ultragatew@gmail.com u1trart5@gmai1.com sergiva43 @hotmai I .com perolsp@yahoo.com westcuternaiI.org percy(rnaiIti.com adrninshanmana.net do Verisign do Verisign do Verisign xdr2eaO4f2329fl b475e@w86bna54f2 lbffa2ffd I .privatewhois.net afsrnedcIagmai1.com admin@sludential.com contactmyprivateregistration.com smartbox0001@yahoo.com do Verisign

73. 74. 75. 76. 77. 78. 79. 80. 81. 82. 83. 84. 85. 86. 87. 88. 89. 90. 91. 92. 93. 94. 95. 96. 97. 98. 99. 100. 101. 102. 103. 104. 105. 106. 107. 108. 109. 110. 111. 1 12. 1 13. 1 14. 1 15. 1 16. 1 17. 118. 1 19. 120. 121. 122. 123.

softsecuritylab.com somanyontion.com sonyvaio77 .com sgwed.net ssl-autoris.com stacyeiblerki.com sterijncompan.com strongtopguard.com suitionsaway.com sunageoshighvi.com svistoklex.com prlwppsunenofsx.com ptsoncmrusnjoew.com guantraxactor.com guardsecurity.com guiverharbor.com guizclub.net gwertyghost 1 22245678.com recavatech.com recellhelsen.com reetexista.com repetitirovnet.net retyuloploples.net revercestable.com rewriterform.com rollingthemydicenetbe.com runtroadeatb.com saldchwetheach.com sampinv.name sardballierman.com sausandergere.com scarts.name schoolboygetout.com sciteleganal.com sdfokoiasedewg.com secariadna.com secstat.com securitydaemon.com seeikom.name seg-opalesl .net sellertop.cn.com senstonymy.com photalegraza.com pintamierback.com planeostsguavep.com polovinkajfie.com poogatodf.com portmeadowcapital.com pospayinstruczione.com posta-myposta.com poste-sedyre.com

dropzone, infector updater dropzone, infector, source dropzone embeddedjs infector updater infector updater updater dropzone infector infector updater infector infector dropzone infector updater updater updater dropzone infector infector dropzone dropzone, infector, source updater updater dropzone updater updater dropzone, infector infector updater updater embeddedjs embeddedj s dropzone, infector dropzone, infector dropzone, source, infector dropzone, infector updater updater updater updater infector infector dropzone dropzone dropzone infector, dropzone

ambrossador@yahoo.com gmvj cxkxhs@whoisservices.cn gmvjcxkxhswhoisservices.cn perolsp@yahoo.com voffchih@yandex.ua ease@fxmail.net do Verisign do Verisign do Verisign do Verisign contact@privacyprotect.org apexdomains@hotmail.com do Verisign do Verisign contactmyprivateregistration.com guivertiprocketmaiI.com zealot@mai113.com mordehaiguryahoo.com do Verisign do Verisign do Verisign ch5m6hg4f2be56c3d025w86bna54f2 1 bffa2ff dl .privatewhois.net d0g0r0n@gmai1.com do Verisign rewriterform.com@whoisprotectservice.net nsrmregister.com do Verisign do Verisign k8ie_e86@yahoo.com admin@sardballierman.com marlenehobsbawm@live.co.uk Iivemeta188@hotmail.com gxwx9ur4f2be5929d2e4w86bna54f2 1 bffa2ff dl .privatewhois.net do Verisign admin@sdfokoiasedewg.com adminoverseedomainmanagement.com contact@privacyprotect.org domain.techyahoo-inc.com livemeta188@hotmai1.com do Verisign livemetal88@hotmai1.com do Verisign phota1egraza.comprivacy.above.com do Verisign do Verisign simonich@inbox.ru windcutemail.org portmeadowcapital.comdomainsbyproxy.co m domain.tech@yahoo-inc.com vilonichpotap@yahoo.com gmvjcxkxhs@whoisservices.cn

124. 125. 126. 127. 128. 129. 130. 131. 132. 133. 134. 135. 136. 137. 138. 139. 140. 141. 142. 143. 144. 145. 146. 147. 148. 149. 150. 151. 152. 153. 154. 155. 156. 157. 158. 159. 160. 161. 162. 163. 164. 165. 166. 167. 168. 169. 170. 171. 172.

vibeapnesbu.com viewediesolver.com vigetectrockset.com viimans.com vipworldhost.com vzrnb4o4.com westansgualiti.com westemillusion.com whatixemieldin.com whyvavilon.com wickissievele.com widowadvertising.net wopedjhfitzfgh.com minollumentlynx.com moderheitrack.com moigerta.cn.com mspselling.com mutanisopendsie.com muticeptad.com myscarts.name mywatchresource.com nachauserinfo.com nachauser-storeinfo.com nakostelidze.net national-security-agency.com neironhounder.com neoprenolen.com newturbobrowser.com nobodyj iomertomcomnet.com nookbizkitsad.com norwitols.com nsdnsrv.com nsonchecks2.com objectsphereuf.com oblomidze.net onespointheadia.com oposumschoone.com ogkplss.com padesionittatu.com panamachnlms.com patrogualarva.com pisoneterts.com justbigtoyssnet kenamersoftvu.com kickthefture.com ki1Idfmerrague.com klrtm.com kristradentro.com krivoglazeg.net layeradv.com

updater updater updater dropzone, infector infector infector updater infector updater infector updater dropzone, infector dropzone, infector updater updater dropzone, infector infector updater updater dropzone, infector dropzone, source, infector infector infector source infector infector dropzone dropzone updater infector dropzone dropzone, infector infector infector updater updater infector dropzone updater embeddedjs updater updater dropzone updater dropzone, infector updater dropzone, infector updater updater dropzone

do Verisign do Verisign do Verisign fundomlong@yandex.ru admin@vipworldhost.com martin.dudley@live.com do Verisign westi1I50gmai1.com do Verisign admin@whyvavflon.com do Verisign val 9zm44f2aa7 I e08338@w86bna54f2 1 bffa2ff dl .privatewhois.net wopedjhfhtzfgh.com@contactprivacy.com do Verisign do Verisign livemeta188@hotmail.com csimons@raingroup.com do Verisign do Verisign Iivemetal88@hotmai1.com admin@mywatchresource.com christopherharms l7@yahoo.com j errylynnhinnantjr@yahoo.com j lhiluz4f4bfb888e24f@w86bna54f2 1 bffa2ffd 1. privatewhois.net lionelmerrdok@yahoo.com tycoonmai1 13 .com bitbitbord@rocketmail.com pending-de1ete(registerapi.com stingomauroyahoo.com hula@mail 13 .com do Verisign dfghrterhotmai1.com ghbvsd@msn.com graspyourisp.ru tf4xsmg4f4bfda8ac864w86bna54t2 1 bffa2ffd 1 .privatewhois.net do Verisign cool@fxmail.net phone@wir3s.com do Verisign admin@panamachnlms.com do Verisign do Verisign doughertyj32yahoo.com repossesseddomaingodaddy.com domain.tech@yahoo-inc.com do Verisign admin@klrtm.com kristradentro.com@privacy.above.com peoid4z4f2b6ace2 1 c7 I @w86bna54f2 1 bffa2ffd I .privatewhois.net ebauacn4f2475b893ed5@w86bnas4f2lbffa2ff

__________________________________________

173. 174. 175. 176. 177. 178. 179. 180. 181. 182. 183. 184. 185. 186. 87. 188. 189. 190. 191. 192. 193. 194. 195. 196. 197. 198. 199. 200. 201. 202. 203. 204. 205. 206. 207. 208. 209. 210. 21 1. 212. 213. 214. 215. 216. 217. 218. 219. 220. 221. 222. 223. 224.

Iekhausurex.com Ieopodentargit.com Ievel-upgrage.com Iilaussieprems.com Iiviarylink.com Iocaldarcenss.com Iocaresplicutl.com lorevingbranta.com lprshcsmijfovp.com lucascattientop.com Iucassfield.com m5ta2bg-server.net managenetwor.com manageopoly.com marsplus.com maymacngocphuong.com mcgoth.com meazeridashloc.com https04.com mediacoif.com mentripete.com michigan4movies.com microbase-update.com microsoft-update.name hoffmnarketraph.com holmancybeac.com hosthgk.net hunterdriveez.com hv673hv573hv53h7khv57.com icredoname 1001 2.com ignarysama.com inboxacc.com incode.name indigocrickets.com inforksonseia.com intelinellouse.com interponsseella.com investriotinto.com invetechinte.com iserverupdates.com jambsulumency.com jdjsaf34.com jellabillat.com jinanpharmaceutical.com jobinedianingfo.com jockesnotliked.com johngottybest.com josunrwpyghvttr.com junioroops.name gedpoil.com gertyphacgueier.com giftcanbuy.com

updater updater dropzone updater updater infector updater updater infector updater updater dropzone, infector updater infector updater infector dropzone, infector updater dropzone, infector source, infector updater dropzone, infector dropzone, infector dropzone, infector updater updater dropzone infector dropzone, infector infector updater dropzone, infector dropzone, infector infector updater updater updater infector updater infector updater infector updater dropzone, infector updater updater dropzone, infector infector dropzone dropzone updater dropzone, infector

dl .privatewhois.net do Verisign do Verisign leve1up7@mai1.com admin@lilaussieprems.com do Verisign thorn@mail 13 .com do Verisign do Verisign 30a2d2f58c3fc4e525e0d2 1 2ad23e5c5l337853contact.gandi.net c/o Verisign do Verisign m5ta2bg-server.net@contactprivacy.com do Verisign boogievoogieoscar@ymail.com marsplus@mail 13 .com chodoi 1 988gmai1.com Ievelupohio@yahoo.com do Verisign contactmyprivateregistration.com lulu@cutemail.org do Verisign newdomainssiteground.com chris.deak1e82@ymai1.com maxpet1212@gmai1.com do Verisign do Verisign adminhosthgk.net expel@cutemail.org chris.deak1e82@ymai1.com mr.andreev84@bk.ru do Verisign contactprivacyprotect.org contact@privacyprotect.org watt@bz3.ru do Verisign do Verisign do Verisign gmvjcxkxhswhoisservices.cn do Verisign iservergmai 1.com do Verisign adminjdjsaf34.com do Verisign registryoder1and.se do Verisign jockesnot1iked.com(privacy.above.com da1e590(aoI.com ti-samfar@mail.ru 1ivemetaI88(hotmaiI.com perolsp@yahoo.com do Verisign jjorgel3@yahoo.com

225. 226. 227. 228. 229. 230. 231. 232. 233. 234. 235. 236. 237. 238. 239. 240. 241. 242. 243. 244. 245. 246. 247. 248. 249. 250. 251. 252. 253. 254. 255. 256. 257. 258. 259. 260. 261. 262. 263. 264. 265. 266. 267. 268. 269. 270. 271. 272. 273. 274. 275. 276.

globalwebz.net globridolumet.com gramablessatro.com grascowallmastmyway.com greatrotewallen.com grounaxyxin.com grz942.com grz97 1 .com gsssoftware5 .com guppobod.net headtickets.com hfcpdaonlines6324.com hhtres.com highnetlifelentrasx.com highnetlifenet.com high-privacy.com high-update.com high-upgrade.com domritu.com doupbox0 1 .com doutektronumni.com driveplex.net drontapesoff.com dst-finance.com dualglobalwave.com ebuityketfinus.com eguildaycock.com eponamindranthe.com eunitynewgbc.com europeconsults.com eurostats20 1 2.net everyyounoeverymecomn.com evraffeyplings.com exedrinsteadna.com famontare80 .net favoritopilodjd.com federalreserve-online.com federetoktyt.net fedralwire-report.com fiboxencercha.com finewcreautomp.com flashbangsecurity.com foolieracceiv.com forppp.net forviclemo.com fzbox.com frtualpomclub.com conwortonnent.com copelixell.com cornermarketmedia.com creamottonovati.com cronjelaw.com

dropzone, infector updater updater dropzone, source, infector embeddedjs updater updater source, updater updater dropzone, infector updater updater dropzone, infector updater dropzone, infector dropzone infector infector updater updater updater updater infector dropzone, infector dropzone updater updater updater updater dropzone infector source updater updater dropzone dropzone, infector dropzone, infector updater updater dropzone, updater dropzone, updater dropzone,

infector infector

infector infector infector

infector updater updater infector, dropzone updater dropzone, infector

admin@macro-store.com do Verisign do Verisign jones@cutemail.org v.saluja@aol.com grounaxyxin.com@privacy.above.com c/o Verisign do Verisign admin@macro-store.com andpushon@hotmail.com gogomai1it.com do Verisign admin@hhtres.com highnetIife1entrasx.com@domainsbyproxy.com pearl@mai113.com highprivaO@hotmail.com highle1ev7@gmai1.com do Verisign Zhongguancun@yahoo.com do Verisign doutektronumni.com(privacy.above.com vio1a@mai113.com drontapesoff.com@whoisprotectservice.net rw5njrx4f2adcae72 I b3w86bna54f2 1 bffa2ffd 1 .privatewhois.net dualwavegmail.com do Verisign do Verisign do Verisign do Verisign smithers3 @yahoo.com jsl I 4@Iive. it nsrm@register.com do Verisign do Verisign admin@famontare80.net simonich@inbox.ru rttreswalo@yahoo.com simonich@inbox.ru rttreswa1oyahoo.com carriefraser@live.co.uk finewcreautomp.comprivacy.above.com apperhousebIackyahoo.com do Verisign plmmvvgl@whoisprivacyprotect.com repossesseddomaingodaddy .com aeca08c 1 5ce745498efdcef3c7020d4d.protect@ whoisguard.com) four@mail 13 .com conwortonnent.com do Verisign domain.tech@yahoo-inc.com creamottonovati.com cronjelaw.com

277. 278. 279. 280. 281. 282. 283. 284. 285. 286. 287. 288. 289. 290. 291. 292. 293. 294. 295. 296. 297. 298. 299. 300. 301. 302. 303. 304. 305. 306. 307. 308. 309. 310. 311. 312. 313. 314. 315. 316.

cryogiwogater.com cuficellimaad.com cumberiangle.com cyberistrolax.com daosf3doapo.com dasyucorbit.com dazerfest.com dbi-static.com demanajelo.com dempeightemya.com deratirelcomni.com deressenwarpol.com dnsonchecks3 .com dogovoridze.net brandc.name brigatexgluc.com bringithomedude.com brnsounds.cc bryandsighter.com bxkkuskgdjskdn.com camesd.com careolnetcompowerfew.com cartapps.com cdkd.net cdnsecurehost.com cedeophys.com celeguidictor.com chacecipe.com chbytechipemen.com chetteaditas.com clingcornem.com closedsource.cc codecurveopusi.com 036px.com IO8cms.com 1 b86a9c7.com lnbank.info 2O2Ofilms.net 24onlinedrug.com 2report-nacha-org.com

updater updater updater updater dropzone, infector updater dropzone infector dropzone, source updater updater updater infector dropzone dropzone, infector updater dropzone, updater dropzone, infector updater dropzone dropzone, source dropzone, source, infector source, updater infector embeddedjs dropzone updater dropzone updater updater dropzone dropzone dropzone embeddedjs source embeddedjs source updater source source

317. 318. 319. 320. 321. 322. 323. 324. 325. 326. 327.

4to4kit.com 56pa7bo.com 73a372rtp.com 7435424vs.com 743 5474vs.com 7435924vs.com 7437424vs.com 743 8424vs.com 83a372rtp.com 888778889900.net 930nbsdaiodsa.com

dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone updater dropzone

cryogiwogater.com@privacy.above.com marlenehobsbawm@live.co.uk do Verisign cyberistroIax.com@privacy.above.com firicosl@live.com do Verisign nvpfydgrs@whoisprivacyprotect.com oke2@mail.ru admin@demanajelo.com dempeighternya.com@privacy.above.com repossesseddomain@godaddy.com deressenwarpoI.com@privacy.above.com domains@microsoft.com do Verisign brandc.name@domainsproxy.name do Verisign steven.som@yahoo.com rastainfogmai1 .com repossesseddomain@godaddy.com bxkkuskgdjskdn.com@contactprivacy.com perolsp@yahoo.com nsrm@register.com waved@mailti.com exsi1e777gmai1.com cadet@fastermail.ru admin@cedeophys.com celeguidictor.com@privacy.above.com xkcrdgfg@whoisprivacyprotect.com chbytechipemen.com@privacy.above.com do Verisign adminc1ingcomem.com do Verisign hut@bz3.ru contact@myprivateregistration.com i.cannot.do.itgmai1.com domain.tech@yahoo-inc.com nogtchamai1.ru admin@exticie.com.au 24onhinedrug.comdomainnameproxyservice. com mzn5z4sihe64xyuvvdsj fickny1nncxhhxsgqet0v hqhndwlc@2report-nachaorg.com.whoisproxy.org repossesseddomain@godaddy.com do Verisign do Verisign do Verisign do Verisign do Verisign do Verisign do Verisign do Verisign do Verisign admin@930nbsdaiodsa.com

328. 329. 330. 331. 332. 333. 334. 335. 336. 337. 338. 339. 340. 341. 342. 343. 344. 345. 346. 347. 348. 349. 350. 351. 352. 353. 354. 355. 356. 357. 358. 359. 360. 361. 362. 363. 364. 365. 366. 367. 368. 369. 370. 371. 372. 373. 374. 375. 376. 377. 378. 379. 380.

aaa I -news.net aaakiudsnayyg.com aboutinsurcar.com accessslist.net ach-files-alert.com ach-nacha.com accoukierlism.com ach-reports.com ach-transffers-us.com achyroransib.com acrefied.com ad 1 cfl g2.com administrationistsdug.com advdomain.com adventurehorde.com adventureineer.com adventureitect.com adventuremechanic.com adventureriver.net adventurerocks.net adventureshoal.com adventureswarm .com aepyhone.com aeractraspac.com afiating.com aitgrgfhvmewsys.com ajax-com.net akcakocadetayinsaat.com alconichill.com aldrorist.com adv-protection.cc aleorew.com alertedzones.com alerts-federalresrve.com alleopneandertal.com allmemoryram.com aII-nachadatainfo.com all-nacha-datainfo.com allnacha-users-bank.com americauta.net amersterin.com angebrethetcombiznet.com anthonydeloso.com antifraud-check.com antiglobalgg.com anualiverk.com applefincorp.net appscoast.com aguadigita.com aguaedition.com aguaj aunt.com aguaschooner.com aguaskiff.com

dropzone updater dropzone embedcledjs source source updater source source updater dropzone embeddedjs dropzone updater Source infector source infector source source source source dropzone updater dropzone dropzone, infector embeddedjs source updater dropzone embeddedjs dropzone dropzone, source, infector source embeddedjs source source source source updater updater updater dropzone embeddedjs updater updater dropzone, source, infector dropzone infector source source infector infector

craig@trexmarketing.co.za aaakiudsnayyg.com@domainsbyproxy.com contact@PrivacyProtect.org adminaccesssIist.net contact@myprivateregistration.com info@premiumregistrations.com 0/0 Verisign Randisnyder33@yahoo.com derewsater@yahoo.com do Verisign 0/0 Verisign contact@myprivateregistration.com admin@ikeainyourmindgiraf.com info@advdomains.com steve@bingotalk.com howellinsuperable@yahoo.com howe11insuperab1e@yahoo.com support@neturf.com support@neturf.com rowenachauvin@ymail.com accountingmoniker.com rowenachauvin@ymai I .com c/o Verisign do Verisign do Verisign g856y7f88nz@nameprivacy.com Domain.tech@yahoo-inc.com akcakocadetayinsaat.com@domainsbyproxy.co m do Verisign andpushon@hotmail.com admin@adv-protection.cc perolsp@yahoo.com admin@alertedzones.com contact@myprivateregistration.com Iancasterchemisorb@yahoo.com Anshpat2826gmai1.com christineselva@yahoo.com crystoIwiedemanyahoo.com allnacha-users-bank.com@contactprivacy.com contactwebdomainsbyproxy.com alanmcwilliams@live.co.uk c/o Verisign anthonyde1oso.comproxy.dreamhost.com info@antifraud-check.com zhongguancunyahoo.com anua1iverk.comdomainsbyproxy.com gmvjcxkxhs@whoisservices.cn video@fxmail.net supporthostgator.com domains(netfirms.com barmintua1ymai1.com barmintual@ymail.com barmintual@ymail.com

381. 382. 383. 384. 385. 386. 387. 388. 389. 390. 391. 392. 393. 394. 395. 396. 397. 398. 399. 400. 401. 402. 403. 404. 405. 406. 407. 408. 409. 410. 41 1. 412. 413. 414. 415. 416. 417. 418. 419. 420. 421. 422. 423. 424. 425. 426. 427. 428. 429. 430. 431. 432.

aguasloop.corn aguasrc.com arabeeffect. corn arctosinbrasilia.com armyfloridagames.com arrested-taxes.corn artechellirat.com articityxpagua.corn aryirs.corn asanveni.corn askeduptier. corn assrnitizeree.corn astinazmen.corn atbandau.corn athmainfosolutions.corn atlancentuage.com audubideonetity.com australia-verse.corn autoparo.com avaintellegeron.com avectintemottis.com azuremator.com babyberta.corn backupdornainrnuie 1245 .com badlike.corn badthen.corn badthese.com bakboro.com balticsevicestrust.com bankencryption.net barcodejoyness.com bariousauk.corn barpetra.com bassyfrornsolhost.com battlewright.com bb4f.net bbbyygd3yggbc.corn bedmany.com bedthese.com bedwilLcorn bedwould.corn beermoth.corn befzdzxfgvvtsjs.com beggardield.com belisirnol.com beluga88.corn bertonald.com bestparoels.com best-trololo.com betterheousermy.com biggestblazer.corn biggestchief.com

infector source dropzone dropzone embeddedj s source source updater infector dropzone dropzone updater dropzone dropzone source updater updater infector ernbeddedj s updater updater source infector dropzone source source source dropzone, source, infector dropzone embeddedjs dropzone dropzone source dropzone infector source dropzone, infector, updater source source source source infector dropzone, infector dropzone dropzone dropzone, source, infector dropzone ernbeddedjs dropzone updater source source

domainshugedomains.com barrnintual@ymail.com do Verisign zhongguancunyahoo.corn doorkeepemava@yahoo.com jukioleroa@yahoo.com repossesseddomain@godaddy.corn alanrncwilliarns@live.co.uk stopgap@yrnail.com the.rna1ware.caba1gmai1.com do Verisign assmitizeree.com@privacy.above.corn do Verisign do Verisign idrearnzsolutions@gmail.com do Verisign do Verisign cheryltreinen@yahoo.com contactprivacyprotect.org susanboyce@live.co.uk do Verisign accountingmoniker.com traffic@infrustdornains.com admin@backupdomainrnuie 1245 .com texasboy00@rocketmail.corn texasboyoo@rocketmaiLcorn texasboy00@rocketrnai1.com chris.deakle82@ymai1.com adrnin@weknewthatallthetirne.com admin@bankencryption.net arcade@rnailae.com andpushon@hotmail.corn barpetra.comcontactprivacy.corn admin@bassyfromsoIhost.com howellinsuperabIe@yahoo.com bb4f.net@domainsbyproxy.com laurake 1 s@grnail.corn dornains@netfirms.com d20bzj44f259909765dfw86bna54f2 I bffa2ffd I .privatewhois.net texasboy00@rocketmail.com do Verisign tulukhulhu@yahoo.com a86af8ue8ca@narneprivacy.corn do Verisign c/o Verisign zhongguancunyahoo.com contact@privacyprotect.org contact@privacyprotect.org noreply@centrohost.ru /o Verisign wanetka@tlen.pl wanetka@tlen.pl

433. 434. 435. 436. 437. 438. 439. 440. 441. 442. 443. 444. 445. 446. 447. 448. 449. 450. 451. 452. 453. 454. 455. 456. 457. 458. 459. 460. 461. 462. 463. 464. 465. 466. 467. 468. 469. 470. 471. 472. 473. 474. 475. 476. 477. 478. 479. 480. 481.

biggestclone.com biggestcoin.com biggestfunds.com biggestloop.com biggestmaster.com biggestmate.com biggestoneer.com biggestpilot.com biggestsetter.com billychalk.com billycharge.com billycheerful.com billydie.com billydoghouse.com bisiteles.com bitebeehive.com biteblew.com biteblind.com biteblown.com blestim.com blogoettindia.com blueberrymo.com bluemator.com blumswell.com boatorldenoras.com boletin_turistico.com borsteksavalu.com boxtaditp.com brigatexgluc.corn broadbandintemetspeedtest.corn bryandsighter.com bstunvzykggpj o.com bumeter.com bumingidea.com bursayserry.com busiene.com buttorfos.com buut7ar.com camesd.com campingrange.com campingshelf.com campingstack.com canceled-transfer.com cardholder-security.com card-security.net careolnetcompowerfew.com caronivarium.com cartapps.com cartethont.com

source infector infector source source source source source source source source source source source infector source source source source dropzone updater updater source source updater dropzone updater dropzone updater source dropzone, updater dropzone, infector dropzone source dropzone embeddedjs dropzone dropzone dropzone source source source source source source updater source updater dropzone

whois@fastdomain.com gogofreeze@hushmail.com gogofreeze@hushmail.com e3up3 ib4f5a9242cf795@w86bna54f2 1 bffa2ffd 1 .privatewhois.net pendingrenewa1ordeIetionnetworksoIutions.c om gogofreezehushmaiI.com pendingrenewaIordeIetionnamesecure.com wanetka@tlen.pl adminoverseedomainmanagement.com vazzamoon@rocketmail.com vazzamoon@rocketmail.com domains@netfirms.com hostmaster@directnic.com accounting@moniker.com hobbitgod@ymail.com techarts@globalsources.com pendingrenewalordeletion@networksolutions.c om h6ad4g34f2599077 1 c70@w86bna54f2 1 bffa2ff dl .privatewhois.net domains@netfirms.com nat.khi1kevichgmaiI.com do Verisign b1ueberrymo.comprivacy.above.com whois@fastdomain.com support@neturf.com alanmcwiIliams@live.co.uk cacueto@comcast.net borsteksava1u.com@privacy.above.com iirnn@yahoo.co.uk do Verisign contact@privacyprotect.org aIanmcwiIliams@Iive.co.uk wv4k5 96n5se@nameprivacy. corn do Verisign jinterva@ucsd.edu do Verisign uguirjjyaho.com admin@buttorfos.com do Verisign perolsp@yahoo.com lcjg@citcom.net lcjg@citcom.net Icjg@citcom.net contactmyprivateregistration.com georgewashere5 1 @yahoo.com card_security.net@contactprivacy.com lauraboschetti@aol .com spruebeatty@yahoo.corn waved@mailti.com gmvjcxkxhs@whoisservices.cn

10

482. 483. 484. 485. 486. 487. 488. 489. 490. 491. 492. 493. 494. 495. 496. 497. 498. 499. 500. 501. 502. 503. 504. 505. 506. 507. 508. 509. 510. 51 1. 512. 513. 514. 515. 516. 517. 518. 519. 520. 521. 522. 523. 524. 525. 526. 527. 528. 529. 530. 531. 532. 533.

cavanaghandcompany.com cccdfgethyn76.com cdnsecurehost.com cedeophys.com celeguidictor.com chacecipe.com chapedciothes.com chbytechipemen.com chdormante.com checkip4u.net checkmelater.com chetteaditas.com chipsiedok.com chorinav.com clickhere67.com clingcomem.com clixa.com cioisan.com coffien.net coil 1 .com coIl2 .com coIl3 .com coiobird.com colocurl.com colocycle.com coioguel.com coiowheel .com combigave.com combigiving.com combijump.com combimyself.com combipiease.com complexfix.com connectsharelearn.com conwortonnent.com cooldgaggle.com cooldherd.com cooldhorde.com copeiixeil.com coralaw.com coralawl23.com coreamesents.com corpsecnet.com crappycrappy 123 .com creamottonovati.com cremasl.com cronoblankostarahmake206.net cryogiwogater.com css-lib.com csspan.net cuficeliimaad.com cumberiangle.com

updater updater embeddedj s dropzone updater dropzone dropzone updater dropzone dropzone, updater dropzone updater source dropzone dropzone dropzone, updater updater dropzone dropzone dropzone dropzone dropzone source infector infector source source source infector source source source dropzone, source, infector source updater source source source updater infector infector updater dropzone dropzone updater dropzone updater updater embeddedjs embeddedjs dropzone, updater updater 11

chriscavanagh@yahoo.com do Verisign cadet(fastermaii.ru admin@cedeophys.com celeguidictor.com@privacy.above.com xkcrdgfg@whoisprivacyprotect.com mgfrjj sn@whoisprivacyprotect.com chbytechipemen.com@privacy.above.com chdormante. comprivacy. above.com checkip4u@yahoo.com bill@haiau.tv do Verisign spruebeatty@yahoo.com andpushon@hotmail.com admin@clickhere67.com adminclingcornem.com peterbrown@ceneb.com do Verisign admin@coffien.net contact@privacy-protect.cn gasmenggrrr@yahoo.com gasmenggrrr@yahoo.com duckymums@yahoo.com duckymums@yahoo.com duckymums@yahoo.com duckymums@yahoo.com supportneturf.com legal@moniker.com korpicsscan@skynet.be korpicsscanskynet.be hostmaster@word.net korpicsscan@skynet.be gmvjcxkxhs@whoisservices.cn eileenroseod@aol.com conwortonnent.com@privacy.above.com mariodibattistageIservicesrI.com mariodibattista@gelservicesrl.com mariodibattistageIservicesr1.com do Verisign admin@coralaw.com do Verisign do Verisign gmvj cxkxhs@whoisservices.cn da4m97i4f25acc2Sc2fe@w86bna54f2 1 bffa2ffd I .privatewhois.net do Verisign do Verisign cronoblankostarahmake206 .netdomainsbypro xy.com cryogiwogater.com@privacy.above.com robertokelly5@yahoo.com timfranklin38@yahoo.com marienehobsbawm@live.co.uk do Verisign

534. 535. 536. 537. 538. 539. 540. 541. 542. 543. 544. 545. 546. 547. 548. 549. 550. 551. 552. 553. 554. 555. 556. 557. 558. 559. 560. 561. 562. 563. 564. 565. 566. 567. 568. 569. 570. 571. 572. 573. 574. 575. 576. 577. 578. 579. 580. 581. 582. 583. 584. 585.

curcandle.net curcell.net curcent.com curchart.com curvechess.com curvechild.com curvechime.com curvechirp.com curvechore.com customemacha-tools.com cwlrgguvioemezr.com cyanicuma.com cyberistrolax.com cytomedi.com cyytmmlxsthywst.com da3a4no.com dasyucorbit.com Datangoo.com datejebemupicku.com dazerfest.com dbase-security.com dbdata-check.com dddfdvreb46hj.com debaketo.info decalintos.com deepinch.com delallosa.com deligatemyname.com demanaj elo.com dempeightemya.com denitraspetr.com deratirelcomni .com deressenwarpol.com derkicide.com desafiodefe.com dgmrsyyrtkosxcjp.com diandres.com diksdirect.com discount-Iondon-tours.com dohturboob.com doIiv777.com doIiv777O.com doIiv777 I .com do1iv7772.com do1iv7773.com do1iv7774.com do1iv7775.com do1iv7776.com do1iv7777.com do1iv7778.com do1iv7779.com domozhe.com

source source source source source source source source source source dropzone, infector, source dropzone updater dropzone dropzone, infector dropzone updater dropzone dropzone, updater dropzone, updater embeddedjs dropzone updater dropzone source dropzone source dropzone dropzone updater updater updater updater dropzone, updater source dropzone, infector dropzone dropzone dropzone source dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone

hostmaster@word.net b6w1pec4f2599056c30f@w86bna54f2 1 bffa2ff dl .privatewhois.net tryagain@tpg.com.au dewus 1 23embargmaiI.com tryagaintpg.com.au printing1aserprinterchecks.com printing@laserprinterchecks.com printing@laserprinterchecks.com yyjnc1x4f25990367 1 a8@w86bna54f2 1 bffa2ffd 1 .privatewhois.net donnawi11ard57@yahoo.com m3g264z34h@nameprivacy.com do Verisign cyberistroIax.com@privacy.above.com do Verisign dt6gh2wj339nameprivacy.com do Verisign do Verisign stefan.hoheisel@gmx.net mihakurcnikgmaiI.com nvp1,dgrs@whoisprivacyprotect.com jfrey43@yahoo.com binder@haiau.tv do Verisign do Verisign bitbitbord@rocketmail.com poltavtzeva. svetlana@yandex.ru dominios@coIombiahosting.com adminde1igatemyname.com admin@demanajelo.com dempeightemya.com(privacy.above.com admin@denitraspetr.com repossesseddomain@godaddy.com deressenwarpo1.comprivacy.above.com admin@derkicide.com pastordesafiodefe.com ht8qj6p2277@nameprivacy.com do Verisign waggner788889yahoo.com domain-admineasiIy.co.uk D0HTURB00B.C0M@domainsbyproxy.com admin@do1iv777.com the.maIware.caba1gmaiI.com admin@doIiv777 1 .com do Verisign do Verisign gmvjcxkxhswhoisservices.cn do Verisign do Verisign do Verisign do Verisign do Verisign gmvj cxkxhs@whoisservices.cn

12

586. 587. 588. 589. 590. 591. 592. 593. 594. 595. 596. 597. 598. 599. 600. 601. 602. 603. 604. 605. 606. 607. 608. 609. 610. 61 1. 612. 613. 614. 615. 616. 617. 618. 619. 620. 621. 622. 623. 624. 625. 626. 627. 628. 629. 630. 631. 632. 633. 634. 635. 636. 637. 638.

domritu.com domsterns.com donttouchme739.com dotmascript.com doublewin.com doutektronumni .com dpoougasjkshpms.com dpouark.com dgsmeipgzhgkrp.com drillnews.com dsjkkwlhhdd.com dskjhiukwlw.com dualforcegate.com dyaybriaiko.com dyaybriaikl.com dyaybriaik2.com dyaybriaik3.com dyaybriaik4.com dyaybriaiks .com dyaybriaik6.com dyaybriaik7.com dyaybriaik8.com dyaybriaik9.com dz-greenhat.com eaiitykhxsnkgngm.com eartherd.com earthorde.com ebaliu.com ebuityketfinus.com edeniu.com eeejkcduyrhjv.com efexxxef.com efexxxefO.com efexxxefl .com efexxxef2.com efexxxef3 .com efexxxef4.com efexxxef5 .com efexxxef6.com efexxxef7 .com efexxxefg.com efexxxef.com eftpsinfo-center.com eguildaycock.com eieniomxzliljlnj .net elekingshop.com elitbasak.com emerati.com encrypted-security-agency.com enscorose.com eponamindranthe.com erodssmnjjmtlnk.net errorsuz.com

updater embeddedjs dropzone source dropzone updater dropzone, source, infector embeddedjs dropzone, infector infector dropzone dropzone source dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone, infector source source dropzone updater dropzone updater dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone source updater dropzone, infector embeddedjs dropzone dropzone embeddedjs dropzone updater dropzone, infector source 13

zhongguancun@yahoo.com admorg122@yahoo.com admin@donttouchme739.com kalavemguard@yahoo.com steven@shalom6000.com doutektronumni.com@privacy.above.com zy3ar8s37zn@nameprivacy.com nhghtrwly@whoisprivacyprotect.com t57hy5u68dr@nameprivacy.com reeks@mailae.com 1iberraIgmai1.com Jiberra1gmai1.com duaIforcegmai1.com do Verisign Monicabrown1911@hotmai1.com the.malware.cabal@gmail.com do Verisign do Verisign the.ma1ware.cabaIgmai1.com the.ma1ware.caba1gmai1.com do Verisign do Verisign do Verisign repossesseddomain@wi1dwestdomains.com t57hy5u68dr@nameprivacy.com denunzioanthony@yahoo.com z42mb88u475@nameprivacy.com benedettennodimele@yahoo.com do Verisign do Verisign do Verisign admin@efexxxef.com do Verisign the.ma1ware.caba1gmaiI.com admin@efexxxef2.com the.ma1ware.caba1gmaiI .com do Verisign the.ma1ware.caba1gmai1.com do Verisign admin@efexxxef7 .com do Verisign do Verisign nichoIaswiltz@yahoo.com do Verisign rf7ph2w73fw@nameprivacy.com do Verisign ELITBASAK.COM@domainsbyproxy.com do Verisign nogtchamaiI.ru contactmyprivateregistration.com do Verisign waterscomprehensive@yahoo.com support@hostmonster.com

