Source: https://www.scribd.com/doc/86725404/Zeus-botnet-TRO-Seizure-Order-Part-1
Timestamp: 2016-12-09 00:35:29
Document Index: 60730949

Matched Legal Cases: ['§ 1030', '§ 7704', '§ 2701', '§ 1114', '§ 1962', '§ 1116', '§ 1651', '§ 1030', '§ 7704', '§ 2701', '§ 1114', '§ 1962', '§ 1030', '§ 7704', '§ 2701', '§ 1114', '§ 1962', '§ 1030', '§ 7704', '§ 2701', '§ 1114', '§ 1962', '§ 1116', '§ 1651', '§ 1116', '§ 1116', '§ 1116', '§1116', '§ 1651', 'art5', 'art 2', 'art 1', 'art 2', 'art 2']

BrowseInterestsBiography & MemoirBusiness & LeadershipFiction & LiteraturePolitics & EconomyHealth & WellnessSociety & CultureHappiness & Self-HelpMystery, Thriller & CrimeHistoryYoung AdultBrowse byBooksAudiobooksArticlesSheet MusicBrowse allUploadSign inJoinRichard A.Jacobsen (RJ5136) ORRICK, HERRINGTON & SUTCLIFFE LLP 51 West 52nd Street New York, New York 10019 Telephone: (212) 506-5000 Facsimile: (212) 506-5151 Gabriel M. Ramsey (pro hac vice application pending) ORRICK, HERRINGTON & SUTCLIFFE LLP 1000 Marsh Road Menlo Park, California 94025 Telephone: (650) 614-7400 Facsimile: (650) 614-7401 Attorneys for Plaintiffs MICROS Off CORPORATION, FS-ISAC, INC. and NATIONAL AUTOMATED CLEARING HOUSE ASSOCIATION
r-;'1 ~ t-~~ ~ ,,,~,J .....
MICROS Off CORP., FS-ISAC, INC., and NATIONAL AUTOMATED CLEARING HO ASSOCIA TION, Plaintiffs
JOHN DOES 1-39 DIBI A Slavik, Monstr, 100, Null, nvidiag, zebra7753, lexa_Mef, gss, iceIX, Harderman, Gribodemon, Aqua, aquaSecond, it, percent, cp01, hct, xman, Pepsi, miami, miamibc, petrOvich, Mr. ICQ, Tank, tankist, Kusunagi, Noname, Lucky, Bashorg, Indep, Mask, Enx, Benny, Bentley, Denis Lubimov, MaDaGaSka, Vkontake, rfcid, parik, reronic, Daniel, bx 1, Daniel Hamza, Danielbx1,jah, Jonni,jtk, Veggi Roma, D frank, duo, Admin20 10, h4xOrdz, Donsft, mary.J555, susanneon, kainehabe, virus_e_2003, spaishp, sere.bro, muddem, mechan 1zm, vlad.dimitrov, jheto2002, sector.exploits AND JabberZeus Crew CONTROLLING COMPUTER BOTNETS THEREBY INJURING PLAINTIFFS, AND THEIR CUSTOMERS AND MEMBERS, Defendants.
r;--fPl-ijj-.jijfE~fpAla~iy~r-EMPO-RARY-RE-STRAINING ORDER, SEIZURE ORDER AND ORDER TO SHOW CAUSE RE PREI.lIMINARY INJUNCTION
Plaintiffs Microsoft Corp. ("Microsoft"), the FS-ISAC, Inc. (Financial ServicesInformation Sharing and Analysis Center) ("FS-ISAC"), and the National Automated Clearing House Association ("NACHA") (collectively, the "Plaintiffs") have filed a Complaint for injunctive and other relief pursuant to, the Computer Fraud and Abuse Act (18 U.s.c. § 1030); the CAN-SPAM Act (15 U.S.c. § 7704); the Electronic Communications Privacy Act (18 U.S.c. § 2701); Trademark Infringement, False Designation of Origin, and Trademark Dilution under the Lanham Act (15 U.S.c. §§ 1114 et seq.); violations of the Racketeer Influenced and Corrupt Organizations Act (18 U.S.c. § 1962); and the common law of trespass, conversion, and unjust enrichment. Plaintiffs have also moved ex parte for an emergency temporary restraining order
and seizure order pursuant to Rule 65(b) of the Federal Rules of Civil Procedure, 15 U.S.C § 1116(d) (the "Lanham Act") and 28 U.S.C. § 1651(a) (the "All Writs Act"), and an order to show cause why a preliminary injunction should not be granted. FINDINGS OF FACT AND CONCLUSIONS OF LAW
Having reviewed the papers, declarations, exhibits, and memorandum filed in support of Plaintiffs' Application for an Emergency Temporary Restraining Order, Seizure Order, and Order to Show Cause for Preliminary Injunction ("TRO Application"), the Court hereby makes the following findings of fact and conclusions of law: 1. This Court has jurisdiction over the subject matter of this case and there is
good cause to believe that it will have jurisdiction over all parties hereto; the Complaint states a claim upon which relief may be granted against Defendants under the Computer Fraud and Abuse Act (18 U.S.c. § 1030); the CAN-SPAM Act (15 U.S.c. § 7704); the Electronic Communications Privacy Act (18 U.S.c. § 2701); Trademark Infringement, False Designation of Origin, and Trademark Dilution under the Lanham Act (15 U.S.c. §§ 1114 et seq.); the Racketeer Influenced and Corrupt Organizations Act (18 U.S.C. § 1962); and the common law of trespass, conversion, and unjust enrichment. 2. Microsoft owns the registered trademarks "Microsoft," "Windows," and
"Outlook" used in connection with its services, software, and products. FS-ISAC's members 2
have invested in developing their brands, trademarks and trade names in association with the financial services they offer. NACHA owns the registered trademark "NACHA" and the NACHA logo used in conjunction with its services. 3. There is good cause to believe that Defendants have engaged in and are likely
to engage in acts or practices that violate the Computer Fraud and Abuse Act (I8 U.S.c. § 1030); the CAN-SPAM Act (15 U.S.c. § 7704); the Electronic Communications Privacy Act (18 U.S.c. § 2701); Trademark Infringement, False Designation of Origin, and Trademark Dilution under the Lanham Act (15 U.S.c. §§ 1114 et seq.); the Racketeer Influenced and Corrupt Organizations Act (18 U.S.c. § 1962); and the common law of trespass, conversion, and unjust enrichment. 4. There is good cause to believe that, unless Defendants are restrained and
enjoined by Order of this Court, immediate and irreparable harm will result from Defendants' ongoing violations of the Computer Fraud and Abuse Act (18 U.S.c. § 1030); the CAN-SPAM Act (15 U.S.c. § 7704); the Electronic Communications Privacy Act (18 U.S.c. § 2701); Trademark Infringement, False Designation of Origin, and Trademark Dilution under the Lanham Act (15 U.S.c. §§ 1114 et seq.); the Racketeer Influenced and Corrupt Organizations Act (I8 U.S.c. § 1962); and the common law of trespass, conversion, and unjust enrichment. The evidence set forth in Plaintiffs' TRO Application and the
accompanying declarations and exhibits, demonstrates that Plaintiffs are likely to prevail on their claim that Defendants have engaged in violations of the foregoing laws by: (1) intentionally accessing and sending malicious software to the protected computers and operating systems of the customers or associated member organizations of Microsoft, FSISAC, and NACHA, without authorization, in order to infect those computers and make them part of the Zeus Botnets; (2) sending malicious software to configure, deploy and operate a botnet; (3) sending unsolicited spam e-mail to Microsoft's Hotrnail accounts; (4) sending unsolicited spam e-rnails that falsely indicate that they are from or approved by Plaintiffs or their associated member organizations, the purpose of which is to deceive 3
computer users into taking steps that will result in the infection of their computers with botnet code and/or the disclosure of personal and financial account information; (5) stealing personal and financial account information from computer users; (6) using stolen information to steal money from the financial accounts of those users; and (7) associating with one another in a common enterprise engaged in these illegal acts. There is good cause to believe that if such conduct continues, irreparable harm will occur to Plaintiffs and the public, including Plaintiffs' customers and associated member organizations. There is good
cause to believe that the Defendants are engaging, and will continue to engage, in such unlawful actions if not immediately restrained from doing so by Order of this Court. 5. There is good cause to believe that immediate and irreparable damage to this
Court's ability to grant effective final relief will result from the sale, transfer, or other disposition or concealment by Defendants of the botnet command and control software that is hosted at and otherwise operates through the Internet domains listed in Appendix A, the Internet Protocol (IP) addresses listed in Appendix B, and the file directories listed in Exhibit C, and from the destruction or concealment of other discoverable evidence of Defendants' misconduct available at those locations if Defendants receive advance notice of this action. Based on the evidence cited in Plaintiffs' TRO Application and accompanying declarations and exhibits, Plaintiffs are likely to be able to prove that: (1) Defendants are engaged in activities that directly violate U.S. law and harm Plaintiffs and the public, including Plaintiffs' customers and member-organizations; (2) Defendants have continued their
unlawful conduct despite the clear injury to the foregoing interests; (3) Defendants are likely to delete or relocate the botnet command and control software at issue in Plaintiffs' TRO Application and the harmful, malicious, and trademark infringing software disseminated through these IP addresses and domains and to warn their associates engaged in such activities if informed of Plaintiffs' action. Plaintiffs' request for this emergency ex parte relief is not the result of any lack of diligence on Plaintiffs' part, but instead is based upon the nature of Defendants' unlawful conduct. Therefore, in accordance with Fed. R. Civ. P. 4
65(b) and 15 U.S.C. § 1116(d), good cause and the interests of justice require that this Order be granted without prior notice to Defendants, and accordingly Plaintiffs are relieved of the duty to provide Defendants with prior notice of Plaintiffs' motion. 6. There is good cause to believe that Defendants have engaged in illegal
activity using the data centers and/or Internet hosting providers identified in Appendix B to host the command and control software and the malicious botnet code and content used to maintain and operate the botnet at computers, servers, electronic data storage devices or media at the IP addresses identified in Appendix B. 7. There is good cause to believe that to immediately halt the injury caused by
Defendants, data and evidence at Defendants' IP addresses identified in Appendix B must be preserved and held in escrow pending further order of the court, Defendants' computing resources related to such IP addresses must then be disconnected from the Internet, Defendants must be prohibited from accessing Defendants' computer resources related to such IP addresses and the data and evidence located on those computer resources must be secured and preserved. 8. There is good cause to believe that to immediately halt the injury caused by
Defendants, and to ensure that future prosecution of this case is not rendered fruitless by attempts to delete, hide, conceal, or otherwise render inaccessible the software components that distribute unlicensed copies of Plaintiffs' registered trademarks and carry out other harmful conduct, with respect to Defendants' most current, active command and control IP addresses hosted at data centers operated by Continuum Data Centers LLC and Burstnet Technologies, Inc., the United States Marshals Service in the judicial districts where the data centers are located should be directed to seize, impound and deliver into the custody of thirdparty escrow service Stroz Friedberg, 1925 Century Park East, Suite 1350, Los Angeles, CA 90067, all of Defendants' computers, servers, electronic data storage devices, software, data or media associated with the IP addresses listed in Appendix B. 9. There is good cause to believe that Defendants have engaged in illegal 5
activity using the Internet domains identified in Appendix A to this order to host the command and control software and content used to maintain and operate the botnet. There is good cause to believe that to immediately halt the injury caused by Defendants, each of Defendants' current and prospective domains set forth in Appendix A must be immediately redirected to the Microsoft-secured Defendants. 10. There is good cause to direct that third party Internet registries, data centers, IP address 199.2.l37.141 and thus made inaccessible to
hosting providers and free website hosting providers with a presence in the United States to reasonably assist in the implementation of this Order and refrain from frustrating the implementation and purposes of this Order, pursuant to 28 U.S.C. § 1651(a) (the All Writs Act). There is good cause to direct that USc-based ICANN communicate this order to foreign domain registries through which Defendants have registered domains subject to this Order. 11. There is good cause to believe that if Defendants are provided advance notice
of Plaintiffs' TRO Application or this Order, they would move the botnet infrastructure, allowing them to continue their misconduct and that they would destroy, move, hide, conceal, or otherwise make inaccessible to the Court evidence of their misconduct, the botnet's activity, the infringing materials, the instrumentalities used to make the infringing materials, and the records evidencing the manufacture and distributing of the infringing materials. 12. There is good cause to permit notice of the instant Order, notice of the
Preliminary Injunction hearing and service of the Complaint by formal and alternative means, given the exigency of the circumstances and the need for prompt relief. The following means of service are authorized by law, satisfy Due Process, satisfy Fed. R. Civ. Pro. 4(1)(3), and are reasonably calculated to notify Defendants of the instant order, the Preliminary Injunction hearing and of this action: (1) personal deli very upon Defendants who provided to the data centers and Internet hosting providers contact information in the 6
U.S.; (2) personal delivery through the Hague Convention on Service Abroad or other treaties upon Defendants who provided contact information outside the United States; (3) transmission bye-mail, electronic messaging addresses, facsimile, and mail to the known email and messaging addresses of Defendants and to their contact information provided by Defendants to the domain registrars, registries, data centers, Internet hosting providers, and website providers who host the software code associated with the IP addresses in Appendix B, or through which domains in Appendix A are registered; and (4) publishing notice to the Defendants on a publicly available Internet website and in newspapers in jurisdictions where Defendants are believed to reside. 13. There is good cause to believe that the harm to Plaintiffs of denying the relief
requested in their TRO Application outweighs any harm to any legitimate interests of Defendants and that there is no undue burden to any third party. TEMPORARY RESTRAINING ORDER AND SEIZURE ORDER IT IS THEREFORE ORDERED as follows: A. Defendants, their representatives and persons who are in active concert or
participation with them are temporarily restrained and enjoined from: Intentionally accessing and sending malicious software to Plaintiffs and the protected computers and operating systems of Plaintiffs' customers' and associated member organizations, without authorization, in order to infect those computers and make them part of the botnet; sending malicious software to configure, deploy and operate a botnet; sending unsolicited sparn email to Microsoft's Hotmail accounts; sending unsolicited spam e-mail that falsely indicate that they are from or approved by Plaintiffs or Plaintiffs' associated member organizations; creating false web sites that falsely indicate that they are associated with or approved by Plaintiffs or Plaintiffs' member organizations; or stealing information, money or property from Plaintiffs, Plaintiffs' customers or Plaintiffs' member organizations, or undertaking any similar activity that inflicts harm on Plaintiffs, or the public, including Plaintiffs' customers or associated member organizations.