639. 640. 641. 642. 643. 644. 645. 646. 647. 648. 649. 650. 651. 652. 653. 654. 655. 656. 657. 658. 659. 660. 661. 662. 663. 664. 665. 666. 667. 668. 669. 670. 671. 672. 673. 674. 675. 676. 677. 678. 679. 680. 681. 682. 683. 684. 685. 686. 687. 688. 689. 690.

eryirs.com eslikerbuna.net etflftvbiwisxnr.com eunitynewgbc.com everyyounoeverymecomn.com evraffeyplings.com evrymonthnighttry.com exedrinsteadna.com faggowh.com fanzinatra.com fdic-advantage.com fdic-customeragent.com fdiccustomer-news.com fdic-insurance.com fdicnewsforcustomer.com fdicuser-advice.com fecticalry.com federalreserve-goverment.com federalreserve-security.com federalresrve.com fgbnutyfhfgjdfghj iI.com fheskmrozstshwo.com fiboxencercha.com files-irs-pdf.com filmv.net finance-customer.com financedata-store.com financialstatements.mrsdl.com financialtime.name findnachareport.com finewcreautomp.com firelinesecrets.com first.lib-invest.net first.lib-invest 1 .net first.lib-invest2.net first.Iib-invest3 .net first.Iib-invest4.net firstdir.cc fletteeierin.com fllmphpxpwgeyhj .net division 1 6000.net flsunstate333 .com ftnsalberta.com finvyywjglpitous.net fIinkwlyvvrrongvp.net fokswltine.com fokwsdfrld.com foodwhisky.com foolieracceiv.com foreveryouandmee.com forviclemo.dom owmtyzgsdsfxJ.net

source dropzone, source, infector dropzone, infector updater updater updater source, infector updater dropzone dropzone source source source source source source dropzone source source source dropzone dropzone, infector dropzone, source, updater source dropzone source source source dropzone source updater embeddedjs dropzone dropzone dropzone dropzone dropzone embeddedjs dropzone dropzone, source, infector dropzone, source, infector updater infector dropzone, infector dropzone, infector embeddedjs embeddedjs updater updater embeddedj s updater dropzone, infector

stopgop@ymail.com contact@webdomainsbyproxy.com rd9cp4t73dg@nameprivacy.com do Verisign Iauraboschetti@aol.com do Verisign admin@jajahbinksdiesforyou.com do Verisign admin@mymysteryisle.net amiIcarortegagmai1.com dodsworthmike@yahoo.com jeschkemary@yahoo.com do Verisign contact@myprivateregistration.com lekpericlendita@yahoo.com hollfelderjeff@yahoo.com do Verisign contact@myprivateregistration.com Iionelmerrdok@yahoo.com contact@myprivateregistration.com repossesseddomain@godaddy.com a35yx3bg2hc@nameprivacy.com carriefraser@live.co.uk info@premiumregistrations.com ce1ikseyhmusgmai1.com simmonsjames1980@yahoo.com cresencioedgar@yahoo.com barton@fimai1.net sukiblyadi@yahoo.com gingere1lis75@yahoo.com finewcreautomp.com@privacy.above.com kyvepavavace@yahoo.com qtu6ta64t2a0ac865ca9w86bna54f2 I bffa2ffd 1 .privatewhois.net the.malware.cabal@gmail.com squc6ss4f2b8c8d68fOew86bna54f2 1 bffa2ffd 1 .privatewhois.net ben.jonson88@yahoo.com the.ma1ware.caba1gmaiI.com brat@mailti.com do Verisign y77jc7ys7xp@nameprivacy.com michalasnick@yahoo.com flsunstate333 .comdomainsbyproxy.com Reactivation-Pendingenom.com d38679a55tn@nameprivacy.com d67rg3d97jpnameprivacy.com webmaster@thefinhouse.com webmaster@thefinhouse.com assetcutemaiJ.org do Verisign adminforeveryouandmee.com repossesseddomain@godaddy.com js5gx56c7w8nameprivacy.com

14

691. 692. 693. 694. 695. 696. 697. 698. 699. 700. 701. 702. 703. 704. 705. 706. 707. 708. 709. 710. 711. 712. 713. 714. 715. 716. 717. 718. 719. 720. 721. 722. 723. 724. 725. 726. 727. 728. 729. 730. 731. 732. 733. 734. 735. 736. 737. 738. 739. 740. 741. 742. 743.

frameworkdisable.com france-facebook.com freac.net freekinas.com freetreebreemree46364.com fresheurope.com fretolu.com fteur.com fucktheabuse.com furniture-Iux.com fvpluxlvnfktssf.com fvxyrrojgrsgkpvr.com gadidthen.com gafatys.com gageri.com gavildippurum.com gavnoebanoe.com gavnoebanoe.net gdemamaruka.com gdemamaruka0.com gdemamarukal.com gdemamaruka2.com gdemamaruka3 .com gdemamaruka4.com gdemamaruka5 .com gdemamaruka6.com gdemamaruka7.com gdemamaruka8.com gdemamaruka9.com gedpoii.com gertyphacgueier.com get2-nacha-report.com get-ach-report.com getcompanyreport. com getnacha-info.com getnachanews.com get-nacha-news.com getodkeltyo.com gettingpregnantips.com getworldnewsfast.com gi0sti.com getbussinesinfo.com giiiettpublishing.com girodiza.com giupmcehjstwgegt.com glasseseverydaynow.com globalmassretrieval .com globalnxtretrieval.com giobaiwebanaiytics.com globalwebz.net globridolumet.com gloomglboom.com godlikeioosers.com

dropzone, source, infector source source dropzone updater embeddedj s dropzone dropzone dropzone, source, infector dropzone dropzone, infector dropzone, infector dropzone dropzone dropzone updater dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone updater source source source source source source dropzone source embeddedjs updater embeddedjs source, infector dropzone dropzone, infector source updater updater dropzone, infector dropzone, infector updater embeddedjs dropzone 15

gmvj cxkxhs@whoisservices.cn deicoregcn.cx coiorsandforms@aoi.com admin@freekinas.com do Verisign garykwatterson@serv.net chris.deak1e82@ymai1.com waggner788889@yahoo.com john.may24@yahoo.com ordova@ya.ru downingcineramayahoo.com x73v27rf67z@nameprivacy.com do Verisign gafatysyahoo.com do Verisign do Verisign dii 1ingmmnnnyahoo.com gasmenggrrryahoo.com admin@gdemamaruka.com do Verisign the.ma1ware.caba1gmaiI.com do Verisign do Verisign the.ma1ware.cabaigmai1.com do Verisign do Verisign do Verisign do Verisign do Verisign perolspyahoo.com do Verisign rogov.vasya@yahoo.com amadasunpatrick@yahoo. corn baomat@dichvubaomattenmien.vn charles_boyette@yahoo.com info@premiumregistrations.com get-nacha-news .com@contactprivacy.com perolsp@yahoo.com mihaitaraipangmail.com dickensextrovert@yahoo.com bassial 985gmaiI.com admin@getbussinesinfo.com 5t1 i4fO686nojunkemaiIaddress.com admin@girodiza.com e255f24x5pb@nameprivacy.com adminjajahbinksdiesforyou.com do Verisign do Verisign admingiobaiwebanaiytics.com admin@macro-store.com do Verisign adming1oomg1boom.com binder@haiau.tv

744. 745. 746. 747. 748. 749. 750. 751. 752. 753. 754. 755. 756. 757. 758. 759. 760. 761. 762. 763. 764. 765. 766. 767. 768. 769. 770. 771. 772. 773. 774. 775. 776. 777. 778. 779. 780. 781. 782. 783. 784. 785. 786. 787. 788. 789. 790. 791. 792.

gomosekov.net gooeylouiecake.corn gordongraduation.com gramablessatro.com grandtarf corn grascowallmastmyway.com grathile.com greenballsoft.com groatcoats.com grounaxyxin.corn grz97.com grz97 1 .com gsobj .net gtpgomgbngpjrnypr.corn guishalf.corn gurmentpass.corn gxxelfrsgtkugry.net h2323yrturtyuk.com hacothailand.com halflife.corn harnbusb.com hatefelonyl I I .com hbasdauadhg.com heeerrrl .com heeerrr2.corn heeerrr3 .com heeerrr4.corn heeerrr5 .com heeerrr6.com heeerrr7.com heiotrqmevizmorvvcio.corn hellofromhere982 13 .com hemgmgizxibgtkrnk.com hetllttuptuyyyf.corn hfcpdaonlines6324.com highnetlifelentrasx.corn hj fknpnzixuxox.corn hmgwuxnzwyegkls.com hofftnarketraph.com hogaric.corn holmancybeac.com hostei.corn hotbgirls.com hotrinkolistnetbiz.com hottenmejenetcominfo.com howellsheatingandair.corn hpftighftxurbsoll.net htdellnoiseunivercom.com htdellnoiseunivercou.com

dropzone, updater dropzone source updater embeddedjs dropzone, source, infector dropzone embeddedjs dropzone, updater updater updater updater embeddedjs dropzone, infector dropzone ernbeddedj s dropzone, infector dropzone updater dropzone dropzone dropzone, source, infector dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone, infector, updater dropzone dropzone, infector dropzone, infector updater updater dropzone, source, infector dropzone, source, infector updater dropzone updater dropzone dropzone updater dropzone, infector, updater dropzone dropzone, infector dropzone, infector, updater updater

nizag@rnail.ru dstieferman@hotmail.com pg9xx6xu7a8networkso1utionsprivateregistra tion.corn do Verisign admin@fastosmile.com jones@cuternail.org do Verisign contact@privacyprotect.org admingroatcoats.com grounaxyxin.com@privacy.above.com admin@macro-store.com admin@macro-store.corn judith.ebrahim@yahoo.com do Verisign do Verisign Reactivation-Pending@enorn.corn do Verisign do Verisign thewhoisguard@gmail.corn halflife.corn@contactprivacy.com do Verisign john.rnay24yahoo.corn adrnin@hbasdauadhg.com heeerrrl.com@contactprivacy.com the.maIware.cabaIgmai1.com do Verisign do Verisign do Verisign do Verisign do Verisign rnikamelio@yahoo.com admin@hellofrornhere982 13 .com wv4k596n5se@nameprivacy.com downingcineramayahoo.corn do Verisign highnet1ife1entrasx.corndornainsbyproxy.com wu4an2xy74snarneprivacy.com adrnin@boostsalesguru.com do Verisign do Verisign do Verisign abuse@O00webhost.com perolsp@yahoo.com carminatimarina@yahoo.it carrninatimarina@yahoo. it howe1Isheatingandair.comprotecteddornainse rvices.corn b52f2gw5ysnarneprivacy.com vrnilenacarla@yahoo.corn do Verisign

16

793 794. 795. 796. 797. 798. 799. 800. 801. 802. 803. 804. 805. 806. 807. 808. 809. 810. 81 1. 812. 813. 814. 815. 816. 817. 818. 819. 820. 821. 822. 823. 824. 825. 826. 827. 828. 829. 830. 831. 832. 833. 834.

htdellnoiseunivercoz. corn huckside.com hugegiantyouth.com hullimpair.corn huniloz.com huntchemical.com hvlgrnwtesgdkktgo.net hydroliets.com hygrofi.corn hzmmvkbsggpt.corn iamnothere823 .com iaywtztjwkndfgtm.com idina-here.com ignarysama.com iigmvgrhotnkgsp.net ijgrginymhjsvr.net ijuussvpteexrx.net ilovefreewifi.com inboxacc.com indigomator.com indosyslife.com inforksonseia.com infrarotendamkevforo.com ingbrownfour.com init-js.com inloggen-ing.com innovazipowenetyunwcz.com insurancepublicliability.net intelinellouse.com interponsseella.com intesasanpaolo.com invetechinte.com invintor. net iosahdoias.com ipcheckeroo 1 .com ipchecker002 .com ipchecker003 .com ipchecker9 1 1 .com ipuimurgmerpvl.net irs-0003 8004800us.com irs-000787002900us.com irs-alerts-report.com

updater dropzone dropzone embeddedjs dropzone source dropzone, infector dropzone dropzone dropzone, infector dropzone dropzone, infector dropzone updater dropzone, infector dropzone, source, infector dropzone, infector dropzone dropzone, source, infector source source updater dropzone, infector, updater infector embeddedjs embeddedjs updater source updater updater embeddedj s updater dropzone dropzone dropzone, updater dropzone, dropzone, dropzone, dropzone, source source source updater updater updater infector

m-renewals@register.com do Verisign adrnin@ikeainyourmindgiraf.com grnvjcxkxhs@whoisservices.cn adminhuni1oz.com infopremiurnregistrations.com apprehensivebrandt@yahoo.com andpushon@hotmail.com do Verisign do Verisign admin@iarnnothere823 .com z34jb9zg2a5@nameprivacy.com starbuckgaf@netscape.net do Verisign u583p92r8uv@nameprivacy.com do Verisign do Verisign support@registerfly.com contact@privacyprotect.org watervis@planet.nl pkarthik24@yahoo.com do Verisign a1banaIiaj16yahoo.com bu1bo1ighteryahoo.com gildertamra@yahoo.com contactprivacyprotect.org do Verisign admin@mai12u.com.au do Verisign do Verisign hostmaster@intesasanpaoIo.com do Verisign bomd@yahoo.com admin@iosahdoias.com ipcheckeroo 1 @yahoo.com admin@overseedomainmanagement.corn admin@overseedomainmanagement.com ipchecker9 I I .com w72p35dd5tt@nameprivacy.com info@premiumregistrations.com jukioleroa@yahoo.com rpsxmbykruvdbquupu2uoqabgfgsvifmjhknqer2 vhsuchyam@irs-alerts report.com.whoisproxy.org irs-charge.comdomainsbyproxy.com contact@privacyprotect.org info@premiumregistrations.com irs-events.com@contactprivacy.com nilonana@yahoo.com do Verisign contactmyprivateregistration.com iss1essensua1.com@privacy.above.com

835. 836. 837. 838. 839. 840. 841. 842.

irs-charge.com irsdatafilereport.com irs-data-storage.com irs-events.com irs-reports.com isopect.com isportes.com isslessensual.com

source source source source source dropzone dropzone embeddedjs

17

843. 844. 845. 846. 847. 848. 849. 850. 851. 852. 853. 854. 855. 856. 857. 858. 859. 860. 861. 862. 863. 864. 865. 866. 867. 868. 869. 870. 871. 872. 873. 874. 875. 876. 877. 878. 879. 880. 881. 882. 883. 884. 885. 886. 887. 888. 889. 890. 891. 892. 893. 894. 895.

itimezonenetcomwerytt.com ixvwpvwulcgenlim.com iylsorzrj lmsuwy.com jabber9ll.com jackeydu.com jahsdiuasbdiaa.com jajahbinksdiesforyou.com jambsulumency.com jdfslkj Idssd.com jeancena.com jellabillat.com jerikold.com j etuodiresbepourtua.com jimpnea.com jitteryworld.com jjuegsggekypj sg.com j lojsunoymwtvktj .com jobinedianingfo.com jockesnotliked.com j ohnsonforums3 .com jollyconcierge.com jonathanhaasdesign.com j ovamekoz.com jpfvgkriogvnswtn.com jrhxuysrppsoum.com jscripts.net jsdlfkhusfds.com js-includes.com js-init.net js-lib.net jsmsgb.com jsobj .com juiorkbopglrijuy.net jujuity.com julithos.com jumemmheavennetcomdre.com junesommerlivey.com justdrv.net kadonisoft.com kadonisoft0.com kadonisoft 1 .com kadonisoft2.com kadonisoft3 .com kadonisoft4.com kadonisoft5 .com kadonisoft6.com kadonisoft7.com kadonisoft8.com kadonisoft9.com karakumma.com kdsnrakdvnezxpwg.com kecisygewayixp.com kenamersoftvu.com

updater dropzone, infector dropzone, infector, source dropzone, updater dropzone dropzone source updater dropzone dropzone updater dropzone dropzone dropzone source dropzone, infector dropzone, infector updater updater dropzone dropzone dropzone dropzone dropzone, infector dropzone, infector embeddedjs dropzone embeddedjs embeddedjs embeddedjs embeddedjs embeddedjs dropzone, source, infector dropzone dropzone updater dropzone, source, infector dropzone, infector dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone, source, infector dropzone dropzone, infector updater

do Verisign do Verisign ns5m23 ur84w@nameprivacy.com jabber911.com@privacy.above.com admin@denitraspetr.com adminjahsdiuasbdiaa.com admin@jajahbinksdiesforyou.com do Verisign IiberraIgmai1.com do Verisign do Verisign do Verisign the.malware.cabal@gmail .com do Verisign jitteryworld.com@contactprivacy.com ea4cy5zc9n8@nameprivacy.com t57hy5u68dr@nameprivacy.com do Verisign jockesnotliked.com@privacy.above.com admin@johnsonforums3 .com domain-admin@easily.co.uk jonhaas@gmail.com jovamekoz@yahoo.com bp24s6n2497@nameprivacy.com z39hp8ky6rj@nameprivacy.com Iindseybowman56@yahoo.com contactprivacyprotect.org morrison_alisha@yahoo.com jennifer.henderson62@yahoo.com susan.haines37@yahoo.com domain.tech@yahoo-inc.com domain.tech@yahoo-inc.com zy3vb4em6bb@nameprivacy.com do Verisign do Verisign do Verisign m-renewals@register.com admin@macro-store.com admin@kadonisoft.com do Verisign the.malware.cabal@gmail.com admin@kadonisoft3 .com kadonisofi3 .comcontactprivacy.com admin@kadonisoft4.com the.malware.cabal@gmail.com do Verisign do Verisign do Verisign do Verisign admin@buttorfos.com contact@privacyprotect.org k63we9nm3yx@nameprivacy.com repossesseddomain@godaddy.com

18

896. 897. 898. 899. 900. 901. 902. 903. 904. 905. 906. 907. 908. 909. 910. 911. 912. 913. 914. 915. 916. 917. 918. 919. 920. 921. 922. 923. 924. 925. 926. 927. 928. 929. 930. 931. 932. 933. 934. 935. 936. 937. 938. 939. 940. 941. 942. 943. 944. 945. 946.

keorgovrrnetsrfo.com kgkdominas.com khkhkjhiocgsgs.com khuuvzgpowtmknby.com kiI1dfmerrague.com kilotran.com kjpgetncnrjothzs.net kniferiddin.com knspgntnrlgkeos.net koklip.com koletrezzo44.com koletrezzo5 5 .com koletrezzo66.com koletrezzo77.com koletrezzo88.com koletrezzo99.com kovjmkilwfgmlpws.com kpcpogyfljrdgpr.net krewgskynesscompowime.com kristradentro.com krivoglazeg.net kvazimoder.com kwalai.com kynhsgpnbjrwvgi.net kzgornnplugwstm .com ladybugecards.com Iantallyga.com Iayuplaeani.com Iazysit.net Ieakedbyzero.com Iekaleo.com Iekhausurex.com lenkzetrgvsnk.net Ieopodentargit.com Ifrtvettnwmnpmi.com thtbsotjisgvwvp.net lilaussieprems.com Iinindi.com Iinsela.com liviarylink.com Imtljukgunydhxuz.net Iobsterliveverrolad.com Iobsterliveverromem.com Iobsterliveverromez.com Iocaresplicutl.com Iorevingbranta.com Ioudworld.net lpaokum.com Ipnksckywkyyxmgh.com Ighkgohgsgvjokr.com Iglktuzitgtghgem.com

dropzone, source dropzone dropzone, updater dropzone dropzone, dropzone dropzone, dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone, dropzone, updater updater updater dropzone infector dropzone, dropzone, source dropzone dropzone source dropzone dropzone updater dropzone, updater dropzone, dropzone, updater dropzone dropzone updater dropzone, dropzone, updater dropzone, dropzone, updater updater updater infector dropzone dropzone, dropzone, dropzone,

source, infector

infector

infector, source infector

infector infector

infector source, infector

infector source, infector infector

infector infector, source, infector infector,

k35hx8dk6nc@nameprivacy.com registrar@macrohost.com do Verisign yj55n8hw5nb@nameprivacy.com do Verisign contact@privacyprotect.org d38679a55tn@nameprivacy.com c/o Verisign contact@privacyprotect.org tayosalaudeen@yahoo.com repossesseddomain@godaddy.com repossesseddomain@godaddy.com koltrezzo66.com@contactprivacy.com the.ma1ware.caba1gmai1.com admin@ko1etrezzo88.com admin@ko1etrezzo99.com u583p92r8uvnameprivacy.com ba55f7xs5g6@nameprivacy.com do Verisign kristradentro.com@privacy.above.com peOid4z4f2b6ace2 I c7 1 @w86bna54t2 1 bffa2ffd I .privatewhois.net kvazimoder.com(privacy.above.com rnsoe@yahoo.fr do Verisign d38679a55tn@nameprivacy.com studio@rinatgaz.com do Verisign do Verisign stevehisey@gmail.com the.maIware.cabaIgmaiI.com perolsp@yahoo.com do Verisign wc2ve8y48hv@nameprivacy.com do Verisign apprehensivebrandt@yahoo.com n97b76fk87g@nameprivacy.com admin@lilaussieprems.com jkcghygwr@whoisprivacyprotect.com do Verisign do Verisign a3 5yx3bg2hcnameprivacy.com m-renewals@register.com m-renewals@register.com admin@overseedomainmanagement.com do Verisign do Verisign almonarion@rocketmai I .com do Verisign hostmaster@above.com d97f84nn9rg@nameprivacy.com bx7g476c6svnameprivacy.com

infector infector infector

19

947. 948. 949. 950. 951. 952. 953. 954. 955. 956. 957. 958. 959. 960. 961. 962. 963. 964. 965. 966. 967. 968. 969. 970. 971. 972. 973. 974. 975. 976. 977. 978. 979. 980. 981. 982. 983. 984. 985. 986. 987. 988. 989. 990. 991. 992. 993. 994. 995. 996. 997. 998. 999.

lra7nef.com lsthupsocdbncgnn.net ltdstar. corn Iucascattientop.corn Iucassfield.com Iuckystrikeo.com ludos-apparare.corn Iunedesign.corn Ivgdsuirnvkxpugro.corn rnanageality.com manageient.corn rnanageity.com rnanageium.com rnanagenetwor.com rnartinololo.corn mastersili.com mastik756bombastik 1 2.corn rnatdugt4 .com materryon.corn mateurner.com rnatoroad.corn matoway.corn mctgyvj mcktrnvsw.net meandyounow.net meazeridashloc.corn mediacoif.com medlya.corn meinliffenetbizcornzz.corn melbarnb.com meligarm.com mentripete.com meslefot.com metabolez.corn mhjgptzoirgklhhm.com mijningeu.corn minienenl.com minollumentlynx.com misskissoftheryear.net misternet.corn mjmaatrnandesigns.com mmskwgowxpgtwt.com moderheitrack.com mofogglsinxslc.com rnoksdog.com moksfin.com mokshark.com moneancens.com mpykgsrhnpitng.com rnqjmusjopkvugnu.com rnsrrevukwitsgpog.com rntufxdylzvomnub.net rnuieptbass.corn mumbaiescortsdirectory.com

dropzone dropzone, infector dropzone updater updater updater source ernbeddedjs dropzone, infector source source source embeddedjs updater dropzone dropzone updater dropzone dropzone dropzone infector infector dropzone, source, infector dropzone updater infector, source dropzone dropzone, infector, updater dropzone dropzone updater dropzone dropzone, infector dropzone, source, infector embeddedjs ernbeddedjs updater dropzone source dropzone dropzone, source, infector updater dropzone, infector infector infector infector dropzone dropzone, infector dropzone, infector dropzone, infector dropzone, infector dropzone source

repossesseddomain@godaddy.com rf7ph2w73fw@nameprivacy.com admin@ltdstar.com do Verisign do Verisign gmvjcxkxhs@whoisservices.cn 8n6ptzvk7oky5psll7ik@f.o-w-o.info Iunedesign@mailti.corn kh3te68h3rnxnarneprivacy.com accounting@rnoniker.com boogievoogieoscar@ymail.com boogievoogieoscaryrnaiI.corn jz95p5cw76d@nameprivacy.com do Verisign admin@ikeainyourrnindgiraf.com contactzinkho1e.org russellimbat@yahoo.com adrninoverseedomainrnanagement.com do Verisign do Verisign huIigatoryahoo.com) hul igator@yahoo.com sw5ct9bh7sg@nameprivacy.com bill@haiau.tv do Verisign Iu1ucutemaiI.org chris.deak1e82@ymai1.com nsrmregister.com do Verisign meligarm@yahoo.com do Verisign perolsp@yahoo.com admin@macro-store.com k86c98xv6bxnameprivacy.com zilvinasbutkus@hotrnail.com info@minienenl.com do Verisign binder@haiau.tv contactprivacyprotect.org rnjmaatmandesignsgmail.com wrn6vn79m42s(narneprivacy.com do Verisign k3 5hx8dk6nc(nameprivacy.com floweflyer@ymail.com floweflyer@ymail.com f1oweflyeryrnaiI.com do Verisign reasonhickeyyahoo.com t5 7hy5u68dr(nameprivacy.com rn3 g264z34h@nameprivacy.com xy96g63g6synameprivady.com admin@muieptbass.com baby@baby.com

20

1000. 1001. 1002. 1003. 1004. 1005. 1006. 1007. 1008. 1009. 1010. 1011. 1012. 1013. 1014. 1015. 1016. 1017. 1018. 1019. 1020. 1021. 1022. 1023. 1024. 1025. 1026. 1027. 1028. 1029. 1030. 1031. 1032. 1033. 1034. 1035. 1036. 1037. 1038. 1039. 1040. 1041. 1042. 1043. 1044. 1045. 1046. 1047. 1048. 1049. 1050. 1051. 1052.

musesguad.com mutanisopendsie.com muticeptad.com muvpihoovdgvyzh.net muzwniltlrpgmpn.com mvdj egonofivwurr.com mvuuorhghofwmu.net myescortsdirectory.com myhandsareveryfying.com mynettube.net myrtlebeachscreenprinting.com mysubmissionservice.com naberlin.net nacha-ach.com nacha-achalert.com nacha-advertisement.com nacha-alarm.com nachabank-users.com nachabank-usertools.com nacha-cashier.com nachaclientsinfo.com nacha-comparison.com nacha-cosm.com nacha-creditor.com nacha-customer.com nachacustomer-alarm.com nacha-customereguipment.com nachacustomer-news .com nacha-customertools.com nachadata-alarm.com nachadataallocation.com nachadatafile.com nachadepartment.com nachaemployee.com nacha-eguipmentstore.com nacha-feedback.com nacha-files.com nacha-industry.com nachainfo-store.com nacha-info-store.com nacha-instructionsuser.com nachanewsarchive.com nacha-news-archive.com nacha-news-download.com nacha--news-download.com nachanewsportal.com nachanews-portal.com nacha-newsportal.com nacha-news-portal .com nacha-news--portal.com nachaorgcompany.com nacha-plex.com nachaport.com

infector updater updater dropzone, dropzone, dropzone, dropzone, source dropzone source source source dropzone, source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source

infector source, infector source, infector infector

source, infector

accountingmoniker.com do Verisign do Verisign wc2ve8y48hv@nameprivacy.com mg8ka9m235j@nameprivacy.com gc2bg2669pw@nameprivacy.com fraserafricayahoo.com bhupendraacharya@gmail.com adminikeainyourmindgiraf.com sngll_orhnn@hotmail.com beachscreenprint@aol.com webmanil@gmail.com gmvjcxkxhs@whoisservices.cn nacha-ach.com@contactprivacy.com pilomakkie@yahoo.com caillet.victoria@yahoo.com nacha-alarm.com@privacy.above.com nachabank-users.com@contactprivacy.com nachabank-usertoo1s.comcontactprivacy.com markskinner56@yahoo.com Iizbethguerrero75@yahoo.com floechristine@yahoo.com info@premiumregistrations.com do Verisign nacha-customer.com@privacy .above.com katherinebannan@yahoo.com pancharlene@yahoo.com nachacustomer-news .com@privacy. above.com oyerdarrell@yahoo.com nachadata-alarm.com@contactprivacy.com nachadataallocation.com@contactprivacy.com dohertysean20yahoo.com gametzip3456@yahoo.com segueiral@rocketmail.com pdustin6 1 @yahoo.com edwincabrera5 5 @Yahoo.com contact@myprivateregistration.com info@premiumregistrations.com kiflombirhane@rocketmail.com baomat@dichvubaomattenmien.vn gphsrywymtwhoisprivacyprotect.com miche11ebyrne96yahoo.com keisergIenyahoo.com caro1.brooks85@yahoo.com walshshirla@yahoo.com admin@overseedomainmanagement.com nachanews-portal.com@contactprivacy.com nacha-newsporta1.comcontactprivacy.com j avaruskij ames@yahoo.com ty1erme1anie47@yahoo.com baomat@dichvubaomattenmien.vn info@premiumregistrations.com arcosmarilyn@yahoo.com

21

1053. 1054. 1055. 1056. 1057. 1058. 1059. 1060. 1061. 1062. 1063. 1064. 1065. 1066. 1067. 1068. 1069. 1070. 1071. 1072. 1073. 1074. 1075. 1076. 1077. 1078. 1079. 1080. 1081. 1082. 1083. 1084. 1085. 1086. 1087. 1088. 1089. 1090. 1091. 1092. 1093. 1094. 1095. 1096. 1097. 1098. 1099. 1 100. 1101. 1102. 1 103.

nacha-port.com nachaportal.com nacha-portal.com nachaportalserver.com nacha-portal-server.com nacha-rejectedalert.com nachareport.com nacha-report-downlod.com nacha-reporte.com nacha-reports-domain .com nacha-reportslink.corn nachaserverportal.corn nachaserver-portal.com nacha-server-portal.com nachasfast-eguiprnent.corn nacha-shire.corn nachasnewsportal.com nachas-portal.corn nachasuser-alarrn.corn nacha-transferreport.com nacha-urgent-portal.corn nachauser-account.corn nacha-userauthorization.com nachauser-banktools.com nacha-userbudget.com nachauser-budgetinfo.com nacha-usercommission.com nachauser-equipment.corn nachauser-estirnatefee.com nachauser-feedback.com nachauserinfo.corn nachauser-info.com nacha--user--news.com nachausers-account.corn nacha-usersalarm.corn nachausersalert.corn nachausers-bank.com nacha-users-bank.corn nachausersbluebook.corn nachausers-book.com nachausers-industry.corn nacha-users-info.corn nachauser-storeinfo.corn nachausers-wirecosts.corn nachauser-tools.com nacha-wirecosts.com napieriarjoumals.com nastysrnell.com nationalcity.corn neoprenant.corn neoprenhopper.corn

source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source embeddedjs source source

miIdredeileensparks@yahoo.com marissawienhold@yahoo.com pau1peffottayahoo.com nachaporta1server.com@privacy.above.com butlersteve93 @yahoo.com contact@myprivateregistration.com edpwzqbdl3jdafk6xe 1 xkvffOwlhzzuvwbflqdufs eb 1 cfa1k@nachareport.com carcinogenicwashingtonum@yahoo.com alberta.burke@yahoo.com nacha-reports domain.comcontactprivacy. corn contact@rnyprivateregistration.corn loita 1 0@yahoo.corn nachaserver-portal.corn@privacy.above.com nacha-server-portal .corn@privacy.above.corn Iong.erik53yahoo.com cvarker@ymail.com infoprerniurnregistrations.corn regina1dsanders86@yahoo.com nei11rn68@yahoo.com contact@rnyprivateregistration.corn paulbrinkley39@yahoo.corn aida_fairman(yahoo.com henricksonselena@yahoo.corn nachauser-banktoo1s.corncontactprivacy.com dianegibson29@yahoo.corn jarneswagoner49yahoo.com raynor charles@yahoo.corn nachauser eguiprnent.corncontactprivacy.com edwardsrandy93 @yahoo.com j im80murfuf@yahoo.com christopherharms 1 7@yahoo.corn marydurand 1 4@yahoo.corn charlarichins@yahoo.corn wxcbshvb@whoisprivacyprotect.com delgadoclaro@yahoo.com susanswanson5 1 @yahoo.corn nachausers-bank.com@contactprivacy.com nacha-users-bank.com@contactprivacy.com shoernakerjames88@yahoo.corn witherspoonfranklin@yahoo.corn robertson.sandra70@yahoo.corn augustinecontreras@yahoo.com j erry1ynnhinnantjryahoo.corn vogelsongjosh@yahoo.com nachauser-tools.com@contactprivacy.com flaglerjairneyahoo.com contact@privacyprotect.org prizak@grnail.com billing@pnc.com neoprenant.com@domainsbyproxy.com neoprenhopper.corn@privacy.above.com

22

1 104. 1 105. 1 106. 1107. 1108. 1109. 1 1 10. 111 1. 1 112. 1 113. 1 114. 1 115. 1116. 1 1 17. 1 1 18. 1 1 19. 1 120. 1121. 1122. 1123. 1 124. 1 125. 1 126. 1 127. 1 128. 1129. 1130. 1131. 1 132. 1133. 1 134. 1 135. 1 136. 1 137. 1 138. 1 139. 1140. 1 141. 1 142. 1143. 1 144. 1 145. 1 146. 1 147. 1 148. 1 149. 1150. 1151. 1152. 1153. 1 154. 1155. 1156.