Defendants, their representatives and persons who are in active concert or
participation with them are temporarily restrained and enjoined from configuring, deploying, operating or otherwise participating in or facilitating the botnets described in the TRO Application, including but not limited to the command and control software hosted at and operating through the domains and IP addresses set forth herein and through any other component or element of the botnets in any location. C. Defendants, their representatives and persons who are in active concert or
participation with them are temporarily restrained and enjoined from using the trademarks "Microsoft," "Windows," "Outlook," "NACHA," the NACHA logo, trademarks of financial institution members of FS-ISAC and/or other trademarks; trade names; service marks; or Internet Domain addresses or names; or acting in any other manner which suggests in any way that Defendants' products or services come from or are somehow sponsored or affiliated with Plaintiffs or Plaintiffs' associated member organizations, and from otherwise unfairly competing with Plaintiffs, misappropriating that which rightfully belongs to Plaintiffs or Plaintiffs' customers or Plaintiffs' associated member organizations, or passing off their goods or services as Plaintiffs or Plaintiffs' associated member organizations. D. Defendants, their representatives and persons who are in active concert or
participation with them are temporarily restrained and enjoined from infringing Plaintiffs' registered trademarks, Registration Nos. 2872708,85467641,2463510,3419145 E. and others.
participation with them are temporarily restrained and enjoined from using in connection with Defendants' activities any false or deceptive designation, representation or description of Defendants' or of their representatives' activities, whether by symbols, words, designs or
statements, which would damage or injure Plaintiffs or give Defendants an unfair competitive advantage or result in deception of consumers.
Defendants' materials bearing infringing marks, the means of making the
counterfeit marks, and records documenting the manufacture, sale, or receipt of things 8
involved in such violation, in the possession of data centers operated by Continuum Data Centers LLC and Burstnet Technologies, Inc. all pursuant to 15 U.S.c. § 1116(d), shall be seized: 1. The seizure at the foregoing data centers and hosting providers shall
take place no later than seven (7) days after the date of issue of this order. The seizure may continue from day to day, for a period not to exceed three (3) days, until all items have been seized. The seizure shall be made by the United States Marshals Service. The United States Marshals Service in the judicial districts where the foregoing data centers and hosting providers are located are directed to coordinate with each other and with Plaintiffs and their attorneys in order to carry out this Order such that disablement and seizure of the servers is effected simultaneously, to ensure that Defendants are unable to operate the botnet during the pendency of this case. In order to facilitate such coordination, the United States Marshals in the relevant jurisdictions are set forth, as follows: a. Northern District of lilinois U.S. Marshal: Darryl K. McPherson 219 S. Dearborn Street, Room 2444 Chicago, IL 60604 (312) 353-5290 b. Middle District of Pennsylvania U.S. Marshal: Martin J. Pane Federal Building Washington Avenue & Linden Street, Room 231 Scranton, PA 18501 (570) 346-7277 2. The United States Marshals and their deputies shall be accompanied
by Plaintiffs' attorneys and forensic experts at the foregoing described seizure, to assist with identifying, inventorying, taking possession of and isolating Defendants' computer resources, command and control software and other software components that are seized. The United States Marshals shall seize Defendants' computers, servers, electronic data storage devices or media associated with Defendants' IP addresses at the hosting companies
set forth above, or a live image of Defendants' data and information on said computers, servers, electronic data storage devices or media, as reasonably determined by the U.S. Marshals Service, Microsoft's forensic experts and/or attorneys. The United States Marshals shall preserve up to four hours of Internet traffic to and from Defendants' servers associated with the IP addresses at the hosting companies set forth above, before disconnecting those computers from the Internet. 3. Stroz Friedberg, 1925 Century Park East, Suite 1350, Los Angeles,
CA 90067, tel. (310) 623-3301, will act as substitute custodian of any and all data and properties seized and evidence preserved pursuant to this Order and shall hold harmless the United States Marshals Service, arising from any acts, incidents, or occurrences in connection with the seizure and possession of the defendants' property, including any thirdparty claims, and the United States Marshal shall be discharged of his or her duties and responsibilities for safekeeping of the seized materials. 4. The United States Marshals accomplishing such seizure are permitted
to enter the premises of the data centers operated by Continuum Data Centers LLC and Burstnet Technologies, Inc. in order to serve copies of this Order, carry out the terms of this Order and to verify compliance with this Order. The United States Marshals shall employ whatever reasonable means are necessary to carry out the terms of this Order and to inspect the contents of or connect to any computers, servers, electronic data storage devices, media, room, closets, cabinets, vehicles, containers or desks or documents and to dismantle any equipment utilized by Defendants to carry out the activities prohibited by this Order. G. Pursuant to the All Writs Act and to effect discovery of the true identities of
the John Doe defendants, the domain registries with a presence in the U.S. identified in Appendix A to this Order and the data centers and hosting providers with a U.S. presence identified in Appendix B to this Order, shall: 1. Coordinate with Microsoft to redirect all traffic to the domains in
Appendix A to secure servers at a Microsoft-secured IP address: 199.2.137.141, and take all 10
steps required to propagate the foregoing domain registry changes to domain name registrars; 2. Permit the United States Marshals Service, with the assistance of Stroz
Friedberg, to preserve up to four hours of Internet traffic to and from the servers corresponding to each IP addresses set for in Appendix B; 3. Following the preservation of Internet traffic ordered above, disable
Defendants' IP addresses set forth in Appendix B (including through any backup systems) so that they can no longer be accessed over the Internet, connected to, or communicated with in any way except as explicitly provided for in this Order; 4. Transfer any content and software hosted on Defendants' IP addresses
listed in Appendix B that are not associated with Defendants to new IP addresses not listed in Appendix B; notify any non-party owners of such content or software of the new IP addresses, and direct them to contact Microsoft's Counsel, Gabriel M. Ramsey, Orrick Herrington & Sutcliffe, 1000 Marsh Road, Menlo Park, CA 90425-1015, (Tel: 650-6147400), to facilitate any follow-on action; 5. Preserve and produce to Plaintiffs documents and information
sufficient to identify and contact Defendants and Defendants' representatives operating or controlling the IP addresses set forth in Appendix B, including any and all individual or entity names, mailing addresses, e-mail addresses, facsimile numbers and telephone numbers or similar contact information, including but not limited to such contact information reflected in billing, usage and contact records; 6. Provide reasonable assistance in implementing the terms of this Order
and shall take no action to frustrate the implementation of this Order, including the provision of sufficient and reasonable access to offices, facilities, computer networks, computers and services, so that the United States Marshals Service, Plaintiffs, and Plaintiffs' attorneys and/or representatives may directly supervise and confirm the implementation of this Order against Defendants; H. Pursuant to the All Writs Act ICANN is directed to communicate this Order 11
to foreign domain registries identified in Appendix A to this Order.
Defendants are directed to permanently disable access to the file paths
identified in Appendix C; permanently delete or otherwise disable the content at those file paths; and take all necessary steps to ensure that a such file paths are not re-enabled nor the content recreated. Pursuant to the All Writs Act, U.S. based free website hosting providers of the domains set forth in Appendix C are directed to permanently delete or otherwise disable the content at the file paths in Appendix C. 1. All parties subject to this order shall refrain from providing notice or warning
of this Order to Defendants, their representatives or persons who are in active concert or participation with them, until this Order is fully executed. Third-parties subject to this order may share the order within their organizations or with partner organizations (such as domain registrars), only to the extent reasonably necessary to implement the Order.
Anyone interfering with the execution of this Order is subject to arrest by
federal or state law enforcement officials. IT IS FURTHER ORDERED that the registries of the domains identified in Exhibit A to this Order (the "Registries") shall implement the provisions of this order in the following fashion:
For currently unregistered domains, the domain name registrant for
the domains shall be changed to "Microsoft Corp." and the domain name registration point of contact shall be changed to the Microsoft Digital Crimes Unit, with full contact details to be provided hereafter to the domains registries by Microsoft Corp., and associated WHOIS information shall be changed accordingly; 2. For currently registered domains, the domain name registrant
information and point of contact shall not be changed and associated WHOIS information shall not be changed; 3. Domain names shall not be deleted or otherwise made available for
registration by any party, but rather should remain active and redirected to IP address
199.2.137.141. 4. Domains shall not be transferred to any other person or registrar,
pending further order of the court; 5. The Registries shall assume authority for name resolution of domain
names to IP address 199.2.137.141, using the name servers of the Registries; 6. 7. Name resolution services shall not be suspended; The Registries shall work with Plaintiffs in good faith to implement
this order expeditiously. IT IS FURTHER ORDERED, notwithstanding 15 U.S.c. § 1116(6), which provides in
relevant part that "[a]n order under this subsection, together with the supporting documents, shall be sealed until the person against whom the order is directed has an opportunity to contest such order," that copies of this Order, notice of the Preliminary Injunction hearing and service of the Complaint may be served by any means authorized by law, including (1) by personal delivery upon defendants who provided contact information in the U.S.; (2) personal delivery through the Hague Convention on Service Abroad upon defendants who provided contact information outside the U.S.; (3) by transmission bye-mail, electronic messaging addresses, facsimile and mail to the known contact information of Defendants and to such contact information provided by defendants to the data centers, Internet hosting providers and domain registrars who hosted the software code associated with the IP addresses set forth at Appendix B or through which domains in Appendix A are registered; and (4) by publishing notice to Defendants on a publicly available Internet website or in newspapers in the jurisdictions where Defendants are believed to reside. IT IS FURTHER ORDERED, notwithstanding 15 U.S.c. § 1116(6), service providers required to take action under this Order and may disclose this Order to employees, agents or other service providers as may reasonably be necessary to implement the Order. IT IS FURTHER ORDERED, pursuant to Federal Rule of Civil Procedure 65(b), 15 U.S.c. §1116(d)(1O) and 28 U.S.c. § 1651(a) (the All Writs Act) that Defendants shall 13
appear before this Court within no more than 28 days from the date of this order, to show cause, if there is any, why this Court should not enter a Preliminary Injunction, pending final ruling on the Complaint against Defendants, enjoining them from the conduct temporarily restrained by the preceding provisions of this Order. The hearing on Plaintiffs' motion for Preliminary Injunction shall take place on , 2012 in Courtroom
of the United States District Court, 225 Cadman Plaza East, Brooklyn, NY 11201. IT IS FURTHER ORDERED that Plaintiffs shall post bond in the amount of $300,000 as cash to be paid into the Court registry. IT IS FURTHER ORDERED that Plaintiffs shall compensate the data centers, Internet hosting providers and/or domain registries and/or website providers identified in Appendices A, Band C at prevailing rates for technical assistance rendered in implementing the Order. IT IS FURTHER ORDERED that this Order shall be implemented with the least degree of interference with the normal operation of the data centers and Internet hosting providers and/or domain registries and/or website providers identified in Appendices A, B and C consistent with thorough and prompt implementation of this Order. IT IS FURTHER ORDERED, specifically with regard to the preserved Internet traffic to and from the servers corresponding to the IP address listed in Exhibit B, that this evidence shall be preserved, held in escrow and kept under seal by Stroz Friedberg, and not accessed by any party, pending further order of this Court. IT IS FURTHER ORDERED, specifically with regard to the Internet traffic that is redirected from the domains listed in Exhibit A to the Microsoft-secured IP address 199.2.137.141, that Microsoft shall not record more than the IP addresses of incoming connections. IT IS FURTHER ORDERED that Defendants shall file with the Court and serve on Plaintiffs counsel any answering affidavits, pleadings, motions, expert reports or declarations and/or legal memoranda no later than four (4) days prior to the hearing on Plaintiffs' request 14
for a preliminary injunction. Plaintiffs may file responsive or supplemental pleadings, materials, affidavits, or memoranda with the Court and serve the same on counsel for Defendants no later than one (1) day prior to the preliminary injunction hearing in this matter. Provided that service shall be performed by personal or overnight delivery, facsimile or electronic mail, and documents shall be delivered so that they shall be received by the other parties no later than 4:00 p.m. (Pacific Standard Time) on the appropriate dates listed in this paragraph. IT IS SO ORDERED
INTERNET COORDINATING BODY
Internet Corporation for Assigned Names and Numbers (ICANN) 4676 Admiralty Way, Suite 330 Marina del Rey, CA 90292-6601 United States
I Entity responsible
for coordination of the Internet's systems of unique identifiers, particularly domain names.
DOMAIN NAME REGISTRIES Verisign Naming Services 21345 Ridgetop Circle 4th Floor Dulles, Virginia 20166 United States VeriSign Global Registry Services 12061 Bluemont Way Reston Virginia 20190 United States
u one Harm flBttD uniterace.com update-kb 186283 I I.com vacantitechip.com varioldinnics.com vcstiturnediana.com vegatorkspeps.com vemaxxlionna.com vendettamenolkreamste.com vensart.net vesryop.com soucker.com strbrst.net xaz6g1 be-server.com xldavinchireverce.com xlreservation.com
'N arne omam
type T embedded js dropzone, source
updater updater updater updater dropzone, dropzone dropzone, dropzone, infector infector infector dropzone infector infector updater updater
infector infector
xtrace-upgrade.com
xxmagicreservation.com xxxmagicreservation.com yettaillarfic.com youthinktoolovenotneco.com
Wh 01S Emal '1A ddress . ivemagalindo@uniterace.com atrabaja@peru.com c/o Verisign c/o Verisign vcstiturnediana.com@privacy.above.com c/o Verisign c/o Verisign c/o Veri sign jonuk!m4f279822 I 092b@w86bna54f2!bffa2ff d I .privatewhois.net peroIsp@yahoo.com contact@myprivateregistration.com meromax@online.ua dimalines@yahoo.com xldavinch@gmail.com revstabl77@gmail.com c/o Verisign yarik33@gmail.com xmagicrv@gmail.com repossesseddomain@godaddy.com lauraboschetti@aol.com
ytjsxkupugwfppp.com ytpfmnmgyjinxrhe.com zlegalsource.com zsearchweb.com answertels.com borrownetpowerlimited.com camesd.corn cdnsecurehost.com everyyounoeverymecomn.com gedpoil.com .globalwebz.net grz942.com .grz971.com headtickets.com keevegolyn.com marsplus.com nobodyj iomertomcomnet.com taemaidoo.com talettedible.com themextoneter.com thescarts.name
infector infector infector infector dropzone updater dropzone, source embedded js dropzone, source, infector dropzone
updater updater source
tokiocitus.com
tongomario.com topsecurityplace.com totalexcel.net
wwwapps-ups.net
tradingcenter.cc trigaproholds.com triplexguard.com tscounter.com tuk-tuk.com tventinypoloret.com tywinderdamaku.com ufkirankmega.net uilveropoly.com ukrainewskill.corn ultragatewealth.com ultrareservation.com u Itrawirereservation. sepnower.net
systrmp.com
updater updater drop zone, updater updater dropzone, dropzone, dropzone, dropzone, dropzone infector dropzone, dropzone, dropzone dropzone, infector dropzone, updater drop zone,
infector infector infector infector
infector infector infector infector infector
sfimnakedgirls.com shikalmuna.corn shipportlise.com silvarnetinn.com montfica.com simplychasinasis.com skiangpa.net sludential.com smartsecurityadvizor.com smartsecuritvbox.com sneckstrurno.com
infector updater infector infector infector embeddedjs infector infector dropzone, infector updater updater updater dropzone, infector dropzone, infector embeddedjs dropzone, infector drofl_zone, infector updater
ikinybyvetudufY@yahoo.com drawnmccoyeavahoo.com zlegal(a)hotmail.com zsearch@yahoo.com adm in@answertels.com c/o Veri sign perolsp@yahoo.com cadet(a)fastermail.ru nsrm@register.com perolsp(cijyahoo.com admin@macro-store.com c/o Verisign admin@macro-store.com gogo@mailti.com clo Verisign marsplus(cijmail13.com sringomauroeayahoo.com flip@mailae.com c/o Verisign c/o Veri sign IivemetaI88@hotmail.com atrabaja@peru.com meromax@online.ua contact@myprivateregistration.com lavionamarkus@yahoo.com sdfdsgfdf@126.com abuse@cinipac.com j .sanchezOOOOO@gmail.com triplexg77@ymail.com nikola@tscounter.com chatchai@twoplussoft.com simonich@inbox.ru clo Verisign cxkmgl64 f2b6d4097 e4c@w86bna54f2 d Lprivatewhois.net jaunt@free-id.ru c/o Verisign ultragatewl7iJgmail.com ultrart5@gmail.com sergiva43@hotmail.com perolsp@yahoo.com west@cutemail.org percy@maiItLcom admin@shanmana.net c/o Veri sign c/o Verisign c/o Veri sign xdr2ea04f2329fI b47 5e@w86bna54f21 1.privatewhois.net afsmedclazsgmail.com admin@sludential.com contact(cijmyprivateregistration.com smartboxOOO I@yahoo.com c/o Verisign
Ibffa2ff
bffa2ffd
73. 74. 75. 76. 77. 78. 79. 80. 8l. 82. 83. 84. 85. 86. 87. 88. 89. 90. 91. 92. 93. 94. 95. 96. 97. 98. 99. 100. 101. 102. 103. 104. 105. 106. 107. 108. 109. lIO.