neoprenpillar.com nernnkkgxrns.com neropisap.corn neweuropeconsult.com newhachainfogetnow.corn newsfig.corn newsnachausers.corn nexusworldnet.com nhknrwuoozndnv.com nholnwtyjrdctjr.com nightycrowlingninjas.corn nilsgrietctyed.corn nkktgggtjundslp.corn nrnhutixnfriondpo.net nnpijflsoflcnlkx.com nongoonis.com northdakotastatesite.com norwitols.com novodebt.com novodebt.net npxwzlxvrzsxhox.com nrrstlgxovkkdc.corn nsnwrspvpghtnwp.corn nssbc-security.cc nvfogwtptkvheh.com nwtispzwpgotek.corn nylon-kingdom.com nyrtsvlcijtsoiog.com oceanmindmore.corn okivoob.corn oldgraber.com onefrpliteztnh.net onespointheadia.com onlineshop24blog.com opionisao.corn oralania.com osforpvglmpiujm.corn ouopdvzwbjflgozo.net ouovoswgogngrpg.com ovokslvgpwonrww.com p3736t6oa.com p3a32rltp.com p3a372rtp.corn p3a377rtp.com p3o3676oa.corn p3o36t6oa.com p3o38t6oa.com p9a372rtp.corn p9o36t6oa.corn pa37rtp.com padesionittatu.corn palaksi.net palonit.corn

source dropzone, source, infector dropzone dropzone source dropzone source embeddedjs dropzone, infector dropzone, infector dropzone updater dropzone, infector dropzone, source, infector dropzone, infector dropzone dropzone dropzone dropzone dropzone dropzone, infector dropzone, infector dropzone, infector ernbeddedjs dropzone, infector, source dropzone, infector dropzone dropzone, infector dropzone, source, infector infector dropzone dropzone, infector updater source dropzone dropzone dropzone, infector dropzone, infector dropzone, source, infector dropzone, source, infector dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone updater dropzone source

do Verisign wh6ar6z58hn@nameprivacy.com contactprivacyprotect.org fau1kner28@yahoo.com paulbrinkley6 1 @yahoo.com whois@bluehost.com crandellgeorge@yahoo.com ejeyty1aogiyahoo.com do Verisign wv4k596n5se@nameprivacy. corn admin@weknewthatallthetime.com braginikolaj@yandex.com x73v27rf67z@narneprivacy.com vf5vt9yz384@nameprivacy.com bx7g476c6sv@narneprivacy.com do Verisign citrads@grnail.com do Verisign anatoliylis@yahoo.com anatoliylis@yahoo.com do Verisign mv6sg27r5st@narneprivacy.com x73v27rf67z@nameprivacy.com felice@mailti.com ns5 m23 ur84w@narneprivacy. corn rf7ph2w73fw@nameprivacy.com webmaster@nylon-kingdom.corn js5gx56c7w8@nameprivacy.corn purvikanji@yrnail.com adrnin@naliora.com the.rnalware.cabal@gmail.com y687276j9vh@nameprivacy.com do Verisign do Verisign contact@privacyprotect.org chris.deak1e82@ymai1.com arnadeus_logan@yahoo.com hy4r394j6ja@nameprivacy.corn v gg6k45nc366nameprivacy.com cr65g2ap483@nameprivacy.com do Verisign do Verisign do Verisign do Verisign do Verisign do Verisign do Verisign do Verisign do Verisign do Verisign do Verisign do Verisign adrnin@nalioran.com

23

1157. 1 158. 1159. 1 160. 1161. 1162. 1163. 1 164. 1165. 1 166. 1 167. 1168. 1169. 1 170. 1171. 1 172. 1173. 1 174. 1175. 1176. 1177. 1 178. 1 179. 1 180. 1 181. 1182. 1183. 1184. 1 185. 1 186. 1187. 1188. 1189. 1190. 1191. 1 192. 1 193. 1194. 1195. 1 196. j 197. 1198. 1199. 1200. 1201. 1202. 1203. 1204. 1205. 1206. 1207. 1208. 1209.

panamachnlms.com parofin.com pasazz.net patrogualarva.com pc4hita.com peindlsadesk.com pending-payment.com perisoneterts.com perveneratio.com pganalytics.net phasefines.com photalegraza.com picassoss.net pinkhatbackup.com pinkmite.com pintamierback.com pirjjsggpmnomxs.com planeostsguavep.com planevipescort.com platinumhd.tv plhypjumukjupk.com plwfrygvhvoiuyr.com pnltknsxsswzkku.net po3t6oa.com pofikpofikfikfik.com pofikpofikfikfik0.com pofikpofikfikfikl.com pofikpofikfikfik2.com pofikpofikfikfik3 .com pofikpofikfikfik4.com pofikpofikfikfik5.com pofikpofikfikfik6.com pofikpofikfikfik7.com pofikpofikfikfik8.com pofikpofikfikfik9.com pontuviewer.com pooletyleyep.com poptarinto.com pornxyx.com portalnachas.com portsterba.com potixmssufuur1.com pgoixuzoaxolmof.net ppugvsssgniwpy.net primedyl.com proaxistherapy.com projens.com promoshuffle.com pszwxwuyyhmktouj net pultaine.com pupikola.com pvhweoj smnnpgov.com pxpnksrwogmjzotk.com

embeddedjs embeddedjs updater updater dropzone dropzone source updater source dropzone, source, infector dropzone updater dropzone dropzone infector updater dropzone, infector updater infector source dropzone, source, infector dropzone, infector dropzone, source, infector dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone embeddedjs dropzone embeddedjs dropzone, updater source dropzone dropzone, source, infector dropzone, infector dropzone, source, infector dropzone, updater updater dropzone source dropzone, infector dropzone dropzone dropzone, source, infector dropzone, infector

admin@panamachnlms.com contact@privacyprotect.org Pasazz.net@domainsbyproxy.cco do Verisign repossesseddomain@godaddy.com IiberraIgmaiI.com pending-payment.com@contactprivacy.com do Verisign Ihenderson@gt.rr.com admin@macro-store.com do Verisign photalegraza.com@privacy.above.com bill@haiau.tv the.malware.cabal@gmail.com cadacadabun@yahoo.com do Verisign u583p92r8uv@nameprivacy.com do Verisign mckeesummon@yahoo.com linda.dlementsplatinumhd.tv dd3t93pu55u@nameprivacy.com dt6gh2wj339@nameprivacy.com d38679a55tn@nameprivacy.com do Verisign gmvjcxkxhs@whoisservices.cn do Verisign admin@pofikpofikfikfikl.com admin@pofikpofikfikfik2.com pofikpofikfikfik3.com@contactprivacy.com do Verisign do Verisign the.ma1ware.cabaIgmai1.com do Verisign do Verisign do Verisign js7oz4o4ea6938faa70cocijij874d9300d54bd9 5 .privatewhois.net do Verisign ylynokybeduresal@yahoo.com ybxrncdvsy@whoisprivacyprotect.com adminoverseedomainmanagement.com do Verisign zm4j68ftn3ze@nameprivacy.com x73v27rf67z@nameprivacy.com y687276j9vh@nameprivacy.com admin@primedyl.com maveridkg@maveridkgarrett.com venubrgmai1.com promoshuffle.comdomainsbyproxy.com c/o Verisign do Verisign do Verisign rd9cp4t73 dgnameprivacy.com epossesseddomain@godaddy.dom

24

1210. 121 1. 1212. 1213. 1214. 1215. 1216. 1217. 1218. 1219. 1220. 1221. 1222. 1223. 1224. 1225. 1226. 1227. 1228. 1229. 1230. 1231. 1232. 1233. 1234. 1235. 1236. 1237. 1238. 1239. 1240. 1241. 1242. 1243. 1244. 1245. 1246. 1247. 1248. 1249. 1250. 1251. 1252. 1253. 1254. 1255. 1256. 1257. 1258. 1259.

pxtnbziashnulfgu.com pygmance.com ghumrnslklxtixrv.com glxrxjoegppwir.com gnvryoduntlmlj .com gpmuggpddrpghkf.com gtmjwghrgmloamt.com gualitta.com guantraxactor.com guickreportnacha.com quick-report-nacha.com guiverain.com guivercove.com guiverforge.com guiverform.com guiversea.com guiverwave.com gulghpiomuvltp.com gwdxkgpcwpolrlrh.com gwhmtksyglohccxk.net gxpmprccrajhxtt.com gzltljpkrvrndtwg.net racindo.com ragsmile.com ragsmog.com ragsmoke.com ragsmug.com ragsnake.com ragsnip.com ragsnipe.com ragsnub.com randomawdowibda.com randomawidnao.com randomnamefordomain I .com raz43op.com rcktigotpsulzlz.net rcspknmpzgmkufiiI.net readmedocument83 .com recavatech.com recellhelsen.com reetexista.com reflectivelayer.com rejectedach-report.com rekgbepytokpfol.com relationshipamersoftwarevu.com rembranddt.com repetitirovnet.net report-007298492us.com report-nacha.com reportnachaapprove.com

dropzone, dropzone dropzone, dropzone, dropzone, dropzone, dropzone, source updater source source

infector infector infector infector source, infector infector

infector source infector infector infector infector dropzone, infector dropzone, infector dropzone, infector dropzone, infector embeddedjs dropzone source source source source source source source source dropzone dropzone dropzone dropzone dropzone, source, infector dropzone, infector dropzone updater updater updater source source dropzone, infector dropzone dropzone dropzone source source source

em4xy6bx7a7@nameprivacy.com do Verisign amadeus_1oganyahoo.com yt8ng93c3tb@nameprivacy.com f868g9ck5pk@nameprivacy.com y77jc7ys7xp@nameprivacy.com ea4cy5zc9n8@nameprivacy.com soporte@mindsetco.com do Verisign googlprofil@yahoo.com 1 vcipylzyybogifsml27kvbk4ubd59t2llpga7x 1 z bvxgebno@guick-report-nacha.com guivertip@rocketmail.com guivertip@rocketmail.com guivertip@rocketmail.com guivertip@rocketmail.com hostmaster@above.com guivertiprocketmai1.com uz9u78n867p@nameprivacy.com dd3t93pu55unameprivacy.com hy4r394j6ja@nameprivacy.com vv73 a9jm5wh@nameprivacy.com exytihazonacyahoo.com do Verisign finkka@verizon.net finkka@verizon.net finkka@verizon.net RAGSMUG.COM@domainsbyproxy.com do Verisign 9178ko4f2ab5db9ff67@w86bna54f2 1 bffa2ffd 1. privatewhois.net hostmaster@word.net whois@fastdomain.com dmin@randomawdowibda.com admin@randomawdowibda.com p3u2mpj4f23c3aeb29ad@w86bna54f2 1 bffa2ff dl .privatewhois.net do Verisign bx7g476c6sv@nameprivacy.com g856y7f88nz@nameprivacy.com admin@readmedocument83 .com do Verisign do Verisign do Verisign dexnet@dextech.com Iuticeferrio@yahoo.com rf7ph2w73fw@nameprivacy.com repossesseddomain@godaddy.com bill@haiau.tv ch5m6hg4f2be56c3d025w86bna54f2 1 bffa2ff dl .privatewhois.net infopremiumregistrations.com contact@myprivateregistration.com info@premiumregistrations,com

25

1260. 1261. 1262. 1263. 1264. 1265. 1266. 1267. 1268. 1269. 1270. 1271. 1272. 1273. 1274. 1275. 1276. 1277. 1278. 1279. 1280. 1281. 1282. 1283. 1284. 1285. 1286. 1287. 1288. 1289. 1290. 1291. 1292. 1293. 1294. 1295. 1296. 1297. 1298. 1299. 1300. 1301. 1302. 1303. 1304. 1305. 1306. 1307. 1308. 1309. 1310. 131 1.

reports-federalreserve.com reports-info.com reportsnacha.com reports-nacha.com reservedomain.com resolym.com restramerer.com rghnyofujngggejw.com rheady.com rhunseal.com rjrgkzujejjpfg.com rksiujowplkkovgk.com rkwvnrgrpigymvj .com rmhkrrufvxjoznp.com rmoytrpxmloeogk.com rmsjsuhunyj ivg.com mmnmupcijzipxip.com rolermpyhvnnrhp.com rollingthemydicenetbe.com romario279.com runtroadeatb.com rwmxtdoleguwoyop.net ryljzfinxdmgrpfog.net rzvggoiglpnpkln.com s0ndell.net sa67634dt.com sa69634dt.com sa6n634dt.com sa6n884dt.com sa7n634dt.com sackbatfish.info sadclapped.com sadjumped.com sadlooked.com sadmissed.com safeinetscripts.net safesaction.com sahhosse.com saldchwetheach.com saln634dt.com san34dt.com santeconference.com rouxiety.com royhnngrumycgtg.com rrhxilokmjytnlmy.com rrvnxnoiefttgrw.net rshgaohvmgrkfo.com rumbt.com rumbt.net sardballierman.com sausandergere.com saxtumi.com

source source source source updater dropzone dropzone dropzone, infector dropzone dropzone dropzone, infector dropzone, infector dropzone, infector embeddedjs dropzone, infector dropzone, source, infector dropzone, infector dropzone, infector updater dropzone updater dropzone, source, infector embeddedjs dropzone, infector dropzone dropzone dropzone dropzone dropzone dropzone dropzone source source infector source dropzone embeddedjs embeddedjs updater dropzone dropzone source dropzone dropzone, source, infector dropzone, infector dropzone, infector dropzone, infector dropzone dropzone updater updater dropzone

1oresriasyahoo.com reports-info.com@contactprivacy.com ronaldfedders@yahoo.com rckjv82i68uomyhltkydzqm2ytan8dxaykcv8xb 1 hyz3 5 ifewreports-nacha.com.whoisproxy.org 09520379481034a5d04a@whoisprivacyservices.com.au plvhghgyhd@whoisprivacyprotect.com do Verisign ea4cy5zc9n8@nameprivacy.com do Verisign admin@rhunseal.com thurmanpang@yahoo.com k87td33t8xf@nameprivacy.com do Verisign erivegutixo@yahoo.com vf5vt9yz384@nameprivacy.com a35yx3bg2hc@nameprivacy.com dt6gh2wj339@nameprivacy.com uvitydareganyha@yahoo.com lauraboschetti@aol.com romariodonate@hotmail.com do Verisign do Verisign exytihazonacyahoo.com do Verisign admin@sOndell.net do Verisign do Verisign do Verisign do Verisign richardpa1mer90yahoo.com do Verisign sadc1apped.comdomainsbyproxy.com bibermootymai I .com bibermootymaiI.com bibermoot@ymail.com adminsecwaystorage.net vinovao@yahoo.ca Reactivation-Pendingenom.com do Verisign do Verisign do Verisign santeconference.com@domainsbyproxy.com do Verisign n63pv6wx9jg@nameprivacy.com do Verisign yj55n8hw5nb@nameprivacy.com exorbitantbonilla@yahoo.com anatoliylis@yahoo.com anatoliylis@yahoo.com admin@sardballierman.com marlenehobsbawm@live.co.uk do Verisign

26

1312. 1313. 1314. 1315. 1316. 1317. 1318. 1319. 1320. 1321. 1322. 1323. 1324. 1325. 1326. 1327. 1328. 1329. 1330. 1331. 1332. 1333. 1334. 1335. 1336. 1337. 1338. 1339. 1340. 1341. 1342. 1343. 1344. 1345. 1346. 1347. 1348. 1349. 1350. 1351. 1352. 1353. 1354. 1355. 1356. 1357. 1358. 1359. 1360. 1361. 1362. 1363.

schoolboygetout.com sciteleganal.com scgnipltesymwgn.net sddkoios.com secariadna.com secstat.com secur3storag3 .com secure-cibc.com securedfrag888.com secureloggin.net secureweb5ervice5 .net securewebtests.com securictychecking.com securitylkins.com securitywebguard.com secwaystorage.net seg-opalesl.net senstonymy.com senvironment.com sepnower.net seguruty.com serlene.com setteredradi.com shgkgwgkls.com shipportlise.com silvarnetinn.com simontfica.com skinze.com skjbsldkjksthu.com slgorykvknmerkz.com sludential.com sneckstrumo.com sntdr-services.cc so47nop.com soa4gol.com softmarketvalu.com softmarketvalue.com softthrifty.com somanyontion.com somebackupdomain 123 .com sonnersbale.com sop3not.com sorbentoig.com sotkmncij eoxgllun.com spectums.com splashnetcombizauron.com splatsplit.com splatspunk.com splatstamp.com sgoajponbtekil.com sgrzdjjwmlvger.net sgwed.net

infector updater dropzone, infector dropzone embeddedj s embeddedjs dropzone embeddedjs updater embeddedjs dropzone embeddedjs embeddedjs embeddedjs embeddedjs dropzone dropzone updater embeddedj s embeddedjs embeddedjs dropzone dropzone dropzone updater updater updater dropzone dropzone dropzone, infector embeddedjs updater embeddedjs dropzone dropzone embeddedjs embeddedj s embeddedjs updater dropzone dropzone dropzone updater dropzone, infector dropzone dropzone, source, infector, updater infector infector source dropzone, infector dropzone, infector dropzone

gxwx9ur4f2be5929d2e4w86bna54f2 I bffa2ff dl .privatewhois.net do Verisign hostmaster@above.com sdfgsdfghfmsn.com admin@overseedomainmanagement.com contact@privacyprotect.org b63498l5@k1z1k.com jwcashergmaiI.com andpushon@hotmail.com admin@secureloggin.net admin@secwaystorage.net falkenstire@yahoo.com admin@securictychecking.com justinporten@yahoo.com admin@security-defense.com adminsecwaystorage.net do Verisign do Verisign snvironment@mail.com perolsp@yahoo.com angelasavina@yahoo.com gmvjcxkxhswhoisservices.cn do Verisign Iiberral@gmail.com do Verisign do Verisign do Verisign jtmdrwze@gmail.com Iiberra1gmaiI.com dt6gh2wj339@nameprivacy.com admin@sludential.com do Verisign do Verisign kristynlauner@yahoo.com nyenaiwilIiams@yahoo.com do Verisign kovic26gmai1.com me1odimatkovic26gmai1.com do Verisign admin@somebackupdomain 123 .com gmvj cxkxhs@whoisservices.cn jaffemizell@yahoo.com zanuidaaa@yahoo.com cz99x6ay7h2@nameprivacy.com meromax@online.ua albana1iajl6@yahoo.com support@name.com hostmaster@word.net klausstork@earthlink.net yj55n8hw5nb@nameprivacy.com do Verisign perolsp@yahoo.com

27

1364. 1365. 1366. 1367. 1368. 1369. 1370. 1371. 1372. 1373. 1374. 1375. 1376. 1377. 1378. 1379. j 380. 1381. 1382. 1383. 1384. 1385. 1386. 1387. 1388. 1389. 1390. 1391. 1392. 1393. 1394. 1395. 1396. 1397. 1398. 1399. 1400. 1401. 1402. 1403. 1404. 1405. 1406. 1407. 1408. 1409. 1410. 1411. 1412. 1413. 1414. 1415. 1416.

srepolik2o.com srimeenakshiagencies.com srgirlswrglcmr.net srztrvrrnomsuyzp.net sshwklwjen.corn ssl-autoris.corn stamperglut.corn standinghost.com startalertmos.corn startancientrnos.corn statosonline.net stattime.net sterientai.corn sterijncornpan.com sticumed.corn strohertinzeocornne.corn stylendeco.com suitionsaway.com sukablyatimes.com sunageoshighvi.corn sunaitenprin.com sustadodo.com svistoklex.corn swsskhpwcgzskn.corn sybilladi.com sythpvoxjztvgp.corn t3a3dor.com t3os7pt.corn ta4n6ar.com takers.aaa 1 -news.net takethatasano.com talettedible.corn tbrntwulmmswpxzi.corn teerersoru.com teleation.corn telelope.com telemonors.corn teleoso.com telephonemeonmyphone.corn temptypath.com teggernsccgblrmi.com terabitscenter.cn.com tfogtwprtlupgcup.com the557sdeee.com the557sdeee0.com the557sdeee I .corn the557sdeee2.corn the557sdeee3.com the557sdeee4.com the557sdeee5 .com the557sdeee6.corn the557sdeee7.corn the557sdeee8.corn

dropzone source dropzone, infector dropzone, infector, source dropzone embeddedjs dropzone embeddedjs infector infector ernbeddedjs embeddedjs dropzone updater dropzone dropzone, infector, updater source updater source updater dropzone dropzone dropzone dropzone, infector dropzone dropzone, infector dropzone dropzone dropzone dropzone dropzone updater dropzone, source, infector dropzone infector infector source infector source dropzone dropzone, infector updater dropzone, infector dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone

contact@privacyprotect.org klrnn.rnohan@gmail.com ts8fh4bw89r@nameprivacy.com do Verisign Iiberra1gmaiI.com voffchih@yandex.ua do Verisign gmvjcxkxhs@whoisservices.cn accounting@rnoniker.com rornewarior@yrnail.corn adrnin@statosonline.net adrnin@stattirne.net do Verisign do Verisign do Verisign carminatirnarina@yahoo. it hs1ee0220@yahoo.com do Verisign krishnamistry73@yahoo.com do Verisign the.rnaIware.cabaIgrnai1.com do Verisign contact@privacyprotect.org vS 6dt2ey98unarneprivacy.com do Verisign wv4k596n5se@nameprivacy.com do Verisign titus.christopher@yahoo.com do Verisign craigtrexm&keting.co.za adrnin@weknewthatallthetirne.com do Verisign do Verisign do Verisign hobbitgodymaiI.corn hobbitgod@ymail.corn hobbitgodymaiI.corn hobbitgod@ymail.corn adrnin@telephonerneonrnyphone.com do Verisign a37zk7bv7v3@nameprivacy.com Iivemetal88@hotrnail.corn do Verisign admin@the557sdeee.corn do Verisign adrnin@the557sdeee 1 .com the.rna1ware.cabaIgmai1.corn do Verisign do Verisign the.rnalware.cabal@gmail.corn do Verisign do Verisign do Verisign

28

1417. 1418. 1419. 1420. 1421. 1422. 1423. 1424. 1425. 1426. 1427. 1428. 1429. 1430. 1431. 1432. 1433. 1434. 1435. 1436. 1437. 1438. 1439. 1440. 1441. 1442. 1443. 1444. 1445. 1446. 1447. 1448. 1449. 1450. 1451. 1452. 1453. 1454. 1455. 1456. 1457. 1458. 1459. 1460. 1461. 1462. 1463. 1464. 1465. 1466. 1467. 1468. 1469.

the557sdeee9.com theavtechs.com theimageshare.com themextoneter.com thesoftcheap.com throatylot.com timandjenny.com tlurionwxgynem.net tngvtxvwmkhirmfk.com tnogypxnyijgyiss.net to365mo.com to3rtol.com toobershmui.cjb.net toplaitit.com tpaprhttltpust.com tpsuyknjrhxwswp.com tgullogrypweghgj.com transersouthyouth.com transfer-canceled.com transfers-ach.com trawwers.comlu.com tremunicu.co tripolefourgaz.com trucktrumpet.com trucktugboat.com trucktulip.com trucktwirl.com truckunzip.com trupledoublehardcore.com truwothvwslmsiv.com tskktvrxjsgopgo.com ttgtwmittvsgapo.com tubehub.net tuzhjntonrszdews.net tweetwinner.com twistloft.com twistplex.com typggjhpjrotegi.net tywinderdamaku.com tzmaxi.com ufrlmukngyvopf.com uhahaka.com uhnuomrrxqjsth.com uitgfowjrhwtrzkx.com ukrainewskill.com uljnnlhshkhlkdt.com ulowzvirxysntmyn.com umwmpwulypvudok.com undercovermimimi.com uosvzyppolgpjmgl.net uptonxtwealth.com urbantoprtunitiesforme.com ursubstootin.com

dropzone updater dropzone updater embeddedjs dropzone updater dropzone, infector dropzone, source, infector dropzone, infector dropzone dropzone dropzone embeddedjs dropzone, infector dropzone, source, infector dropzone, infector infector source source dropzone dropzone dropzone infector source infector source source source dropzone, infector dropzone, infector dropzone, infector dropzone dropzone, infector source source source dropzone, updater dropzone dropzone, dropzone, dropzone, dropzone, updater dropzone, dropzone, dropzone, dropzone dropzone, source source dropzone

infector

infector source, infector source, infector infector infector infector source, infector source, infector

do Verisign theavtechs.com@domainsbyproxy.com dns@videotron.ca do Verisign me1odimatkovic26@gmai1.com do Verisign infogoIdencarat.com w72p35dd5tt@nameprivacy.com hy4r394j6ja@nameprivacy.com eguilateralfranklin@yahoo.com do Verisign do Verisign cjb@cjbmanagement.com bet222wingmaiI.com mx6np6jy4dc@nameprivacy.com do Verisign mclainfibrosis@yahoo.com mckeesummon@yahoo.com derewsater@yahoo.com dstvpbwbr@whoisprivacyprotect.com awexhostprince.com do Verisign adminikeainyourmindgiraf.com marvoIgmx.net annie@dentand.com riverrat@rochester.rr.com trucktwirl.com@privacy.above.com hostmaster@word.net adminjajahbinksdiesforyou.com d97f84nn9rg@nameprivacy.com f76ah7cb472@nameprivacy.com wm6vn79m42s@nameprivacy.com dean@lakefrontmedia.net k87td33t8xf@nameprivacy.com support@neturf.com rmzf5vi4f25da87bd976@w86bna54f2 1 bffa2ffd 1 .privatewhois.net twistp1ex.comdomainsbyproxy.com k35hx8dk6nc@nameprivacy.com do Verisign do Verisign w72p35dd5tt@nameprivacy.com admin@uhahaka.com de69d4d63er@nameprivacy.com xy96g63g6sy@nameprivacy.com d/O Verisign kh3te68h3mx(nameprivacy.com yj 55n8hw5nbnameprivacy.com mw73n8ed7n4nameprivacy.com adminikeainyourmindgiraf.com k63 we9nm3yxnameprivacy.com uptonxtwgmaiI.com admin@jajahbinksdiesforyou.com do Verisign

29

1470. 1471. 1472. 1473. 1474. 1475. 1476. 1477. 1478. 1479. 1480. 1481. 1482. 1483. 1484. 1485. 1486. 1487. 1488. 1489. 1490. 1491. 1492. 1493. 1494. 1495. 1496. 1497. 1498. 1499. 1500. 1501. 1502. 1503. 1504. 1505. 1506. 1507. 1508. 1509. 1510. 1511. 1512. 1513. 1514. 1515. 1516. 1517. 1518. 1519. 1520.

urtlhcpdotfrkxp.net usa-itunes.com us-ccsecurity.com us-credit-security.com userbrick.com userdata-distribute.com userinfo-nacha.com usemacha-alarm.com usernacha-bills.com usernacha-wireinfo.com usersea.com utugkoykmwjguzg.com uvxzzkspgxfgp1s.com uxgpvcmogxyutkp.net uzkrtoomtnjpohn.com vacantitechip.com valuetory.com var3 57.com varioldinnics.com vasexzl fhjklwa.com vasexzfhjklwa.com vavasasvb 1 klwa.info vavvb 1 klwa.com vcstiturnediana.com veandlifronanonetwceg.com vegatorkspeps.com vemaxxlionna.com veonset.com veriary.net veroabelos0.com vesryop.com vetrucomneticejestreg.com vfrgsiekewtckden.com vibeapnesbu.com victori I .net viewcheapetsways.com viewediesolver.com viewfdiccustomer.com vigetectrockset.com vikingwer5 .com vincent-world.com vipplacetv.com virgull.com vivaforelifenetcombie.com vizonix.com vjzljyvmvghflrjl.com vkrrllufgweinm.net vpxguhxtxhngrfirig.com vgitgvunhrevlso.com vgpfnhspltysgejg.com vgwp1eyyxjhxgri.com

dropzone, infector source source source source source source source source source embeddedjs dropzone, infector dropzone, infector dropzone, infector dropzone, infector updater infector embeddedjs updater dropzone dropzone dropzone dropzone updater updater updater updater dropzone infector dropzone dropzone updater dropzone, infector updater dropzone embeddedjs updater source updater dropzone source infector dropzone updater source dropzone, dropzone, dropzone, dropzone, dropzone, dropzone, infector infector, source infector infector infector infector

cb3mu9k97eu@nameprivacy.com marina.santa13@yahoo.com infopremiumregistrations.com infopremiumregistrations.com caprimai113.com userdata_distribute.com@contactprivacy.com richardmeggersyahoo.com tahboub_m(yahoo.com infopremiumregistrations.com info@premiumregistrations.com bunts@fxmail.net dt6gh2wj339@nameprivacy.com jr7v53ge4pk@nameprivacy.com rd9cp4t73dg@nameprivacy.com kh3te68h3 mx@nameprivacy.com do Verisign jorimelodey@yahoo.com contactmyprivateregistration.com do Verisign j .c.angeldeath@ymail.com j .c.angeldeath@ymail.com do Verisign j .c.angeldeath@ymail.com vcstiturnediana.com@privacy.above.com do Verisign do Verisign do Verisign admin@naliora.com j essemccurdy@yahoo.com guiz@mailae.com perolsp@yahoo.com paolosassi7 I (yahoo.com wv4k596n5se@nameprivacy.com do Verisign admin@victoril.net af32tgf4ea693903 5bd3ocijij874d9300d54bd9 5.privatewhois.net do Verisign llekperic@yahoo.com do Verisign salts@mailti.com kasinakosfine@yahoo.com pau1acobb56(yahoo.com jhnvns.92@googlemail.com vivaforelifenetcombie.com@domainsbyproxy.c om gu79p6a88z8networkso1utionsprivateregistra tion.com contact@privacyprotect.org do Verisign screechydorsey@yahoo.com dt6gh2wj339nameprivacy.com wv4k596n5se@nameprivacy.com z34jb9zq2a5@nameprivacy.com

30

1521. 1522. 1523. 1524. 1525. 1526. 1527. 1528. 1529. 1530. 1531. 1532. 1533. 1534. 1535. 1536. 1537. 1538. 1539. 1540. 1541. 1542. 1543. 1544. 1545. 1546. 1547. 1548. 1549. 1550. 1551. 1552. 1553. 1554. 1555. 1556. 1557. 1558. 1559. 1560. 1561.

vrgoryutlgnjpod.com vrkmifksfogungwu.com vulxkncvstfukrow.com vvxriolskjgrsrs.net wantpint.com waweaime.com wealthnxtreimbursement.com wealthnxtupdate.com webjanse.com weddingbee.com weighan.com westansgualiti.com westarray.com westdirect.net westemunlon.net westwiserce.com wgewygkn.com whatixemieldin.com wheredoyouplayloveme.com whitemite.com white-shopping.com whole-saIe2Oll.com wickissievele.com winlaps.net wmmwempyjpgymfl.net womidfer.com wonderchat.net wonderfulworn.com wonderfulwreath.com wonderfulwrench.com wonderfulyard.com wrmultsorgrjsolp.com wtugiwwgsskojuft.com wviosppfhslgyyvn.com wvzvdjbgpigpg.net atlas57.com backorderru.com france-facebook.com h2024700065 .com kwalai.com nacha-rejected.com

dropzone, infector dropzone, infector dropzone, infector dropzone, source, infector dropzone dropzone, updater updater infector source dropzone dropzone updater infector, source dropzone source updater dropzone updater dropzone, infector, updater infector dropzone dropzone, source, infector updater dropzone, source, infector dropzone, infector dropzone dropzone, infector source source source source dropzone, source, infector dropzone, infector embeddedjs dropzone, source, infector dropzone, updater dropzone, updater dropzone, infector, updater updater source source

visitus@bitandjazzdanceclub.com b52fp2gw5ys@nameprivacy.com d67rg3d97jp@nameprivacy.com k87td33t8xf@nameprivacy.com the.ma1ware.caba1gmai1.com admin@waweaime.com do Verisign do Verisign newdomains@siteground.com mknapp@internetbrands.com do Verisign do Verisign kitkatwilou@yahoo.com atticcutemai1.org westernunlon.net@privacy.aboab.com do Verisign contact@privacyprotect.org do Verisign pescifabio83@yahoo.fi hexagenoidyahoo.com visco1asgmai1.com real.host50@yahoo.com c/o Verisign gmvjcxkxhs@whoisservices.cn rf7ph2w73fw@nameprivacy.com abc1234@gg.com admin@macro-store.com wonderfu1worn.com@privacy.above.com coortus@t-onhine.hu hostmaster@word.net lacq 1 ud4f08896 1 d534d@oqj ij874d9300d54bd 95 .privatewhois.net a86afSue8ca@nameprivacy.com benavideseuripides(yahoo.com exytihazonacyahoo.com pt8gt97u8x5@nameprivacy.com random68@live.com contactPrivacyProtection.org delcore@gcn.cx H2024700065 .COMdomainsbyproxy.com msoeyahoo.fr frt57pmkq4fiu7sslywrvoallyyzd8fiTlegonkpawn nx05ky0c@nacha rejected.com.whoisproxy.org do Verisign su3tc7gw94s@nameprivacy.com cgecexq4f3e77 1 37f2ab@w86bna54f2 1 bffa2ffd 1 .privatewhois.net ea4cy5zc9n8@nameprivacy.com r793d9ww3fr@nameprivacy.com u65dt7g82a7nameprivacy.com dt6gh2wj339@nameprivacy.com

1562. 1563. 1564. 1565. 1566. 1567. 1568.

wznrifvicsipbmnv.com xndmnoj imsojgx.net xpadv.net xpousnnulhihoer.com xprlxottijelpvl.com xviadovj lyhltry.com xxvwinjgarjrnw.com

dropzone, infector dropzone, infector embeddedjs dropzone, dropzone, dropzone, dropzone, infector infector source, infector infector

31

1569. 1570. 1571. 1572. 1573. 1574. 1575. 1576. 1577. 1578. 1579. 1580. 1581. 1582. 1583. 1584. 1585. 1586. 1587. 1588. 1589. 1590. 1591. 1592. 1593. 1594. 1595. 1596. 1597. 1598. 1599. 1600. 1601. 1602. 1603. 1604. 1605. 1606. 1607. 1608. 1609. 1610. 161 1. 1612. 1613. 1614. 1615. 1616. 1617. 1618. 1619. 1620. 1621.

yazarcanyucel.com yettaillarfic.com yftuomlonknooigt.net yinrhuwgpftnscvf.com you-ach-report.com younggirlsdomovie.com younona.com yournachareport.com your-nacha-report.com ypggwphsfjinogau.com ypghrijclijnnoyg.net yregmst.com ytmvsfsijnxjnm.net ytpseigmednislds.com ywilkswylnvufje.net ywtgytkejnke.com zauxszgulsxryw.com zfpvulogppyymwuf.com ziiditnmcmlvjp.net zjhwjnpkxgtj lgg.com zj snoklkbethgkpt.com zkggrwspdxuuprcm.net zooourglprftvgkd.com zgffthhnuivonkz.net zgnirpgupugmksng.com zuvgpugmmmgrdskd.com zxyopetnzktkknd.com zzgpmmzspzrtzood.com 12300291 5.cn.com 423654m.cn.com 90fd78b9078bd0g.com 98DFGR994883798df.com googiezuju.com accoukierlism.com achecad.com achyroransib.com activedent.net advdomain.com aeractraspac.com aeronitrex.com akronisltd.com alconichill.com alI-nacha-datainfo.com amberschool.com amberschool2.com amersterin.com analyticdns.com angebrethetcombiznet.com anissaeve.com answertels.com antiglobalgg.com antiglobalgg2.com antisorit.cn.com

source dropzone, updater dropzone, infector dropzone, source, infector source dropzone dropzone source source dropzone, infector dropzone, source, infector embeddedjs dropzone, infector dropzone, infector dropzone, source, infector dropzone dropzone, source, infector dropzone, source, infector dropzone, source, infector dropzone, infector, source dropzone, source, infector dropzone, source, infector dropzone, source, infector dropzone, source, infector embeddedjs dropzone, source, infector dropzone, infector dropzone, infector infector, dropzone infector, dropzone infector, dropzone infector, dropzone infector updater dropzone updater infector, dropzone updater updater infector infector updater infector infector, dropzone infector, dropzone updater infector, dropzone updater infedtor dropzone dropzone, source, infedtor updater infector, dropzone

bjk_habibe_22@hotmai1.com repossesseddomain@godaddy.com do Verisign do Verisign stevecremers@yahoo.com mantaphosting@gmail.com contactprivacyprotect.org melissaarnott93 @yahoo.com boggskarla@ymail.com do Verisign tu2f838h73z@nameprivacy.com contact@myprivateregistration.com vv73a9jm5wh@nameprivacy.com kh3te68h3mx@nameprivacy.com do Verisign 1iberraIgmai1.com sw5ct9bh7sg@nameprivacy.com cr65g2ap483 @nameprivacy.com gv9st8nk4ka@nameprivacy.com am9zr2ng3p8@nameprivacy.com armeniangillespie@yahoo.com k86c98xv6bx@nameprivacy.com k87td33t8xf@nameprivacy.com e255f24x5pb@nameprivacy.com exytihazonacyahoo.com do Verisign yj55n8hw5nb@nameprivacy.com ch67e4ve6tz@nameprivacy.com Iivemeta188@hotmai1.com Iivemeta188@hotmai1.com oi@ppmail.ru jenny@fxmail.net liuwei1000@gmai1.com do Verisign keys@fxmail.net do Verisign achuleta_salomon@yahoo.com info@advdomains.com do Verisign aeronitro@ymail .com jcv_s@yahoo.com do Verisign crysto1wiedemanyahoo.com a1isonspencer95@yahoo.com brooksal1en71@yahoo.com repossesseddomain@godaddy.com dfghrterhotmai1.com do Verisign Of9ecd 1 40a 161 2330b42 1 f33ef9ffae5@domain disdreet.com admin(answerte1s.com zhongguancunyahoo.com do Verisign 1ivemeta188hotmaiI.com