softsecufityIab.com somanyontion.com sonyvaio77 .com sqwed.net ssl-autoris.com stacyeiblerki.com sterijncompan.com stron~uard.com suitionsaway.com sunageoshighvi.com svistoklex.com prlwppsunenofsx.com ptsoncmrusnjoew.com quantraxactor.com quardsecurity, com
dropzone, updater dropzone,
infector infector, source js
embedded infector
infector updater updater dropzone infector infector updater infector infector dropzone infector updater updater updater dropzone infector infector dropzone dropzone, updater updater dropzone updater updater dropzone, infector updater updater embedded embedded dropzone, dropzone, dropzone, dropzone, updater updater
quiverharbor
quizclub.net qwertyghostl22245678.com
recavatech.com
recellhelsen.com reetexista.com repetitirovnet.net retyuloploples.net revercestable.com rewriterform.com rollingthemydicenetbe.com runtroadeatb.com saldchwetheach.com sampinv.name sardballierman.com
infector, source
sausandergere.com scarts.narne
schoolboygetout.com sciteleganal.corn sdfokoiasedewg.com secariadna.com secstat.com securitydaemon.com seeikom.name seg-opales Lnet sellertop.cn.com senstonymy.com photalegraza.com pintamierback.com planeostsquavep.com polovinkajfie.com .poogatodfcom portmeadowcapital.com
infector infector source, infector infector
115. 116. 117. 118. 119. 120. 121. 122. 123.
updater infector infector dropzone dropzone
pospayinstruczione.corn
posta-rnyposta.com poste-secyre, com
infector, dropzone
ambrossadoreayahoo.com gmvjcxkxhseswhoisservices.cn gmvjcxkxhsrdrwhoisservices.cn perolsp@yahoo.com voffchih@yandex.ua ease@fxmail.net clo Verisign c/o Verisign c/o Verisign c/o Veri sign contact@privacyprotect.org apexdomainseuhotmail.com c/o Verisign c/o Verisign contact@myprivateregistration.com quivertip@rocketmaiLcom zealot@maiI13.com mordehaigureeyahoo.com c/o Verisign c/o Veri sign c/o Verisign ch5m6hg4 f2be56c3d025@w86bna54f21 d l.privatewhois.net dOgOrOn@gmail.com c/o Verisign rewriterform.com@whoisprotectservice.net nsrm@register.com c/o Verisign c/o Verisign k8ie e86@yahoo.com admin@sardballierman.com marlenehobsbawmeslive.co.uk livemetaI88@hotmail.com gxwx9ur4f2be5929d2e4@w86bna54f2Jbffa2ff d l.privatewhois.net c/o Verisign admin@sdfokoiasedewq.com admin@overseedomainmanagement.com contact0Jpri vacyprotect. org domain. tech@yahoo-inc.com livemetaI88@hotmail.com c/o Verisign livemetaI88(a)hotmail.com c/o Veri sign photalegraza.com@privacy.above.com c/o Verisign c/o Veri sign simonich@inbox.ru wind@cutemail.org portmeadowcapital.com@domainsbyproxy.co m domain. tech@yahoo-inc.com vilonichpotap@yahoo.com gmvjcxkxhs@whoisservices.cn
bffa2ff
124. 125. 126. 127. 128. 129. 130. 131. 132. 133. 134. 135. 136. 137. 138.. 139. 140. 141. 142. 143. 144. 145. 146. 147. 148. 149. 150.
vibeapnesbu.com
updater updater dropzone, infector infector updater infector updater infector updater dropzone, dropzone, updater updater dropzone, infector updater updater dropzone, dropzone, infector infector source infector infector dropzone dropzone updater infector dropzone dropzone, infector infector updater updater infector dropzone updater embedded
viewediesolver.corn
vigetectrockset.com viimans.com vipworldhost.com vzmbao-t.ccm westansgualiti.com westernillusion.com whatixemieldin.com
c/o Verisign c/o Verisign c/o Veri sign
infector fundomlong@yandex.ru admin@vipworldhost.com martin.dudley@live.com c/o Verisign westiII50@gmaiI.com c/o Verisign admin@whyvavilon.com c/o Veri sign vaI9zm44f2aa71e08338@w86bna54f2Ibffa2ff dl.privatewhois.net wopedjhfutzfgh.com@contactprivacy.com
whyvavilon.com wickissievele.corn
widowadvertising.net wopedjhfutzfgh.com
rninollumentlynx.com
moderheitrack.com moigerta.cn.com
c/o Verisign c/o Verisign
infector livemetaI88@hotmail.com csimons@raingroup.com c/o Verisign c/o Verisign livemetaI88@hotmail.com admin@mywatchresource.com christopherharms 17@yahoo.com jerrylynnhinnantjr@yahoo.com jlhiluz4f4bfb888e24f@w86bna54f2Ibffa2ffdl.
mspselling.corn
mutanisopendsie.com muticeptad.com
myscarts.name
mywatchresource.com
infector source, infector
nachauserinfo.corn nachauser-storeinfo.corn
nakostelidze.net national-security -agency .com neironhounder.com
lionelmerrdok@yahoo.com tycoon@mailI3.com bitbitbord@rocketmail.com pending-deleteesreglsterapi.com stingomauroesyahoo.com hula@maill3.com c/o Verisign dfghrter@hotmail.~om ghbvsd@msn.com grasp@yourisp.ru tf4xsmg4f4bfda8ac864@w86bna54f2lbffa2ffd l.privatewhois. net
neoprenolen.com
newturbobrowser.com nobody] iomertomcomnet.com nookbizkitsad.com norwitols.com
152. 153. 154. 155. 156. 157. 158. 159. 160.
nsdnsrv.com
nsonchecks2.com ob] ectsphereuf. com oblomidze.net
onespointheadia.corn oposumschoone.com
o_gkplss.com padesionittatu.com
c/o Verisign
cool@fxmail.net phone@wir3s.com c/o Verisign admin@panamachnlms.com c/o Verisign c/o Verisign doughertyj32cmyahoo.com repossesseddomain@godaddy.com domain.tech@yahoo-inc.com clo Verisign admin@klrtm.com kristradentro.com@privacy.above.com peOid4z4f2b6ace21 c71@w86bna54f21bffa2ffd Lprivatewhois.net ebauacn4f2475b893ed5@w86bna54f21bffa2ff
162. 163. 164. 165. 166. 167. 168. 169. 170. 171.
panamachnlms.com
patroqualarva.com perisoneterts.com justbigtoyss.net kenamersoftvu.com
updarer
dropzone updater dropzone, updater dropzone, updater updater dropzone
kickthefuture.corn killdfyrnerraque.corn
klrtm.com kristradentro.com krivoglazeg.net
Iayeradv.com
173. 174. 175. 176. 177. 178. 179. 180. 181. 182. 183. 184. 185. 186. 187. 188. 189. 190. 191. 192. 193. 194. 195. 196. 197. 198. 199. 200. 201. 202. 203. 204. 205. 206. 207. 208. 209. 210. 211. 212. 213. 214. 215. 216. 217. 218. 219. 220. 221. 222. 223. 224.
Iekhausurex.com leopodentargit.com level-upgrage.com lilaussieprems.com
updater updater dropzone
d l.privatewhois.net c/o Verisign
levelup7@mail.com admin@lilaussieprems.com
updater infector up<:later updater infector updater updater dropzone, infector updater infector updater infector dropzone, infector updater dropzone, infector source, infector updater dropzone, infector drop zone, infector dropzone, infector
Iiviarylink.com
Iocaldarcenss.com locaresplicutl.com
thom@mailI3.com c/o Verisign c/o Verisign -----30a2d2f58c3fc4e525eOd212ad23e5c51337853@contact.gandLnet c/o Verisign c/o Verisign mS tazbq-server .net@contactprivacy.com c/o Verisign boogievoogieoscar@ymail.com marsplus@maiI13.com chodoi 1988@gmail.com levelupohio@yahoo.com c/o Verisign contact@myprivateregistration.com lulu@cmemail.org c/o Verisign newdomains@siteground.com chris.deakle82@ymail.com maxpet 1212@gmail.com c/o Veri sign c/o Verisign admin@hosthqk.net expel@cutemail.org chris.deakle82@ymail.com mr.andreev84@bk.ru c/o Verisign contact@privacyprotect.org contact@privacyprotect.org watt(a2bz3.ru clo Verisign c/o Verisign clo Verisign gmvjcxkxhs@whoisservices.cn c/o Verisign iserver@gmail.com clo Verisign admin@jdisaf34.com
lorevingbranta.com
lprshcsmijfovp.com lucascattientop.com lucassfield.com m5ta2bq-server.net managenetwor.com manageopoly.com marsplus.com maymacngocphuong.com mcgoth.com meazeridashloc.com https04.com mediacoif.com mentripete.com michigan4movies.com micro base-update. com microsoft-update.name hoffmarketraph.com
holmancybeac.com
hosthqk.net
dropzone infector dropzone, infector updater dropzone, dropzone, infector updater updater updater infector updater infector updater infector updater dropzone, updater
hv673hv573hv53h7khv57.com icredoname 100 12.com ignarysama.com inboxacc.com incode.name indigocrickets.com inforksonseia.com intelinellouse.corn interponsseella.com
investriotinto.com invetechinte.com
iserverupdates.com
iambsulumency.corn
jdjsaf34.com Jellabillat.com jinanpharmaceutical.com jobinedianingfo.com
clo Verisign
infector registry@oderland.se cia Verisign iockesnotl iked.com@privacy.above.com dale590@aol.com ti-samfar@maii.ru livemetal88@hotmail.com perolsp@yahoo.com c/o Verisign j jorgeI3@yahoo.com
jockesnotl iked.com
johngottybest.com josunrwpyghvttr.com junioroops.name gedpoil.com gertyphacqueier.com
dropzone, infector infector dropzone dropzone updater drop zone, infector
giftcanbuy.com
225. 226. 227. 228. 229. 230. 231. 232. 233. 234. 235. 236. 237. 238. 239. 240. 241. 242. 243. 244. 245. 246. 247. 248. 249. 250. 251. 252. 253. 254. 255. 256. 257. 258. 259. 260. 261. 262. 263. 264. 265. 266. 267. 268. 269. 270.
globalwebz.net globridolumet.com gramablessatro.com grascowallmastmyway.com greatrotewallen. com grounaxY){in.com grz942.com grz971.com gsssoftware5.com guppobod.net headtickets.com hfcpdaonlines6324.com hhtres.com highnetlifelentrasx.com highnetlifenet.com high-privacy.com high-update.com high-upgrade. com domritu.com doujlboxO Lcom doutektronumni.corn driveplex.net drontapesoff.com dst-flnance.com dualglobalwave.com ebuityketfinus.com eguildaycock.com eponamindranthe.com eunitynewgbc.com europeconsults.com eurostats20 12.net everyyounoeverymecomn.com evraffeypl ings.corn exedrinsteadna.com famontare80.net favoritopilodjd.com federalreserve-online.corn federetoktyt.net ~alwire-report.com oxencercha.com
updater dropzone, source, infector embedded js updater updater source, updater
dropzone, updater infector
drop zone, infector updater dropzone, infector dropzone infector infector updater updater updater updater infector dropzone, infector dropzone updater updater updater updater dropzone infector source updater updater dropzone dropzone, infector dropzone, infector updater updater dropzone, updater dropzone,
finewcreautomp.com
flashbangsecurity, foolieracceiv.com com
infector infector infector
forppp.net
forviclemo.com fpzbox.corn frtualpornclub.com conwortonnent.com copelixell.com comermarketmedia.com
272. 273. 274. 275. 276.
creamottonovati.com
infector updater updater infector, dropzone updater dropzone, infector
admin@macro-store.com c/o Verisign c/o Verisign jones@cutemail.org v.saJuja@aol.com grounaxyxin.com@privacy.above.com c/o Verisign c/o Verisign admin@macro-store.com andpushon@hotmail.com gogo@mailit.com clo Verisign admin@hhtres.com highnetlifelentrasx.com@domainsbyproxy.com pearl@mailI3.com highprivaO@hotmail.com highlelev7@gmail.com c/o Verisign Zhongguancun@yahoo.com c/o Verisign doutektronumni.com@privacy.above.com viola@mail13.com drontapesoff.com@whoisprotectservice.net rw5njrx4f2adcae72I b3@w86bna54f2lbffa2ffd l.privatewhois.net dualwave@gmail.com clo Verisign c/o Verisign c/o Verisign clo Verisign smithers3@yahoo.com jsI14@live.it nsrm@register.com c/o Verisign c/o Verisign admin@famontare80.net simonich@inbox.ru rttreswalo@yahoo.com simonich@inbox.ru rttreswalo(i4yahoo.com carriefraser@live.co.uk finewcreautomp.com@privacy.above.com apperhouseblack(G)yahoo.com c/o Verisign plmmvvql@whoispfivacyprotect.com repossesseddomain@?godaddy.com aeca08c 15ce 745498efdcef3c7020d4d.protect@ whoisguard.com) four@mail I 3.com conwortonnent.com c/o Verisign domain.tech@yahoo-inc.com creamottonovati.com
cronjelaw.corn
277. 278. 279. 280. 281. 282. 283. 284. 285. 286. 287. 288. 289. 290. 291. 292. 293. 294. 295. 296. 297. 298. 299. 300. 301. 302. 303. 304. 305. 306. 307. 308. 309. 310. 311. 312. 313. 314. 315. 316.
cryogiwogater.com cuficellimaad.com cumberiangle.corn cyberistrolax.com daosf3 doapo. com dasyucorbit.com dazerfest.com dbi-static.com
demanaielo.com
dempeightemya.com deratirelcomni.com deressenwarpoJ.com dnsonchecks3.com dogovoridze.net brandc.name
brigatexgluc.corn
brin&ithomedude.com bmsounds.cc bryandsighter.com bxkkuskgdjskdn.com camesd.com
careolnetcompowerfew.corn
cartapps.com cdkd.net cdnsecurehost.com cedeophys.com celequidictor.com chacecipe.com chbytechipemen.com chetteaditas.com
clingcornern.com
c1osedsource.cc codecurveopusi.com 036px.com I08cmS.com Ib86a9c7.com
1nbank.info
2020films.net 24onlinedrug.com 2report-nacha-org.com
updater updater updater updater dropzone, infector updater dropzone infector dropzone, source updater updater updater infector drol'zone dropzone, infector updater dr0J>zone, updater dro(J_zone, infector updater dropzone drop zone, source dropzone, source, infector source, updater infector embedded js drop zone updater dropzone updater updater dropzone dropzone dropzone embedded js source embedded js source updater source source
317. 318. 319. 320. 321. 322. 323. 324. 325. 326. 327.
4to4kit.com 56pa7bo.com 73a372rtp.com 7435424vs.com 7435474vs.com 7435924vs.com 7437424vs.com 7438424vs.com 83a372rtp.com 888778889900.net 930nbsdaiodsa.com
drop zone dropzone dropzone dropzone dropzone dropzone dropzone dropzone
cl) ogiwogater.com@privacy.above.com marlenehobsbawm@Jive.co.uk c/o Verisign cyberistro lax. co m@privacy.above.com firicosl@live.com c/o Verisign nvpZYdgrs@whoisprivacyprotect.com oke2@mail.ru admin@demanajelo.com dempeightemya.com@privacy.above.com repossesseddomain@godaddy.com deressenwarpol. com@privacy.above.com domains@microsoft.com c/o Verisign brandc.name@domainsproxy.name c/o Verisign steven.sol1!@yahoo.com rastainfo@Jgmail.com reeossesseddomain(a)godaddy.com bxkkuskgdjskdn.com@contactprivacy.com .perolsp@yahoo.com nsrm(a)register .com waved(a)mailti.com exsile777 (a)gmail.com cadet@fastermail.ru admin@cedeophys.com celequidictor.com@privacy.above.com xkcrdqfg@whoisprivacyprotect.com chbytechipemen.com@privacy.above.com c/o Verisign admin@clingcomem.com c/o Verisign hut@bz3.ru contact@myprivateregistration.com i.cannot.do.it@gmail.com domain.tech@yahoo-inc.com noqtcha@mail.ru admin@exticie.com.au 24onlinedrug.com@domainnameproxyservice. com mznSz4sihe64xyuvvdsjfucknylnncxhhxsgqetOv hqhndwlc@2report-nachaorg.corn. whoisproxy.org repossesseddomain@godaddy.com c/o Verisign c/o Veri sign c/o Verisign c/o Verisign
c/o Verisign c/o Verisign c/o Verisign c/o Verisign admin(a)930nbsdaiodsa.com
328. 329. 330. 331. 332. 333. 334. 335. 336. 337. 338. 339. 340. 341. 342. 343. 344. 345. 346. 347. 348. 349. 350. 351. 352. 353. 354. 355. 356. 357. 358. 359. 360. 361. 362. 363. 364. 365. 366. 367. 368. 369. 370. 371. 372. 373. 374. 375. 376. 377. 378. 379. 380.
aaa l-news.net
aaakiudsnayyq.com aboutinsurcar.com accessslist.net ach-files-alert.corn ach-nacha.corn accoukierlism.corn ach-reports.corn ach-transffers-us.com achyroransib.com acrefled.com ad I cflg2.com administrarlonistsdug.com
dropzone updater
embedded js source source updater source source updater droEzone embedded js dropzone updater Source infector source infector source source source source dropzone updater dropzone dropzone, infector embedded js source updater dropzone embedded js dropzone dropzone, source, infector source embedded js source source source source updater up dater updater dropzone embedded js up dater ~e, dropzone infector source -- source infector infector source, infector
advdomain.corn
adventurehorde.com adventureineer.com adventureitect.com adventuremechanic.com adventureriver .net adventurerocks.net adventureshoal.com
adventureswarm
aepyhone.com aeractraspac.com afiating.com aitgrqfhvmewsys.com aj ax -com. net akcakocadetayinsaat.com alconichill.com aldrorist.com adv-protection.cc aleorew.com alertedzones.corn alerts- federalresrve.com alleopneandertal.com allmemoryram.com all-nachadatainfo.com all-nacha-datalnfo.com allnacha-users-bank.com americauta.net amersterin.com angebrethetcombiznet.com anthonydeloso.com antifraud -check, com antiglobalgg.eom anualiverk.com applefincorp.net appscoast.corn aquadigita.com
aquaedition.com
aquajaunt.com
aquaschooner.corn aquaskiff.com
craig@trexmarketing.co.za aaakiudsnayyq.com@domainsb:z'Eroxy.com contact@PrivacyProtect.org admin@accessslist.net contact@myprivateregistration.com info@premiumregistrations.com c/o Verisign Randisnyder33@yahoo.com derewsater@yahoo.com c/o Verisign c/o Verisign contact@myprivateregistration.com admin@ikeainyourmindgiraf.com info@advdomains.com steve@bingotalk.com howellinsuperable@yahoo.com howellinsuperable@yahoo.com support@neturf.com support@neturf.com rowenachauvin@ymail.com accounting@moniker.com rowenachauvin@ymail.com clo Verisign c/o Verisign c/o Verisign g856y7f88nz@lnameprivacy.com Domain. tech@yahoo-inc.com akcakocadetayinsaat.com@domainsbyproxy.co m c/o Verisign andpushon@hotmail.com admin@adv-protection.cc perolsp@yahoo.com admin@alertedzones.com contact@myprivateregistration.com lancasterchemisorb@yahoo.com Anshpat2826@gmail.com christineselva@yahoo.com crystolwiedeman@yahoo.com allnacha-users-bank.com@contactprivacy.com contact@webdomainsbyproxy.com alanmcwilliams@live.co.uk c/o Verisign anthonydeloso.com@proxy.dreamhost.com info@antifraud-check.com zhongguancun@yahoo.com anualiverk.com@domainsbyproxy.com gmvjcxkxhs@whoisservices.cn video@fxmail.net support@hostgator.com domains@netfirms.com barmintual@ymail.com barmintual@ym;:lii.e.om ua'llllntual@ymailcom
381. 382. 383. 384. 385. 386. 287. 388. 389. 390. 391. 392. 393. 394. 395. 396. 397. 398. 399. 400. 401. 402. 403. 404. 405. 406. 407. 408. 409. 410. 411. 412. 413. 414. 415. 416. 417. 418. 419. 420. 421. 422. 423. 424. 425. 426. f-----.-427. 428. 429. 430.
aquasloop.com aquasrc.com arabeeffect.com
arctosinbrasllia.com armyfloridagames.com arrested-taxes. com artechellirat.com articityxpaqua.com aryirs.corn asanveni.com askeduptier.corn
infector source dropzone dropzone embedded source source updater infector dropzone dropzone
assmitizeree.com
astinazmen.com atbandau.com athmainfosolutions.com atlancentuage.com audubideonetity.com australia-verse. com autoparo.com avaintellegeron.com avectintemottis.com azuremator.com babyberta.com backupdornainrnuie 1245.com badlike.com badthen.com badthese.corn bakboro.com balticsevicestrust.com bankencryption, net barcodeioyness.com bariousauk.com
updater infector
updater updater source infector dropzone source source source dropzone, source, infector dropzone embeddedjs dropzone dropzone source dropzone infector source dropzone, infector, updater source source source source infector dropzone,
barnetra.com
bassyfromso Ihost. com
battlewright.com
bb4f.net bbbyygd3 yggbc.com bedmany.com bedthese.com bedwill.com bedwould.com beermoth.com befzdzxfpgvvtsjs.com beggardield.com belisimo I.com beluga88.com bertonald.com bestparoels.com
domains@hugedomains.com barmintual@ymail.com c/o Verisign zhongguancun@yahoo.com doorkeepemava@yahoo.com jukioleroa@yahoo.com repossesseddomainesgodaddy.com aianmcwilliams@live.co.uk stopgap@ymail.com the.maIware.cabal@gmail.com c/o Veri sign assmitizeree.com@privacy.above.com c/o Verisign c/o Verisign idreamzsolutions@gmail.com c/o Verisign c/o Verisign cheryltreinen@yahoo.com contact@privacyprotect.org susanboyce@live.co.uk c/o Verisign accounting@moniker.com traffic@intrustdomains.com admin@backupdomainmuieI245.com texasboyOO@rocketmail.com texasboyOO@rocketmail.com texasboyOO@rocketrnail.com chris.deakle82_@ymail.com admin@weknewthatallthetime.com admil!@bankenc~tion.net arcad~@mailae.com an~ushon@Jhotmail.com b'!lJl_etra.com@!contactprivacy.com admil!@bassyfromsolhost.com howellinsll_i)erabl~yahoo.com bb4f.net@domains~},Qroxy.com laurake 1s@gmaiI.com domains@netfmns.com d20bzj44f259909765df@w86bna54f21bffa2ffd Lprivatewhois.net texasboyOO@rocketmail.com c/o Verisign tulukhulhu@yahoo.com a86afSue8ca@nameprivacy.com c/o Verisign c/o Verisign zhongguancun@yahoo.com contact@Jprivacyprotect.org contact@Jprivacyprotect.org noreply@centrohost.ru c/o Verisign wanetka@tlen.pl wanetka@tlen.pl
dropzone dropzone, source, infector dropzone embedded js dropzone updater -_source source
best-trololo.com
betterheousermy.com biggestblazer.com biggestchief.ccm
blggestclone.com biggestcoin.com biggestfunds.com biggest loop. com
source infector infector source
gogofreeze@hushmaiI.com gogofreeze@hushmail.com e3up3ib4f5a9242cf795@w86bna54f21bffa2ffd l.privatewhois.net 437. biggestmaster.corn source pendingrenewalordeletion@networksolutions.c om 438. biggestmate.com source gogofreezeeahushmail.com 439. biggestoneer.com source pendingrenewalordeletion@,lnamesecure.com 440. biggestpilot.com source wanetka@,ltlen.pl 441. biggestsetter.com source admin@overseedomainmanagement.com 442. billychalk.com source vazzamoon@rocketmail.com 443. billycharge.com source vazzamoon@rocketmaiLcom 444. billycheerful.com source domains@netfirms.com 445. billydie.com source hostmaster@directnic.com 446. bilIydoghouse.com source accounting@moniker.com 447. bisiteles.com infector hobbitgod@ymail.com 448. bitebeehive.com source techarts@globaIsources.com 449. biteblew.com source pendingrenewalordeletion@networksolutions.c om biteblind.com 450. source h6ad4g34f2599077! c70@w86bna54t21bffa2ff d I.privatewhois.net 451. biteblown.com source domains@netfirms.com 452. blestim.com dropzone nat.khilkevich@gmail.com 453. blogoettindia.com updater c/o Verisign 454. blueberrymo.com updater blueberrymo.com_@privacy.above.com 455. bluemator.com source whois@fastdomain.com 456. blumswell.com source support@neturf.com 457. boatorldenoras.com updater alanmcwiIliams@,llive.co.uk 458. boletin turistico.com dropzone cacueto@comcast.net 459. borsteksavalu.com updater borsteksavalu.com@,lprivacy.above.com 460. boxtaditp.corn dropzone iimn@,lyahoo.co.uk 461. brigatexgluc.com updater c/o Verisign 462. broadbandintemetspeedtest.com source contact@,lprivacyprotect.org 463. bryandsighter.corn dropzone, updater alanmcwilliamsealive.co.uk 464. bstunvzykqqpjo.corn dropzone, infector wv4k596n5se@,lnameprivacy.com 465. bumeter.com dropzone c/o Verisign 466. bumingidea.com source jinterva@ucsd.edu 467. bursayserry.com dropzone c/o Verisign 468. busiene.corn embedded js uquirjj@,lyaho.com 469. buttorfos.com dropzone admineabuttorfos.com 470. buut7ar.com dropzone c/o Verisign 471. camesd.com dropzone perolsp@,lyahoo.com 472. camplngrange.corn source lcjg@citcom.net 473. campingshelf.com source lcjg@citcom.net ~=7---r~-L~~~~-----------------------+~~~-------------4~~~~~~~-------------'------~ 474. campingstack.com source lcjg@,lcitcom.net 475. canceled-transfer.com source contact@,lmyprivateregistration.com 476. cardholder-security.com source georgewashere5I@,lyahoo.com 477. card-security.net source card-security.net@contactprivacy.com , 478. careolnetcompowerfew.com updater lauraboschettigaaol.com 479. caronivarium.com source spruebeatty@yahoo.com 480. cartanos rAm updater waved@mailtLcom 481. car rcuun .corn dropzone gmvjcxkxhs@whoisservices.cn
~~--~~~~~~-----------------------~~~~------------~~~~~~'~~~~~----------------4
482. 483. 484. 485. 486. 487. 488. 489. 490. 491. 492. 493. 494. 495. 496. 497. 498. 499. 500. 501. 502. 503. 504. 505. 506. 507. 508. 509. 510. 511. 512. 513. 514. 515. 516. 517. 518. 519. 520. 521. 522. 523. 524. 525. 526. 527. 528. 529. 530. 531. 532. 533.