32

1622. 1623. 1624. 1625. 1626. 1627. 1628. 1629. 1630. 1631. 1632. 1633. 1634. 1635. 1636. 1637. 1638. 1639. 1640. 1641. 1642. 1643. 1644. 1645. 1646. 1647. 1648. 1649. 1650. 1651. 1652. 1653. 1654. 1655. 1656. 1657. 1658. 1659. 1660. 1661. 1662. 1663. 1664. 1665. 1666. 1667. 1668. 1669. 1670. 1671. 1672. 1673. 1674.

anualiverk.corn aptitude.name aguaedition.com aguajaunt.com aguaskiff.com aguasrc.com ariodtalk.com articityxpagua.com assmitizeree.com astrawebservice.com asus7.com atlancentuage.com au-business-customer.com audubideonetity.com avectintemottis.com guizclub.net rollingthemydicenetbe.com secstat.com sepnower.net sludential.com springautumnemetbiz.corn sgwed.net teamten.net vesryop.com yagijakes.com youthinktoolovenotneco.com level-3 .net edge02.net core02.net basedmarket.com basic-auth.com battlewright.com bespar.net bestlongnet.net bestvideoworld.com betswinstrategy.cn.com betterheousermy.com biggestcoin.com biggestfunds.com billycheerful.com billyd.com.au bisiteles.com bisonbuy.com blackbuckseri.com blogoettindia.com blueberrymo.com boatorldenoras.com borsteksavalu.com hppp:// 173.44.34.1 84/el/loadlload.exe tolbargueries-google2.net bestlongnet.net retyuloploples.net retyuloploples.net

updater infector, dropzone infector infector dropzone infector infector dropzone, source, updater updater infector updater updater infector updater updater dropzone dropzone, infector, source embeddedjs embeddedjs embeddedjs updater dropzone updater dropzone dropzone updater dropzone dropzone dropzone dropzone, infector embeddedjs dropzone infector dropzone, infector dropzone, infector dropzone, infector updater dropzone dropzone infector infector dropzone infector infector updater updater dropzone, source, updater updater

anual iverk.com@domainsbyproxy.com contact@privacyprotect.org domains@netfirms.com barrnintual@ymail.com barmintual@ymail.com barmintual@ymail.com adminvistapromb1og.com alanmcwilliams@live.co.uk assmitizeree.com@privacy.above.com astrawebgmai1.com gmvjcxkxhs@whoisservices.cn do Verisign kro1ando26@yahoo.com do Verisign do Verisign zealot@mai113.com lauraboschetti@aol.com contact@privacyprotect.org perolsp@yahoo.com admin@sludential.com do Verisign perolsp@yahoo.com vomit@mai113.com peroIsp@yahoo.com do Verisign Iauraboschetti@aol.com contact@myprivateregistration.com perezbrittany93@yahoo.com ada.shapiro@yahoo.com swansonjudy83@yahoo.com admin@basic-auth.com howellinsuperable@yahoo.com mousavisepehr@yahoo.com d0g0r0ngmai1.com contact@myprivateregistration. corn livemeta188@hotrnai1.com do Verisign gogofreeze@hushmail.com gogofreezehushmai1 .com do Verisign do Verisign hobbitgod@yrnail.com gvgkggrsm@whoisprivacyprotect.com seamy@mai113.com do Verisign blueberryrno.com@privacy.above.com repossesseddomain@godaddy.com borsteksavalu.com@privacy.above.com sysop@iptelligent.com vshostmasterverisign.com d0g0r0ngrnai1.com d0g0r0n@gmai1.com d0g0r0n@gmai1.com

33

1675. 1676. 1677. 1678. 1679. 1680. 1681. 1682. 1683. 1684. 1685. 1686. 1687. 1688. 1689. 1690. 1691. 1692. 1693. 1694. 1695. 1696. 1697. 1698. 1699. 1700. 1701. 1702. 1703.

tynegertyonioloki.net esterraspa.com savetimeon.com sdfkj348923r1 131 .com fds323rwe48237rhkaj .com 11 l32erfw23rwqasdfd.com asiasoniconline.com sdflcjkfdsklf34j348 .com fds32jflcwj43rewf3r.com 1 ll32erfw23rjkvsdf.com justbigtoyss.net downloadertempfWl.net savetimeforyoulife20 1 1 .net freejumpcomptell.com freesecuritychecknarne.net alabamaislandsfree.net asiasoniconline.com sdtkjkfdsklf34j348.com fds32jflcwj43rewf3r.com lll32erfw23rjkvsdf.com asiasoniconline.com sdfkjkfdsklf34j348.com fds32jfkwj43rewf3r.com lll32erfw23rjkvsdf.com ksljdfka23 .com sjxu297x-a.com yho-fman-ce-update.com g297xx-n.com tronopays.com

vshostmasterverisign.com webmaster@sunstream.com tswzyyx4f2 1 e8 I bead5f@w86bna54t2 I bffa2ffd 1 .privatewhois.net vshostmaster@verisign.com brianbrodyjr@yahoo.com 11 132erfw23rwqasdfd.comdomainsbyproxy. corn superpuper56@yahoo.com atlon_atlon@yahoo.corn vshostmaster@verisign.com atlon_atlon@yahoo.corn doughertyj32yahoo.com atlon_atlon@yahoo.com atlon_atlon@yahoo.com atlon_atlon@yahoo.corn atlon_atlon@yahoo.com atlon_atlon@yahoo.com superpuper56yahoo.com atlon_atlon@yahoo.com vshostmasterverisign.com atlon atIonyahoo.com superpuper56@yahoo.com atlon_atlon@yahoo.corn vshostmaster@verisign.com atlon_atlon@yahoo.corn biI1hrodriguez18423grnai1.corn vshostmaster@verisign.com vshostmaster@verisign.com vshostmasterverisign.com bobgolfsen@yahoo.corn

34

National Internet Exchange of India 5th Floor, Incube Business Centre, 18, Nehru Place New Delhi Delhi 110 019 India Afihias Limited CIO Afihias USA, Inc. 300 Welsh Road, Building 3 Suite 105 Horsham, PA 19044 United States
1704. 1705. 1706. 1707. 1708. 1709. 1710. 171 1. 1712. 1713. 1714. 1715. 1716. 1717. 1718. 1719. 1720. 1721. 1722. 1723. 1724. 1725. 1726. 1727. 1728. 1729. 1730. 1731. 1732. 1733. 1734. 1735. 1736. 1737. 1738. 1739. 1740. 1741. 1742. Harmful Botnet Domain Name prodano.in abrakadabradomen000.in abrakadabradomen00 1 .in poydun.in massa 195 .in testofiesto0.in hullamulla.in trackerlohaaa.in astaloscojonesback.net.in ipwnbotsforfun.net.in pacman.net.in pacmanback.in indietours.in indietours.net. in indietoursbck. in indietoursbck.net.in indietoursbckl.in indietoursbck2.in getwolrdnewsfast.in bhbhbhaa6536.in pppllllmdkjt2.in kasoblanka.in zabaz.in coltrc.in domennow.in yferro.in googlemaster92 1203. in itismybestsite2277.in itismybestsite2323 .in itismybestsite23 77.in kjrldsghslekjhgl.in mybackdomain8732.in mybackdomain8733.in mylifieissogood.in supportonline-posta.in shopsoft.in cOr3 .in milloneti.net.in alibabadropshipping.in TVDe dropzone, infector dropzone dropzone source dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone embeddedjs dropzone dropzone embeddedjs infector infector infector infector dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone embeddedjs dropzone dropzone dropzone, updater embeddedjs Whois Email Address shishakov@inbox.ru donalbreen456@yahoo.com donalbreen456@yahoo.com global_76@mail.ru abuseriiditenahuy@gmail.com abuseriiditenahuy@gmail.com abuseriiditenahuy@gmail.com abuseriiditenahuygmail.com nemesysnice.tld do Afilias g4hosting@safe-mail.net do Afilias adrian4love(ymail.com do Verisign adrian4love@ymail.com do Afihias do Afihias do Afilias dickensextrovert@yahoo.com abuseriiditenahuygmai1.com abuseriiditenahuygmail.com a1banovsergeyyahoo.com global 76@mail.ru cryasanmail.ru cryasanmail.ru cryasanmail.ru admin@contentserver.ru do Afilias admin@contentserver.ru do Afilias do Afilias admin@contentserver.ru do Afilias admin@contentserver.ru rsfallonMcdowell@yahoo.com swpower@gmail.com dragan.plavsic9 1 @live.com g4hosting@safe-mail.net donalbreen456@yahoo.com

35

1743. 1744. 1745. 1746. 1747. 1748. 1749. 1750. 1751. 1752. 1753. 1754. 1755. 1756. 1757. 1758. 1759. 1760. 1761.

itismybestsite. in itismybestsitel 1 1 .in itismybestsite222.in itismybestsite333.in itismybestsite444.in postepaysystem.in adoult-zonasjk.in myjabba.in myjabbaer.in myjabbaerer.in serpentarikn.in serpentarin.in wallswayl 5 .in zazazar.jn slonoboy.in garik-m. in joumalmy.in kurpin.in yellowpageschennai.in

dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone source source source source source source source

admin@contentserver.ru admin@contentserver.ru do Afilias do Afilias do Afihias admin@contentserver.ru do Afihias franklinsheena@yahoo.com c/o Afihias do Afihias pro@postingscript.com pro@postingscript.com luckyluc@mail.ru 1abasonovamai1.ru albanovsergey@yahoo.com albanovsergey@yahoo.com labasonova@mail.ru a1931190@jnxjn.com thegreenvision@yahoo.in

36

DotAsia Organisation Ltd. 15/F, 6 Knutsford Terrace Tsim Sha Tsui Kowloon Hong Kong
1762. 1763. 1764. 1765. 1766. 1767. 1768. 1769. 1770. 1771. 1772. Harmful Botnet Domain Name achnachajoumaldownload.asia ach-nacha-report-downloadshop.asia achnacharevjewfiledownloacl.asja bestach-nacha-report-download.asia mynacha-filereport.asia nachafilereport.asia nacha-filereportonline.asia nacha-filereportsite.asia nacha-filereportstore.asia newnacha-filereportasia theach-nacha-report-download.asia Type source source source source source source source source source source source Whois Email Address timsmith(astro-tek.com timsmith@astro-tek.com timsmith@astro-tek.com timsmith@astro-tek.com timsmith@astro-tek.com timsmithcastro-tek.com timsmith@astro-tek.com timsmith@astro-tek.com timsmith@astro-tek.com timsmith@astro-tek.com timsmith@astro-tek.com

.CO Internet S.A.S. Calle 100 8 A 49 Torre B of 507 Bogota Colombia

-

NeuStar, Inc. 21575 Ridgetop Circle Sterling, VA 20166 United States NeuStar, Inc. Loudoun Tech Center 46000 Center Oak Plaza Sterling Virginia 20166 United States
1773. 1774. 1775. 1776. 1777. 1778. 1779. 1780. 1781. 1782. 1783. 1784. 1785. 1786. 1787. 1788. 1789. 1790. 1791. 1792. 1793. 1794. 1795. 1796. 1797. 1798. 1799. 1800. 1801. 1802. 1803. 1804. Harmful Botnet Domain Name betterheousermy.co blogoettindia.co boatorldenoras.co borsteksavalu.co thernextoneter.co tywinderdamaku.co ukrainewskill.co vacantitechip.co varioldinnics.co vcstiturnediana.co vegatorkspeps.co vemaxxlionna.co yettaillarfic.co guantraxactor.co recavatechco recellhelsen.co reetexista.co runtroadeatb.co saldchwetheach.co sardballierman.co sausandergere.co senstonymy.co shipportlise.co silvarnetinn.co simontfica.co sneckstrumo.co somanyontion.co sterijncompan.co suitionsaway.co sunageoshighvi.co talettedible.co photalegraza.co Type updater updater updater updater updater updater updater updater updater updater updater updater updater updater updater updater updater updater updater updater updater updater updater updater updater updater updater updater updater updater updater updater do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar Whois Email Address

38

1805. 1806. 1807. 1808. 1809. 1810. 181 1. 1812. 1813. 1814. 1815. 1816. 1817. 1818. 1819. 1820. 1821. 1822. 1823. 1824. 1825. 1826. 1827. 1828. 1829. 1830. 1831. 1832. 1833. 1834. 1835. 1836. 1837. 1838. 1839. 1840. 1841. 1842. 1843. 1844. 1845. 1846. 1847. 1848. 1849. 1850. 1851. 1852. 1853. 1854. 1855. 1856. 1857.

padesionittatu.co patrogualarva.co perisoneterts.co pintamierback.co planeostsguavep.co vibeapnesbu.co viewediesolver.co vigetectrockset.co westansgualiti.co westwiserce.co whatixemieldin.co wickissievele.co managenetwor.co meazeridashloc.co mentripete.co minollumentlynx.co moderheitrack.co mutanisopendsie.co muticeptad.co onespointheadia.co holmancybeac.co ignarysama.co inforksonseia.co intelinellouse.co interponsseella.co invetechinte.co jambsulumency.co jellabillat.co jobinedianingfo.co kenamersoftvu.co killdfymerrague.co kristradentro.co lekhausurex.co Ieopodentargit.co Iiviarylink.co Iocaresplicutl.co Iorevingbranta.co Iucascattientop.co Iucassfield.co gavildippurum.co gertyphacgueier.co globridolumet.co gramablessatro.co grounaxyxin.co hoffhiarketraph.co fiboxencercha.co finewcreautomp.co foolieracceiv.co forviclemo.co copelixell.co conwortonnent.co creamottonovati.co cryogiwogater.co

updater updater updater updater updater updater updater updater updater updater updater updater updater updater updater updater updater updater updater updater updater updater updater updater updater updater updater updater updater updater updater updater updater updater updater updater updater updater updater updater updater updater updater updater updater updater updater updater updater updater updater updater updater

do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar

39

1858. 1859. 1 860. 1861. 1862. 1863. 1864. 1865. 1866. 1867. 1868. 1 869. 1870. 1871. 1872. 1873. 1874. 1875. 1876. 1 877. 1 878. 1879. 1 880. 1881. 1882. 1883. 1884. 1885. 1886. 1887. 1888. 1889. 1890. 1891. 1892. 1893. 1894. 1895. 1896. 1897. 1898. 1899. 1900. 1901. 1902. 1903. 1904. 1905. 1906. 1907. 1908. 1909. 1910.

cuficellimaad.co cumberiangle.co cyberistrolax.co dasyucorbit.co dempeighternya.co denitraspetr.co deratirelcomni.co deressenwarpol.co doutektronumni.co ebuityketfinus.co eguildaycock.co eponamindranthe.co eunitynewgbc.co evraffeyplings.co exedrinsteadna.co brigatexgluc.co bryandsighter.co celeguidictor.co chbytechipemen.co chetteaditas.co accoukierlism.co achyroransib.co aeractraspac.co alconichill.co alederpe.co amersterin.co andeena.co annadiat.co anualiverk.co armrena.co artechellirat.co articityxpagua.co assmitizeree.co ataghty.co atlancentuage.co auchaulu.co audubideonetity.co avaintellegeron.co avectintemottis.co babical.co beregg.co berrat.co betterheousermy.co blogoettindia.co boatorldenoras.co bobetic.co borsteksavalu.co bottler.co brigatexgluc.co bryandsighter.do bulingelah.co bullfot.co bundhaker.co

updater updater updater updater updater updater updater updater updater updater updater updater updater updater updater updater updater updater updater updater updater updater updater updater dropzone updater dropzone dropzone updater dropzone updater updater updater dropzone updater dropzone updater updater updater dropzone dropzone dropzone updater updater updater dropzone updater dropzone updater updater dropzone dropzone dropzone

do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar

40

1911. 1912. 1913. 1914. 1915. 1916. 1917. 19 18. 1919. 1920. 1921. 1922. 1923. 1924. 1925. 1926. 1927. 1928. 1929. 1930. 1931. 1932. 1933. 1934. 1935. 1936. 1937. 1938. 1939. 1940. 1941. 1942. 1943. 1944. 1945. 1946. 1947. 1948. 1949. 1950. 1951. 1952. 1953. 1954. 1955. 1956. 1957. 1958. 1959. 1960. 1961. 1962. 1963.

cantailya.co carratina.co cashlitype.co cavient.co celeguidictor.co chbytechipemen.co chetteaditas.co cocklemili.co collex.co collowesto.co conwortonnent.co coolityle.co coopese.co cootterian.co copelixell.co coreamesents.co cothonal.co creamottonovati.co criterage.co crosco.co cryogiwogater.co cuficellimaad.co cyberistrolax.co dasyucorbit.co cumberiangle.co dempeightemya.co denitraspetr.co deratirelcomni.co deressenwarpol.co detindi.co doutektronumni.co dwomanti.co ebuityketfinus.co eguildaycock.co eineep.co encyte.co eponamindranthe.co emesti.co eunitynewgbc.co evraffeyplings.co excelat.co exedrinsteadna.co exogael.co explogu.co fantasynche.co fiboxencercha.co finewcreautomp.co globridolumet.co gertyphacgueier.co foolieracceiv.co forviclemo.co gagenpau.co gavildippurum.co

dropzone dropzone dropzone dropzone updater updater updater dropzone dropzone dropzone updater dropzone dropzone dropzone updater updater dropzone updater dropzone dropzone updater updater updater updater updater updater updater updater updater dropzone updater dropzone updater updater dropzone dropzone updater dropzone updater updater dropzone updater dropzone dropzone dropzone updater updater updater updater updater updater dropzone updater

do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar c/o NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar

41

1964. 1965. 1966. 1967. 1968. 1969. 1970. 1971. 1972. 1973. 1974. 1975. 1976. 1977. 1978. 1979. 1980. 1981. 1982. 1983. 1984. 1985. 1986. 1987. 1988. 1989. 1990. 1991. 1992. 1993. 1994. 1995. 1996. 1997. 1998. 1999. 2000. 2001. 2002. 2003. 2004. 2005. 2006. 2007. 2008. 2009. 2010. 201 1. 2012. 2013. 2014. 2015. 2016.

gramablessatro.co grounaxyxin.co grumner.co guessounthu.co gulabill.co heavykyly.co hektary.co hildarchi.co hoffmarketraph.co holmancybeac.co hydrole.co ignarysama.co jacketerer.co ileenyet.co incrence.co ineniali.co inesilk.co inesmate.co inforksonseia.co intelinellouse.co interponsseella.co inthou.co invetechinte.co iranitereno.co jambsulumency.co jectoral.co jellabillat.co jellotr.co jobinedianingfo.co katussi.co judithri.co kenamersoftvu.co kiHdfimerrague.co kindjin.co kristradentro.co Iekhausurex.co Ieopodentargit.co Ieverry.co Iiviarylink.co Iocaresplicutl.co Iorevingbranta.co Iucascattientop.co Iucassfield.co Iuristri.co managenetwor.co manillack.co manmark.co mannieda.co measubstomy.co meazeridashloc.co mentripete.co millewine.co minollumentlynx.co

updater updater dropzone dropzone dropzone dropzone dropzone dropzone updater updater dropzone updater dropzone dropzone dropzone dropzone dropzone dropzone updater updater updater dropzone updater dropzone updater dropzone updater dropzone updater dropzone dropzone updater updater dropzone updater updater updater dropzone updater updater updater updater updater dropzone updater dropzone dropzone dropzone dropzone updater updater dropzone updater

do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar c/o NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar

42

2017. 2018. 2019. 2020. 2021. 2022. 2023. 2024. 2025. 2026. 2027. 2028. 2029. 2030. 2031. 2032. 2033. 2034. 2035. 2036. 2037. 2038. 2039. 2040. 2041. 2042. 2043. 2044. 2045. 2046. 2047. 2048. 2049. 2050. 2051. 2052. 2053. 2054. 2055. 2056. 2057. 2058. 2059. 2060. 2061. 2062. 2063. 2064. 2065. 2066. 2067. 2068. 2069.

moderheitrack.co mulleril.co mutanisopendsie.co muticeptad.co nedataryjosc.co onespointheadia.co openity.co padesionittatu.co pandidarma.co patrogualarva.co pederm.co perisoneterts.co phimore.co photalegraza.co pintamierback.co pistonlover.co planail.co planeostsguavep.co primasc.co pucessop.co guantraxactor.co recavatech.co recellhelsen.co reetexista.co rosellewe.co rozencess.co runtroadeatb.co saldchwetheach.co salterembl.co soupchi.co sardballierman.co sausandergere.co sciteleganal.co senstonymy.co shalyxiard.co shawler.co shipportlise.co shutiary.co silvametinn.co smagogre.co sneckstrumo.co simontfica.co snowser.co somanyontion.co sterijncompan.co stourangebo.co suitionsaway.co sument.co sunageoshighvi.co talettedible.co tallyso.co tantainie.co tegony.co

updater dropzone updater updater dropzone updater dropzone updater dropzone updater dropzone updater dropzone updater updater dropzone dropzone updater dropzone dropzone updater updater updater updater dropzone dropzone updater updater dropzone dropzone updater updater updater updater dropzone dropzone updater dropzone updater dropzone updater updater dropzone updater updater dropzone updater dropzone updater updater dropzone dropzone dropzone

do NeuStar do NeuStar do NeuStar c/o NeuStar c/o NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar c/o NeuStar do NeuStar do NeuStar do NeuStar c/o NeuStar do NeuStar do NeuStar c/o NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar

43

2070. 2071. 2072. 2073. 2074. 2075. 2076. 2077. 2078. 2079. 2080. 2081. 2082. 2083. 2084. 2085. 2086. 2087. 2088. 2089. 2090. 2091. 2092. 2093. 2094. 2095. 2096. 2097. 2098. 2099. 2100. 2101. 2102. 2103. 2104. 2105. 2106. 2107.

thernextoneter.co toonereretry.co tornallogue.co tourinathol.co turbiculu.co turpipeltim.co twalliar.co tywinderdamaku.co ukrainewskill.co urerariece.co vacantitechip.co varioldinnics.co vcstiturnediana.co vegatorkspeps.co vemaxxlionna.co veratedra.co vibeapnesbu.co viewediesolver.co vigetectrockset.co westansgualiti.co westwiserce.co whatixemieldin.co wickissievele.co wriereging.co yettaillarfic.co accoukierlism.co achyroransib.co aeractraspac.co alconichill.co amersterin.co anualiverk.co artechellirat.co articityxpagua.co assmitizeree.co atlancentuage.co audubideonetity.co avaintellegeron.co avectintemottis.co

updater dropzone dropzone dropzone dropzone dropzone dropzone updater updater dropzone updater updater updater updater updater dropzone updater updater updater updater updater updater updater dropzone updater updater updater updater updater updater updater updater updater updater updater updater updater updater

do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar

44

NeuStar, Inc. 21575 Ridgetop Circle Sterling, VA 20166 United States NeuStar, Inc. Loudoun Tech Center 46000 Center Oak Plaza Sterling Virginia 20166 United States
2108. 2109. 21 10. 21 1 1. 2112. 21 13. 2114. 2115. 21 16. 21 17. 21 18. 2119. 2120. 2121. 2122. 2123. 2124. 2125. 2126. 2127. 2128. 2129. 2130. 2131. 2132. 2 133. 2134. 2135. 2136. 2137. 2138. 2139. 2140. 2141. 2142. 2143. 2144. 2145. 2146. 2147. Harmful Botnet Domain Name ogocbgmmmnnjzg.biz petroleumgroup.biz wdoygoxnmmrlgyot.biz roobshall.biz seoengine.biz snaretrace.us snaretrack.biz snarework.us hoycktsjwgsmklnv.biz iesnare.us ilovekeks.biz lwbbtfrtjjsyksl.biz njxnerslmmvpyto.biz dasad4 I da4safasdasd2 I .biz executivesuites.us faasppouk.biz apricot-fresh.us avocado-fresh.us bannersurvey.biz beaverday.biz bfhognbpunvgymd.biz blackcurrant-free.us bgrbhtwvrykrsyl.biz cprmhmttslomusm.biz cherry-free.us carbossa.biz clfuhmciswossut.biz goojeojohegbnx.biz go6po.biz egpnhotnhnvsfeus.biz executivesuites.us giyieggwwxiro.biz gxdmmspexrtooes.biz gxxlzrylggplvpnp.biz gywsglihvdleyupu.biz helpsupport.biz hrllmdklzoigxywn.biz hmngkmoyhmmoynz.biz hvlpmopbnutrciju.biz hxvluohophnnse.biz Type infector infector infector dropzone, infector dropzone, source dropzone, infector dropzone, infector dropzone, infector infector dropzone, infector dropzone, infector infector infector dropzone, infector updater dropzone, infector dropzone dropzone embeddedjs source dropzone, infector dropzone dropzone, infector dropzone, infector dropzone embeddedjs dropzone, infector dropzone, source, infector dropzone, source dropzone, infector updater dropzone, infector dropzone, infector dropzone, infector dropzone, infector updater, dropzone dropzone, infector dropzone, infector dropzone, infector dropzone, source, infector Whois Email Address es73z29g2m5@nameprivacy.com petroleumgrroup@yahoo.com drawnmccoy@yahoo.com contactwebdomainsbyproxy.com gmvjcxkxhs@whoisservices.cn dunn.doug1as24@yahoo.com jitchikoff@yahoo.com portelIkathyyahoo.com arellanoteasel@yahoo.com dadasd 1231 dadsadasda@yahoo.com glaseranne(yahoo.com are1lanotease1yahoo.com arellanoteasel@yahoo.com domain.tech@yahoo-inc.com enmemai1foryou.com tgwg-uanic(priv.uanic.ua himacss@yandex.ru himacss@yandex.ru bannersurvey.biz@domainsbyproxy.com spruebeattyyahoo.com lang1eyinexpiab1eyahoo.com himacssyandex.ru d448j8f25nx@nameprivacy.com ge4nx92w6rk(nameprivacy.com himacssyandex.ru admin@carbossa.biz downingcineramayahoo.com rd9cp4t73dgnameprivacy.com abcnamecompanygmail.com d97f84im9rg@nameprivacy.com enm@emailforyou.com rh6fk9xv2g5@nameprivacy.com wm6vn79m42s@nameprivacy.com yj55n8hw5nb@nameprivacy.com z34jb9zg2a5nameprivacy.com xabkdanripl@whoisservices.cn contact@privacyprotect.org do NeuStar d97f84nn9rgnameprivacy.com reasonhickey@yahoo.com

45

2148. 2149. 2150. 2151. 2152. 2153. 2154. 2155. 2156. 2157. 2158. 2159. 2160. 2161. 2162. 2163. 2164. 2165. 2166. 2167. 2168. 2169. 2170. 2171. 2172. 2173. 2174. 2175. 2176. 2177. 2178. 2179. 2180. 2181. 2182. 2183. 2184. 2185. 2186. 2187. 2188. 2189. 2190. 2191. 2192. 2193. 2194. 2195. 2196. 2197. 2198. 2199. 2200.

ijogjpkdprgpsugn.biz injruhjxrntccrut.biz ipcohyjqjxlmmtgs.biz jfvpgxvywordryr.biz ixkgojregupooitp.biz izknfgnsrvmvswuh.biz jctozilnwnwutgf.biz jmgvtnkjgtzglij .biz jptptmlpgnzdnpl.biz jslpfnsrsmngsvl.biz kiwslglkjvntt.biz kkksvmrsyxfvj.biz korpupnpnghjvvk.biz kyupjxrwpwxmrgn.biz lastking.biz lcocnvxlpkokso.biz lwgltmttgujtf5cg.biz Izrfudhklvocwo.biz mass-money-makers.us mnrpxtmkkwmilig.biz mnxpeejxpvwrhkrm.biz mcvogncggnmzowno.biz mcvogncggnmzowno.biz mlhnxglrghycorl.biz mpnweiuongwwrsmg.biz mshtgghttopdon.biz mtlrnsfbhukaj.biz nacha-reports.us pnjnopugsdkg.biz nnkpwsnovpsptl.biz ntfgzoeywg irupfitbiz ntvwooywivrkcnn.biz nzfv1ftthenmygh.biz nzvgksojootbmzk.biz oeypjdcijnncrkwd.biz ofuvjtxplutlxccr.biz oltgugnneowyolh.biz onikyhljniporunk.biz onpglbpkkyfxspr.biz orjvswjonrrksn.biz oymgseiwtolsoog.biz pdupvzgwlngw.biz pnmlpmgzztvugfrt.biz pvg1rzjzfj ipksp.biz pzfcvgwvg1yyksjp.biz gisgmckijfictgzf.biz gmgomrppninyuls.biz gmypbeggvgxeanu.biz gpfhrnsmycglujs.biz ggmypinpiwywnkg.biz groslnnklpmcrmor.biz gymvlgijnppjugv.biz rbnsngiyukmkrg.biz

dropzone, source, infector dropzone, infector dropzone, infector dropzone, infector dropzone, infector dropzone, infector dropzone, source, infector dropzone, infector dropzone, source, infector dropzone, infector dropzone, infector dropzone, infector dropzone, infector dropzone, infector source dropzone, source, infector dropzone, infector dropzone, infector source dropzone, infector dropzone, infector dropzone, infector source dropzone, infector dropzone, source, infector dropzone, infector dropzone, infector source clropzone, infector dropzone, infector dropzone, source, infector dropzone, source, infector dropzone, infector dropzone, infector, source dropzone, infector dropzone, infector dropzone, infector dropzone, infector dropzone, source, infector dropzone, infector dropzone, infector dropzone, infector dropzone, infector dropzone, infector dropzone, source, infector dropzone, source, infector dropzone, source, infector dropzone, infector dropzone, source, infector dropzone, infector dropzone, infector dropzone, infector dropzone, infector

visitus@bitandjazzdanceclub.com visitus@bitandjazzdanceclub.com ea4cy5zc9n8@nameprivacy.com apprehensivebrandt@yahoo.com repossesseddomain@godaddy.com e255f24x5pb@nameprivacy.com do NeuStar a86af8ue8ca@nameprivacy.com ab5s54gb8eg@nameprivacy.com hs4mk7kj38v@nameprivacy.com dw6va7pc9dk@nameprivacy.com je4k75up8xt@nameprivacy.com do NeuStar ge4nx92w6rk@nameprivacy.com u5ek5js4f2ab5e 1 b0ae7@w86bna54f2 I bffa2ffd 1 .privatewhois.net do NeuStar apprehensivebrandt@yahoo.com wv4k596n5se@nameprivacy.com gwatenegmaiI.com mcroker@charter.net mcroker@charter.net ns5m23ur84w@nameprivacy.com ns5m23ur84w@nameprivacy.com alle@alleopneandertal.com gv9st8nk4ka@nameprivacy.com do NeuStar n97b76fk87g@nameprivacy.com fillopos@yahoo.com do NeuStar do NeuStar a3 7zk7bv7v3 @nameprivacy.com jr7v53ge4pk@nameprivacy.com a37zk7bv7v3@nameprivacy.com reasonhickey@yahoo.com d97f84nn9rgnameprivacy.com xr3sg3h779x@nameprivacy.com vf5vt9yz384@nameprivacy.com eguilateralfranklin@yahoo.com am9zr2ng3p8@nameprivacy.com fracturegIennyahoo.com wm6vn79m42s@nameprivacy.com condo1enceIangfordyahoo.com odommclean@yahoo.com d67rg3d97jp@nameprivacy.com contactprivacyprotect.org seymourfarsighted@yahoo.com do NeuStar root@cheaplobstersny.com ea4cy5zc9n8nameprivacy.com do NeuStar repossesseddomaingodaddy.com f76ah7cb472nameprivacy.com d38679a55tn@nameprivacy.com

46

2201. 2202. 2203. 2204. 2205. 2206. 2207. 2208. 2209. 2210. 2211. 2212. 2213. 2214.

rjrnxlwpokwmrrptn.biz rkpwlosgmxmnhtm.biz rkvktnfhygmwggwk.biz moqvsomcgkmpeli .biz rronxvwgietsrlp.biz rszgpgvjhgwflp.biz rumbt.biz rvwpovgppaggpax.biz ryspbfpvyhvygvng.biz selxowomwwoirvnl.biz mzonphxtliwrw.biz shkrvpwjyisjiu.biz snmwtynjppjptsi.biz snsflrqppsuwj ino.biz

dropzone, dropzone, dropzone, dropzone,

infector infector infector source, infector

do NeuStar thurmanpang@yahoo.com m84np6jd4gt@nameprivacy.com xoxaxybetokic@yahoo.com ea4cy5zc9n8@nameprivacy.com erivegutixo@yahoo.com anatoliylis@yahoo.com n97b76fk87g@nameprivacy.com z34jb9zq2a5@nameprivacy.com t57hy5u68dr@nameprivacy.com yj55n8hw5nb@nameprivacy.com do NeuStar mccartybimetallism@yahoo.com sr7254hn4hnnetworkso1utionsprivateregistrat ion.com olegibanko@gmail.com cha11enge_greenyahoo.com ym84e7fe3rbnameprivacy.com ns5m23ur84wnameprivacy.com hy4r394j6ja@narneprivacy.com yz4rr2um7gb@nameprivacy.com am9zr2ng3p8@nameprivacy.com d448j8f25nx@nameprivacy.com repossesseddomain@godaddy.com d97fs4nn9rg@nameprivacy.com dd3t93pu55u@nameprivacy.com gz8kp89m9e8@narneprivacy.com armeniangillespie@yahoo.com n97b76fk87g@nameprivacy.com waterscomprehensive@yahoo.com g856y7f88nz@nameprivacy.com cz99x6ay7h2@nameprivacy.com fracturegIennyahoo. corn d97f84nn9rgnarneprivacy.corn dt6gh2wj339nameprivacy.com a37zk7bv7v3@nameprivacy.com mdroker@charter.net condo1ence1angfordyahoo.com refectiongay@yahoo.com kh3te68h3mx@nameprivacy.com w72p35dd5ttnameprivacy.com perolsp@yahoo.com contactprivadyprotect.org condoIence1angfordyahoo.com gv9st8nk4ka@nameprivacy.com vv73a9jm5wh@nameprivacy.com gv9st8nk4kanameprivacy.com x26gt7dr3b4@nameprivacy.com

dropzone, infector embeddedjs dropzone dropzone, dropzone, dropzone, dropzone, dropzone, dropzone, dropzone,

infector infector infector infector infector infector infector

2215. 2216. 2217. 2218. 2219. 2220. 2221. 2222. 2223. 2224. 2225. 2226. 2227. 2228. 2229. 2230. 2231. 2232. 2233. 2234. 2235. 2236. 2237. 2238. 2239. 2240. 2241. 2242. 2243. 2244. 2245. 2246. 2247.

symlink.us spidyvjliglsmoen.biz sspjrymvsodngwg.biz stpdwjxgltpovlg.biz tfugtgofsrnpral.biz thglsllnoogtnyhm.biz tieglmmspckyoohn.biz tigpoxkpvspitpgg.biz tj clczxrekrpgpx.biz tjnmwewowigphghr.biz tovrzkvjxtwhvgn.biz tpckorvoxpmship.biz ttdjeisdlpvge.biz tvhwlpgwgrrmoerr.biz ufiwhgrjjtsdwjn.biz ukluuioksgirih.biz umrmimwlezmjfgb.biz usij ogzjvqtix.biz utgworflirkxmcgrn.biz uykrlrijlgdnlgfj.biz vokkvkudxxftljh.biz vrjgehsppcgprhs.biz vslgkrsprvrgtgu.biz vttyntejogftwkcn.biz vuuggwuywtpfgno.biz wddlvxtmhggijsvt.biz weraty.biz wfsgshkrjj leojg.biz wfzmkpwgggdhvkso .biz wilmrsmpsgzuuup.biz wktxuzgvbt1cgln.biz wrtohiimhvlj .biz xiftkgniniwoirvu.biz

embeddedjs dropzone, source, infector dropzone, dropzone, dropzone, dropzone, dropzone, dropzone, dropzone, dropzone, dropzone, dropzone, dropzone, dropzone, dropzone, dropzone, dropzone, dropzone, source, infector infector infector source, infector infector infector, source infector, source source, infector infector infector infector infector infector infector infector source, infector

dropzone, infector dropzone, infector dropzone, infector dropzone, infector dropzone, infector dropzone, infector dropzone, infector dropzone, infector dropzone dropzone, infector dropzone, source, infector dropzone, infector dropzone, infector dropzone, infector dropzone, source, infector

47

2248. 2249. 2250. 2251. 2252. 2253. 2254. 2255. 2256. 2257. 2258. 2259. 2260. 2261. 2262. 2263. 2264.

xxvtrrmbugshu.biz ylhhkuofhlpugkp.biz ylkhrvojxmgngidj.biz yngguoufhfjfmtr.biz yxcgvgiszlkoygn.biz zrpfingyvgmxmhxflc.biz zrxymtgzmrielrm.biz ztjphpsmplbog.biz 1 Iplants.biz 28843622.biz 2x5 .us amstelone3 .biz antifoher.biz anysnare.us xxvtrrmbugshu.biz level-3.us Ievel-3.biz

dropzone, source, infector dropzone, infector dropzone, source, infector dropzone, source, infector dropzone, infector dropzone, source, infector dropzone, source, infector dropzone, source, infector infector, dropzone infector, dropzone infector, dropzone infector, dropzone infector, dropzone infector, dropzone infector dropzone dropzone

waterscomprehensive@yahoo.com hv59t3tr3v6@nameprivacy.com do NeuStar k86c98xv6bx@nameprivacy.com d38679a55tn@nameprivacy.com d38679a55tn@nameprivacy.com u583p92r8uv@nameprivacy.com seymourfarsightedyahoo.com contact@webdomainsbyproxy.com contactwebdomainsbyproxy.com keayon@hotmail.com nij ankinchristina@yahoo.com contact@webdomainsbyproxy.com zhoushaoming@yahoo.com waterscomprehensive@yahoo.com joegeorgeboy001@yahoo.com contactmyprivateregistration.com

48

Afihias Limited C/O Afihias USA, Inc. 300 Welsh Road, Building 3 Suite 105 Horsham, PA 19044 United States
2265. 2266. 2267. 2268. 2269. 2270. 2271. 2272. 2273. 2274. 2275. 2276. 2277. 2278. 2279. 2280. 2281. 2282. 2283. 2284. 2285. 2286. 2287. 2288. 2289. 2290. 2291. 2292. 2293. 2294. 2295. 2296. 2297. 2298. 2299. 2300. 2301. 2302. 2303. 2304. 2305. 2306. 2307. 2308. Harmful Botnet Domain Name robohoste.info rokgsjhzyiusvrj.info ultimatesecurity.info hostingguru.info localhOst.info freetop.mobi actinatist.info advertising-services.info ahaccu.info akularryzare.info algroton.info alianalingta.info allyga.info alpriate.info amidinesfa.info anagodwator.info anateam.info ancemvir.info anecdadiard.info aniani.info antifraudsolutions.info apagoni.info aphard. info aphasmuce.info apple-fresh. info apricot-fresh, info argiropoulos.info ashnmjjpolj fnl info ass-tube.info astroamah.info aubirdwa. info avocado-fresh.info bad-tube.info barserginger.info bativolt.info bbw-go.info biLberry-free.info binetu.info beginestition.info belleterer.info blackberry-free. info blackcurrant-free.info blaismanni.info blueberry-free.info
.