cavanaghandcompany.com cccdfgethyn76.com cdnsecurehost.com cedeophys.com celequidictor.com chacecipe.com chapedclothes.corn chbytechipemen.com chdormante.com checkip4u.net checkmelater.com chetteaditas.corn chipsiedok.com chorinav.com clickhere67. corn clingcornem.com clixa.eom cloisan.corn coffien.net coil I.com coll2.com co1l3.com colobird.com colocurl.com colocycle.com coloquel.com colowheel.com combigave.com combigi ving.com combijump.com combimyself.com combiplease.com complexflx.com
updater updater embedded js dropzone updater dropzone dropzone updater dropzone dropzone, updater dropzone updater source dropzone dropzone dropzone, updater updater
connectsharelearn.corn
conwortonnent.com cooldgaggle.com cooldherd.com cooldhorde.com copelixell.com coralaw.com coralaw 123 .com coreamesents.corn corpsecnet.com crappycrappy 123 .com creamottonovati.com cremasl.com cronoblankostarahmake206.net cryogiwogater.com css-lib.corn csspan.net cuficellimaad.com cumberiangle.com
dropzone dropzone dropzone dropzone source infector infector source source source infector source source source dropzone, source, infector source updater source source source updater infector infector updater dropzone dropzone updater dropzone updater updater embedded js embedded js drop zone, updater updater
chriscavanagheayahoo.com c/o Verisign cadet@fastermail.ru admin@cedeophys.com celequidictor.com@privacy.above.com xkcrdqfg@whoisprivac)'protect.com mgfrijsn@whoi~ivacyprotect.com chb}1echipemen.com@privacy.above.com chdormante.com@privacy.above.com checkip_4l!@yahoo.com bill@haiau.tv c/o Verisign spruebeatly@yahoo.com andpushoneahotmail.com admin@clickhere67.com admin@clingcomem.com peterbrowneaceneb.com c/o Verisign admin@coffien.net contact@privacy-protect.cn gasmenqqrrrgayahoo.com gasmenqqrrreayahoo.com duckymumseayahoo.com duckymums@yahoo.com duckymumseayahoo.com duckymums@yahoo.com support@neturf.com legal@moniker.com korp icsscan@skynet.be korpicsscan@skynet.be hostmaster@word.net kOIJ)icsscan@skynet.be gmvjcxkxhs@whoisservices.cn eileenroseod@aol.com conwortonnent.com@privacy.above.com mariodibattista@gelservicesrLcom mariodibattista@gelservicesrl.com mariodibattista@gelservicesrl.com c/o Verisign admin@coralaw.com c/o Verisign c/o Verisign gmvicxkxhscawhoisservices.cn da4m97i4t25acc25c2fe@w86bna54f2lbffa2ffd 1.private who is. net c/o Verisign c/o Verisign cronoblankostarahmake206.net@domainsbypro
cryogiwogater.com@privacy.above.com robertokelly5@yahoo.com timfranklin38@yahoo.com marlenehobsbawm@live.co.uk clo Verisign
534. 535. 536. 537. 538. 539. 540. 541. 542. 543. 544. 545. 546. 547. 548. 549. 550. 551. 552. 553. 554. 555. 556. 557. 558. 559. 560. 561. 562. 563. 564. 565. 566. 567. 568. 569. 570. 57l. 572. 573. 574. 575. 576. 577. 578. 579. I 580. 581. 582. 583. 584. 585.
curcandle.net curcell.net curcent.com curchart.com
source source source source source source source source source source drop_zone, infector, source dro_pzone uQ_dater dropzone dropzone, infector
curvechess.com
curvechild.com curvechime.com curvechirp.com curvechore.corn customernacha-tools.com cwlrqguvioemezr.com cyanicuma.com cyberistrolax.com cytomedi.com cyytmmlxsthywst.com da3a4no.com dasyucorbit.corn Datangoo.com datejebemupicku.corn dazerfest. com dbase-security .com dbdata-check.corn dddfdvreb46hj.com debaketo. info decalintos.com deep inch. com delaIIosa.com deligatemyname.com demanajelo.com dempeightemya.com denitraspetr.corn deratirelcomni.com deressenwarpol.com derkicide.com desafiodefe.com dgmrsyyrtkosxcjp.com
updater dropzone dropzone, updater drop zone, updater embedded _is dropzone updater dropzone source
source dropzone
updater updater updater updater dropzone, source dropzone, dropzone dropzone dropzone source dropzone dropzone dropzone dropzone
diandres.com diksdirect.com
discount-london-tours. dohturboob.com doliv777.com doliv7770.com doliv777I.com doliv7772.com doliv7773.com doliv7774.com doIiv7775.com doliv7776.com doliv7777.com doliv7778.com doliv7779.com domozhe.com com
dropzone dropzone drop zone dropzone dropzone dropzone dropzone
hostmaster(i1Jword.net b6wlpec4f2599056c30f@w86bna54f21bffa2ff d l.privatewhois.net tryagain@tpg.com.au dewus 123@embarqmail.com tryagain@tpg.com.au printing@laserprinterchecks.com printing@laserprinterchecks.com printing@laserprinterchecks.com yyjnclx4f259903671 a8@w86bna54f2lbffa2ffd l.privatewhois.net donnawillard57@yahoo.com rn3q264z34h@nameprivacy.com c/o Verisign cyberistro lax. com(i1Jprivacy .above.com c/o Verisign dt6gh2wi339(i1Jnameprivacy.com c/o Verisign clo Verisign stefan.hoheiseljagmx.net mihakurcnik@gmail.com nvpfydgrs@whoisprivacyprotect.com jfrey43@yahoo.com binder@haiau.tv c/o Verisign c/o Verisign bitbitbord@rocketmail.com poltavtzeva.svetlana@yandex.ru dominios@colombiahosting.com admin@deligatemyname.com admin@demanajelo.com dempeightemya.com@privacy.above.com admin@denitraspetr.com repossesseddomain@godaddy.com deressenwarpol.com@privacy.above.com admin@derkicide.com pastor@desafiodefe.com ht8qj6p2277@nameprivacy.com c/o Verisign waggner788889@yahoo.com domain-admin@easily.co.uk DOHTURBOOB.COM@domainsbyproxy.com admin@doliv777.com the.malware.cabal@gmail.com admin@doliv777I.com c/o Verisign c/o Veri sign ..gmvjcxkxhs@whoisservices.cn c/o Verisign c/o Verisign c/o Veri sign c/o Verisign c/o Verisign gmvicxkxhscawhoisservices.cn
586. 587. 588. 589. 590. 59!. 592. 593. 594. 595. 596. 597. 598. 599. 600. 601. 602. 603. 604. 605. 606. 607. 608. 609. 610. 611. 612. 613. 614. 615. 616. 617. 618. 619. 620. 621. 622. 623. 624. 625. 626. 627. 628. 629. 630. 63l. 632. 633. 634. 635. 636. 637. 638.
domritu.com domsterns.com donttouchme73 9.com dotmascript.com doublewin.corn doutektronumni.corn dpoougasjkshpms.com
dpouark.com
dqsrneipgzhqkrp.com
drill news. com dsjkkwlhhdd.com dskjhiukwlw.com dualforcegate.com dyaybriaikO.com dyaybriaik Lcorn dyaybriaik2.com dyaybriaik3.com dyaybriaik4.com dyaybriaik5.com dyaybriaik6.com dyaybriaik7.com dyaybriaik8.com dyaybriaik9.com dz-greenhat.com eaiitykhxsnkgnqrn.com eartherd.com earthorde.com ebaliu.com ebuityketfinus.com edeniu.com
updater embedded is dropzone source dropzone updater dropzone, source, infector embedded js dropzone, infector infector dropzone dropzone source dropzone dropzone dropzone dropzone dropzone
drop zone dropzone dropzone dropzone dropzone dropzone, infector source source drop zone updater
eeejkcduyrhjv.corn
efexxxef.com efexxxefO.com efexxxefl.com efexxxefz.com efexxxef3 .com efexxxef4.com efexxxefS.com efexxxef6.com efexxxef? .com efexxxef8.com
dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone source updater dropzone, infector embedded js dropzone dropzone embedded js dropzone up dater dropzone, infector source
efexxxets .com
eftpsinfo-center.com eguildaycock.com eieniomxzliljlnj.net elekingshop.com elitbasak.com emerati.com encryt>ted-securi!J:'-agency.com enscorose.corn eponamindranthe.com erodssmnjjmtlnk.net errorsuz.com
zhongguancun@yahoo.com admorg122@yahoo.com admin@donttouchme739.com kalavernguard@yahoo.com steven@shaiom6000.com doutektronumni.com@privacy.above.com zy3ar8s37zn@nameprivacy.com nhghtrwly@whoisprivacyprotect.com t57hy5 u68dr@nameprivacy.com reeks@mailae.com liberral@gmail.com liberral@gmail.com dualforce@gmail.com c/o Verisign Monicabrownl911@hotmail.com the.malware.cabaI@gmaii.com c/o Verisign c/o Verisign the.malware.cabal@gmail.com the.malware.cabal@gmail.com c/o Verisign c/o Verisign c/o Verisign repossesseddomain@wildwestdomains.com t57hy5 u68dr@nameprivacy.com denunzioanthony@yahoo.com z42mb88u4 75@nameprivacy.com benedettennodimele@yahoo.com c/o Verisign c/o Verisign c/o Verisign admin@efexxxef.com c/o Verisign the.malware.cabal@gmail.com admin@efexxxef2.com the.malware.cabal@gmail.com c/o Verisign the.malware.cabal@gmail.com c/o Verisign admin@efexxxef7.com c/o Verisign c/o Verisign nicholaswiltz@yahoo.com c/o Verisign rf7ph2w73 fw@nam~privacy.com c/o Verisign ELITBASAK.COM@domainsbyproxy.com c/o Verisign noqtcha@mail.ru contact@myprivateregi"",,<IVi .com c/o Verisig_n waterscomprehensive~yahoo.com support(tvhostmonster.com
639. 640. 641. 642. 643. 644. 645. 646. 647. 648. 649. 650. 651. 652. 653. 654. 655. 656. 657. 658. 659. 660. 661. 662. 663. 664. 665. 666. 667. 668. 669. 670. 671. 672. 673. 674. 675. 676. 677. 678. 679. 680. 681. 682. 683. 684. 685. 686. 687. 688. 689. 690.
eryirs.com eslikerbuna.net etflftvbiwisxnr.com eunitynewgbc.com everyyounoeverymecomn.com
evraffeypl ings.com
evrymonthnighttry.com exedrinsteadna.com faggowh.com
fdic-advantage, com fdic-custorneragent.com fdiccustomer-news.com fdic- insurance. com fdicnewsforcustomer.com fdicuser-advice.com fecticalry .com federalreserve-goverment.com federalreserve-security.corn federalresrve.com fgbnutyfhfgjdfghjil.com fheskmrozstshwo.com
source dropzone, source, infector dropzone, infector updater updater u~dater source, infector updater dropzone droj!zone source source source source source source dropzone source source source
dropzone, infector dropzone, source, updater source dropzone source source source dropzone source updater embedded js dropzone dropzone dropzone
fiboxencercha.com
files-irs-pdf.com filmv.net finance-customer. com financedata-store.com financialstatements.mrsdl.com financialtirne.name flndnachareport.com finewcreautomp.com firelinesecrets.com first.lib-invest.net first.lib-invest l.net first.lib-investz.net first.lib-invesrLnet first.1ib-invest4.net firstdir.cc fletteeierin.com fllmphpxpwqeyhj.net division 16000.net tlsunstate333.com fmsalberta.com fmvyywjqlpitous.net fnnkwlyvvrronqvp.net fokswltine.com fokwsdfrld.corn foodwhisky.com foolieracceiv.com foreveryouandmee.com forviclemo .com fpowmtyzqsdsfxl.net
dropzone embeddedjs dropzone dropzone, source, infector dropzone, source, infector updater infector dropzone, infector dropzone, infector embedded js embedded js updater updater embedded js updater dropzone, infector
stopgop@ymail.com contact@webdomainsbyproxy.com rd9cp4t73 dq(a)nameprivacy. com c/oVeris~ -lauraboschetti@aol.com c/o Verisign adm in@jajahbinksdiesforyou.com c/o Verisign admin@mymyst~ryisle.net amilcarortega@gmail.com dodsworthmike@yahoo.com jeschkemary@yahoo.com c/o Verisign contact@myprivateregistration.com lekpericlendita@yahoo.com hollfelderjeff@yahoo.com c/o Verisign contact@myprivateregistration.com lionelmerrdok@yahoo.com contact@myprivateregistration.com repossesseddornaingagodaddy.com a35yx3bq2hc@nameprivacy.com carriefraser@Iive.co.uk info@premiumregistrations.com celikseyhmus@gmaiI.com simmonsjames 1980@yahoo.com cresencioedgar@yahoo.com barton@fxmail.net sukiblyadi@yahoo.com gingerelIis75@yahoo.com finewcreautomp.com@privacy.above.com kyvepavavace@yahoo.com qtu6ta64 f2aOac865ca9@w86bna54121 bffa2ffd l.privatewhois.net the.malware.cabal@gmail.com squc6ss412b8c8d68fOe@w86bna5412lbffa2ffd l.privatewhois.net ben.jonson88@yahoo.com the.malware.cabal@gmail.com brat@mailtLcom c/o Verisign j'_77jc7ys7xp@nameprivacy.com michalasnick@yahoo.com fls~nstate3 33.com_@domainsbyproxy.com Reactivation-Pending@enom.com d386?9a55tn@nameErivaqcom d67rg3d97jp@nameprivacy.com webmaster@thefinhouse.com webmaster@thefinhouse.com asset@cutemail.org clo Veri sign adm in@foreveryouandmee.com re lIli .com js5gx56c7w8@nameprivacy.com
691. 692. 693. 694.
696. 697. 698. 699. 700. 701. 702. 703. 704. 70S. 706. 707. 708. 709. 710. 711. 712. 713. 714.
716. 717. 718. 719. 720. 721. 722. 723. 724. 725. 726. 727. 728. 729. 730. 731. 732. 733. 734. 735. 736. 737. 738. 739. 740. 741. 742. 743.
frameworkdisable.corn france- facebook.com freac.net freekinas.com freetreebreemree46364.com fresheurope.com fretolu.com fteur.com fucktheabuse.com furniture-lux.com fvpluxlvntktssf.com fvxyrrojqrsqkpvr.com gadidthen.com gafatys.com gagerLcom gavildippurum.com gavnoebanoe.com gavnoebanoe.net gdemamaruka.com gdemamarukaO.com gdemamaruka I .com gdemamaruka2.com gdemamaruka3 .com gdemamaruka4.com gdemamaruka5.com gdemamaruka6.com gdemamaruka7.com gdemamaruka8.com gdemamaruka9.com gedpoil.com gertyphacqueier.com getz-nacha-report.com get-ach-report.corn getcompanyreport.com
dropzone, source, infector source source dropzone updater embedded js dropzone dropzone dropzone, source, infector dropzone dropzone, infector dropzone, infector dropzone dropzone dropzone uRdater drop zone dropzone dropzone dro_pzone dropzone dropzone dropzone
dropzone dropzone dropzone dropzone dropzone dropzone updater source source source source source source dropzone source embeddedjs updater embedded js source, infector
getnacha-info.com getnachanews.com
get-nacha-news.com getodkeltyo.com gettingpregnantips.com getworldnewsfast.com giOsti.com getbuss inesin fo. com
girodiza.corn giupmcehjstwqeqt.com
dropzone, source updater updater dropzone, dropzone, updater embedded dropzone infector
glasseseverydaynow.com
gl obalmassretrieval, com gl obalnxtretrieval. com gl obalwebanalytics .co m globalwebz.net globridolumet.corn gloomglboorn.com godlikeloosers.com
infector infector js
gmvjcxkxhseawhoisservices.cn delcore~gcn.cx colorsandformscaaol.com admin~freekinas.com c/o Verisign garykwatterson@serv.net chris.deakle82@y_mail.com waggner788889(i1Jyahoo.com john.may24@yahoo.com ordova@ya.ru downingcinerama@yahoo.com x73 v2 7rf67z@nameprivacy.com c/o Verisign gafa!ys@yahoo.com c/o Verisign clo Verisign dillingmmnnn(tl)yahoo.com gasmenqqrrr@yahoo.com admin(tl)gdemamaruka.com c/o Verisign the.malware.cabaleagmail.com c/o Verisign c/o Verisign the.malware.cabal@gmail.com c/o Verisign c/o Verisign do Verisign c/o Verisign c/o Verisign perolsp@yahoo.com c/o Verisign rogov. vasya@yahoo.com amadasunpatrick@yahoo.com baomat@dichvubaomattenmien.vn charles boyette@yahoo.com info@premiumregistrations.com get-nacha-news.com@contactprivacy.com perolsp@yahoo.com mihaitaraipan@gmail.com dickensextrovert@yahoo.com bassia 1985@gmail.com admin@getbussinesinfo.com 5tI i4fD686@nojunkemailaddress.com admin@girodiza.com e255f24xSpb@nameprivacy.com admin@jajahbinksdiesforyou.com c/o Verisign clo Verisign admin@globalwebanalytics.com admin@ma9v-3wte.co,!! c/o Verisign admin@gloomglboom.com
binder 2l.haiau.tv
744. 745. 746. 747. 748. 749. 750. 75 !. 752. 753. 754. 755. 756. 757. 758. 759. 760. 761. 762. 763. 764. 765. 766. 767. 768. 769. 770. 771. 772. 773. 774. 775. 776. 777. 778. 779. 780. 781. 782. 783. 784. 785. 786. 787. 788. 789. 790. 791. 792.
gomosekov.net
gooeylouiecake.corn gordongraduation.com gramablessatro.com grandtarf.com cowallmastmyway.com ile.com eenballsoft.com groatcoats.com grounaxyxin.com grz97.com grz971.com gsobj.net gtpgomqbngpjmypr.com guishalf.com gurmentpass.com gxxelfrsqtkugry. net h2323yrturtyuk.com hacothalland.com
dropzone, dropzone source
embedded dropzone, dropzone embedded dropzone, updater updater updater embedded dropzone, dropzone embedded dropzone, dropzone updater dropzone dropzone dropzone, dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone, updater dropzone dropzone, dropzone, updater updater dropzone, dropzone, js source, infector
infector js infector
hambusb.com hatefelonyl l l.com hbasdauadhg.com heeerrr Lcom heeerrr2.com heeerrr3.com heeerrr4.com heeerrr5.com heeerrr6.com heeerrr7.com
source, infector
heiotrqmevizmorvvcio.com
hellofromhere98213.com hemqmqizxibgtkmk.com hetllttuptuyyyfcom hfcpdaonlines6324.com h ighnetli felentrasx. com hjfpknpnzixuxox.com hmqwuxnzwyeqkls.com hoffrnarketraph.com hogaric.com holrnancybeac.com hostei.com hotbgirls.com hotrinkolistnetbiz.com hottenmejenetcominfo.com howellsheatingandair.corn hpfuqhftxurbsoll.net htdellnoiseunivercom.com
nizag(a)mail.ru dstieferman@lhotmail.com pg9xx6xu7a8@networksolutionsprivateregistra tion.com c/o Verisign admin@fastosmile.com jones@lcutemail.org c/o Verisign contact@privacyprotect.org admin@groatcoats.com grounaxyxin.com@privacy.above.com admin@macro-store.com admin@macro-store.com judith.ebrahim@yahoo.com c/o Verisign c/o Verisign Reactivation-Pending@enom.com clo Verisign c/o Verisign thewhoisguard@gmaiI.com halfli fe. com@contactprivacy.com clo Verisign john.may24@yahoo.com adrnin@hbasdauadhg.com heeerrr I .com@contactprivacy.com the.malware.cabai@gmail.com clo Verisign c/o Verisign c/o Verisign clo Verisign c/o Verisign rnikamelio@yahoo.com admin@hellofrornhere98213.com wv4kS96nSse@nameprivacy.com downingcinerama@yahoo.com c/o Verisign highnetlifelentrasx.com@domainsbyproxy.com wu4an2xy74s@nameprivacy.com adrnin@boostsalesguru.com c/o Verisign c/o Verisign c/o Verisign abuse@OOOwebhost.com perolsp@yahoo.com carminatimarina@yahoo.it carminatimarina@yahoo.it howellsheatingandair.com@protecteddomainse rvices.com b52fp2qw5ys@lnameprivacy.com vmilenacarla@yahoo.com
source, infector source, infector
dropzone updater dropzone dropzone updater dropzone, updater dropzone dropzone, dropzone,
infector infector,
updater htdellnoiseunivercou.com
793. 794. 795. 796. 797. 798. 799. 800. 801. 802. 803. 804. 805. S06. 807. 808. 809. 810. 811. 812. 813. S14. SI5. 816. S17. SIS. 819. S20. 821. 822. 823. 824. 825. 826. 827. 828. 829. 830. 831. 832. 833. 834.
htdellnoiseunivercoz.com huckside.com hugegiantyouth.com hullimpair.corn huniloz.com huntchemical.com -'I. hvlqrn .net hydroliets.com hygrofi.com
hzmrnvkbsqqpt.com
iamnothere823.com laywtztjwkndfqtm.com idina-here.com ignarysama.com iigmvqrhotnkqsp.net ijqrqinymhjsvr.net ijuussvpteexrx.net ilovefreewifi.com inboxacc.com indigomator.com indosyslife.com
inforksonseia.com
infrarotendamkevforo.com in_gprownfour.com init-js.com inloggen-ing.com innovazipowenetyunwcz.com insurancepublicIiability.net intelinellouse.com interponsseella.corn intesasanpaolo.com invetechinte.com invintor.net iosahdoias.corn ipcheckerOO I.com ipchecker002.com ipchecker003.com il'checker911.com ipuimurqmerpvl.net irs-00038004800us.com irs-000787002900us.com irs-alerts-report. com
updater dropzone dropzone embedded dropzone source dropzone, dropzone drop zone dropzone, dropzone dropzone, dropzone updater dropzone, dropzone, drop zone, dropzone dropzone, source source updater dropzone, updater infector embedded embedded updater source updater updater embedded updater dropzone dropzone dropzone, dropzone, dropzone, drop zone, dropzone, source source source
infector source, infector infector source, infector
m-renewals@r~gister.com c/o Verisign admin@ikeainyourmindgirafcom ~gmvjcxkxhs@whoisservices.cn admin@huniloz.com info@premiumregistrations.com apprehensivebrandt@yahoo.com andpushon@hotmail.com c/o Veri sign c/o Veri sign admin@iamnothere823.com z34jb9zg_2a5@nameprivacy.com starbuckqaf@netscape.net c/o Verisign u583p92r8uv@nameprivacy.com c/o Verisign c/o Veri sign support@registerfly.com contact@privacyprotect.org watervis@planet.nl pkarthik24@yahoo.com clo Verisign albanaliaj 16@yahoo.com bulbolighter@yahoo.com gi Idertamra@yahoo.com contact@privacyprotect.org clo Veri sign admin@maiI2u.com.au c/o Verisign c/o Verisign hostmastereqintesasanoaolo.com clo Verisign bornd@yahoo.com admin@iosahdoias.com ipcheckerOO l@yahoo.com admin@overseedomainmanagement.com admin@overseedomainmanagement.com ipchecker911.com w72p3 5dd5tt@nameprivacy.com info@premiumregistrations.com iukioleroa@yahoo.com rp5xmbykruvdbquupu2uOqabgfgsvifmjhknqer2 vhsuchyam@irs-alertsreport.com.whoisproxy.org irs-charge.com@domainsbyproxy.com contact@privac}'Protect.org in fo@premiumregistrations.com irs-even ts. com@contactprivacy.com nilonana@y~ hoo. com clo Veri sign contact@mvprivateregistration.com isslessensual.com@privacy.above.com
updater updater updater updater infector
835. 836. 837. 838. 839. 840. 841. 842.
irs-charge.com irsdatafilereport. com irs-data-storage.com irs-events. com irs-reports. com isopect.com isportes.com isslessensual.com
source source source source source dropzone dropzone embedded
843. 844. 845. 846. 847. 848. 849. 850. 851. 852. 853. 854. 855. 856. 857. 858. 859. 860. 861. 862. 863. 864. 865. 866. 867. 868. 869. 870. 871. 872. 873. 874. 875. 876. 877. 878. 879. 880. 881. 882. 883. 884. 885. 886. 887. 888. 889. 890. 891. 892. 893. 894. 895.
itimezonenetcomwerytt.com ixvwpvwulcqenlim.com iylsorzrj Imsuwy.com jabber911.com jackeydu.com jahsdiuasbdiaa.com
jajahbinksdiesforyou.corn
jambsulumency.com jdfslkjldssd.com
jeancena.corn
jellabillat.com jerikold.com jetuodiresbepourtua.com jimpnea.com jitteryworld.com jjuegsqqekypjsg.com jlojsunoymwtvktj.com j obinedianingfo. com jockesnotliked.com johnsonforums3.com jollyconcierge.com jonathanhaasdesign.com
updater dropzone, dropzone, dropzone, dropzone dropzone source updater dropzone dropzone updater dropzone dropzone dropzone source dropzone, dropzone, updater updater
infector infector, source updater
dropzone dropzone drop zone dropzone, dropzone, embedded drop zone embedded embedded embedded embedded embedded dropzone, drop zone dropzone up dater dropzone, dropzone, dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone
jovamekoz.corn
jp fvgkrio_qvnswtn. com irhxuysrpJlsoum .com jscripts.net isdlfkhusfds.com js-includes.com js-init.net js-lib.net jsmsgb.corn jsobj.corn ju iorkbopglri] uy, net jujuity.com julithos.com jumernmheavennetcomdre.ccm junesornmerlivey.com justdrv .net kadonisoft.com kadonisoftO .com kadonisoft l.com kadonisoft2.com kadonisoft3.com kadonisoft4.com kadonisoft5.com kadonisoft6.com kadonisoft7.com kadonisoft8.com kadonisoft9.com
infector infector is js js js js .is source, infector
source, infector infector
dropzone dropzone, dro2zone dro2zone, source, infector infector
karakumma.corn
kdsnrakdvnezxpwq.com kecisygewayixp.com
kenamersoft
c/o Verisign c/o Verisign ns5m23 ur84 w@nameprivacy.com jabber911.com@privacy.above.com admin@denitraspetr.com admin@jahsdiuasbdiaa.com admin@jajahbinksdiesforyou.com c/o Verisign liberral@gmail.com c/o Verisign c/o Veri sign c/o Verisign the.malware.cabal@gmail.com c/o Verisign j itterywor ld. com@contactprivacy.com ea4cy5zc9n8@nameprivacy.com t57hy5u68dr@nameprivacy.com c/o Veri sign jockesnotliked.com@privacy.above.com admin@johnsonforums3.com domain-admin@easily.co.uk jonhaas@gmail.com jovamekoz@yahoo.com bp24s6n2497@nameprivacy.com z39h~ky6rj@nameprivacy.com lindseybowman56@yahoo.com contact@privacyprotect.org morrison alisha@yahoo.com jennifer.henderson62@yahoo.com susan.haines3 7@yahoo.com domain.tech@yahoo-inc.com domain.tech@yahoo-inc.com zy3vb4em6bb@nameprivacy.com c/o Verisign c/o Verisign c/o Verisign m-renewals@register.com admin@macro-store.com admin@kadonisoft.com c/o Veri sign the.malware.cabal@gmail.com admin@kadonisoft3.com kadonisoft3.com@contactprivacy.com admin@kadonisoft4.com the.malware.cabal@gmail.com clo Veri sign clo Verisign c/o Verisign c/o Verisign admin@buttorfos.com contact@privacyprotect.org k63we9nm3yx@nameprivacy.com repossesseddomain@godaddy.com
896. 897. 898. 899. 900. 901. 902. 903. 904. 905. 906. 907. 908. 909. 910. 911. 912. 913. 914. 915. 916. 917. 918. 919. 920. 921. 922. 923. 924. 925. 926. 927. 928. 929. 930. 931. 932. 933. 934. 935. 936. 937. 938. 939. 940. 941. 942. 943. 944. 945. 946.