Type dropzone infector dropzone, infector dropzone, infector dropzone, infector

-

dropzone, infector dropzone source dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone source dropzone, infector dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone

Whois Email Address toniparish@imap.cc do Afihias domain.tech@yahoo-inc.com damage.smithyandex.ru lb 1 8ff4e8dfd4023 8305edda885ba968.protect @whoisguard.com chandru.sept24gmail.com do Afilias godaddy@profitsigur.ro do Afihias do Afilias do Afilias do Afilias support@simioffers.com the.malware.cabal@gmail.com do Afilias do Afihias do Afilias sarahcolvin@live.co.uk do Afilias david.austin44@yahoo.com exitthematrix@ymail.com do Afihias sarahcolvin@live.co.uk do Afilias himacss@yandex.ru himacss@yandex.ru whois@bluehost.com waterscomprehensive@yahoo.com himacss@yandex.ru do Afilias do Afihias himacss@yandex.ru himacss@yandex.ru do Afihias sarahcolvin@live.co.uk himacss@yandex.ru himacss@yandex.ru sarahcolvin@live.co.uk david.austin44@yahoo.com do Afihias himacss@yandex.ru himacss@yandex.ru do Afilias himacss@yandex.ru

49

2309. 23 10. 231 1. 2312. 2313. 2314. 2315. 2316. 2317. 2318. 2319. 2320. 2321. 2322. 2323. 2324. 2325. 2326. 2327. 2328. 2329. 2330. 2331. 2332. 2333. 2334. 2335. 2336. 2337. 2338. 2339. 2340. 2341. 2342. 2343. 2344. 2345. 2346. 2347. 2348. 2349. 2350. 2351. 2352. 2353. 2354. 2355. 2356. 2357. 2358. 2359. 2360. 2361.

bobbiestube.info bowsterb.info bptigozrtypzj.info bggsnpnvppxpgg.info brokedidood.info broncomm.info bucraggerie.info bum-bam-sexy-blam.info bum-bum.info bumbums.info bummaryhout.info burghne.info butteency.info cabintemme.info cacheeseed.info cadenelec.info caffinform.info canoede. info carologel.info castee.info cdvgvnjggtkghsoo.info cemesolele.info chairlorigh.info chariewildry.info cherry-free. info chintal.info cholifo.info chorge.info chuppines.info cjputytllgkygylj .info clernmet.info compapageon.info contlocele.info contoppet.info copresiati.info crampinte.info cranian.info cranzartue.info crucery.info cognessa.info costarmo.info defealn.info deficilla.info defindl.info denistar.info desponechpo.info desprush.info diwance.info dogedbust.info dominmoney 1 24.info doorerti.info dortelwittle.info duceptic.info

dropzone dropzone dropzone, source, infector dropzone, infector dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone, infector dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone, infector dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone updater dropzone dropzone dropzone

himacss@yandex.ru do Afilias do Afilias wv4k596n5se@nameprivacy.com do Afihias do Afihias allen.peter@mail.com himacss@yandex.ru himacss@yandex.ru himacss@yandex.ru do Afilias do Afilias do Afilias the.malware.cabal@gmail.com do Afilias do Afilias susanboyce@live.co.uk david.austin44@yahoo.com do Afilias do Afilias d97f84nn9rg@nameprivacy.com do Afihias do Afilias do Afilias himacss@yandex.ru do Afilias david.austin44@yahoo.com do Afihias do Afilias elkinselongate@yahoo.com do Afilias do Afilias do Afihias do Afitias do Afihias do Afilias do Afilias do Afilias do Afilias do Afilias do Afihias do Afilias do Afihias do Afilias do Afihias do Afihias do Afilias do Afilias do Afihias repossesseddomaingodaddy.com do Afihias do Afilias do Afilias

50

2362. 2363. 2364. 2365. 2366. 2367. 2368. 2369. 2370. 2371. 2372. 2373. 2374. 2375. 2376. 2377. 2378. 2379. 2380. 2381. 2382. 2383. 2384. 2385. 2386. 2387. 2388. 2389. 2390. 2391. 2392. 2393. 2394. 2395. 2396. 2397. 2398. 2399. 2400. 2401. 2402. 2403. 2404. 2405. 2406. 2407. 2408. 2409. 2410. 2411. 2412. 2413. 2414.

dulinepa.info dwayer.info efugxssjrwnrgegk.info egiajf,sgwoajhs.info elsgoophgynbhkv.info egwgpniruglhnrh.info eremitelo.info euzzpjntlskotws. info evalgism.info excitta.info fastspy.info federalreserve-report-domain. info federalreserve-report-download.info feudineedci.info thoutive.info fixineed.info foveari.info fglpvggpvtzgpgqp.info fsojgkutpyohu.info fwjvgkousppprtt.info fzrgovj Ivkwrwnx. info galewindit.info ganapkinet.info gdolnlrgenronnn.info giganatwo.info go6po.me gomarichor.info ggvloeozbodgfwgh.info grascowallbrick.info growupti.info gtgvwfgshlxtppkz.info guenessollet.info guilldo.info gxsnxkgahaopsjnLinfo habbiece.info hckgtsgpsstzmdp.info hemdomance.info hernandrumen.info hgbu67bjyrturtyuk.info hjpxtfnrenufxsvr.info hjsdbkjnlsamdfa.info hkkmgvttugpo.info hogchariane.info horali.info hztplrrrfgmjyrrd.info iekffimigvpwtpxr. info imitall.info instationne.info jessatianator.info itkwvfguvznhtpi.info iupmkmcprthetfgs.info jmovpypolsgogkog.info khchukgggsgxszr. info

dropzone dropzone dropzone, infector embeddedjs dropzone, infector dropzone, infector dropzone dropzone, infector dropzone dropzone dropzone, source, infector source source dropzone dropzone dropzone dropzone dropzone, infector dropzone, infector dropzone, infector dropzone, infector dropzone dropzone dropzone, infector dropzone infector dropzone dropzone, infector updater dropzone dropzone, infector dropzone dropzone dropzone, source, infector dropzone dropzone, infector dropzone dropzone dropzone dropzone, infector source dropzone, infector dropzone dropzone dropzone, source, infector dropzone, infector dropzone dropzone dropzone dropzone, infector dropzone, infector dropzone, infector dropzone, source, infector

do Afihias do Afilias ea2cm9ex6wp@nameprivacy.com erivegutixo@yahoo.com r793d9ww3fr@nameprivacy.com n75wc8m88ak@nameprivacy.com do Afihias waterscomprehensive@yahoo.com do Afihias do Afilias admin@fastspy.info contact@myprivateregistration.com malejo0828@yahoo.com do Afilias do Afihias do Afilias do Afihias wm6vn79m42s@nameprivacy.com g856y7f88nz@nameprivacy.com benavideseuripides@yahoo.com g856y7f88nz@nameprivacy.com do Afihias do Afilias jr7v53ge4pk@nameprivacy.com do Afihias kapany3y@mai1.com do Afilias yj55n8hw5nb@nameprivacy.com do Afilias do Afihias chenmilwaukee@yahoo.com do Afilias do Afihias pu29m3h93 qj@nameprivacy.com do Afihias Iarsenvicious@yahoo.com do Afilias do Afihias purtucz@mail.ru hjpxtfhrenuficsvr.info gwdhjasvdhv@yahoo.com wh6ar6z58hn@nameprivacy.com do Afihias do Afilias covizubewybebi@yahoo.com root@cheaplobstersny.com do Afihias do Afilias /o Afihias waterscomprehensive@yahoo.com wm6vn79m42s@nameprivacy.com do Afilias downingcinerama@yahoo.com

51

2415. 2416. 2417. 2418. 2419. 2420. 2421. 2422. 2423. 2424. 2425. 2426. 2427. 2428. 2429. 2430. 2431. 2432. 2433. 2434. 2435. 2436. 2437. 2438. 2439. 2440. 244 1. 2442. 2443. 2444. 2445. 2446. 2447. 2448. 2449. 2450. 2451. 2452. 2453. 2454. 2455. 2456. 2457. 2458. 2459. 2460. 2461. 2462. 2463. 2464. 2465. 2466. 2467.

killendl.info kkrhznwjsxgonmhk. info korelererta.info kgggmvarlsomrfgl.info kratedm.info Iaconf.info Iadyereredra. info lbulnilughhlj .info Ieenriller.info Iklhprwvhreuuti.info Ipsnbzozyhvpepyp.info Igfrowptgpchrxpn.info lsusksvtvgklrgnr.info Itigggslxworvm.info mafia-wars.info manchm.info margagm.info marimettalf.info marisey.info maximpa.info memoutaltyne.info merilia.info millierer.info mirupgtfvwvnzf.info mnestrap.info modasiem. info moglgtipnogftrr.info morselantif.info motote.info mggghryddzjyik. info mtgvovwtelpnuor.info muonuxxksinhhwv. info mupumgzpnuetglp.info muriadervai.info muskintenent.info myach-privacy-c. info mynacha-solutions-o.info mzoyprgctlwipiu.info mzvlpddnlzguowr.info nacha-report-domain-syst. info nacha-report-downloads. info nacha-solutions-onow. info nachasolutionst.info newyaction.info newyactionl23.info ngutoplgypnorsuu. info nisselfia.info nkhhrutvwvnwvkg. info nkogyzmlnrgo. info nsjohymwghjgiv.info ntuvpsknopsntuvg.info nuthog.info nxknjssmizekbimg.info

dropzone dropzone, infector dropzone dropzone, infector dropzone dropzone dropzone embeddedjs dropzone dropzone, infector dropzone, infector dropzone, source, infector dropzone, source, infector dropzone, infector dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone, infector dropzone dropzone dropzone, infector dropzone dropzone dropzone, infector embeddedjs dropzone, source, infector dropzone, infector dropzone dropzone source source dropzone, source, infector dropzone, source, infector source source source source dropzone, source updater dropzone, infector dropzone dropzone, source, infector dropzone, source, infector dropzone, infector dropzone, infector dropzone dropzone, infector

do Afilias rf7ph2w73fw@nameprivacy.com do Afihias kh3te68h3mx@nameprivacy.com do Afihias hostmaster@proxad.net do Afilias exytihazonac@yahoo.com do Afihias rh6fk9xv2g5@nameprivacy.com js5gx56c7w8@nameprivacy.com bonilIascenic@yahoo.com d38679a55tn@nameprivacy.com nd44b2bm6z2@nameprivacy.com domain-admin@easily.co.uk do Afihias do Afilias do Afihias paultribouillard@hotmail.co.uk do Afihias do Afilias do Afilias do Afihias wv4k596n5se@nameprivacy.com do Afihias do Afihias js5gx56c7w8@nameprivacy.com do Afihias do Afilias r793d9ww3 fr@nameprivacy.com wyco1ynyhonyahoo.com rh6f1c9xv2g5@nameprivacy.com webmaster@indianlegaltroops.com do Afilias do Afihias perditionMcmanusP1(yahoo.com admin@mynacha-solutions-o.info mx6np6jy4dc(nameprivacy.com uz9u78n867p@nameprivacy.com roksoa@yahoo.com mil1eralan42@yahoo.com admin@nacha-solutions-onow.info cardinogenicWashingtonumyahoo.com erikschwelnus@mailcan.com do Afihias benavideseuripides@yahoo.com do Afilias pd7hz3xc48r@nameprivacy.com seymourfarsightedyahoo.com benavideseuripides@yahoo.com a37zk7bv7v3@nameprivacy.com do Afilias rd9cp4t73dg@nameprivacy.com
-

52

2468. 2469. 2470. 2471. 2472. 2473. 2474. 2475. 2476. 2477. 2478. 2479. 2480. 2481. 2482. 2483. 2484. 2485. 2486. 2487. 2488. 2489. 2490. 249 1. 2492. 2493. 2494. 2495. 2496. 2497. 2498. 2499. 2500. 2501. 2502. 2503. 2504. 2505. 2506. 2507. 2508. 2509. 2510. 251 1. 2512. 2513. 2514. 2515. 2516. 2517. 2518. 2519. 2520.

nyctalkswag.info oculins.info oddmenterer. info ommlxlegpglhxiv.info onhinecorporation. info onvirudttwhfu. info onwzpkcyvtugg. info opwhmilxsjkgdge.info orrheather.info ovemate.info paireeho.info paraud.info pardency.info paschoiceny.info pathflite.info paulmasc.info peanerry.info peristoreder.info petrozedn.mfo phrendogm.info phytolo.info pidbusyglzhkmglk.info pineapple-free.info pingermi.info planacymric.info pnmtwnhxkgypk.info pnudyprlhnuvzpjy.info poggene.info pookixusufvgkx.info preteza.info pgiwumrdnnhmmtad.info provingsp.info pruringlyte.info psgzgaffrnvonvs. info pubbeerlo.info pxlilkgwfgxllme.info gbdsesosgmsocij io.info recalingbole.info recarban.info guantehlaines.info guerrysl.info guironet.info gvswpxlpgfwlpks.info rabotascuka.info recrusawf.info redessenn.info relifemismiazo.info reneliastereren.info retankin.info retorihewor.info retts I rementts 1 nvestts I ng.info rhnwnnrrztoygird.info rmmjmohwdnxuhgx.info

dropzone dropzone dropzone dropzone, infector dropzone dropzone, infector dropzone, infector dropzone, source, infector dropzone dropzone dropzone dropzone dropzone embeddedjs dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone, infector dropzone dropzone dropzone dropzone, infector dropzone, infector dropzone dropzone, source, infector dropzone dropzone, infector dropzone dropzone dropzone, infector embeddedjs dropzone, infector dropzone, source, infector dropzone dropzone dropzone dropzone dropzone dropzone, infector dropzone, updater dropzone dropzone dropzone dropzone dropzone dropzone source dropzone, source, infector dropzone, infector

do Afilias do Afilias do Afihias e255f24x5pb@nameprivacy.com exitthematrixymaiI.com waterscomprehensive@yahoo.com ea4cy5zc9n8@nameprivacy.com rd9cp4t73dg@nameprivacy.com orrheather.info do Afihias do Afilias do Afilias do Afihias idymohobalu@yahoo.com do Afilias do Afilias do Afihias do Afihias do Afihias do Afilias do Afihias do Afihias himacss@yandex.ru do Afihias do Afihias z34jb9zg2a5@nameprivacy.com ea4cy5zc9n8@nameprivacy.com do Afihias rd9cp4t73 dg@nameprivacy.com do Afilias dt6gh2wj339@nameprivacy.com do Afihias do Afihias chenmilwaukee@yahoo.com idymohoba1uyahoo.com do Afilias d97f84nn9rgnameprivacy.com do Afihias do Afilias do Afihias do Afihias do Afilias dt6gh2wj339(nameprivacy.com contact@privacyprotect.org do Afihias do Afilias do Afilias do Afihias do Afilias do Afilias maksim_kugifmai1.ru k86c98xv6bx@nameprivacy.com boniIlascenic@yahoo.com

53

2521. 2522. 2523. 2524. 2525. 2526. 2527. 2528. 2529. 2530. 2531. 2532. 2533. 2534. 2535. 2536. 2537. 2538. 2539. 2540. 2541. 2542. 2543. 2544. 2545. 2546. 2547. 2548. 2549. 2550. 2551. 2552. 2553. 2554. 2555. 2556. 2557. 2558. 2559. 2560. 2561. 2562. 2563. 2564. 2565. 2566. 2567. 2568. 2569. 2570. 2571. 2572. 2573.

roxystyleech.info rpogugmgurbpzpp.info rpxokscszeptrx. info rgfgokssfomjgvd.info rsanyhvdyghpwgw. info rumbt.info ruskiple.info salmidesilv.info saraard.info sarysaileu.info savarideti.info scarlen.info scherce.info scoreboaton.info scoter.info scyton.info seconicil.info securityaim.info securitymark. info semipsium.info sfjpnueguoilx.info shipmess.info sjfwmoprjknpgg.info skiny-hub.info soundombrid.info spgjeyvglfskt.info spriguagebe.info sgfgstggoyrId.info ssjgkktjugwgepz.info stansforgingst.info starmainid.info star-tu-o-ticket.info stepperence.info suierovkgoxrzmmb. info sustdxvsknlbrpn.info sweatorizzl.info symmhock.info synager.info syotxofmnipxosiij.info tempeliad.info teniangsymp.info theinternationaltravel. info thlypter.info thymigr.info tihryljrhttwowkk.info tioneeti.info titiverie.info tnzmolrsjrzhc.info tonismanna.info touchettage.info tsoriantry.info tufsverkvghmlm.info tumetteju.info

dropzone dropzone, source, infector dropzone, infector dropzone, source, infector dropzone, infector dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone source source dropzone dropzone, infector dropzone dropzone, infector dropzone dropzone dropzone, infector dropzone dropzone, infector dropzone, source, infector dropzone dropzone source dropzone dropzone, source, infector dropzone, infector dropzone dropzone dropzone dropzone, source, infector dropzone dropzone source dropzone dropzone dropzone, source, infector dropzone dropzone dropzone, infector dropzone dropzone dropzone dropzone, infector dropzone

do Afilias do Afihias repossesseddomain@godaddy.com j27vg4968ba@nameprivacy.com wh6ar6z58hn@nameprivacy.com anatoliylis@yahoo.com do Afihias do Afihias saraard.info@domainsbyproxy.com do Afilias do Afilias do Afihias do Afihias do Afilias do Afilias do Afilias do Afilias purtucz@mail.ru purtucz@mail.ru do Afilias dt6gh2wj339@nameprivacy.com do Afilias do Afilias himacss@yandex.ru do Afilias stepsonyoung@yahoo.com do Afilias repossesseddomain@godaddy.com d97f84nn9rgnameprivacy.com do Afihias do Afilias carpBmAmbrose@yahoo.com c/o Afihias osborntablespoon@yahoo.com jt9xs7y73p5@nameprivacy.com do Afilias do Afihias do Afilias do Afilias do Afihias do Afilias sachinsearch-vaIue.com do Afilias do Afilias d67rg3d97jp@nameprivacy.com do Afilias do Afilias yc9wy3c75gv@nameprivacy.com do Afilias do Afilias do Afilias rd9cp4t73dgnameprivacy.com do Afilias

54

2574. 2575. 2576. 2577. 2578. 2579. 2580. 2581. 2582. 2583. 2584. 2585. 2586. 2587. 2588. 2589. 2590. 2591. 2592. 2593. 2594. 2595. 2596. 2597. 2598. 2599. 2600. 2601. 2602. 2603. 2604. 2605. 2606. 2607. 2608. 2609. 2610. 2611. 2612. 2613. 2614. 2615. 2616. 2617. 2618. 2619. 2620.

tutiora.info uncisi.info uopjmzjxkrrpggto.info uralersole.info utuihhnndtmitunv. info uyzrmgsuktljbgg.info uznloepzpertgrs. info venevers.info verstran.info vmnszmothuovvoll.info vocatagit.info vohrudopljluv.info vspgtnowemfjlsu.info vtmkxntgplkkst.info vvvsfinnngowoevh.info vxspuugdrknvyogw.info wanigle.info wardwatt.info wergerf.info whenererer.info wifi-hardware.info wrapmyarmsand. info wrssrjgpiyfsmwp.info domain 123456789. info xaviestocri.info xfjcnroiyiwwrp.info xjkotrupgefjimoz.info xusgryrighzotg.info xvgllmehlirsryh.info yjwstksxxpmul.info ynnssrpdcugmlrer. info ygyphsmxmovzmj wu. info yrvdpwslswkpgsbg. info ziswpytgtjohtrn.info zardback.info zigzare.info zmdkjzrsmusshg 1g. info zorzpygrpckkmtf5cinfo zsocijlsznnussh.info charterbeans.info dominmoney 1 24.info gotoberlin.info grascowallbrick.info renwoxing.me theddos.me ygn1gxyzamfcv1t.info level-3.me

dropzone dropzone dropzone, infector dropzone dropzone, infector dropzone, source, infector dropzone, source, infector dropzone dropzone dropzone, infector dropzone dropzone, infector dropzone, infector dropzone, source, infector dropzone, infector dropzone, infector, source dropzone dropzone dropzone, source, infector dropzone source source dropzone, source, infector dropzone, source dropzone dropzone, source, infector dropzone, source, infector dropzone, source, infector dropzone, source, infector dropzone, infector dropzone, source, infector dropzone, source, infector dropzone, source, infector dropzone, infector dropzone dropzone dropzone, source, infector dropzone, source, infector dropzone, source, infector dropzone, infector updater infector updater dropzone, infector dropzone, infector infector dropzone

do Afihias do Afihias vd6f5a996tcnarneprivacy.com do Afihias root@cheaplobstersny.com hv59t3tr3v6@narneprivacy.com ingrownadams@yahoo.com do Afilias ashlyevans@live.co.uk univalentlongoria@yahoo.com do Afilias ge4nx92w6rk@nameprivacy.com uz9u78n867p@narneprivacy.com contact@privacyprotect.or rd9cp4t73dgnameprivacy.com ns5m23ur84w@nameprivacy.com do Afilias do Afilias faterins@gmail.com do Afilias carpBmAmbroseyahoo.com admin@neverbealoneorlethim. info scripturecrocker@yahoo.com jobs@facebookjob.de do Afihias j35gg6na33k@nameprivacy.com wh6ar6z5 8hn(nameprivacy.com hv59t3tr3v6@nameprivacy.com ge2zu9xk6mpnameprivacy.com ag9wf9hb8uunameprivacy.corn repossesseddomain@godaddy. corn apprehensivebrandt@yahoo.com d448j8f25nxnameprivacy.com Iarsenvicious@yahoo.com do Afihias do Afihias jr7v53ge4pk@nameprivacy.com meansspeedometer@yahoo.com scripturecrocker@yahoo.com srivastava.akshay 1 grnaiI.com repossesseddomain@godaddy.com a1exak1arkgomai1.com do Afihias e59egg.com hostmaster(one.corn do Afihias f1836151 1b32484991 1 182c54d185df4.protect @whoisguard.com

55

Public Interest Registry (PIR) 1775 Wiehle Avenue Suite 200 Reston Virginia 20190 United States
2621. 2622. 2623. 2624. 2625. 2626. 2627. 2628. 2629. 2630. 2631. 2632. 2633. 2634. 2635. 2636. 2637. 2638. 2639. 2640. 2641. 2642. 2643. 2644. 2645. 2646. 2647. 2648. 2649. 2650. 2651. 2652. 2653. 2654. 2655. 2656. 2657. 2658. 2659. 2660. 2661. 2662. 2663. 2664. 2665.
Harmful Botnet Domain Name barclaysghana.org pganalytics.org wcgplaynow.org wsgwehnnjppxrgxp.org wuvwgckpzfxrgLorg strujkysnirnern.org Type dropzone, infector updater dropzone, infector infector infector source Whois Email Address sec.indi@yahoo.com do Public Interest Registry admin@rnacro-store.corn c67cv95z47c@nameprivacy.com do Public Interest Registry eusaok34f2bfa8becb0e@w86bna54f2 I bffa2ffd I .privatewhois.net dfhcsdfs@l26.com do Public Interest Registry sb6n59an64m@nameprivacy.com sb6n59an64m@narneprivacy.com williammitchellworld@yahoo.com c/o Public Interest Registry adrnin@macro-store.corn ftgy23fge@l26.com ftgy23fge126.com rowenachauvin@ymail.com bobevanscoupons .org@dornainsbyproxy. corn gmvjcxkxhs@whoisservices.cn borrnorler@gmail.com ns5rn23 ur84w@narneprivacy. corn d97f84nn9rg@nameprivacy.com derewsater@yahoo.com aj rnorganpacifier.corn b52f2gw5ys@nameprivacy.corn d38679a55tn@narneprivacy.com d3 8679a55tn@narneprivacy.corn excelat.co hy4r394j6ja@narneprivacy.com k86c98xv6bx@nameprivacy.com cr65g2ap483@nameprivacy.com do Public Interest Registry f76ah7cb472@nameprivacy.com wv4k596n5senarneprivacy.corn dt6gh2wj339@narneprivacy.com xr3sg3h779x@narneprivacy.com hgbu67bjyrturtyuk.org@domainsbyproxy.corn gv9st8nk4ka@nameprivacy.com refectiongay@yahoo.com y77jc7ys7xp@narneprivacy.com contactwebdornainsbyproxy.com hv59t3tr3v6@nameprivacy.com ingrarnprice@yahoo.com apprehensivebrandt@yahoo.com fraserafrica@yahoo.com am9zr2ng3p8@nameprivacy.com

rnyapps-ups.org hnwxgurcijvynwljf.org jcmtczpwontvppnt.org jligigsnggdwxp.org just-ping.org mswgvxohtpthzj.org muzonline.org mybackupdns.org narnesservers.org adventurefinder.org bobevanscoupons.org boboyes.org cosainse.org cglggycnkfoovvn.org dlmsonisfzksiogg.org download-report-nacha.org dunegoon.org ehsswiirxmsmoxxc.org eijggpggsuht.org ephrnvzsnppmnzgzk.org evzgffspxhsrvf.org eyphgugjugprphvn.org fggsrmvklmwlulg.org flttsptygppvgdoy.org fgkmrulylslzrtm.org gsgeptneinjuwlt.org gphtznwlcggg.org gtxwgptngkltozv.org gultpurpllppiwt.org hgbu67bjyrturtyuk.org hisiogkdtgcotbgr.org hrxgnkovlvssuiv.org hupppszsglgmjsp.org huyagwop.org hwgpgrimkngkfizg.org iugbutilloghooi.org ingppkgaj lnrsjkh.org iogtvgrnjrnwrrn.org itnhtwopdvkronw.org

infector infector infector infector dropzone, infector infector dropzone, infector, source infector dropzone, infector source source updater dropzone, source dropzone, source, infector dropzone, infector source infector dropzone, infector dropzone, infector dropzone, infector dropzone, infector dropzone, infector dropzone, source, infector dropzone, source, infector dropzone, infector dropzone, infector dropzone, infector dropzone, infector dropzone, infector dropzone dropzone, infector dropzone, infector dropzone, infector updater dropzone, infector dropzone, infector dropzone, infector, source dropzone, source, infector dropzone, infector

56

2666. 2667. 2668. 2669. 2670. 2671. 2672. 2673. 2674. 2675. 2676. 2677. 2678. 2679. 2680. 2681. 2682. 2683. 2684. 2685. 2686. 2687. 2688. 2689. 2690. 2691. 2692. 2693. 2694. 2695. 2696. 2697. 2698. 2699. 2700. 2701. 2702. 2703. 2704. 2705. 2706. 2707. 2708. 2709. 2710. 2711. 2712. 2713. 2714. 2715. 2716. 2717. 2718.

jdzgklktenlmi.org jmjjegfunuotrion.org j pudusmoaelmept.org jssqjwugwrxkmz.org jxwoplygbtglodx.org kdnrjewtvsgujnk.org kkhoukytgmxwxrfs.org k1dsvyjjfgdpgtv.org knxohnzsrjvti.org koglplnulwksxule.org kpjprkghsmgrmsj org ldkvpouuhxloiwpv.org kwgocmfjilthiyfs.org lmpgvpmjfidgsw.org lntepipjekorghi.org lvvuokugwwnsjdm.org mlslndjveljmdppr.org mfevsldswrkmppj .org mjxjtgnvcfswgwp.org mnptwsoweulgpgo.org mogstogugrutjjto.org nacha-trans.org nacha-transactions.org nacha-ach.org nacha-alert.org nacha-online.org nacha-report.org nacha-reports.org nacha-wire.org nkowprjysxxocxjy.org nnlhruyyrkkvjmr.org nncij vgrhnglijegn.org novodebt.org ngurj fgj olirrrpy.org nsbewpkwpmrxkmup.org nuiojpgvrsgkowz.org nzighwrmvkjusvn.org oglzyrwnoixsgsom.org ospvagkgcnimozns.org oswash.org ozrollfj gkrjhtor.org peoriaautoshow.org perdfcovj oldtv.org personal-web-security.org pganalytics.org pmgnhzymsoopghog.org pnutmmmjclvrtngn.org pozpwukkuoyhwmm.org ppruxxpgpewtuym.org pgyrmyojvrvnxos.org prwllungikkawbvf.org psugtoosnolpmju.org pvupsppujstxpfc.org

dropzone, infector dropzone, source, infector dropzone, infector dropzone, infector dropzone, infector dropzone, infector dropzone, infector dropzone, infector dropzone, infector dropzone, infector dropzone, source, infector dropzone, source, infector dropzone, infector dropzone, infector dropzone, source, infector dropzone, infector dropzone, source, infector dropzone, infector dropzone, infector dropzone, source, infector dropzone, infector source source source source source source source source dropzone, infector dropzone, infector dropzone, infector dropzone dropzone, source, infector dropzone, infector dropzone, infector dropzone, source, infector dropzone, source, infector dropzone, infector source dropzone, source, infector dropzone dropzone, source, infector source updater dropzone, source, infector dropzone, source, infector dropzone, infector dropzone, infector embeddedjs dropzone, source, infector dropzone, source, infector dropzone, source, infector

u583p92r8uvnameprivacy.com apprehensivebrandt@yahoo.com hostmaster@above.com yj55n8hw5nb@nameprivacy.com webmasterindianlega1troops.com fh4u39er8bh@nameprivacy.com r46gz65d8xg@nameprivacy.com amadeus_logan@yahoo.com k87td33t8xf@nameprivacy.com wm6vn79m42s@nameprivacy.com am9zr2ng3 p8@nameprivacy.com ne26s6sf8v2@nameprivacy.com wh6ar6z58hn@nameprivacy.com wm6vn79m42s@nameprivacy.com xy9u66ja35d@nameprivacy.com rf7ph2w73fw@nameprivacy.com do Public Interest Registry rf7ph2w73fw@nameprivacy.com declaratoryfoote@yahoo.com do Public Interest Registry amadeus_logan@yahoo.com contact@myprivateregistration.com admin@nacha-transactions.org loralio43@yahoo.com contact@myprivateregistration.com poruesaw@yahoo.com admin@nacha-report.org adminnacha-reports.org 1oraIio43yahoo.com nd44b2bm6z2nameprivacy.com d97f84nn9rg@nameprivacy.com wm6vn79m42s@nameprivacy.com anatoliylis@yahoo.com wm6vn79m42s@nameprivacy.com k86c98xv6bx@nameprivacy.com vd6fS5a996t@nameprivacy.com do Public Interest Registry be98f37p79m@nameprivacy.com uz9u78n867p@nameprivacy.com info@vibit.eu ingrownadams@yahoo.com contact@privacyprotect.org am9zr2ng3p8@nameprivacy.com admin@personal-web-security.org do Public Interest Registry wh6ar6z58hn@nameprivacy.com d97f84nn9rg@nameprivacy.com dt6gh2wj339@nameprivacy.com meansspeedometer@yahoo.com contact@privacyprotect.org n75wc8m88ak@nameprivacy.com wh6ar6z58hn@nameprivacy.com dd3t93pu55u@nameprivacy.com