keorqovrmetsrfo.com kgkdominas.corn khkhkjhiocgsgs.com khuuvzqpowtmknby.com killdfymerraque.com kilotran.com kjpqetncnrjothzs.net kniferiddin.com knspqntnrlqkeos.net koklip.com koletrezzo44.com koletrezzo55.com koletrezzo66.com ko letrezzo77 .com koletrezzo88.com koletrezzo99.com kovjmkilwfqmlpws.com kpcpoqyfljrdqpr.net krewqskynesscompowime.com kristradentro.com krivoglazeg.net kvazimoder.com kwalai.com kynhsqpnbjrwvqi.net kzqorrmplugwstm.com ladybugecards.com lantallyga.com layuplaeani.com lazysit.net leakedbyzerO.com lekaleo.com lekhausurex.com lenkzetrqvsnk.net Ieopodentargit.com Ifrtvettnwmnpmi.com lhtbsotjisgvwvp.net lilaussieprems.com Iinindi.com Iinsela.com liviarylink.corn lmtljukqunydhxuz.net lobsterliveverrolad.com lobsterliveverromem.com lobsterliveverromez.com locaresplicutl.com lorevingbranta.com loudworld.net Ipaokum.com Ipnksckywkyyxmqh .com Iqhkqohqsqvjokr.com lq Iktuzitgtghqem.com
dropzone, source, infector source
dropzone, up dater dropzone dropzone, dropzone dropzone, dropzone drgpzone dropzone dropzone drop zone dropzone dropzone dropzone, dropzone, updater updater updater
infector, source infector
drop zone infector dropzone, infector dropzone, source, infector source dropzone
source dropzone dropzone updater dropzone, updater dropzone, dropzone, updater dropzone dropzone updater dropzone, dropzone, updater dropzone, dropzone, updater
infector source, infector infector
infector infector, source, infector infector,
k3 5hx8dk6 nc(a?nameprivacy .com registrar{l'vmacrohost.com c/o Verisign yj55n8hw5nb(a?nameprivacy.com c/o Verisign contact@privacyprotect.org d38679a55tn(a?namepriva\:y,com c/o Verisign contact(a?privacyprotect.org tayosalaudeen(a?yahoo.com repossesseddomain(a?godaddy.com repossesseddomaineagodaddy.corn ko letrezzo66 .com(a}contactprivacy. com the.ma!ware.cabal@gmail.com adm in(a?ko letrezzo8 8.com admin(a?ko letrezzo99 .com u5 83p92r8uv(a?namepri vacy, com ba55f7xs5g6@nameprivacy.com c/o Verisign kristradentro.com@privacy.above.com peOid4z4f2b6ace21 c7l@w86bna54f2lbffa2ffd I.privatewhois.net kvazimoder.com_@privacy.above.com msoe(a?yahoo.fr c/o Verisign d38679a55tn(a?nameprivacy.com studio(a?rinatgaz.com .. c/o Veri sign _--= c/o Verisign stevehisey@gmaiI.com the.malware.cabal@gmail.com perolsp@yahoo.com c/o Verisign wc2ve8y48hv@nameprivacy.com c/o Verisign apprehensivebrandt@yahoo.com n97b76fk87g@nameprivacy.com admin@lilaussieprems.com jkcqhygwr@whoisprivacyprotect.com c/o Verisign c/o Verisign a35yx3 bq2hc@nameprivacy.com m-renewals@register.com m-renewaIs@register.com admin@overseedomainmanagement.com c/o Veri sign clo Verisign almonarion(a?rocketmail.com c/o Verisign hostmastereeabc /e.corn d97f84nn9rq@nameprivacy.com bx7 q4 76c6sv@nameprivacy.£2_l!l__
updater infector dropzone dropzone, infector dropzone, infector dropzone, infector
947. 948. 949. 950. 951. 952. 953. 954. 955. 956. 957. 958. 959. 960. 961. 962. 963. 964. 965. 966. 967. 968. 969. 970. 971. 972. 973. 974. 975. 976. 977. 978. 979. 980. 981. 982. 983. 984. 985. 986. 987. 988. 989. 990. 991. 992. 993. 994. 995. 996. 997. 998. 999.
Ira7nef.com lsthupsocdbncqnn.net ltdstar.com lucascattientop.com Iucassfield.com luckystrikeO.com ludos-apparare.com lunedesign.com lvqdsuimvkxpuqro.com manageality.com manageient.com manageity.com manageium.com
managenetwor.com
martinololo.com mastersil i.com mastik? 56bombastik matdugt4.com materryon.com mateumer.com matoroad.com matoway.com mctqyvjmcktmvsw.net meandyounow.net meazeridashloc.com mediacoif.com
dropzone drop zone, infector dropzone updater up dater updater source embedded js dropzone, infector source source source embeddedjs updater dropzone dropzone updater dropzone dropzone dropzone infector infector dropzone, source, infector dropzone updater infector, source
medlya.com
meinliffenetbizcomzz.com melbamb.com meligarm.corn mentripete.com meslefot.com metabolez.com mhjqptzoirgklhhrn.com mijningeu.com minienenl.com
dropzone, updater dropzone dropzone updater dropzone dropzone, dropzone, embedded embedded updater dropzone source dropzone dropzone, updater dropzone, infector infector infector dropzone dropzone, dropzone, dropzone, dropzone,
Ul "l'L.V"'O
repossesseddomain@godaddy.com rf7po2w73 fw@nameprivacy.com admin@ltdstar.com c/o Verisign cio Verisign gmvjcxkxhs@whoisservices.cn 8n6ptzvk7oky5psIl7ik@f.o-w-o.info lunedesign@mailti.com kh3te68h3mx@nameprivacy.com accounting@moniker.com boogievoogieoscareaymail.corn boogievoogieoscar@ymail.com jz95pScw76d@nameprivacy.com c/o Verisign admin@ikeainyourmindgirafcom contact@zinkhole.org russellimbat@yahoo.com admin@overseedomainmanagement.com c/o Veri sign c/o Verisign huligator@yahoo.com) huligator@yahoo.com swSct9bh 7 sg@nameprivacy.com bill@haiau.tv c/o Verisign lulu@cutemail.org chris.deakle82@ymail.com nsrm@register.com c/o Verisign meligarm@yahoo.com c/o Verisign perolsp@yahoo.com admin@macro-store.com k86c98xv6bx@nameprivacy.com zilvinasbutkus@hotmail.com info@minienenl.com cio Verisign binder@haiau.tv contact@privacyprotect.org rnimaatmandesignsesgmail.com wm6vn79m42~@nameprivacy.com c/o Verisign k35hx8dk6nc@nameprivacy.com floweflyer@ymail.com floweflyer@ymail.com tloweflyer(aJymail.com clo Verisign
infector source, infector js js
minollumentlynx.com
misskissoftheryear.net mistemet.com mjmaatmandesigns.com mmskwqowxpgtwt.com moderheitrack.com mofoqglsinxslc.com moksdog.com moksfin.com
rnokshark.com
moneancens.com mpykqsrhnpitnq.com mqjmusjopkvuqnu.com msrrevukwitsgpog.com mtufxdylzvomnub.net muientbass.com mumbaiescortsdirecto~.co'.!!__
reasonhickeyeavahoo.com
t57hy5u68dr@nameprivacy.com rn3q264z34h@nameprivacy.com xy96q63 g6sy@narHcvl1 lacy. com corn admin@mu: baby@baby.com
1000. 1001. 1002. 1003. 1004. 1005. 1006. 1007. 1008. 1009. 1010.
musesquad.com mutanisopendsie.com muticeptad.com muvpihoovdqvyzh.net muzwniltlrpgmpn.corn mvdjeqonofivwurr.com mvuuorhqhofpwmu.net myescortsdirectory .com
myhandsareveryfying.com
mynettube.net myrtlebeachscreenprinting.com mysubrnissionservice.corn naberlin.net nacha-ach.com nacha-achalert.com nacha-advertisement.com nacha-alarm.com nachabank-users.com nachabank -usertools. com
1Ol3.
1014. 1015. 1016. 1017. 1018. 1019. 1020. 1021. 1022. 1023. 1024. 1025. 1026. 1027. 1028. 1029. 1030. 1031. 1032. 1033. 1034. 1035. 1036. 1037. 1038. 1039. 1040. 1041. 1042. 1043. 1044. 1045. 1046. 1047. 1048. 1049. 1050. 1051. 1052.
nacha-cashier.com
nachaclientsinfo.com nacha-comparison.corn nacha-cosm.com nacha-creditor.corn nacha-custorner.com nachacustomer-alarm.com nacha-customerequipment.com nachacustorner-news.corn nacha-customertools.com nachadata-alarm.com
nachadataallocation.com nachadatafile.com
nachadepartment.com nachaemployee.com nacha-equipmentstore.corn nacha-feedback.com nacha-files.com nacha-industry .com nachainfo-store.com nacha-info-store.com nacha- instructions user. com nachanewsarchive.com
nacha-news-archive.corn
nacha-news-download.com nacha-news-download.corn nachanewsportal.com nachanews-portal.com nacha-newsportal.com nacha-news-portal.com nacha-news--portal.com nachaorgcompany.com
nacha-plex.com
infector up dater updater dropzone, infector dropzone, source, infector dropzone, source, infector dropzone, infector source drop zone source source source dropzone, source, infector source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source
accounting@moniker.com c/o Verisign c/o Verisign wc2ve8y48hv@nameprivacy.com mq8ka9m235j@nameprivacy.com qc2bg2669pw@nameprivacy.com fraserafrica@yahoo.com bhupendraacharya@gmail.com admin@ikeainyourmindgiraf.com sngll orhnn@hotmail.com beachscreenprint@aol.com webmanil@gmail.com gmvjcxkxhs@whoisservices.cn nacha-ach.com@contactprivacy.com pilomakkie@yahoo.com caillet. victoria@yahoo.com nacha-alarm.com@privacy.above.com nachabank-users.com@contactprivacy.com nachabank-usertools.com@contactprivacy.com markskinner56@yahoo.com lizbethguerrero 7 5@yahoo.com fIoechristine@yahoo.com info@premiumregistrations.com c/o Verisign nacha-customer.com~privacy.above.com katherinebannan@yahoo.com pancharlene@yahoo.com nachacustomer-news.com~privacy.above.com oyerdarrell@yahoo.com nachadata-alarm.com@contactprivacy.com nachadataallocation.com@contactprivacy.com dohertysean20@yahoo.com gametzip3456~yahoo.com sequeiralezrocketmail.com pdustin6 I ~yahoo.com edwincabrera55@yahoo.com contact@myprivateregistration.com info@premiumregistrations.com kiflombirhane@rocketmail.com baomat@dichvubaomattenmien.vn qphsrywymt@whoisprivacyprotect.com michellebyme96@yahoo.com keiserglen@yahoo.com carol.brooks85@yahoo.com walshshirla@yahoo.com admin@overseedomainmanagement.com nachanews-portal.com@contactprivacy.com nacha-newsportal.com@contactprivacy.com javaruskijames@yahoo.com tylermelan ie4 7@yahoo.com baomat@dichvubaomattenmien.vn info@premiumregistrations.com arcosmari Iyn@yahoo.com
1053. 1054. 1055. 1056. 1057. 1058. 1059. 1060. 1061. 1062. 1063. 1064. 1065. 1066. 1067. 1068. 1069. 1070. 1071. 1072. 1073. 1074. 1075. 1076. 1077. 1078. 1079. 1080. 1081. 1082. 1083. 1084. 1085. 1086. 1087. 1088. 1089. 1090. 1091. 1092. 1093. 1094. 1095. 1096. 1097. 1098. 1099. 1100. 1101. 1102.
nacha-port.com nachaportal.com nacha-portal.com nachaportalserver.corn nacha-portal-server.com nacha-rejectedalert.com nachareport.com nacha-report-downlod.corn nacha-reporte.com nacha-reports-domain.com nacha-reportsl ink. com nachaserverportal.corn nachaserver-portal.com nacha-server-portal.com nachasfast-equipment.com nacha-shire.com nachasnewsportal.com nachas-portal.corn nachasuser-alarm.com nacha-transferreport.com nacha-urgent-portal.com nachauser-account.corn nacha-userauthorization.com nachauser-banktools.com nacha-userbudget.com
source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source source embeddedjs source source
nachauser-budgetinfo.corn
nacha-usercommission.com nachauser-equipment.com nachauser-estimatefee.com nachauser-feedback.com nachauserin fo. com
nachauser-info.corn
nacha-user-news.com nachausers-account.com
nachausersalert.com nachausers-bank.com nacha-users-bank.com nachausersbluebook.com nachausers-book, com nachausers-industry.com nacha-users-mfo.com nachauser-storeinfo.com nachausers- wirecosts, com nachauser-tools.com nacha-wirecosts.com napieriarioumals.com nastysmell.com nationalcity.com neoprenant.com neoprenhopper.corn
r-um:
mildredeileensparks(ajyahoo.com marissawienhold@yahoo.com _p_auljJ_errotta@yahoo.com nach~ortalserver.com@privacy.above.com butlersteve93@yahoo.com contact@myprivateregistration.com edpwzqbdl3 jdafk6xe 1xkvffOwlhzzuvwbflqdufs eb Icfalk@nachareportcom carcinogenicwashingtonum(ajyahoo.com alberta.burke@yahoo.com nacha-reportsdomain.com@contactprivacy.com contact@myprivateregistration.com loita 1O@yahoo.com nachaserver-portal.com@privacy.above.com nacha-server-portal.com@privacy.above.com long:erik53@yahoo.com cvarkel'_@ymail.com info@premiumre_gistrations.com r~inaldsanders8~ahoo.com neiIlm68(a}yahoo.com contact@m2'Ql'ivater~stration.com _paulbrinkley3 9(a}yahoo .com aida fairman@yahoo.com henricksonselena(a}yahoo.com nachauser-banktools.com@contactprivacy.com dianegibson29@yahoo.com jameswagoner49@yahoo.com raynor charles@yahoo.com nachauser~uil>_ment.c0l1'l@contactprivacy.com edwardsran<b'93@y_ahoo.com jim80murfuf@yahoo.com christopherharms 17@yahoo.com marydurand 14@yahoo.com charlarichins@yahoo.com wxcbshvb@whoi~ivacyprotect.com delgadoclaro@yahoo.com susanswanson51@yahoo.com nachausers-bank.com@,contactprivacY.com nacha-users-bank.com@contactprivacy.com shoemakerjames88@yahoo.com witherspoonfranklin@yahoo.com robertson.sandra70@yahoo.com augustinecontreras@yahoo.com jerrylynnhinnantjr@yahoo.com vogelsongjosh@yahoo.com nachauser-too!s.com@contactprivacy.com flaglerjaime@yahoo.com contact@privacyprotect.org prizak@gmail.com billing@pnc.com neoRrenant.com@domainsbyproxy.com neoprenhopper.com@privacy.above.com
1106. 1107. 1108. 1109. 11l0. III 1. 1112.
1116. 1117. 1118. 1119. 1120. 1121. 1122. 1123. 1124.
neojJrenpillar.com nemnkkqxrns.com neropisap.corn neweuropeconsult.com newhachainfogetnow.corn newsfig.com newsnachausers.com nexusworldnet.com nhknrwucozndnv.com nholnwtyjrdctjr.com nightycrowlingninjas.com nilsgrietctyed.com nkktqqqtjundslp.com nmhutixnfriondpo.net nnpijflsofknlkx.com nongoonis.com
northdakotastatesite.com
source dropzone, dropzone dropzone source dropzone source embedded dropzone, dropzone, dropzone updater dropzone, dropzone, dropzone, dropzone dropzone
js infector infector
norwitols.com
novo debt. com novodebt.net npxwzlxvrzsxhox.corn nrrstlqxovkkdc.com nsnwrspvpghtnwp.com nssbc-security.cc nvfogwtptkvheh.com nwtispzwpqotek.com nylon-kingdom. com nyrtsvlqjtsoioq.com oceanmindmore.com okivoob.com oldgraber.com on~frpliteztnh.net onespointheadia.com onlineshop24blog.com opionisaO.com oralania.com osforpvqlmpiujm.com ouopdvzwbjflqozo.net ouovoswqognqrpg.com ovokslvqpwonrww.com p3736t6oa.com p3a32rltp.com p3a372rtp.com p3 a3 77rtp.com p303676oa.com p3036t6oa.com p3038t6oa.com p9a372rtp.com p9036t6oa.com pa3I_rtp.com padesionittatu.com palaksi.net palonit.com
dropzone dropzone dropzone, dropzone, dropzone, embedded dropzone, dropzone, dropzone dropzone, dropzone, infector dropzone dropzone, updater source dropzone dropzone dropzone, dropzone, dropzone, dropzone, dropzone infector infector infector js infector, source infector infector source, infector
1126. 1127. 1128. 1129. 1130. 1131. 1132. 1133. 1134.