57

2719. 2720. 2721. 2722. 2723. 2724. 2725. 2726. 2727. 2728. 2729. 2730. 2731. 2732. 2733. 2734. 2735. 2736. 2737. 2738. 2739. 2740. 2741. 2742. 2743. 2744. 2745. 2746. 2747. 2748. 2749. 2750. 2751. 2752. 2753. 2754. 2755. 2756. 2757. 2758. 2759. 2760. 2761. 2762. 2763. 2764. 2765. 2766. 2767. 2768. 2769. 2770. 2771.

pxsgzfgsgpwklu.org gcjre1f,hmrojx.org geikltnsjojtsdgf.org getvlnivjxwiqj.org ggswsnpgtiiexlp.org gretnmimzjmppe.org grujovkkngzlop.org grwprgjnrykrsvwf.org gtjmnpjfzqosool.org gtglnorngkvsum.org guantserv.org gugnxngegtohjcso.org gusihtgckpgprfg.org gymrxmskrjltps.org repleyser.org reports-nacha.org rliuvgcvxgbtyj .org rsjgssfrvmnvmltg.org rstwvogfpgyggl.org rumbt.org rzgsundonswmtox.org muabanxetai.org mxocrmlxgkrkeppy.org mxpithhmmjxpvse.org sptospivowopxpxv.org strujkysnimem.org tfrxtwxpmj nswl.org thnskivvpkimmzw.org tivbekwplurydgr.org tmkclsstnskukmtj.org tkmwplnhmdgr.org tttzrivfvlmvui.org tynijxrmuigsngf.org tyussplgyvsutegr.org ucwrlztmgpzumkj s. org uj mggkpwvwpzpem.org ujzssilgouzjsgep.org uofmneuppmshcij pz.org vhirpnoulgmuszg.org visitmyblog.org vuihtdsoonutxvdk.org wbutitosldtnmbrf.org wcgplaynow.org weyvnorgvkpmu.org whakrxuonsghrved.org wkrrvojpgvgzmpm.org xolycnpprskxnt.org xomsmpotrxrorl.org ybjgwwwnggsinmk.org ycyyfgsjptiorc.org ylklgmpuggtmssnh.org ymwvffjrosntpzgr.org ytpczxtfxuzftxp.org

dropzone, source, infector dropzone, source, infector dropzone, source, infector dropzone, infector dropzone, source, infector dropzone, infector dropzone, infector dropzone, infector dropzone, source, infector dropzone, source, infector embeddedjs dropzone, infector dropzone, infector dropzone, infector embeddedjs source dropzone, infector dropzone, source, infector dropzone, infector dropzone dropzone, source, infector dropzone dropzone, infector dropzone, infector dropzone, infector source dropzone, source, infector dropzone, source, infector dropzone, infector dropzone, infector dropzone, infector dropzone, source, infector dropzone, infector dropzone, infector dropzone, infector dropzone, source, infector dropzone, infector dropzone, infector, source dropzone, infector embeddedjs dropzone, source, infector dropzone, source, infector infector dropzone, infector dropzone, source, infector dropzone, source, infector dropzone, source, infector dropzone, infector dropzone, infector embeddedjs dropzone, source, infector dropzone, infector dropzone, infector, source

hv59t3tr3v6@nameprivacy.com downingcineramayahoo.com wn2597rp22x@nameprivacy.com js5gx56c7w8@nameprivacy.com bonillascenic@yahoo.com bonillascenic@yahoo.com humphreyts@yahoo.com be98f37p79m@nameprivacy.com m84np6jd4gt@nameprivacy.com u65dt7g82a7@nameprivacy.com admin@guantserv.org wv4k596n5se@nameprivacy.com contactprivacyprotect.org cz99x6ay7h2@nameprivacy.com Iexus333new@yahoo.com polonokias@yahoo.com meansspeedometer@yahoo.com am9zr2ng3p8@nameprivacy.com d67rg3d97jp@nameprivacy.com anatoliylis@yahoo.com vf5vt9yz384@nameprivacy.com muabanxetai.org@protecteddomainservices.com e255f24x5pb@nameprivacy.com univalentlongoria@yahoo.com rd9cp4t73dg@nameprivacy.com eusaok34f2bfa8becb0e@w86bna54f2 1 bffa2ffd 1 privatewhois.net gv9st8nk4ka@nameprivacy.com do Public Interest Registry armeniangillespie@yahoo.com am9zr2ng3p8nameprivacy.com u583p92r8uv@nameprivacy.com k86c98xv6bx@nameprivacy.com yj55n8hw5nb@nameprivacy.com s82z84x55fs@nameprivacy.com rf7ph2w73 fw@nameprivacy.com exorbitantbonil la@yahoo.com v56dt2ey98u@nameprivacy.com ns5m23ur84w@nameprivacy.com condolencelangford@yahoo.com gmvjcxkxhswhoisservices.cn wh6ar6z5 8hn(nameprivacy.com jr7v53ge4pk@nameprivacy.com admin@macro-store.com u65dt7g82a7@nameprivacy.com h58ys7kg989(nameprivacy.com dd3t93pu55u@nameprivacy.com d97f84nn9rgnameprivacy.com f76ah7cb472(nameprivacy.com wh6ar6z58hn@nameprivacy.com wycolynyhonyahoo.com fractureg1enn(yahoo.com fitchguyanayahoo.com ns5m23ur84w@nameprivacy.com

58

2772. 2773. 2774. 2775. 2776. 2777. 2778. 2779. 2780. 2781. 2782. 2783. 2784. 2785. 2786.

zluidmzuhpumogg.org zoflnpyvpknxolkp.org analyticdns.org au.guantserv.org chamska.org cordsrilanka.org countrysefa.org daraskiluk.org games4win.org united-trans.org yuelgmpimjxsmn.org zapppo 1 .org pganalytics.org dev.simulinux.org key-finance.org

dropzone, source, infector dropzone, infector infector, dropzone embeddedjs dropzone, infector infector infector dropzone, infector dropzone, infector infector infector dropzone, infector updater infector, dropzone

do Public Interest Registry x26gt7dr3b4@nameprivacy.com dfghrter@hotmail.com adminguantserv.org livemetal88@hotmail.com vasanthanb@yahoo.com contact@webdomainsbyproxy.com hyrdbih4f2bb505cf760w86bna54f2 I bffa2ffd 1 .privatewhois.net admin@macro-store .com united-trans.orgcontactprivacy.com transfers-auth@names.co.uk rs7qw I b4f275a33c4d65@w86bna54f2 I bffa2ffd I .privatewhois.net do Public Interest Registry admin@simulinux.org billhrodriguezl8423@gmail.com

59

Coordination Center for TLD RU 8, Zoologicheskaya str. Moscow 123242 Russian Federation Coordination Center for TLD RU Boishoy Golovin, 23 107045 Moscow, Russian Federation
2787. 2788. 2789. 2790. 2791. 2792. 2793. 2794. 2795. 2796. 2797. 2798. 2799. 2800. 2801. 2802. 2803. 2804. 2805. 2 806. 2807. 2808. 2809. 2810. 281 1. 2812. 2813. 2814. 28 15. 2816. 2817. 2818. 2819. 2820. 2821. 2822. 2823. 2824. Harmful Botnet Domain Name uralgaz.ru uskamalchik.ru vardington7.ru vastcoins.ru edgefox.ru xlamonline.ru xoophafiel.ru youdontfkjbaher.ru youngmetal.ru yourtulip.ru zanyguery.ru zenhour.ru zlen.ru zxlake3 .ru shoshololo.ru taxescell.ru telefonchukcha.ru tg2000.ru theshop.su tixuanabridge.ru toplake.ru topupdate.ru topupdater.ru topupdaters.ru topupdates.ru toxicyack.ru truststats.ru trutofiTlymemory.su tunesfrag.ru uerstatepw.ru ukadevochka.ru uklopandaberk.ru underfeet.ru sgy.ru shokoladdeath.ru sickstage.ru siimplesale.ru simulatormage.ru Type infector dropzone, infector dropzone, infector infector infector infector infector dropzone, infector infector dropzone dropzone dropzone, infector dropzone dropzone dropzone, source, infector updater dropzone, infector dropzone, infector dropzone, infector infector dropzone, infector infector infector dropzone, infector dropzone, infector dropzone dropzone, infector dropzone dropzone dropzone infector dropzone infector infector dropzone, infector infector dropzone, infector dropzone Whois Email Address https://www.nic.rulwhois http ://www.reg.ru/whoisladmin_contact https://cLient.naunet.ruJc/whoiscontact http://www.reg.rulwhois/admin_contact http://www.reg.rulwhois/admin_contact http://www.reg.ru/whois/admin_contact https://client.naunet.rulc/whoiscontact https://client.naunet.rulc/whoiscontact http://www.reg.rulwhois/admin_contact http://www.reg.ru/whois/admin_contact http://www.reg.rulwhoisJadmin_contact https://client.naunet.ru/c/whoiscontact https://partner.rOl.rulcontact_admin.khtml https://client.naunet.ru/c/whoiscontact http://www.reg.rulwhois/admin_contact http://www.reg.ru/whois/admin contact https://client.naunet.rulc/whoiscontact https://www.nic.rulwhois londry32@mai1.ru https://client.naunet.rulc/whoiscontact http://www.reg.rulwhois/admin_contact http://whois.webnames.ru http://whois.webnames.ru http://whois.webnames.ru http://whois.webnames.ru http://www.reg.ru/whois admin_contact http://www.reg.rulwhois admin_contact trutof@ca4.ru http://www.reg.ru/whois admin_contact http://www.reg.rulwhois/admin_contact http://www.reg.rulwhois/admin_contact https://client.naunet.rulc/whoiscontact http://www.reg.rulwhois/admin_contact https://client.naunet.ru/c/whoiscontact https://client.naunet.rulc/whoiscontact http://www.reg.rulwhois/admin_contact http://whois.webnames.ru https://client.naunet.rulc/whoiscontact

60

2825. 2826. 2827. 2828. 2829. 2830. 2831. 2832. 2833. 2834. 2835. 2836. 2837. 2838. 2839. 2840. 2841. 2842. 2843. 2844. 2845. 2846. 2847. 2848. 2849. 2850. 2851. 2852. 2853. 2854. 2855. 2856. 2857. 2858. 2859. 2860. 2861. 2862. 2863. 2864. 2865. 2866. 2867. 2868. 2869. 2870. 2871. 2872. 2873. 2874. 2875. 2876. 2877.

skykeyboard2.ru smartcheat.ru smokybear.ru snotarms.ru softmarket-drom.ru softmarkets.ru soretag.ru staplescratch.ru staticplan.ru steelcinetecs.ru stfuthesims.ru stripsneko.ru styleforyour.ru svjazbila.ru wrapweb.ru deepanalyse.ru potvamp.ru ptichka.ru purecash.ru pyrohost.su gueenchair.ru guoteandrun.ru rabbitsgohole.ru rehandntersfee.ru rioamazonas.ru rmlakel.ru roguefood.ru rogueroad.ru routerstructo.ru rudeink.ru runnystorm.ru sarjnessfindof.su sdkjgndfjnf.ru seawoljoystick.ru secondconcert.ru secureserfingnet.ru ourtulip.ru ozoneiphone.ru papertulip.ru pearlrumor.ru pellicslotersa.ru phoneajoystick.ru photo-repair.ru plantlunch.ru plastpromcentr.ru poisk.su popspostenkple.ru villiam-grea.ru viperos.ru vologdansk.ru vvmmp.ru wardeed.ru warynews.ru

dropzone dropzone infector dropzone dropzone, dropzone, dropzone dropzone, dropzone dropzone infector dropzone, infector dropzone, source dropzone infector dropzone infector dropzone, dropzone dropzone, dropzone dropzone dropzone, dropzone infector infector dropzone dropzone dropzone dropzone infector infector dropzone dropzone dropzone, dropzone dropzone, dropzone infector dropzone dropzone, dropzone dropzone dropzone dropzone dropzone, dropzone, dropzone, infector dropzone infector

infector infector infector

infector infector

infector infector

infector
-

infector infector

infector

infector infector infector

https://client.naunet.ru/c whoiscontact http://www.reg.rulwhois admin_contact http://www.reg.rulwhois admin_contact http://www.reg.rulwhois/admin_contact https://client.naunet.rulc/whoiscontact https://client.naunet.rulc/whoiscontact http://www.reg.rulwhois/admin_contact https://client.naunet.rulc/whoiscontact http://whois.webnames.ru https://client.naunet.rulc/whoiscontact https://client.naunet.rulc/whoiscontact http://www.reg.ru/whois/admin contact http://www.webdrive.ru/webmaill http://www.reg.rulwhois/admin_contact http://www.reg.rulwhois/admin_contact https://client.naunet.rulc/whoiscontact http://www.reg.ru/whois/admin_contact https://partner.rO 1 .ru/contact_admin.khtml http ://www.reg.rulwhois/admin_contact wizzardzOl@hotmail.com http ://www.reg.ru/whois/admin_contact https ://client.naunet.rulc/whoiscontact https://client.naunet.ru/c/whoiscontact https://client.naunet.rulc/whoiscontact https://client.naunet.rulc/whoiscontact https://client.naunet.ru/c/whoiscontact http://www.reg.ru/whois admin_contact http://www.reg.ru/whois admin_contact https://client.naunet.ru/c/whoiscontact http://www.reg.ru/whois/admin_contact http ://www.reg.ru/whois/admin_contact sarjness@free-id.ru https://client.naunet.rulc/whoiscontact https://client.naunet.rulc/whoiscontact https://client.naunet.rulc/whoiscontact https://client.naunet.rulc/whoiscontact http://www.reg.ru/whois/admin_contact http://www.reg.rulwhois/admin_contact http://www.reg.rulwhois/admin_contact http://www.reg.rulwhois/admin_contact https://client.naunet.ru/c/whoiscontact https://client.naunet.rulc/whoiscontact http://www.reg.ru/whois/admin_contact http://www.reg.rulwhois/admin_contact http://whois.webnames.ru Iionalex@hotmail.ru https://client.naunet.rulc/whoiscontact https://client.naunet.ru/c/whoiscontact http://www.reg.rulwhois admin_contact http://whois.webnames.ru https://www.nic.ru/whois http://www.reg.rulwhois/admin_contact http ://www.reg.rulwhois/admin_contact

61

2878. 2879. 2880. 2881. 2882. 2883. 2884. 2885. 2886. 2887. 2888. 2889. 2890. 2891. 2892. 2893. 2894. 2895. 2896. 2897. 2898. 2899. 2900. 2901. 2902. 2903. 2904. 2905. 2906. 2907. 2908. 2909. 2910. 2911. 2912. 2913. 2914. 2915. 2916. 2917. 2918. 2919. 2920. 2921. 2922. 2923. 2924. 2925. 2926. 2927. 2928. 2929. 293 0.

weaktrash.ru weaponomd.ru wearysnake.ru westfight.ru wildboy.ru winner-bets.ru witlion.ru naughtywifepal.ru nearhog.ru netupdate 1 .ru netupdate4.ru netupdate5 ru netupdate8.ru netupdater.ru netupdaters.ru netupdates.ru netupdatings.ru nicefilmsa.ru nuttyknack.ru okrug2-bel.ru oneant.ru onemoretimehi.ru onepet.ru onlinereger.ru openlocalsnet.ru makethemdie.ru mationsperohe.ru midbomb.ru mildtune.ru minihoseru miniokoyokolia.su missboys.ru misssershmidt.ru mlm-book.ru moodgum.ru muchachoslot.ru munaeghohz.ru nahwisohch.ru namemybet.ru kawabungashop.ru kosmovodki.ru Iameedge.ru Iesslane.ru Ietstarting.ru Iiberweb.ru lostyear.ru Iowerdog.ru Iogicaltrading.ru makeitsosu makemeal ive.ru holdorgold.ru hotupdaters.ru hselrurele.ru

dropzone, infector dropzone, infector dropzone dropzone, infector dropzone, infector dropzone, infector dropzone infector dropzone dropzone, infector dropzone, infector dropzone, infector dropzone, infector dropzone, infector dropzone, infector dropzone, infector dropzone, infector infector dropzone infector dropzone, infector infector infector dropzone, infector dropzone dropzone, infector infector dropzone, infector dropzone, infector dropzone dropzone infector dropzone, infector infector updater dropzone dropzone, infector dropzone, infector dropzone, infector infector dropzone dropzone infector dropzone, infector dropzone, infector infector infector dropzone dropzone, infector dropzone, infector dropzone, infector dropzone infector

http://www.reg.ru/whois/admin_contact https://cp.mastername.ruldomain_feedback/ http://www.reg.ru/whois/admin_contact http://www.reg.rulwhois/admin_contact https://cLient.naunet.ru/c/whoiscontact https ://client.naunet.rulc/whoiscontact https://client.naunet.ru/c/whoiscontact https://client.naunet.ru/c/whoiscontact http ://www.reg.rulwhois/admin_contact http://whois.webnames.ru http://whois.webnames.ru http://whois.webnames.ru http://whois.webnames.ru http://whois.webnames.ru http://whois.webnames.ru http://whois.webnames.ru http://whois.webnames.ru https://partner.rO 1 .ru/contact_admin.khtml http://www.reg.ru/whois/admin_contact https://www.nic.ru/whois http://www.reg.rulwhois/admin_contact https://client.naunet.rulc/whoiscontact http://www.reg.rulwhois/admin_contact http://whois.webnames.ru https ://client.naunet.ru/c/whoiscontact http://www.reg.rulwhois/admin contact https ://ciient.naunet.rulc/whoiscontact http://www.reg.ru/whois/admin_contact http://www.reg.rulwhois/admin_contact http://www.regruJwhois/admin_contact resaw@fastermail.ru http://www.reg.rulwhois/admin_contact https://client.naunet.rulc/whoiscontact https://www.nic.rulwhois http://www.reg.rulwhois/admin_contact https://client.naunet.rulc/whoiscontact https://client.naunet.ru/c/whoiscontact https://client.naunet.rulc/whoiscontact https://client.naunet.rulc/whoiscontact https://client.naunet.rulc/whoiscontact https://client.naunet.ru/c/whoiscontact http://www.reg.rulwhois/admin_contact http://www.reg.ru/whois/admin_contact https://client.naunet.rulc/whoiscontact http://www.reg.ru/whois/admin_contact http://www.reg.ru/whois/admin_contact http://www.reg.ru/whois/admin_contact https://client.naunet.ru/c/whoiscontact https://client.naunet.rulc/whoiscontact https://client.naunet.rulc/whoiscontact https://client.naunet.ru/c/whoiscontact http://whois.webnames.ru http://whois.webnames.ru

62

2931. 2932. 2933. 2934. 2935. 2936. 2937. 2938. 2939. 2940. 2941. 2942. 2943. 2944. 2945. 2946. 2947. 2948. 2949. 2950. 2951. 2952. 2953. 2954. 2955. 2956. 2957. 2958. 2959. 2960. 2961. 2962. 2963. 2964. 2965. 2966. 2967. 2968. 2969. 2970. 2971. 2972. 2973. 2974. 2975. 2976. 2977. 2978. 2979. 2980. 2981. 2982. 2983.

huntersamplifi.ru huntersrafters.ru ignis.net.ru indingo.ru ionicfood.ru ironsum.ru ishopsystem.ru itchyclock.ru itchysauce.ru itisagooddaytodie.ru jad3 .ru jamesbondajent.ru jetcrafting.ru jjustdoit.ru johninjucy.ru jupaizeuph.ru gerlsipslokane.su ghostbustards.ru ghosttrick.ru gigasoftware.ru godfix.ru gorycup.ru greathell.ru greatjazz.ru hairme.ru haltermancelo.ru heyitsme.ru ftwtogether.ru fastgoal.ru fattree.ru favino.ru filebale.ru finans-group-global.ru florianarray.ru comlion.ru cruelsummer.ru cvmed.ru dartzofinybpull.ru delovar999.ru dolgosting.ru domeafavour.ru fabsnot.ru face 1 8.ru fakepict.ru dvsdfvsw.narod2.ru earlyship.ru ecommerceone.ru eepeohothe.ru esperadooptic.ru companian-usa.ru coolsofa.ru cooltruling.ru axeswizardepx.ru

dropzone infector dropzone, infector dropzone infector infector infector dropzone, infector dropzone dropzone, infector dropzone dropzone, infector infector dropzone, infector dropzone dropzone, infector infector dropzone, infector dropzone, infector infector dropzone, infector dropzone, infector dropzone infector infector infector infector dropzone, infector dropzone, infector infector dropzone, infector dropzone infector dropzone updater dropzone infector infector dropzone, infector dropzone, infector dropzone, infector dropzone, infector dropzone, infector dropzone, infector infector dropzone, infector dropzone, infector dropzone, infector dropzone dropzone, infector dropzone infector infector

https://client.naunet.rulc/whoiscontact https ://client.naunet.rulc/whoiscontact kshabanovlist.ru http://www.reg.ru/whois/admin_contact usageppmai1.ru. http://www.reg.rulwhois/admin_contact https://client.naunet.rulc/whoiscontact http://www.reg.rulwhois/admin_contact http://www.reg.ru/whois/admin_contact https://client.naunet.ru/c/whoiscontact https://client.naunet.rulc/whoiscontact https://client.naunet.rulc/whoiscontact https://cp.mastemame.ruldomain_feedback/ http://whois.webnames.ru https://cl ient.naunet.rulc whoiscontact https://client.naunet.rulc whoiscontact gerlsipslokane@bz3.ru http://www.reg.rulwhois admin_contact https://partner.rO 1 .ru/contact_admin.khtml https://client.naunet.ru/c/whoiscontact clients. agava.rulwhois/admin_contact http://www.reg.rulwhois/admin_contact http://www.reg.rulwhois/admin_contact http://www.reg.ru/whois/admin_contact http://www.reg.rulwhois/admin_contact https://client.naunet.ru/c/whoiscontact http://www.reg.rulwhois/admin_contact https://client.naunet.ru/c/whoiscontact https://www.nic.rulwhois http://www.reg.ru/whois admin_contact https://partner.rO I .ru/contact_admin.khtml http://www.reg.ru/whois admin_contact http://whois.webnames.ru https://client.naunet.rulc/whoiscontact http://www.reg.rulwhois/admin_contact https://cp.mastemame.ruldomain feedbackJ https://www.nic.rulwhois https://client.naunet.ru/c/whoiscontact https://client.naunet.rulc/whoiscontact http://whois.webnames.ru https://client.naunet.rulc/whoiscontact http ://www.reg.rulwhois/admin_contact http://www.reg.rulwhois/admin_contact jamcnuttl ll@hotmail.com https://www.nic.rulwhois http://www.reg.rulwhois/admin_contact https://client.naunet.ru/c/whoiscontact https://client.naunet.rulc/whoiscontact https://client.naunet.ru/c/whoiscontact https://client.naunet.rulc/whoiscontact http://www.reg.rulwhois/admin_contact https://client.naunet.rulc/whoiscontact https://client.naunet.rulc/whoiscontact

63

2984. 2985. 2986. 2987. 2988. 2989. 2990. 2991. 2992. 2993. 2994. 2995. 2996. 2997. 2998. 2999. 3000. 3001. 3002. 3003. 3004. 3005. 3006. 3007. 3008. 3009. 3010. 301 1. 3012. 3013. 3014. 3015. 3016. 3017. 3018. 3019. 3020. 3021. 3022. 3023. 3024. 3025. 3026. 3027. 3028. 3029. 3030. 3031. 3032. 3033. 3034. 3035. 3036.

basiliskos.ru becutie.ru bellicbridge.ru bellicoreturbo.ru bestsoftics.ru betternewyear.ru bigupdate.ru bigupdater.ru bigupdaters.ru bigupdates.ru bigupdating.ru bigupdatings.ru bonaguadjriga.ru boredret.ru boutigue26.ru brainrace.ru cakerecipes.ru callmenowhere.ru cekcuc.ru champiogogo.ru cherlend2.ru chot-extreme.ru cloudsaround.ru cloudy-dns.ru boredret.m zhremvkusno.ru gulayemdolgo.ru vodkavkusnaya.ru pyemmonogo.ru pivastemniy.ru forelnamangale.ru kupimbrabusik.ru zubkichistim.ru pyemsokifresh.ru spimkreepko.ru bezhimlegko.ru clopsandsuits.ru dishimgluboko.ru yumorinacheap.ru zhivemdoolgo.ru poedemvpole.ru odessaideribassi.ru Odgt8xx.ru Ogt5dx.ru Ogt6dx.ru Ogt7dx.ru ldgt8xx.ru 2dgt8xx.ru izba4you.ru registration 1 20.ru registration 1 200.ru registration2300.ru registration400.ru

dropzone, infector dropzone infector infector dropzone, infector dropzone, infector infector infector dropzone, infector infector infector dropzone, infector dropzone infector dropzone, infector dropzone dropzone, infector dropzone, infector dropzone, infector infector infector dropzone, infector dropzone, infector dropzone, infector source embeddedjs embeddedjs embeddedjs embeddedjs embeddedjs embeddedj s embeddedjs embeddedjs embeddedjs embeddedjs embedded_js embeddedjs embeddedjs embeddedjs embeddedjs embeddedjs embeddedjs dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone

http://whois.webnames.ru https://www.nic.rulwhois https://client.naunet.rulc/whoiscontact https://client.naunet.rulc/whoiscontact https://client.naunet.rulc/whoiscontact https ://client.naunet.ru/c/whoiscontact bigupdater.ru http://whois.webnames.ru http://whois.webnames.ru http://whois.webnames.ru http://whois.webnames.ru http://whois.webnames.ru https://client.naunet.rulc/whoiscontact https://client.naunet.ru/c/whoiscontact http://www.reg.rulwhois/admin_contact http://www.reg.rulwhois/admin_contact https ://client.naunet.ru/c/whoiscontact https://client.naunet.rulc/whoiscontact http://www.reg.rulwhois/admin_contact https://client.naunet.ru/c/whoiscontact http://www.reg.rulwhois admin_contact https://client.naunet.rulc/whoiscontact https://client.naunet.ru/c/whoiscontact https://client.naunet.ru/c/whoiscontact https://client.naunet.rulc/whoiscontact http://www.reg.rulwhois/admin_contact http://www.reg.rulwhois/admin_contact http://www.reg.ru/whois/admin_contact http://www.reg.rulwhois/admin_contact http://www.reg.ru/whois/admin_contact http://www.reg.rulwhois/admin_contact http://www.reg.ru/whois/admin_contact http://www.reg.ru/whois/admin_contact http://www.reg.rulwhois/admin_contact http://www.reg.ru/whois/admin_contact http://www.reg.rulwhois/admin_contact http://www.reg.rulwhois/admin_contact http://www.reg.ru/whois/admin_contact http://www.reg.ru/whois/admin_contact http://www.reg.rulwhois/admin_contact http://www.reg.rulwhois/admin_contact http://www.reg.rulwhois/admin_contact do Coordination Center for TLD RU do Coordination Center for TLD RU do Coordination Center for TLD RU do Coordination Center for TLD RU do Coordination Center for TLD RU do Coordination Center for TLD RU https://client.naunet.ru/c/whoiscontact do Coordination Center for TLD RU do Coordination Center for TLD RU do Coordination Center for TLD RU do Coordination Center for TLD RU

64

3037. 3038. 3039. 3040. 3041. 3042. 3043. 3044. 3045. 3046. 3047. 3048. 3049. 3050. 3051. 3052. 3053. 3054. 3055. 3056. 3057. 3058. 3059. 3060. 3061. 3062. 3063. 3064. 3065. 3066. 3067. 3068. 3069. 3070. 3071. 3072. 3073. 3074. 3075. 3076. 3077. 3078. 3079. 3080. 3081. 3082. 3083. 3084. 3085. 3086. 3087. 3088. 3089.

registration4300.ru registration4345O.ru registration43500.ru registration445.ru registration46O.ru registration4768.ru registration500.ru registration600.ru registration700.ru registration800.ru registration900.ru majmun.su ygla.ru needfortwomorebilliondollars.ru ciscoc.ru dankin.ru gooddaystart.ru getasamemilliondollars.ru billiard-star.ru koletrezzo44.ru koletrezzo55 .ru koletrezzo66.ru koletrezzo77.ru onlinesourceget.ru dkmsetchdwh-Icmnetrhc.ru dkmsetchdwh-Icmnetrhc 1 .ru remstwedber-keltbrzsemcd .ru remstwedber-keltbrzsemcd I .ru sdemxhtruskdsh-wendtrhnzsef.ru sdemxhtruskdsh-wendtrhnzsefyl .ru shdnerthxkdn-aldatednjfwsnc.ru shdnerthxkdn-aldatednjfwsnc 1 .ru happyfourfriends.ru hotfight.ru irontea.ru megahock.ru nosyfan.ru yummyship.ru dkmsetchdwh-Icmnetrhc.ru dkmsetchdwh-Icmnetrhc 1 .ru remstwedber-keltbrzsemcd.ru remstwedber-keltbrzsemcd 1 .ru sdemxhtruskdsh-wendtrhnzsefy.ru sdemxhtruskdsh-wendtrhnzsefyl .ru shdnerthxkdn-aldatednjfwsnc.ru shdnerthxkdn-aldatednjfwsnc 1 .ru ahawualwbcnd-aewjdkasdk.ru andhersnmrtsh-sawhadnhsya.ru ctmsehbglzth-wtnghapdnsmtrg.ru shajshdthwnlkjas-erwgoabejlad.ru sjahtewhandl-aldhiowhalndas.ru agedstuff.ru emptyspa.ru

dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone, updater dropzone embeddedjs dropzone dropzone embeddedjs embeddedjs dropzone dropzone dropzone dropzone dropzone embeddedj s dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone updater dropzone infector updater source updater dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone updater updater

do Coordination Center for TLD RU do Coordination Center for TLD RU do Coordination Center for TLD RU do Coordination Center for TLD RU do Coordination Center for TLD RU do Coordination Center for TLD RU do Coordination Center for TLD RU do Coordination Center for TLD RU do Coordination Center for TLD RU do Coordination Center for TLD RU do Coordination Center for TLD RU adminmajmun.su https://www.nic.rulwhois http://www.reg.ru/whois/admin_contact https://cp.mastername.ruldomain_feedback/ https://cp.mastername.ru/domain_feedback/ http://www.reg.rulwhois/admin_contact http://www.reg.rulwhois/admin_contact http://www.reg.rulwhois/admin_contact http://www.reg.rulwhois/admin_contact https://client.naunet.ru/c/whoiscontact do Coordination Center for TLD RU do Coordination Center for TLD RU http ://www.reg.ru/whois/admin_contact do Coordination Center for TLD RU do Coordination Center for TLD RU https ://client.naunet.rulc/whoiscontact do Coordination Center for TLD RU do Coordination Center for TLD RU do Coordination Center for TLD RU do Coordination Center for TLD RU do Coordination Center for TLD RU do Coordination Center for TLD RU http://www.reg.rulwhois/admin_contact http://www.reg.rulwhois/admin_contact http://www.reg.rulwhois/admin_contact http://www.reg.rulwhois/admin_contact http://www.reg.rulwhois/admin_contact do Coordination Center for TLD RU do Coordination Center for TLD RU https ://client.naunet.ru/c/whoiscontact do Coordination Center for TLD RU do Coordination Center for TLD RU do Coordination Center for TLD RU do Coordination Center for TLD RU d/O Coordination Center for TLD RU do Coordination Center for TLD RU d/o Coordination Center for TLD RU https://client.naunet.rulc/whoiscontact do Coordination Center for TLD RU do Coordination Center for TLD RU http://www.reg.rulwhois/admin_dontadt http://www.reg.rulwhois/aadmi_dontadt

65

3090. 3091. 3092. 3093. 3094. 3095. 3096. 3097. 3098. 3099. 3100. 3101. 3102. 3103. 3104. 3105. 3106. 3107. 3108. 3109. 31 10. 311 1. 31 12. 31 13. 31 14. 31 15. 31 16. 31 17. 3 118. 31 19. 3120. 3121. 3122. 3123. 3124. 3125. 3126. 3127. 3128. 3129. 3130. 3 131. 3132. 3133. 3. 34. 3135. 3136. 3137. 3138. 3139. 3140. 3141. 3142.

Iitfox.ru smartcheat.ru splitflash.ru steelstorm.su izba4you.ru safetraffIace.ru sebezh.ru arttkachev.ru koletrezzo44.ru koletrezzo55.ru koletrezzo6.ru koletrezzo77.ru billiard-star.ru arttkachev.ru mega-zona.ru dishacid.ru earthfile.ru panbaby.ru pighair.ru vampkeys.ru billiard-star.ru mega-zona.ru agedstuff.ru deadpage.ru mildruby.ru piecerack.ru stormhock.ru avforwarding.ru dayan.ru mega-zona.ru angerlunch.ru dealface.ru tut-freesteam.tut.su gannoover.ru goreeotuma.ru kaleidosskop.ru kommunizzzm.ru listriskevish.ru optimizzzm.ru pereostanovka.ru plan2000putina.ru pravilozhizzzni.ru sheregessh.ru stervyatniks.ru swistertwister.ru zadnj asansa.ru jebote.demand.su mapusismiga.broke.su shop.broke.su avforwarding.ru mega-zona.ru clanguack.ru laketulip.ru

source infector dropzone dropzone, source, infector dropzone embeddedjs dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone infector updater updater dropzone source dropzone dropzone updater infector dropzone updater source dropzone, updater dropzone, updater updater infector dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone updater updater

http://www.reg.ru/whois/admin_contact http://www.reg.ru/whois/admin_contact http://www.reg.rulwhois/admin_contact wi11iam.hi11146@hotmail.com https://client.naunet.ru/c/whoiscontact http://www.reg.rulwhois/admin_contact https://partner.rO I .ru/contact_admin.khtml http://www.reg.ru/whois/admin_contact http:flwww.reg.ru!whois admin_contact https://client.naunet.rulc whoiscontact do Coordination Center for TLD RU do Coordination Center for TLD RU http://www.reg.ru/whois/admin_contact http://www.reg.rulwhois/admin contact system@iphoster.ru http://www.reg.ru/whois/admin_contact http://www.reg.ru/whois/admin_contact http://www.reg.rulwhois/admin_contact http://www.reg.rulwhois/admin_contact http://www.reg.rulwhois/admin_contact http://www.reg.rulwhois/admin_contact system@iphoster.ru http://www.reg.rulwhois/admin_contact http://www.reg.ru/whois/admin_contact http://www.reg.ru/whois/admin_contact http://www.reg.rulwhois/admin_contact http://www.reg.ru/whois/admin_contact http://registrant.ru/who is/form https://partner.rOl.rulcontact_admin.khtml system@iphoster.ru http://www.reg.rulwhois/admin_contact http://www.reg.ru/whois/admin_contact domains@akavita.com https://client.naunet.rulc/whoiscontact https ://client.naunet.ru/c/whoiscontact https://client.naunet.ru/c/whoiscontact https://client.naunet.rulc/whoiscontact https://client.naunet.rulc/whoiscontact https://client.naunet.rulc/whoiscontact https://client.naunet.rulc/whoiscontact https://client.naunet.rulc/whoiscontact https://client.naunet.rulc/whoiscontact https://client.naunet.ru/c/whoiscontact https://client.naunet.ru/c/whoiscontact https://client.naunet.ru/c/whoiscontact http://www.webdrive.rulwebmaill demand.su@allperson.ru gzero@arrest.su gzero@arrest.su http://registrant.ru/whois/form system@iphoster.ru http://www.reg.ru/whois/admin_contact http://www.reg.rulwhois/admin_contact

66

3143. 3144. 3145. 3146. 3147. 3148. 3149. 3150. 3151. 3152. 3153. 3154. 3155. 3156. 3157. 3158. 3159. 3160. 3161. 3162. 3163. 3164. 3165. 3166. 3167. 3168. 3169. 3170. 3171. 3172. 3173. 3174. 3175. 3176. 3177. 3178. 3179. 3180. 3181. 3182. 3183. 3184. 3185. 3186. 3187. 3188. 3189. 3190. 3191. 3192.

viperheart.ru watersod.ru centralintelligenceagency.ru msndctermcnd-sldnemrtchndmawlscnx.ru pkdnmtbczpldt-lsdetmcthnszbaas.ru rncswshdrkstbhl-srtmxbchecwskch.su tdsnmserebttbdehcnd-asrehanmedhtsn.ru comlion.ru linuxhour.ru tunecampxu tunepage.ru caserow.ru edgefox.ru angerlunch.ru legcold.ru noseclan.ru poleblame.ru tiecom.ru moodgum.ru pupwork.ru taxescell.ru edgefox.ru globalnetworkingwebsitefordomainpurpose.ru keyforoperationinmaximumtendencyforofscure ment.ru onlinezoneforchecknresultaboutmaintenance.ru planningforovertheglobesyncofexistencescenari o.ru projectforinvertigationaboutintelligence.ru projectforinvestigationaboutsubspecificintellige nce.ru routearoundtheworlwidesitefordisbursement.ru blingcar.ru Ievischildxu balusizo.ru needears.ru emibors.ru filesziso.ru newsearching.ru noisel.ru onlinetraids.ru rolabork.ru cakedoor.ru Iidlip.ru baedeeguu.ru emivohngu.ru hubooyeew.ru joobieves.ru zeahungee.ru brainrace.ru chintoe.ru 8j1.ru 9iy.ru

dropzone infector dropzone dropzone dropzone dropzone dropzone updater updater updater source dropzone infector infector source dropzone updater updater updater dropzone updater infector dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone updater dropzone, source, infector, updater updater updater updater updater updater updater updater source dropzone source updater updater dropzone updater dropzone source dropzone, infector updater

http://www.reg.ru/whois/admin_contact http://www.reg.rulwhois/admin_contact https://client.naunet.rulc/whoiscontact do Coordination Center for TLD RU c/o Coordination Center for TLD RU admin@mcswshdrkstbhl-srtmxbchecwskch.su do Coordination Center for TLD RU http://www.reg.ru/whois/admin_contact http://www.reg.ru/whois/admin_contact http://www.reg.ru/whois/admin_contact http://www.reg.rulwhois/admin_contact http ://www.reg.rulwhois/admin_contact http://www.reg.rulwhois/admin_contact http://www.reg.rulwhois/admin_contact http://www.reg.rulwhois admin_contact http://www.reg.rulwhois admin_contact http://www.reg.rulwhois admin_contact http://www.reg.rulwhois admin_contact http://www.reg.rulwhois admin_contact http://www.reg.rulwhois/admin_contact http://www.reg.rulwhois/admin_contact http://www.reg.ru/whois/admin_contact do Coordination Center for TLD RU do Coordination Center for TLD RU do Coordination Center for TLD RU do Coordination Center for TLD RU https://client.naunet.rulc/whoiscontact http://whois.webnames.ru https ://client.naunet.rulc/whoiscontact http://www.reg.ru/whois/admin_contact http://www.reg.rulwhois/admin_contact https://client.naunet.ru/c/whoiscontact http://www.reg.rulwhois/admin_contact https://client.naunet.rulc/whoiscontact https://client.naunet.rulc/whoiscontact https://client.naunet.rulc/whoiscontact https://client.naunet.ru/c/whoiscontact https://client.naunet.rulc/whoiscontact https://client.naunet.rulc/whoiscontact http://www.reg.ru/whois/admin contact http://www.reg.ru/whois/admin_contact http://www.reg.rulwhois/admin_contact https://client.naunet.ru/c/whoiscontact https://client.naunet.rulc/whoiscontact http://www.reg.ru/whois/admin_contact https://client.naunet.rulc/whoiscontact http://www.reg.ru/whois/admin_contact http ://www.reg.rulwhois/admin_contact https://client.naunet.ru/c/whoiscontact https://client.naunet.ru/c/whoiscontact

67

3193. 3194. 3195. 3196. 3197. 3198. 3199. 3200. 3201. 3202. 3203. 3204. 3205. 3206. 3207. 3208. 3209. 3210. 321 1. 3212. 3213. 3214. 3215. 3216. 3217. 3218. 3219. 3220.

brainrace.ru levischild.ru needears.ru tablepack.ru vsemskazalpoka.ru vsemskazalpokaO.ru vsemskazalpokal .ru vsemskazalpoka2.ru vsemskazalpoka3.ru vsemskazalpoka4.ru vsemskazalpokas.ru vsemskazalpoka6.ru vsemskazalpoka7.ru vsemskazalpoka8.ru vsemskazalpoka9.ru radarcourt.ru stuffjub.ru Obg.ru 1 digitalsmarkets.ru atlantatoagofs.ru atlantawadding.ru xoophafiel.ru eepeohothe.ru nahwisohch.ru munaeghohz.ru jupaizeuph.ru tolbargueries-google33 .ru tolbargueries-google3 5 .ru

dropzone updater updater source dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone source dropzone dropzone, infector dropzone infector, dropzone dropzone

http://www.reg.rulwhois/admin_contact http://www.reg.ru/whois/admin_contact http://www.reg.rulwhois/admin_contact http://www.reg.rulwhois/admin_contact https ://client.naunet.ru/c/whoiscontact do Coordination Center for TLD RU do Coordination Center for TLD RU do Coordination Center for TLD RU do Coordination Center for TLD RU do Coordination Center for TLD RU do Coordination Center for TLD RU do Coordination Center for TLD RU do Coordination Center for TLD RU do Coordination Center for TLD RU do Coordination Center for TLD RU http://www.reg.ru/whois/admin_contact http://www.reg.rulwhois/admin_contact rake@isprovider.ru https://client.naunet.rulc/whoiscontact https://client.naunet.ru/c/whoiscontact https://c}ient.naunet.ru/c/whoiscontact https://www.nic.rulwhois https://client.naunet.rulc/whoiscontact https://client.naunet.ru/c/whoiscontact https://client.naunet.rulc/whoiscontact https://client.naunet.rulc/whoiscontact https://www.nic.ru/whois https://www.nic.rulwhois

68

Telecommunication Tokelau Corporation (Teletok) Fenuafala Fakaofo Tokelau Dot TK Limited 8 Berwick Street London W1F OPH United Kingdom
Harmful Botnet Domain Name makemoneyonline.tk j3kxheldda.tk 999888 1.TK ARMNPLS.TK buunetfit.tk LODINGS.TK norwits.tk ntoort.tk windlonset.tk sderfytms-wcedmertpnspr.tk sderfytms-wcedmertpnsprl .tk sderf,tms-wcedmertpnspr2.tk sderf,tms-wcedmertpnspr3 .tk sderfytms-wcedmertpnspr4.tk sderfytms-wcedmertpnspr5 .tk sderfytms-wcedmertpnspr6.tk sderftms-wcedmertpnspr7.tk sderftms-wcedmertpnspr8 .tk sderftms-wcedmertpnspr9.tk vnzlashop.tk ownnxwn2na.tk smk4mslnwxDlx8l.tk j3kxhelddb.tk smhn44nclx.tk frmwm40dmh.tk nf23nsmnv.tk Tvne dropzone, infector updater dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone updater updater updater updater updater updater Whois Email Address raykelly I 7gmai1.com abuse@dot.tk abuse@dot.tk abuse@dot.tk abuse@dot.tk abuse@dot.tk abuse@dot.tk abuse@dot.tk abuse@dot.tk abuse@dot.tk abuse@dot.tk abuse@dot.tk abuse@dot.tk abuse@dot.tk abuse@dot.tk abuse@dot.tk abuse@dot.tk abuse@dot.tk abuse@dot.tk abuse@dot.tk abuse@dot.tk abuse@dot.tk abuse@dot.tk abuse@dot.tk abuse@dot.tk abuse@dot.tk

3221. 3222. 3223. 3224. 3225. 3226. 3227. 3228. 3229. 3230. 3231. 3232. 3233. 3234. 3235. 3236. 3237. 3238. 3239. 3240. 3241. 3242. 3243. 3244. 3245. 3246.

69

Taiwan Network Information Center (TWNIC) 4F-2, No. 9, Roosevelt Road, Section 2 Taipei 100 Taiwan
3247. 3248. 3249. 3250. 3251. 3252. 3253. 3254. 3255. 3256. 3257. 3258. 3259. 3260. 3261. 3262. 3263. 3264. 3265. 3266. 3267.
Harmful Botnet Domain Name microfreaks.com.tw masterdominion.com.tw freehost2 1 .tw foresttest2 I 8999fhjslk.com.tw online-protection.tw adminpaneltestasdf000444.com.tw domainfortestingpanel999ll 1.com.tw panelfretbbuiewnwdkhjg8883 33 .com.tw test444for555test333 .com.tw testeradminpanel222777.com.tw testfhjtestpanel2226333 .com.tw testfortestltd444557.com.tw testingltesting2thj3 888222.com.tw testingdomainforthj222000 I .com.tw testingforgOOgle77724s .com.tw testingforinnovation222 1 999.com.tw testinglightversion999lll.com.tw testonlyforfhj33 55591 .com.tw testtestforfhj 1 1 1 998.com.tw testtestingpotatoesl 1 1222.com.tw testtexttost555 888 .com.tw Tvne dropzone, infector dropzone, infector dropzone, infector dropzone, infector embeddedjs dropzone infector infector infector dropzone, infector dropzone dropzone, infector dropzone, infector infector dropzone, infector dropzone, infector dropzone, infector dropzone, infector dropzone, infector dropzone dropzone, infector Whois Email Address adminmicrofreaks.com.tw admin@veryniceofou.com.tw hilarykneber@yahoo.com admin@foresttest28999fhjslk.com.tw cafe@ppmail.ru admin@adminpane1testasdfOO0444.com.tw admin@domainfortestingpane1999111.com.tw adminpanelfretbbuiewnwdkhjg888333 .com.tw admin@test444for555test333.com.tw admin@testeradminpane1222777.com.tw do Taiwan Network Information Center admin@testfortest1td444557.com.tw admin@testinglightversion999 1 1 1 .com.tw admin@testingdomainforfhj2220001.com.tw admintestingforg00g1e777245.com.tw admin(testingforinnovation222 1 999.com.tw admin@testing1ightversion9991l1.com.tw admin@testonlyforfhj3355591.com.tw admin@testfortest1td444557.com.tw admintesttestingpotatoes1 1 1222.com.tw admin@testeradminpane1222777.com.tw

70

000 XocTMacTep 04053, r. KHeB, a/si 23

YKpaHHa Hostmaster Ltd. P.0.Box 89 Kiev-136, 04136 Ukraine Harmful Botnet Domain Name exetsoft.org.ua buyakabuyaka.kiev.ua rftnsbclebp-sndetzahcher. in. ua rftnsbclebp-sndetzahcherO.in.ua rfinsbclebp-sndetzahcherl .in.ua rftnsbclebp-sndetzahcher2. in.ua rftnsbclebp-sndetzahcher3 .in.ua rftnsbclebp-sndetzahcher4.in.ua rftnsbclebp-sndetzahcher5 .in.ua rftnsbclebp-sndetzahcher6.in.ua rftnsbclebp-sndetzahcher7.in.ua rftnsbclebp-sndetzahcher8.in.ua rftnsbclebp-sndetzahcher9.in.ua Tvne dropzone, infector infector, dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone Whois Email Address tgwg-uanic@priv.uanic.ua tv 1 87-uanic@priv.uanic.ua registry@ukrnames.com do Hostmaster Ltd. do Hostmaster Ltd. do Hostmaster Ltd. do Hostmaster Ltd. do Hostmaster Ltd. do Hostmaster Ltd. do Hostmaster Ltd. do Hostmaster Ltd. do Hostmaster Ltd. do Hostmaster Ltd.

3268. 3269. 3270. 3271. 3272. 3273. 3274. 3275. 3276. 3277. 3278. 3279. 3280.

MNI Networks Ltd. Olveston Drive Olveston Salem Montserrat West Indies Lubimal (MS) Ltd. do Kelsick & Kelsick, P.O. Box 185 Woodlands Road, Woodlands Montserrat
3281. 3282. 3283. 3284. 3285. 3286. 3287. Harmful Botnet Domain Name ownnxwn2na.ce.ms smk4mslnwa.ce.ms mt3dooxch.ce.ms oemx88dclo.ce.ms frmwm4Odmh.ce.ms nfp23nsmnv.ce.ms smk4mslnwb.ce.ms Type updater updater updater updater updater updater updater Whois Email Address mgermann@key-systems.net mgermann@key-systems.net mgermann@key-systems.net mgermann@key-systems.net mgermann@key-systems.net mgermann@key-systems.net mgermannkey-systems.net

SWITCH The Swiss Education & Research Network Werdstrasse 2 Zurich CH-8004 Switzerland Universitaet Liechtenstein Fuerst-Franz-Josef-Strasse Vaduz LI-9490 Liechtenstein
3288. 3289. 3290. 3291. 3292. 3293. 3294. Harmful Botnet Domain Name ownnxwn2na.cOm.li smk4mslnwa.cOm.Ii an50smsal2.c0m.li j6sk5hmxkj.c0m.li frmwm40dmh.c0m.li nf23nsmnv.c0m.Ii dcfjctykdyywrth.com.li Type updater updater updater updater updater updater source do do do do do do do Whois Email Address SWITCH SWITCH SWITCH SWITCH SWITCH SWITCH SWITCH

Internet Verwaltungs-und Betriebsgesellschaft m.b.H. Jakob-Haringer-Stral3e 8/V 5020 Saizburg Austria

3295. 3296. 3297. 3298. 3299. 3300. 3301. 3302. Harmful Botnet Domain Name adv-servjce.at onhine-security.at additional-group.at m-sservices.at proto-service.at webhelper.at optiker-gramm.at rietzer-sk.at Type embeddedjs embeddedjs embeddedjs embeddedjs embeddedjs embeddedjs infector infector
-

Whois Email Address miIo(mai1ti.com admin@onhine-security.at admin@additional-group.at admin@additional-group.at iragi@mail 13 .com adminadditiona1-group.at optiker.gramm@aon.at richard.kratzer@liebherr.com

DENIC eG Kaiserstrasse 75-77 Frankfurt am Main 60329 Germany

3303. 3304. 3305. 3306. Harmful Botnet Domain Name seminarload.de ayjay.de sporcu.de tyou.de Type dropzone dropzone infector infector Whois Email Address hostmaster@serverkompetenz.de info@all-inkl.com hostmaster@serverkompetenz.de hostmaster@serverkompetenz.de

EURId vzw/asbl Parkstation Woluwelaan 150 Diegem Vlaams Brabant 1831 Belgium
3307. 3308. 3309. 3310. 331 1. 3312. 3313. Harmful Botnet Domain Name infobbc.eu broker-vinea.eu sicherheit-schild.eu crime-club.eu sicherheit-schild.eu ymlo.eu zaebiz.eu TvDe embeddedjs embeddedjs embeddedjs source embeddedjs dropzone dropzone, infector Whois Email Address domain.manager@pub1icdomainregistry.com do EURid do EURid do EURid do EURid do EURid tech@eurid.eu

76

DNS BE vzw/asbl Ubicenter, Philipssite 5, bus 13 Leuven 3001 Belgium

3314. 3315. Harmful Botnet Domain Name bonfarto.be servicespaypal.be Type source dropzone, infector Whois Email Address hostmaster@one.com domeinen@hostnet.nl

NeuStar, Inc. 21575 Ridgetop Circle Sterling, VA 20166 United States NeuStar, Inc. Loudoun Tech Center 46000 Center Oak Plaza Sterling Virginia 20166 United States China Internet Network Information Center 4, South 4th Street, Zhongguancun, Haidian district, Beijing 100190, China
3316. 3317. 3318. 3319. 3320. 3321. 3322. 3323. 3324. 3325. 3326. 3327. Harmful Botnet Domain Name fgbnutyfhfgjdfghjil.cn trololololo.cn trololololo0.cn trololololol.cn trololololo2.cn trololololo3.cn trololololo4.cn trololololo5.cn trololololo6.cn trololololo7.cn trololololo8.cn trololololo9.cn Tvoe dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone Whois Email Address do NeuStar delicto@mail.ru do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar do NeuStar

78

SIDN P0 Box 5022 6802 EA Arnhem The Netherlands SIDN Meander 501 6825 MD Arnhem The Netherlands
3328. 3329. 3330. 3331. 3332. 3333.
Harmful Botnet Domain Name drankenservicestein.nI vakgararichtlijn.nl bijlesnederland.nI jennifermusic.nl schimmer-online.nl thunnissenexclusief.nl Type

dropzone dropzone dropzone infector dropzone

Whois Email Address abuseargeweb.nl info@lapi.net do SIDN do SIDN schimmer-online.nl keesvanduijn@thunnissenonderhoud.nl

79

Canadian Internet Registration Authority (CIRA) 350 Sparks Street Suite 306 Ottawa Ontario K1R 7S8 Canada
3334.

Harmful Botnet Domain Name americanmobile.ca

Type

Whois Email Address

infector

do CIRA

80

LA Registry Pte Ltd 89 Chelverton Road London SW15 1RW Lao National Internet Committee (LANIC) Science Technology and Environment Agency Prime Ministers Office P. 0. Box 2279 Vientiane Lao PDR Lao Peoples Democratic Republic

3335.

Harmful Botnet Domain Name botcat.la

Type dropzone, infector

Whois Email Address admin@alben.la

81

MARNet Boulevard Partisan Set No.17 1000 Skopje Macedonia ByJIeBap

IIaPTH3aHCKH

Opew 6p.l7
Type dropzone, infector Whois Email Address MARNet

1000 CKoHje

3336.

Harmful Botnet Domain Name 24fun.mk

C 0

82

National Institute for R&D in Informatics Bd. Averescu 8-10 Sector 1 Bucharest 011454 Romania
3337.
Harmful Botnet Domain Name buletindeprima.ro Type

infector

Whois Email Address repossesseddomaingodaddy.com

83

Comite Gestor da Internet no Brash Av. das NaOes Unidas, 11541, 70 andar So Paulo SP 04578-000 Brazil

3338.

Harmful Botnet Domain Name djpeterblue.com.br

Type dropzone, infector

Whois Email Address do Comite Gestor da Internet no Brasil

84

Association of IT Companies of Kazakhstan 6/5 Kabanbai Batyra Office 3 Astana AST 010000 Kazakhstan
3339. 3340. Harmful Botnet Domain Name duowork.kz sox.kz Type Infector dropzone, infector Whois Email Address do Association of IT Companies of Kazakhstan nikolai.vartanyan@mail.ru

85

Institute for Research in Fundamental Sciences Shahid Bahonar (Niavaran) Square Tehran 1954851167 Islamic Republic Of Iran
3341. 3342. 3343. 3344. 3345. 3346. 3347. Harmful Botnet Domain Name e-exchanger.ir faint.ir fileservice.ir freshcomp.ir insane.ir igservice.ir pochemuchka.ir dropzone, dropzone, dropzone, dropzone, dropzone, dropzone, infector Type infector infector infector infector infector infector Whois Email Address jamcnuttlll@hotmail.com jamcnuttl I 1@hotmail.com jamcnuttllhotmail.com jamcnuttl 1 I@hotmail.com jamcnuttlll@hotmail.com jamcnuttlllhotmail.com jamcnuttl I 1@hotmail.com

86

Information Systems Division, Isle of Man Government St Andrews House Finch Road Douglas Isle of Man IM1 3PX United Kingdom Domicilium (loM) Ltd Isle of Man Datacentre Ronaldsway Isle of Man 1M9 2RS United Kingdom
3348. 3349. Harmful Botnet Domain Name forum4you.im cc.im Type dropzone, infector dropzone, infector Whois Email Address do Domicilium (loM) Ltd do Domicilium (loM) Ltd

87

Registro .it Istituto di Informatica e Telematica del CNR CNR

-

AREA DELLA RICERCA

Via Giuseppe Moruzzi, 1 1-56124 PISA Italy

3350.

Harmful Botnet Domain Name garati.it

Type dropzone, infector

Whois Email Address Admin Contact: Ettore Loggia via Scala, 132 Fiumicino 00054 RM IT (no email)

88

GMO Registry, Inc. 26-1 Sakuragaokacho Tokyo 150-8512 Japan

3351.

Harmful Botnet Domain Name holdaslas.so

Type dropzone, infector

Whois Email Address c o GMO Registry, Inc.

89

.au Domain Administration (auDA) 114 Cardigan Street Canton VIC 3053 Australia
3352. 3353. Harmful Botnet Domain Name krhjfc.com.au thestudiospace.com.au Type updater dropzone, infector Whois Email Address whois.ausregistry.com.au do auDA

90

Autoriteti i Komunikimeve Elektronike dhe Postare AKEP Str. Reshit Collaku Nr. 43, Tirana Albania
-

3354.

Harmful Botnet Domain Name hsbc.com.aI

Type dropzone, infector

Whois Email Address

do AKEP

91

Research and Academic Computer Network NASK Wawozowa 18 Warsaw 02-796 Poland
-

3355.

Harmful Botnet Domain Name kupie-dlugi.pl

Type dropzone, infector

Whois Email Address

do NASK

92

Christmas Island Internet Administration Limited Christmas Island Technology Centre (6RCI), Nursery Road, Drumsite Christmas Island Indian Ocean 6798 Christmas Island CoCCA Registry Services (NZ) Limited ha Wynyard Street Devonport Auckland 0744 New Zealand

3356.

Harmful Botnet Domain Name syntaxhack.it.cx

Type dropzone, infector

Whois Email Address gian1ucacampaneIla.org

93

SWITCH The Swiss Education & Research Network Werdstrasse 2 Zurich CH-8021 Switzerland
3357. pinguini.ch dropzone do SWITCH

94

APPENDIX B

Appendix B
1. Harmful Botnet IP Address 173.243. 1 12.20 Type infector, source, dropzone infector, source, dropzone Hosting Company Continuum Data Centers LLC 835 Oak Creek Drive Lombard, IL 60148 Burstnet Technologies, Inc. d/b/a Network Operations Center, Inc. 420-422 Prescott Ave Scranton, PA 18510

2.

64.120.135.186

APPENDIX C

Appendix C
The following is a list of specific file paths or subdomains to be disabled. The general domain name may remain in operation. Only the specific file path or subdomains must be disabled.
1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 1 1. 12. 13. 14. 15. 16. 17. 18. 19. 20. 21. 22. 23. 24. 25. 26. 27. 28. 29. 30. 31. 32. 33. 34. 35. 36. 37. 38. 39. 40. Harmful Botnet Web Address/File Path http://maps.nexuizninjaz.com/check/free.php http://Iartery.netau.net/krrtyyer/gytret.php http://sew.t1.com.ua/img/music/index5 .php http://dineromode.dvrdns.org/morech/gate.php http://ircbot.b1ogdns.net/morech/gate.php http://raktobint.sytes.net: 8080 http://paradoxfiles-ru.na.by index5.php http://www. hans-dabringhausen.de/images imagesheadllogo.php http://jade.nseasy.comlmanishar/7xl9bd.html http://fb.servatusdev.comkservdev/56iy2.html http://costantinifoto.altervista.orgljxbgp8ilindex.html http://giacobbo.a1tervista.org/2g4cl1/index.html http://costantinifoto.altervista.orglgia4cd/index.html http://ecotehno.zzl.org/nx8iI9/index.htm1 http://ilfantaclub.altervista.orgl9g8gcer/index.html http://collogui.aItervista.org/psgt9uk/index.html http://panchalsamaj .x I 0.bzlsnhlcme/index.html http://ip- 184-168-9268. ip.secureserver.net/gwot29s/index.html http://paolamartefli.altervista.orgldva7hi/index.html http://ssggratis.altervista.org/7i6rha1index.htmI http://camgirlmsn.altervista.org/rmhjh5/index.html http://avon.anyservers.com/accur/go2pu9y/index.html http://go1dentouch.99k.org/xsjorzc/index.htm1 http://ns 1 277.websitewelcome.comJasoprestlz79gr2q!index. html http://host 1 .hosting2000.orgkprogenlinczcf/index.html http://daedalus2solar.bplaced.netluooc8gx/index.html http://amonapolicalcio.altervista.orglwxvg7tlindex.html http://startl g.ovh.net/.leperilj/Snmug6x/index.html http://033 I edc.netsolhost.com/akravs/index.html http://ash.phpwebhosting.com/maiselIjs50098/index.htmI http://malta.site5.comkvividimp/20picb/index.html http://wdbadboy2005mi.de.tl http://lanuevaera.x 1 0.mxlb9xow9f/index.html http://blacksite.xhost.ro/n2lzyc5/index.html http://malta.site5.comlvividimp/7dkxhme/index.html http://ns 1 277.websitewelcome.comlasoprestlh97pk1 /index.h tml http://cpOS .digitalpacific.com.aulaustragc/8Os7nn/index.html http://malta.sites .com/vividimp/ 1 ks74o/index.html http://fly.nseasy.comlkennelv 1/mOSmdl/index.html http://members.iinet.net.aulmaccadelicnew/ndb 1 nkl/index. html Type dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source Whois Email Address tyler@detrition.net info@sprendimai.net joel.mayer@tlsystems.eu hostmaster@dyndns.com hostmaster@dyndns.com domains@no-ip.com abuse@hetzner.de domainmaster@teamnet.de sw.nsminmaxgroup.com tom.servatusgmai1.com abuse_rs@altervista.it abuse_rs@altervista.it abuse_rs@altervista.it report@abuse.zymic.com abusers@altervista.it abuse_rs@altervista.it supportx I Ohosting.com dnsjomax.net abuse_rs@altervista.it abusers@altervista.it abuse_rs@altervista.it osmanski@ivhosting.com report@abuse.zymic.com ntIfqyxhcwhoisprivacyprotect.com g.russo@hosting2000.it hostmaster@computino.de abuse rs@altervista.it vicxc7ypo5etsazcn5lr@m.o-w-o.info nocsupervisor@networkso1utions.com domains@phpwebhosting.com domain.admin@site5 .com support@webme.com netops@singlehop.com istoica@yahoo.com (historical) domain.admin@site5 .com nt1fqyxhcwhoisprivacyprotect.com whois.ausregistry.com.au domain.admin@site5 .com sw.ns@minmaxgroup.com whois.ausregistry.com.au

41. 42. 43. 44. 45. 46. 47. 48. 49. 50. 51. 52. 53. 54. 55. 56. 57. 58. 59. 60. 61. 62. 63. 64. 65. 66. 67. 68. 69. 70. 71. 72. 73. 74. 75. 76. 77. 78. 79. 80. 81. 82.

http://www.web3 .bizfindex2.html http://gr.net/fhika http://members.iinet.net.au/.dbw/Oyeebnlindex.html http://tie.ly/_gagccm http://shorl.com/hugarutigrami http://web3 .bizlep ljamlindex.html http://host I .hosting2O00.org/-progen/i86omy/index.html http://host 1 .hosting2000.org/--progenll tlx5h/index.html http://s342953645 .onIine.de/thefastdesignIw7y9kh/index.ht ml http://getfelstatfi l.serveirc.comlmain.php?page 1 1 750cdaf4bde6a7 http://sysdev.c1anteam.com/eisbcfc/index.htm1 http://2.8a.5446.static.theplanet.com/traveladminJkeq7nh/ind ex.html http://eewqrl2.servebeer.com main.php?page 1 1 750cdaf4bde 6a7 http://gentfiloz.serveirc.com/main.php?page=4749d799dd46 1 ec7 http://pass66.dizinc.comJ-timbytec/nhdoum/index.htm1 http://sweethome.serveirc.com/main.php?page=a4ad3cf3d5bd d3 84 http://backlinks.99k.org/6fbcpg3/index.htm1 http:/Is 15419483 .onlinehomeserver.info/bluemars/tz9aeuIindex.htm1 http://backlinks.99k.orgl76oghf/index.html http://badcompanyeredar.ba.ohost.de/gjx6wf0/index.html http://s 15419483 .onlinehomeserver.info/%7Ebluemars/8p1o98x/index.html http://bookshopl 0.xhost.ro/gnhekx/index.html http://badcompanyeredar.ba.ohost.de/gg8s8xe/index.html http://bookshop 1 0.xhost.ro/cvy7m5/index.html http://fe.25.79ae.static.theplanet.comiLblindamaJqzbnbc/index .html http:/fbumblebeeman.enixns.com/bookmi/gcdskg/index.html http://3e.2.79ae.static.theplanet.com/%7Ebizgolf/g4sqnuxlind ex.html http:/Ibadcompanyy.ba.ohost.de/tukono/index.html http://3e.2.79ae.static.theplanet.com/bizgolf/ggfvqs/index.ht ml http://bmw02.neostrada.pl/zfin.html http://masterscomputer.a1tervista.org/11f3rs/index.html http://onIinenews.altervista.org/iw9u2rj.htm1 http://users 1 00.lolipop.jp/boy.jpthonarafc/330u3mlindex.html http://gatorl 057.hostgator.com/--bmccrack/t7sOk9/index.html http://snipr.com/2npp7n http://snipr.com/2nprcm http://redir.ec/eGUJ http://a.md/9DT http://gs.a.md/9Do http://rftp.rf.ohost.de/47rdx2 1 /index.html http://pro.ovh.netkritregiv/jdx9vvy/index.html http://chimera.lunarpages.com/micro I 5/d9vsfihindex.html 2

source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source

team@web3.ms gr.gmbh@googlemail.com whois.ausregistry.com.au teknorhinogmail.com filip@infix.se team@web3.ms g.russohosting2000.it g.russo@hosting2000.it hostmaster@lundl.de domains@no-ip.com jacknetcosolutions.com domains@softlayer.com domains@no-ip.com domains@no-ip.com webmaster@hostdime.com domains@no-ip.com report@abuse.zymic.com hostmaster@lundl.de report@abuse.zymic.com n.buechner@unitedcolo.de hostmaster@lundl.de istoica@yahoo.com (historical) n.buechner@unitedcolo.de domain-admin@listserv.rnc.ro (historical) domains@softlayer.com info@enixltd.com domains@softlayer.com n.buechner@unitedcolo.de domains@softlayer.com info@home.pl abuse_rs@altervista. it abuse_rs@altervista.it jp@muumuu-domain.com support@hostgator.com privacy@dynadot.com privacy@dynadot.com mail@nameaction.com admin@nocdirect.com admin@nocdirect.com n.buechner@unitedcolo.de vicxc7ypo5etsazcn5lr@m.o-w-o.info domains@lunarpages.com

83. 84. 85. 86. 87. 88. 89. 90. 91. 92. 93. 94. 95. 96. 97. 98. 99. 100. 101. 102. 103. 104. 105. 106. 107. 108. 109. 1 10. 111. 1 12. 1 13. 1 14. 1 15. 1 16. 1 17. 1 18. 1 19. 120. 121. 122. 123. 124. 125. 126. 127. 128.

http://qybohubybewu.freewebsitehosting.comlnonplatentiluu2 1 .html http://pdc.bplaced.netlndiuomw/index.html http://wca8532g2.homepage.t-online.de/ylzvww/index.html http://gibubetelo.pochta.ru/mezigogu.htmI http://pdc.bplaced.netlsj6cup/index.html http://pchelpch.pc.ohost.de/2g7vwk/index.html http://wca8532g2.homepage.t-online.de/zjs8o8b/index.html http://mariage.zxg.net/v6f8ij/index.htm1 http://mattandtiera2o 1 1 .zxg.netl67eajc/index.html http://9OpIan.ovh.netlmarocvudlhxegls/index.html http://ryanandassoc.temppub1ish.com/s88pzpfYindex.html http://TACITUS.lunariffic.comimecha7/sgfl nnlindex.html http://saxwksop2.freetcp.comlmain.php?page=b 1 23ee3 17624 7430 http://v008u07gar.maximumasp.com/v5k2jrh/index.htm1 http://tacitus.lunariffic.com/mecha7/t7dth 1/index.html http://pass73 .dizinc.comlrssdevil/7dzgmxglindex.html http://saxwksop2.freetcp.comlcontent/g43kb6j34kblq6jh34kb 6j3k14.jar http://pisxzxe.gpoe.comlmain.php?page=b 1 23ee3 176247430 http://cam08 15 .ca.ohost.de/ajaxam.js http://noe1g.host22.com/ajaxam.js http://safedownload.hopto.org/main.php?page2cef279c7a3c I 0d2 http:I/terstata. instanthq.comlmain.php?page=3a23d88707335 55a http://www.amigosdeloajeno.mihost.biz/ajaxam.js http://lookitup.webatu.com/ajaxam.js http://cirangeI.net78.net/ajaxam.js http://gorecznik.home.pI/ajaxam.js http://partnerrid.ikwb.com/main.php?page=b 1 23ee3 17624743 0 http://getmybit.servequake.com/main.php?page=0 I a64bf4 112 5d37a http://domovnik.ic.czlajaxam.js http://soltys.tym.czJajaxam.js http ://jeanpaulstocks.zxg.netJajaxam.js http://nandtesystco.pochta.ru/ijomerem.html http://philstrobi.bplaced.netJajaxam.js http://chattbook.pyta1host.com/ajaxam.js http://staytuned.99k.org/ccounter.js http://sven89.bplaced.netlajaxam.js http://veldhuisen-media.woelmuis.nl/adsens.js http://tbattitu.o2switch.net/ajaxam.js http://00587 15 .netsolhost.comljjguery.js http://therallyproductions.woelmuis.nI/ajaxam.js http://s207455068.online.de/adsens.js http://s3 88939403 .mia!ojamiento.es/ajaxam.js http://nutz.zzI.org/stcounter.js http://moneymaker.zymichost.com/jjguery.js http://down!oaddatafast.serveftp.comlmain.php?pagedb3408 bf080473cf http://sownload.zapto.org/main.php?page=2cd375 1 6bfc47eba

source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source

domainsnetgears.com xrmb2@che11o.at hostmaster@t-onhine.net https://cp.centrohost.ru/contact_admin.khtml xrmb2@che11o.at n.buechner@unitedcolo.de hostmaster@t-onhine.net report@abuse.zymic.com report@abuse.zymic.com vicxc7ypo5etsazcn5 lr@m.o-w-o.info admin@dnsone.net domains@lunarpages.com nsi@changeip.com joe.oesterling@cbeyond.net domains@lunarpages.com webmaster@hostdime.com nsi@changeip.com nsi@changeip.com n.buechner@unitedcolo.de awex@hostprince.com domains@no-ip.com nsichangeip.com dominios@arturoaparicio.com awex@hostprince.com awex@hostprince.com infohome.pI nsichangeip.com domains@no-ip.com domeny@nodus.cz domeny@nodus.cz report@abuse.zymic.com https://cp.centrohost.ru/contact_admin.khtml xrmb2@che11o.at webmaster@marjano.com report@abuse.zymic.com xrmb2(che11o.at admin@nocdirect.com support@o2switch.fr nocsupervisor@networkso1utions.com abuse@leaseweb.com hostmaster@ lund! .de abuse@oneandone.net report@abuse.zymic.com reportabuse.zymic.com domains@no-ip.com domains@no-ip.com

129. 130. 131. 132. 133. 134. 135. 136. 137. 138. 139. 140. 141. 142. 143. 144. 145. 146. 147. 148. 149. 150. 151. 152. 153. 154. 155. 156. 157. 158. 159. 160. 161. 162. 163. 164. 165. 166. 167.

http://loaddocsfast.servehttp.com/main.php?page=64078c3dc 54bfa8a http://CN20090 135 .p-client.netfkquery.js http://chattbook.ch.funpic.de/kguery.js http://czanna.webege.com/kguery.js http://ral2.ra.funpic.de/statcounter.js http://tarracogo1dfish.zxg.net/jgueri.js http://tbattitu.o2switch.net/statcounter.js http://freefreefree.sytes.netJmain.php?page=4a4fd3 141 d846cd d http://bootle.servebeer.comlmain.php?page=64078c3dc54bfa 8a http://ftpstore.sytes.net/main.php?page=977334ca1 1 8fcb8c http://grankeysehteelsp3 .hotbox.rulurepemys.html http://pin.bissnes.net/iei71o/index.htm1 http://ecommerce.nuvention-dev.org/76f4b3/index.html http://financeportal.sytes.net/main.php?page=1 1 1d937ec38dd I 7e http://migre.me/5ZTtg http://perbesuscsemyzk42.pop3 .rulhelazyj .html http:I/vs 170173 .vserver.de/r 1 d6pf.html https://mlbtnnew55s.cx.cc/mybt/hzigate.php https://mlbtnnew888.cx.cc/mybtJhz/gate.php https://mlbtnnewl 1i.cx.cc/mybtJhz/gate.php https://mlbtnnew222.cx.cc/mybtJhz/gate.php https://mlbtnnew333 .cx.cc/mybtlhz/gate.php http://fff555.cx.cc/cpp/gate.php http://fff666.cx.cc/application/hthal5 .php http://fff777.cx.cc/application2/hthal I .php http://tbyu657ib7k67iddro.cx.cc: 8080/pic 1 sofs.php http://asdfasdgqghgsw.cx.cc/forum.php?tp=8 1 4e9f808 1 e083c 2 http://wergcrhvtyifupqasf.cx.cc/main.php?pageOb2d44See44 79ec7 http://cdethstfrjhstfrjeadfrds.cx.cc/main.php?page2eff3 ec7 if d39078 http://nacharejected.cx.cc/main.php?page=ce862eccdc I e4cd6 http://ach-rejected.cx.cc/main.php?pagece862eccdc 1 e4cd6 http://cancelednacha.cx.cc/main.php?page=ce862eccdc 1 e4cd6 http://nacha-reports.cx.cc/main.php?pagece862eccdc 1 e4cd6 http://nacha-details.cx.cc/main.php?pagece862eccdc I e4cd6 http://hgqkehgcmvuqisdfkop.cx.cc/main.php?pagea85f6ff3ff 9f5213 http://irofojghqhyhurtjhnalsop.cx.cc/main.php?page363cbO7 6cf50e6a5 http://hlqueghfkjhasdfcmfiaopdf.cx.cc/main.php?page363cb 076cf50e6a5 http://dsfbgkjerqfijkevyhfger.cx.cc/main.php?page= 1 9dcbf92 4e67dd7e http://mgrezlxnswkd-alsdsmcyrthsagkdcb.cu.cc/

source source source source source source source source source source infector source source source source infector source dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone

domains@no-ip.com info@provider.nl n.buechner@unitedcolo.de awex@hostprince.com n.buechner@unitedcolo.de report@abuse.zymic.com contact@gandi.net domains@no-ip.com domains@no-ip.com domains@no-ip.com https://cp.centrohost.ru/contact_admin.khtml order@iphoster.ru whois@bluehost.com domains@no-ip.com jonnyken@gmail.com hups://cp.centrohost.rulcontact_admin.khtml domainsdomains.intergenia.de internetservicegmx.com internetservicegmx.com internetservicegmx.com intemetservice@gmx.com internetservice@gmx.com intemetservicegmx.com internetservicegmx.com internetservicegmx.com internetservicegmx.com internetservicegmx.com intemetservicegmx.com intemetservicegmx.com intemetservicegmx.com intemetservice@gmx.com intemetservicegmx.com intemetservicegmx.com intemetservice@gmx.com intemetservicegmx.com internetservicegmx.com internetservicegmx.com internetservicegmx.com admin@cu.cc

168. 169. 170. 171. 172. 173. 174. 175. 176. 177. 178. 179. 180. 181. 182. 183. 184. 185. 186. 187. 188. 189. 190. 191. 192. 193. 194. 195. 196. 197. 198. 199. 200. 201. 202. 203. 204. 205. 206. 207. 208. 209. 210. 21 1.

http://mgrezlxnswkd-alsdsmcyrthsagkdcbO.cu.cc/ http://mgrezlxnswkd-alsdsmcyrthsagkdcb I .cu.cc/ http://mgrezlxnswkd-alsdsmcyrthsagkdcb2.cu.cc/ http://mgrezlxnswkd-alsdsmcyrthsagkdcb3 .cu.cc/ http://mgrezlxnswkd-alsdsmcyrthsagkdcb4.cu.cc/ http://mgrezlxnswkd-alsdsmcyrthsagkdcb5 .cu.cc/ http://mgrezlxnswkd-alsdsmcyrthsagkdcb6.cu.cc/ hup://mgrezlxnswkd-alsdsmcyrthsagkdcb7.cu.cc/ http://mgrezlxnswkd-alsdsmcyrthsagkdcb8.cu.cc/ http://mgrezlxnswkd-alsdsmcyrthsagkdcb9.cu.cc/ http://xdcvygkiyipbkjmnds.cu.cc/forum.php?tp=86 I a283626b Sfe6b http://vpsuk.co.cc:53 http://Odgt8xx 1 .co.cc:443 http://1 dgt8xx 1 .co.cc:443 http://2dgt8xx 1 .co.cc:443 http://jeronimkali23 .co.cc/nomore 1 23/gate.php http://Iupinaval 123 .co.cc/nomore 1 23/gate.php http://tendonina.co.cc/nomore 1 2/gate.php http://beshenklipst.co.cc/mulg/gate.php http://hastlooksz.co.cc/mulg/gate.php http://linnexmandg.co.cc/mulg/gate.php http://mixmunelrtn.co.cc/mulg/gate.php http://nrkloopres.co.cc/mulg/gate.php http://pilermansox.co.cc/mulg/gate.php http://chsparkos.co.cc:8080/pic 1 sofs.php http://uybkyukn78k67rvjyro.co.cc:8080/pic 1 s0fs.php http://war9932rerew.co.cc: 8080/pie 1 sofs.php http://vpsnl.co.cc/ http://vpsuk.co.cc/ http://redirlsonnapking.co.cc/bot.exe http://redirrickagmentive.co.cc/redir.php http://redirstregentedhosplings.co.cc/redir.php http://vpsnl.co.cc/gate.php http://vpsuk.co.cc/gate.php http://fredxs 1231 4.co.cc/point http://fredxs 12323 .co.cc/point http://fredxs 1 2332.co.cc/point http://fredxs 12341 .co.cc/point http://fredxs 123 50.co.cc/point http://pk 1 23pk42er.co.cc:5788 http://pkl24pk2 1 3er.co.cc:5788 http://pkl 25pk45er.co.cc:5788 http://pkl 26pk245er.co.cc:5788 http://hatefelony44 1 .co.cc/config/bot.php

dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone source dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone infector dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone source, infector dropzone dropzone dropzone dropzone dropzone dropzone dropzone
,

admin@cu.cc admin@cu.cc admin@cu.cc admin@cu.cc admin@cu.cc admin@cu.cc admin@cu.cc admin@cu.cc admin@cu.cc admin@cu.cc admin@cu.cc legal@co.cc legal@co.cc legal@co.cc 1ega1co.cc Iegal@co.cc 1ega1co.cc legal@co.cc lega1co.cc legal@co.cc 1ega1co.cc Iegal@co.cc Iegal@co.cc Iegal@co.cc legal@co.cc 1ega1co.cc 1ega1co.cc lega1co.cc Iega1co.cc Iegal@co.cc legal@co.cc 1ega1co.cc Iegal@co.cc legal@co.cc Iega1co.cc Iegal@co.cc Iega1co.cc legal@co.cc legal@co.cc Iega1co.cc 1egaI(co.cc 1egaIco.cc 1ega1(co.cc legal@co.cc

212. 213. 214. 215. 216. 217. 218.

http://1 dgt8x6 1 2.co.cc:4443 http://2dgt84x 13 .co.cc:4443 http://3dgt82x 1 4.co.cc:4443 http://jero2nim2kali23 .co.cc/bem_gate/gate.php http://lupi2 1 nav3al 123 .co.cc/bern_gate/gate.php http://tend4oninanos 1 .co.cc/bern_gate/gate.php http://online-zona.co.cc/engine/on.php

1egaIco.cc Iegal@co.cc legal@co.cc Iegal@co.cc 1egaIco.cc Iegal@co.cc 1ega1co.cc

219. 220. 221. 222. 223. 224. 225. 226. 227. 228. 229. 230. 231. 232. 233. 234. 235. 236. 237. 238. 239. 240. 241. 242. 243. 244. 245. 246. 247. 248. 249. 250. 251. 252. 253. 254. 255. 256. 257. 258. 259. 260. 261. 262. 263. 264.

http://thedarkzonechat.co.cc/community/images/index5 .php http://fredxs 1231 .co.cc/uugt/gate.php http://fredxs 1 232.co.cc/uugt/gate.php http://fredxs 1233 .co.cc/uugtlgate.php http://fredxs I 234.co.cc/uugt/gate.php http://fredxs 1235 .co.cc/uugt/gate.php http://fredxs 1245 .co.cc:3752 http://fre4xs 1 246.co.cc:3752 http://fredxs 1 247.co.cc:3 752 http://fredxs 1 248.co.cc:3752 http://fredxs 1 249.co.cc:3752 http ://online-zona.co.cc/engine/next2.php http://vpsuk.co.cc/cp/gate.php http://rajbhanse.co.cc/images/js.js http://rajbhanse.co.cc/js.js http://tttpp I .cz.cc/ 1 /index.php http://bhood.cz.cc/spyeye/mainlgate.php http://kzoklo.cz.cc/rr.php http://herrmonaglf.cz.cc/em.php http://Jongerm.cz.cc/rr.php http://Iongemsen.cz.cc/rrr.php http://unifenmes.cz.cc/pis.php http://refg4thu56j7klbnm.cz.cc: 8080/pici s0fs.php http://eve11s234858997.cz.cc/cpss/weaspp.php http://eve11s234858997.cz.cc:8080 http://hostsolioo.cz.cc/cpss/webcred.php http://ldofoibuyas.cz.cc/forum.php?tp=8bcc822a05 189962 http://nbhjbyatrsd.cz.cc/forum.php?tp=02be77593f350f96 http://dfufrghgasdf.cz.cc/forum.php?tp=90c8a53a07d563 1 d http://egrgbczbdgger.cz.cc/index.php?tp=9d 1 1 5d328 I bf42 14 http://dsgjhdfgath.cz.cc/forum.php?tp=ec 1 3bb9673 84b4a6 http://sddghdskfgjr.cz.cc/forum.php?tp=ee2ef72f535564e9 http://bnhkdfghadfg.cz.cc/forum.php?tp=6998ca3 1 2c 143687 http://jfgggggdhcv1hflu.cz.cc/main.php?page=2f692f8fde2d5 le http://dtfrsykdflofyluolpu.cz.cc/main.php?page=2f692f98fde2 d5 I e http://sghdyjhdtyktrydfg.cz.cc/main.php?page=8ef63c2673 c6f 66a http://cwrhryjjfdhsrsdfc.cz.cc/main.php?page=ad89 1 989d I e4 ae62 http://ajkbgfajkdghsjkfadsfgdh.cz.cc/main.php?page=2ef5c8d 245d84484 http://kugkbqwhetcvjsdfgqer.cz.cc/main.php?page=6ab9084a b99c9482 http://jfjfhfhuqnbnciper.cz.cc/main.php?page=46df69 1 6c2a8 7d98 http://xwwwwhtryjqafvmjhj iouty.cz.cc/main.php?page9647 286421 ee3fd6 36osafeupdateo2.gicp.net/36osafe.bin 36Osafeupdateo2.gicp.net/360safe.php 3apa3a.tomsk.tw/c/cfg.bin 3apa3a.tomsk.tw/web/gate.php 7system.ezua.com/cfg/config.php

dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone source source dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone source source source source source source source source source source source source source source source infector dropzone infector dropzone infector

legal@co.cc Iegal@co.cc 1ega1co.cc Iega1co.cc legal@co.cc Iegal@co.cc legal@co.cc legal@co.cc Iegal@co.cc Iegal@co.cc Iegal@co.cc Iegal@co.cc Iegal@co.cc 1ega1co.cc Iegal@co.cc dominiguepiatti@hotmail.com dominiguepiattihotmai1.com dominiguepiattihotmai1.com dominiguepiatti@hotmail.com dominiguepiatti@hotmail.com dominiguepiatti@hotmail.com dominiguepiattihotmai1.com dominiguepiatti@hotmail.com dominiguepiatti@hotmail.com dominiguepiatti@hotmail.com dominiguepiatti@hotmail.com dominiguepiatti@hotmail.com dominiguepiattihotmai1.com dominiguepiatti@hotmail.com dominiguepiatti@hotmail.com dominiguepiath@hotmail.com dominiguepiatti@hotmail.com dominiguepiatti@hotmail.com dominiquepiatti@hotmail.com dominiquepiatti@hotmail.com dominiquej,iatti@hotmail.com dominiquepiatti@hotmail.com dominiquepiatti@hotmail.com dominiquepiattihotmaiI.com dominiquepiatti@hotmail.com dominiquepiatti@hotmail.com yezi@oray.com yezi@oray.com dm@ezar.ru dm@ezar.ru nsi@changeip.com

265. 266. 267. 268. 269. 270. 271. 272. 273. 274. 275. 276. 277. 278. 279. 280. 281. 282. 283. 284. 285. 286. 287. 288. 289. 290. 291. 292. 293. 294. 295. 296. 297. 298. 299. 300. 301. 302. 303. 304. 305. 306. 307. 308. 309. 310. 31 1. 312. 313. 314. 315.

alexej-borovickov.narod2.rulblack.bin alexej-borovickov.narod2.ru/white.bin http://asddsrterter.uni.me/Ied/config.php asia-euromillions.co.cc/ioulbot.exe asia-euromillions.co.cc/iou/config.bin asia-euromillions.co.cc/iou/gate.php barugen.dlinkddns.comlz/Idr.exe barugen.dlinkddns.comlz/cfg.bin barugen.dlinkddns.comlz/gate.php berdonet20ll.dlinkddns.com/zJldr.ex berdonet20ll.dlinkddns.com/z/cfg.bin berdonet20 11 .dlinkddns.comlzlgate.php bionetlladlinkddns.comlzlldr.exe bionetlla.dlinkddns.comlzJcfg.bin bionetlla.dlinkddns.com/zlgate.php drilng.dlinkddns.comlz/Idr.exe drilng.dlinkddns.comlzfcfg.bin drilng.dlinkddns.comlz/gate.php honetop20.dlinkddns.com/z/Idr.exe honetop20.dlinkddns.com/z/cfg.bin honetop20.dIinkddnscom/z/gate.php ivan-ivanovivanchenk.narod2.ru/black.bin ivan-ivanovivanchenknarod2.ru/white.bin mpout.dlinkddns.comlzlldr.exe mpout.dlinkddns.comlz/bot.exe mpout.dlinkddns.coniJzJcfg.bin mpout.dlinkddns.com/z/gate.php botnetdown.gicp.net/winupdateze.exe candy-models.co.cc/jobcfg/cfg.bin ccleanerwithsteak.co.ccfbot.exe ccleanerwithsteak.co.cc/config.bin ccleanerwithsteak.co.cc/gate.php choiodos.kodingen.comltstJflower.ex choiodos.kodingen.comltstJconfig.bin choiodos.kodingen.comltst/Iion.php coooolzz.zapto.org/Iocal.exe coooolzz.zapto.org/zs.exe cp 101 .sharkserve.comlcc/config.bin cp 101 .sharkserve.comlcc/gate.php dlugitarg 1-1 0.home.pI/fo4.exe dns 1 .nsdnsrv.comlssl.exe dns 1 .nsdnsrv.comlxml.php domainnameprovder.cz.cc/job2/shit.e domainnameprovder.cz.cc/job2/cfg.bin domainnameprovder.cz.cc/job2/exitphp domainsrecords.co.cc/job20/exit.php domainsrecords.co.cc/job3/exit.php eewqr 1 2.servebeer.comlw.php?f=26&e= funtime.arvixe.ru/imgslbayy.exe funtime.arvixe.ru/different_1 /banner.tiff funtime.arvixe.ru/different 1 /banner.tiff

infector infector updater infector infector dropzone infector infector dropzone infector infector dropzone infector infector dropzone infector infector dropzone infector infector dropzone infector infector infector infector infector dropzone infector infector infector infector dropzone infector infector dropzone infector infector infector dropzone infector infector dropzone infector infector dropzone dropzone dropzone infector infector infector infector

https://www.nic.ru/whois https://wwwnic.niJwhois dominiguepiatti@hotmail.com 1egaIco.cc legal@co.cc Iegal@co.cc j Iai@dlink.com j Iai@dlink.com jlai@dlink.com jlai@dlink.com jlai@dlink.com jlai@dlink.com jlai@dlink.com j Iai@dlink.com jlai@dlink.com jlai@dlink.com jlai@dlink.com jlai@dlink.com jlai@dlink.com jlai@dlink.com jlai@dlink.com https://www.nic.rulwhois https://www.nic.rulwhois jlai@dlink.com jlai@dlink.com jlai@dlink.com jlai@dlink.com yezi@oray.com abuse@iana.org abuse@iana.org abuse@iana.org abuse@iana.org domains@kodingen.com domains@kodingen.com domainskodingen.com domains@no-ip.com domains@no-ip.com webmaster@sysmesh.com webmaster@sysmesh.com info@home.pl dfghrter@hotmail.com dfghrter@hotmail.com dominiguepiatti@hotmail.com dominiguepiatti@hotmail.com dominiguej,iatti@hotmail.com abuse@iana.org abuse@iana.org domains@no-ip.com http://whois.webnames.ru http://whois.webnames.ru http://whois.webnames.ru

316. 317. 318. 319. 320. 321. 322. 323. 324. 325. 326. 327. 328. 329. 330. 331. 332. 333. 334. 335. 336. 337. 338. 339. 340. 341. 342. 343. 344. 345. 346. 347. 348. 349. 350. 351. 352. 353. 354. 355. 356. 357. 358. 359. 360. 361.

funtime.arvixe.ru/myoldlgate.php gameslist.got-game.org/list.php guiodertoll.dlinkddns.comlzJldr.exe guiodertoll.dlinkddns.comlz/cfg.bin guiodertoll.dlinkddns.com/zlgate.php h2 121 1 .srv7.test-hf.ru/bot.exe h2 1211 .srv7.test-hf.ru/config.bin h2 121 1 .srv7.test-hf.ru/gate.php hewj .ignorelist.comibackend/recycle.bin hewj .ignorelist.comibackend/store.php hewj .mooo.comlcheckoutlrecycle.bin hewj .mooo.comlbackendlrecycle.bin hewj .mooo.comlbackendlstore.php http://iasderwert.aaa.ailled/config.php iopyte.bget.ruJloI/pok.bin iopyte.bget.ruJlol/loe.php https://titolari.cartasi.it/portaleTitolariljs/extJadapter/ext/extbase.js kabertompo.dlinkddns.com/zlcfg.bin kabertompo.dlinkddns.com/zlgate.php koukou.mine.nu/zadminlbot.exe koukou.mine.nulzadminlconfig.bin koukou.mine.nu/zadminlgate.php marciuxtest.co.cc/job3/shit.exe marciuxtest.co.cc/jobcfg3/cfg.bin marciuxtest.co.cc/job3/exit.php mibolyri.pisem.su/profi.bin microsofto.sytes.netlweb/config.bin microsofto.sytes.netlweb/gate.php mz.u-gu.rulvktbot.exe mz.u-gu.rulconfig.bin mz.u-gu.rulgate.php ohfansub. instantfreesite.com/game.e ohfansub.instantfreesite.comlupdate.bin ohfansub.instantfreesite.comlgate.php retomend.dlinkddns.comlzlcfg.bin retomend.dlinkddns.comlzfgate.php si 30662.gridserver.comlzeus/config.bin sc00d.webatu.com/00/cfg.bin scood.webatu.comJOO/gate.php serlene.serveblog.netlmove/config.bin serlene.serveblog.netlcheckout/recycle.bin serlene.zapto.org/checkoutlrecycle.bin serlene.zapto.org/move/config.bin darkoansestg.zapto.org/ezfsrnm/sabrerry.php serva4ok.server2.eu/10v3/cfg_z3u5 .bin serva4ok.server2.eu/10v3/g4t3_z3u5 .php

dropzone dropzone infector infector dropzone infector infector dropzone infector dropzone infector infector dropzone updater infector dropzone embedde djs infector dropzone infector infector dropzone infector infector dropzone infector infector dropzone infector infector dropzone infector infector dropzone infector dropzone infector infector dropzone infector infector infector infector dropzone infector dropzone

http://whois.webnames.ru nsi@changeip.com jlai@dlink.com jlai@dlink.com jlai@dlink.com http://whois.webnames.ru http://whois.webnames.ru http://whois.webnames.ru hostmaster@afraid.org hostmaster@afraid.org hostmaster@afraid.org hostmaster@afraid.org hostmaster@afraid.org jeroen@kuiper.in https://partner.rO 1 .rulcontact_admin.khtml https://partner.rO 1 .rulcontact_admin.khtml angeIo_dandreacartasi.it jlai@dlink.com j lai@dlink.com hostmaster@dyndns.com hostmaster@dyndns.com hostmaster@dyndns.com abuse@iana.org abuse@iana.org abuse@iana.org manager-pochta@relax.ru domains@no-ip.com domains@no-ip.com https://www.nic.rulwhois https://www.nic.rulwhois https://www.nic.rulwhois edc5e8a9ec3d4dfa944d63e 1 c8O3c3aa.protect@who isguard.com edc5e8a9ec3d4dfa944d63e 1 c8O3c3aa.protect@who isguard.com edc5e8a9ec3d4dfa944d63e 1 c8O3c3aa.protect@who isguard.com jlai@dlink.com jlai@dlink.com mtdomains(mediatempIe.net awex@hostprince.com awex@hostprince.com domains@no-ip.com domains@no-ip.com domains@no-ip.com domains@no.ip.com domainsno-ip.com eurid@websuche.de eurid@websuche.de

362. 363. 364. 365. 366. 367. 368.

369.

370. 371. 372. 373. 374. 375. 376. 377. 378. 379. 380. 381. 382. 383. 384. 385. 386.
387. 388.

ssss.everywebspace.com/ZEU S/config.bin ssss.everywebspace.com/ZEUS/gate.php statserver.admin 1 63biz.ru/statistics/optio statserver.admin 1 63biz.ru/statistics/adminlstatme.php thelookaround.net.atservers.netltemp/tmp/gate.php tr.hyundaita.com/w.php?f= 1 6&e0 troj .zx9.de/confIg.bin troj .zx9.de/gate.php vdugu39.co.cc/images/logo2.cdr vdugu39.co.cc/imagesfbanner.php vitia-bolotin.narod2.ru!black.bin vitia-bolotin.narod2.rulwhite.bin wisework.orge.plladminka/gate.php woodyalternative.nsl.name/zs/wgate.php woodyalternative2.ns I .name/zs/woody.bin zxz666.darktech.org/zeus/gate.php zxz666.myftp.org/zeus/builderfbot.e zxz666.myftp.org/zeus/builder/cfg2.bin zxz666.myftp.org/zeus/gate.php lindenbolle.cjb.netlmind/index.php longehinter.cjb.netlmind/index.php lresterlonhs.cjb.netJmind/index.php mikalongesti.cjb.net/mind/index.php mingermancjb.netlmind/index.php rupertnn.cjb.net/mind/index.php
windemmvz.cjb.net/mind/index.php media.e 1 s2.net

infector dropzone infector dropzone dropzone infector infector dropzone infector dropzone infector infector dropzone infector dropzone infector dropzone infector infector infector dropzone dropzone dropzone dropzone dropzone dropzone
, , dropzone dropzone embedde djs

contact@myprivateregistration.com contact@myprivateregistration.com http://www.webdrive.rulwebmaill http://www.webdrive.ru/webmail/ oleg@active.by hyundaita.com@domainsbyproxy.com info@websuche.de info@websuche.de abuse@iana.org abuse@iana.org https://www.nic.rulwhois (historical) https://www.nic.ru/whois (historical) pomoc@ovh.pl pomoc@ovh.pl support@changeip.com leviathandarktech.org domains@no-ip.com domains@no-ip.com domainsno-ip.com cjb@cjbmanagement.com cjb(cjbmanagement.com cjbcjbmanagement.com cjb@cjbmanagement.com cjb(cjbmanagement.com
cjb@cjbmanagement.com cjb@cjbmanagement.com

donaldsemrau@yahoo.com

389. 390. 391. 392. 393. 394. 395. 396. 397. 398. 399. 400. 401. 402.

roncbag.cz.cc fisixjhia.co.be mnuyspe.co.be sammy.dommel.be 3apa3a.tomsk.tw 7system.ezua.com isdfsrttygza.biz.tm isdfsrttygza.com.li moporikolis.bee.pl toloveornottolove.ipg.co adgga.co.cc shop.solution-networks.de asia-euromillions.co.cc polusuk.co.cclbest/bbbb.exe

source source source source infector, dropzone infector updater updater dropzone infector infector source dropzone infector, dropzone source
,

dominiguepiatti@hotmail.com hostmaster@eurodns.com hostmaster@eurodns.com support@dommel.com dm@ezar.ru nsi@changeip.com hostmaster@afraid.org domein@kuiper.in domenyconsultingservice.pl john@johnleach.co.uk legal@co.cc info@x2-network.de legalco.cc Iegal@co.cc

APPENDIX D

Trademark Electronic Search System (TESS)

Page 1 of 2

United States Patent and Trademark Office

Home|Site Index|Search|FAQ|Glossary|Guides|Contacts|eBusiness|eBiz alerts|News|Help

Trademarks > Trademark Electronic Search System (TESS)

TESS was last updated on Fri Mar 16 04:35:47 EDT 2012

Logout

Please logout when you are done to release system resources allocated for you.
OR Jump to record:

Start List At:

Record 1 out of 27
( Use the "Back" button of the Internet

Browser to return to TESS) Typed Drawing

Word Mark Goods and Services Mark Drawing Code Serial Number Filing Date Current Filing Basis Original Filing Basis Published for Opposition Registration Number Registration Date Owner Attorney of Record Prior Registrations Type of Mark Register Affidavit Text Live/Dead Indicator MICROSOFT IC 037. US 100 103 106. G & S: Installation, maintenance and repair of computer networks and computer systems consisting of software. FIRST USE: 19870105. FIRST USE IN COMMERCE: 19870105 (1) TYPED DRAWING 78190864 December 3, 2002 1A 1B August 5, 2003 2872708 August 10, 2004 (REGISTRANT) Microsoft Corporation CORPORATION WASHINGTON One Microsoft Way Redmond WASHINGTON 980526399 William O. Ferron, Jr. 1200236;1256083;1259874 SERVICE MARK PRINCIPAL SECT 15. SECT 8 (6-YR). LIVE

http://tess2.uspto.gov/bin/showfield?f=doc&state=4005:u9vh09.5.1

3/16/2012

Trademark Electronic Search System (TESS)

Page 2 of 2

|.HOME | SITE INDEX| SEARCH | eBUSINESS | HELP | PRIVACY POLICY

http://tess2.uspto.gov/bin/showfield?f=doc&state=4005:u9vh09.5.1

3/16/2012

Trademark Electronic Search System (TESS)

Page 1 of 2

United States Patent and Trademark Office

Home|Site Index|Search|FAQ|Glossary|Guides|Contacts|eBusiness|eBiz alerts|News|Help

Trademarks > Trademark Electronic Search System (TESS)

TESS was last updated on Fri Mar 16 04:35:47 EDT 2012

Logout

Please logout when you are done to release system resources allocated for you.
OR Jump to record:

Start List At:

Record 1 out of 4
( Use the "Back" button of the Internet

Browser to return to TESS)

Word Mark Goods and Services

OUTLOOK IC 042. US 100 101. G & S: Computer services; Cloud computing featuring software for use in email, calendaring, contacts management and accessing remotely stored data for such applications; Providing temporary use of on-line non-downloadable software and applications for email, calendaring, and contacts management; Providing technical information in the field of computer software and cloud computing

Standard Characters Claimed Mark Drawing Code Serial Number Filing Date Current Filing Basis Original Filing Basis International Registration Number Owner Attorney of

(4) STANDARD CHARACTER MARK 85467641 November 8, 2011 1B 1B 1107047 (APPLICANT) Microsoft Corporation CORPORATION WASHINGTON One Microsoft Way Redmond WASHINGTON 980526399 William O. Ferron, Jr.

http://tess2.uspto.gov/bin/showfield?f=doc&state=4005:u9vh09.7.1

3/16/2012

Trademark Electronic Search System (TESS)

Page 2 of 2

Record Prior Registrations Type of Mark Register Live/Dead Indicator

2188125 SERVICE MARK PRINCIPAL LIVE

|.HOME | SITE INDEX| SEARCH | eBUSINESS | HELP | PRIVACY POLICY

http://tess2.uspto.gov/bin/showfield?f=doc&state=4005:u9vh09.7.1

3/16/2012

APPENDIX E

Trademark Electronic Search System (TESS)

Page 1 of 2

United States Patent and Trademark Office

Home|Site Index|Search|FAQ|Glossary|Guides|Contacts|eBusiness|eBiz alerts|News|Help

Trademarks > Trademark Electronic Search System (TESS)

TESS was last updated on Fri Mar 16 04:35:47 EDT 2012

Logout

Please logout when you are done to release system resources allocated for you.
OR Jump to record:

Start List At:

Record 1 out of 11
( Use the "Back" button of the Internet

Browser to return to TESS)

Word Mark Goods and Services

NACHA IC 016. US 002 005 022 023 029 037 038 050. G & S: Books in the field of electronic payment; Brochures about electronic payment; Business cards; Informational flyers featuring information about electronic payment; Journals concerning electronic payment; Letterhead paper; Manuals in the field of electronic payment; Newsletters in the field of electronic payment; Posters; Printed charts; Study guides. FIRST USE: 19770100. FIRST USE IN COMMERCE: 19770100 IC 035. US 100 101 102. G & S: Association services, namely, promoting the interests of safe and reliable electronic payment services. FIRST USE: 19770100. FIRST USE IN COMMERCE: 19770100 IC 041. US 100 101 107. G & S: Education services, namely, providing conferences, workshops, and teleconferences in the fields of electronic payment and risk management. FIRST USE: 19770100. FIRST USE IN COMMERCE: 19770100

Standard Characters Claimed Mark Drawing Code Serial Number Filing Date Current Filing Basis Original Filing

(4) STANDARD CHARACTER MARK 85451163 October 19, 2011 1A

http://tess2.uspto.gov/bin/showfield?f=doc&state=4005:u9vh09.12.1

3/16/2012

Trademark Electronic Search System (TESS)

Page 2 of 2

Basis Published for Opposition Owner Attorney of Record Prior Registrations Type of Mark Register Live/Dead Indicator

1A April 3, 2012 (APPLICANT) National Automated Clearing House Association non-profit corporation DELAWARE Suite 100 13450 Sunrise Valley Drive Herndon VIRGINIA 20171 Joseph L. Morales 3118444;3419145;3932804;AND OTHERS TRADEMARK. SERVICE MARK PRINCIPAL LIVE

|.HOME | SITE INDEX| SEARCH | eBUSINESS | HELP | PRIVACY POLICY

http://tess2.uspto.gov/bin/showfield?f=doc&state=4005:u9vh09.12.1

3/16/2012

Trademark Electronic Search System (TESS)

Page 1 of 2

United States Patent and Trademark Office

Home|Site Index|Search|FAQ|Glossary|Guides|Contacts|eBusiness|eBiz alerts|News|Help

Trademarks > Trademark Electronic Search System (TESS)

TESS was last updated on Fri Mar 16 04:35:47 EDT 2012

Logout

Please logout when you are done to release system resources allocated for you.
OR Jump to record:

Start List At:

Record 9 out of 11
( Use the "Back" button of the Internet

Browser to return to TESS)

Word Mark Goods and Services

NACHA IC 016. US 002 005 022 023 029 037 038 050. G & S: Books in the field of electronic payment; Brochures about electronic payment; Business cards; Informational flyers featuring information about electronic payment; Journals concerning electronic payment; Letterhead paper; Manuals in the field of electronic payment; Newsletters in the field of electronic payment; Posters; Printed charts; Study guides. FIRST USE: 20070100. FIRST USE IN COMMERCE: 20070100 IC 035. US 100 101 102. G & S: Association services, namely, promoting the interests of safe and reliable electronic payment services. FIRST USE: 20070100. FIRST USE IN COMMERCE: 20070100 IC 041. US 100 101 107. G & S: Education services, namely, providing conferences, workshops, and teleconferences in the field of electronic payment and risk management. FIRST USE: 20070100. FIRST USE IN COMMERCE: 20070100

Mark Drawing Code Design Search Code Trademark Search Facility Classification Code Serial Number Filing Date

(3) DESIGN PLUS WORDS, LETTERS, AND/OR NUMBERS 26.01.02 - Circles, plain single line; Plain single line circles 26.01.04 - Circles with two breaks or divided in the middle SHAPES-CIRCLE Circle figures or designs including semi-circles and incomplete circles SHAPES-MISC Miscellaneous shaped designs 77038508 November 7, 2006

http://tess2.uspto.gov/bin/showfield?f=doc&state=4005:u9vh09.12.9

3/16/2012

Trademark Electronic Search System (TESS)

Page 2 of 2

Current Filing Basis Original Filing Basis Published for Opposition Registration Number Registration Date Owner Attorney of Record Prior Registrations Description of Mark Type of Mark Register Live/Dead Indicator

1A 1B June 26, 2007 3419145 April 29, 2008 (REGISTRANT) National Automated Clearing House Association CORPORATION DELAWARE 13450 Sunrise Valley Drive, Suite 100 Herndon VIRGINIA 20171 Dana O. Lynch 1468237 Color is not claimed as a feature of the mark. TRADEMARK. SERVICE MARK PRINCIPAL LIVE

|.HOME | SITE INDEX| SEARCH | eBUSINESS | HELP | PRIVACY POLICY

http://tess2.uspto.gov/bin/showfield?f=doc&state=4005:u9vh09.12.9

3/16/2012