1136. 1137. 1138. 1139. 1140. 1141. 1142. 1143. 1144. 1145. 1146. 1147. 1148. 1149.
infector infector source, in fector source, infector
dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone updater dropzone source
Verisign wh6ar6zS8hn@)nameprivacy.com contact@)privacyprotect.org faulkner28@)yahoo.com paulbrinkley61@)yahoo.com whois@)bluehost.com crandellgeorge@)yahoo.com ejeyty laoqi@)yahoo.com c/o Verisign wv4kS96nS se@)nameprivacy.com admin@)weknewthatallthetime.com braginikolaj@)yandex.com x73v27rf67z@)nameprivacy.com vfS vt9yz3 84@)nameprivacv.com bx7q476c6sv@)nameprivacy.com c/o Verisign citrads@)gmail.com c/o Verisign anato liy lis@yahoo.com anato liylis@yahoo.com c/o Verisign mv6sg27rSst@nameprivacy.com x73v27rf67z@nameprivacy.com felice@mailti.com nsS m23 ur84 w@nameprivacy.com rf7ph2w73 fw@nameprivacy.com webmaster@nylon-kingdom.com jsSgxS6c7w8@nameprivacy.com purvikanj i@)ymail.com admin@)naliora.com the.malware.cabal@)gmail.com y687276j9vh@)nameprivacy.com c/o Verisign c/o Verisign contact@privacyprotect.org chris.deakle82@)ymail.com amadeus logan@yahoo.com hy4r394j6ja@nameprivacy.com v gg6k4Snc366@)nameprivacy.com cr65 g2ap483@nameprivacy.com c/o Verisign c/o Verisign c/o Verisign c/o Verisign c/o Verisign c/o Veri sign
11S0. 11S1. 11S2. 11S3. 11S4. 11SS. 11S6.
c/o Verisign c/o Verisign c/o Verisign c/o Verisign c/o Verisign admin@nalioran.com
1157. 1158. 1159. 1160. 1161. 1162. 1163. 1164. 1165. 1166. 1167. 1168. 1169. 1170. I 171. 1172. 1173. 1174. 1175. 1176. 1177. 1178. 1179. 1180. I18!. 1182. 1183. 1184. 1185. 1186. 1187. 1188. 1189. 1190. I 191. 1192.
panamachnlms.com parofin.com pasazz.net patroqualarva.com pc4hita.com peindlsadesk.com pending-payment.com perisoneterts.com
perveneratio .corn
pganalytics.net phasefines.com photalegraza.corn picassoss.net pinkhatbackup.com pinkmite.com pintamierback.com pirjjsqgpmnomxs.com planeostsquavep.corn planevipescort.com platinumhd.tv plhypjumukjul'k.com plwfryqvhvoiuyr.com pnl tknsxsswzkku, net po3t6oa.com poflkpofikfikfik.corn pofikpofikfikfikO .com
embedded js embedded js updater updater dropzone dropzone source updater source dropzone, source, infector
updater drop zone dropzone infector updater dropzone, infector updater infector source dropzone, source, infector dropzone, infector dropzone, source, infector dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone
admin(i7Jpanamachnlms.com contac~@privacyprotect.org Pasazz.net@domainsbyproxy.cco c/o Verisign repossesseddomain(i7Jgodaddy.com liberral@gmail.com pending-payment.com@contactprivacy.com c/o Verisign Ihenderson@gt.rr.com admin@macro-store.com c/o Verisign photalegraza.com@privacy.above.com biU@haiau.tv the.malware.cabaleagmail.com cadacadabuneayahoo.com do Verisign u583p92r8uv@nameprivacy.com
mckeesummon@yahoo.com linda.clements@jJlatinumhd.tv dd3t93pu55u@nameprivacy.com dt6gh2wj339~nameprivacy.com d3 8679a55tn~nameprivacy .com c/o Verisign gmvjcxkxhs(a)whoisservices.cn c/o Verisign admih@pofikpofikfikfikI.com admin@pofikpofikfikfik2.com pofikpofikfikfik3.com@contactprivacy.com c/o Verisign c/o Verisign the.malware.cabal@gmail.com c/o Verisign c/o Verisign c/o Verisign js7oz404ea6938faa70c~oqjijS74d9300d54bd9 5. privatewhois. net clo Verisign ylynokybeduresal@yahoo.com ybxrfx:dvsy@whoisprivacyprotect.com admin@overseedomainmanagement.com c/o Verisign zm4j6Sfm3ze@nameprivacy.com x73v27rf67z@nameprivacy.com y687276j9vh@nameprivacy.com admin~primedyl.com maverickg@maverickgarrett.com venubr@gmail.com promoshuffle.com@domainsbyproxy.com do Verisign c/o Verisign c/o Verisign rd9cp4t73dq@nameprivacy.com epossesseddomain@godaddy.com
pcfikpofikfikfiklcom
pofikpofikftkfik2.com pofikpofikfikfik3.com pofikpofikfikfik4.com pofikpoflkfikfiki.com pofikpoflkfikfiko.com pofikpofikfikfik7.com pofikpofikfikfikS.com pofikpofikfikfik9.com pontuviewer.com pooletyleyep.com poptarinto.com pornxyx.com portalnachas.com portsterba, com
dropzone embedded dropzone, source dropzone dropzone, dropzone, dropzone, dropzone,
J 193.
1194. 1195. 1196. 1197. 1198. 1199. 1200. 1201. 1202. 1203. 1204. 1205. 1206. 1207. 1208. 1209.
js updater
potixmssufpuurl.com
pqoixuzoaxolmof.net
ppuqvsssgniwpy.net
primedyl.com proaxistherapy.com projens.com promoshuffle.com
source, infector infector source, infector updater
dropzone source dropzone, dropzone dropzone dropzone, dropzone,
pszwxwuyyhrnktouj
pultaine.com pupikola.com pvhweojsrnnnpqov.com pxpnksrwoqmjzotk.com
1210. 1211. 1212. 1213. "1214. 1215. 1216. 1217. 1218. 1219. 1220. -i221. 1222. 1223. 1224. 1225. 1226. 1227. 1228. 1229. 1230. 1231. 1232. 1233. 1234. 1235. 1236. 1237. 1238. 1239. 1240. 1241. 1242. 1243. 1244. 1245. 1246. 1247. 1248. 1249. 1250. 1251. 1252. 1253. 1254. 1255. 1256. 1257. 1258. 1259.
pxtnbziashnulfgu.corn
pygmance.corn
qhumrnslklxtixrv.com qlxrxjoeqppwir.com qnvryoduntlmlj.com qpmuqqpddrpqhkf.com qtmjwghrgmloamt.com qualitta.com quantraxactor.com quickreportnacha.com quick-report-nacha.com quiverain.com quivercove.com quiverforge.com quiverform.com quiversea.com quiverwave.corn qulqhpiornuvltp.com qwdxkgpcwpolrlrh.com qwhmtksyqlohccxk.net qxprnprccrajhxtt.com qzltljpkrvmdtwq.net racindo.com ragsrnile.com ragsmog.corn ragsmoke.com ragsmug.com ragsnake.com ragsnip.com ragsnipe.com ragsnub.com randornawdowibda.com randornawidnao.com randomnamefordomainlcom raz430p.com rcktiqotpsulzlz.net rcspknmpzqmkufnl. net readmedocument83.com recavatech.com recellhelsen.com reetexista. com
dropzone, dropzone dropzone, dropzone, dropzone, dropzone, dropzone, source updater source source
infector infector infector infector source, infector infector
infector source infector infector infector infector dropzone, infector dropzone, infector dropzone, infector dropzone, infector embeddedjs dropzone source source source source source source source source dropzone dropzone dropzone dropzone dropzone, source, infector dropzone, infector dropzone updater updater updater source source dropzone, infector dropzone dropzone drop zone source source source
reflectivelayer .corn
rejectedach-report.com rekq bepytokpfo l.com relationshipamersoftwarevu.com rembranddt.com repetitirovnet.net report-007298492us,com report-nacha.com reportnachaapprove.corn
em4 xy6bx7 a7(OJnamepri vacy, com c/o Verisign amadeus logan@yahoo.com yt8ng93c3tb@nameprivacy.com f868g9ck5pk@nameprivacy.com y77jc7ys7xp@nameprivacy.com ea4cy5zc9n8@nameprivacy.com soporte@mindsetco.com c/o Verisign googlprofil@yahoo.com 1vcipylzyybOgifsm127kvbk4ubd59t2l1pga7x bvxgebnO@quick-report-nacha.com quivertip@rocketmaiI.com quivertip@rocketmail.com quivertip@rocketmail.com quivertip@rocketmail.com hostmaster@above.com quivertip@rocketmail.com uz9u78n867p@narneprivacy:com dd3t93pu55u(OJnarneprivacy.com hy4r394j6ja@nameprivacy.com vv73a9jm5wh@nameprivacy.com exytihazonac@yahoo.com c/o Verisign finkka@verizon.net finkka@verizon.net finkka@verizon.net RAGSMUG.COM@domainsbyproxy.com c/o Verisign 9178ko4f2ab5db9ff67@w86bna54f2lbffa2ffdl. privatewhois.net hostmasteresword.net whois(c4fastdomain.com dmin@randomawdowibda.com admin@randomawdowibda.com p3u2rnpj4f23c3aeb29ad@w86bna54f21bffa2ff d l.privatewhois.net c/o Verisign bx7q476c6sv@narneprivacy.com g856y7f8 8nz@nameprivacy.com admin@readmedocument83.com c/o Veri sign c/o Verisign c/o Veri sign dexnet@dextech.com
luticeferriotdtyahoo.com
rflph2w73 fw@nameprivacy.com rer>_ossesseddomain(cilgodaddy.com bill@haiau.tv ch5m6hg4f2be56c3d025@w86bna54f2lbffa2ff d l.privarewhois.net info@premiumregistrations.com contact@myprivateregistration.com info@premiumregistrations,com
1260. 1261. 1262. 1263. 1264.
reports- federalreserve.com reports-info.corn reportsnacha.com reports-nacha.com reservedomain.com
126S. resolvm.corn 1266. restrarnerer.com 1267. rghnyofuinqgoeiw.com 126S. rheady.com 1269. rhunseal.com 1270. rjrqkzuieiipfyq.com 1271. rksiujowplkkovqk.ccm 1272. rkwvnrqrpiqymvi.com 1273. rmhkrrufvxioznp.com 1274. rmoytrpxmlceogk.com 127S. rmsjsuhunyiivg.com 1276. mmnmupqizipxip.com 1277. rolermpyhvnnrhp.corn ~~8~ .. ~~ro~l~li=n~~lh~e~m~y'd~ic~e=n~et~b~e~.c~o~m~ rj279~ romario279.com 1280. runtroadeatb.com 1281. rwmxtdolequwoyop.net 1282. rylizfmxdmqrpfog.net 1283. rzvqqoiqlpnpkln.com 1284. sOndell.net 128S. sa67634dt.com 1286. sa69634dt.com 1287. sa6n634dt.com 1288. sa6n884dt.com 1289. sa7n634dt.com 1290. sackbatfish.info 1291. sadclapped.com 1292. sadjumped.com 1293. sadlooked.com 1294. sadmissed.com 129S. safeinetscripts.net 1296. safesacrion.com 1297. sahhosse.com 1298. saldchwetheach.com 1299. saln634dt.com 1300. san34dt.com 1301. santeconference.com 1302. rouxiety.com 1303. royhnnqrumycqtq.com 1304. rrhxilokmiytnlmv.com 130S. rrvnxnoiefttgrw.net 1306. rshqaohvmqrkfo.com 1307. rumbt.com 1308. rumbt.net 1309. sardballierman.com 1310. sausandergere.com 1311. saxtumi.com
Ioresrias@yahoo.com reports-info.com@contactprivacy.com ronaldfedders@yahoo.com rckjvS2 i6Suomyhltkydzqm2ytanSdxaykcvSxb 1 i hyz3 Sifew@reports-nacha.com.whoisproxy.org updater 09S20379481034aSd04a@whoisprivacyservices.com.au dropzone plvhghqyhd@whoisprivacyprotect.com dropzone c/o Verisign dropzone, infector ea4cySzc9nS@nameprivacy.com drop zone c/o Verisign dropzone admin@rhunseal.com dropzone, infector thurmanpang@yahoo.com dropzone, infector k87td33t8xf@nameprivacy.com dropzone, infector c/o Verisign embedded js erivegutixo@yahoo.com dropzone, infector vfSvt9yz384@nameprivacy.com dropzone, source, infector a3Syx3bq2hc@nameprivacy.com dropzone, infector dt6gh2wj339@nameprivacy.com dropzone, infector uvitydareqanyha@yahoo.com ~u~p,d=at~e~r __ ---~la~u~ra=b~o~s~ch=e~tt~i@~;a~o~1.~co~m~ ~ dropzone romariodonate@hotmail.com updater c/o Veris!g_n dropzone, source, infector c/o Verisign embedded js exytihazonac@yahoo.com dropzone, infector c/o Verisign dropzone admin@sOndell.net dropzone c/o Verisign drop zone c/o Verisign dropzone c/o Verisign dropzone c/o Verisign dropzone richardpalmer90@yahoo.com dropzone c/o Verisign source sadclapped.com@domainsbyproxy.com source bibermoot@ymail.com infector bibermoot@ymail.com source bibermoot@ymail.com dropzone admin@secwaystorage.net embedded js vinovao@yahoo.ca embedded js Reactivation-Pending@enom.com updater c/o Verisign dropzone c/o Verisign dropzone clo Verisign source santeconference.com@domainsbyproxy.com dropzone c/o Verisign dropzone, source, infector n63pv6wx9jq@nameprivacy.com dropzone, infector c/o Verisign dropzone, infector yjSSn8hwSnb@nameprivacy.com dropzone, infector exorbitantbonilla@yahoo.com dropzone anato Iiylis@_y_ahoo.com dropzone anatoliylis@yahoo.com updater admil!@Sardballiemlan.com updater marlenehobsbawmfYlive.co.uk dropzone clo Verisign
1312. 1313. 1314. 1315. 1316. 1317.
schoolboygetout.com sciteleganal.com scqnipltesymwqn.net sddkoios.com secariadna.com secstat.com secur3 storag3 .com secure-cibc.com securedfrag888. com secureloggin.net secureweb5ervice5.net securewebtests.com securictychecking.com security lkins.com securitywebguard.com secwaystorage.net seg-opales l.net senstonymy.com senvironment.com sepnower.net
infector updater dropzone, dropzone embedded embedded dropzone embedded updater embedded dropzone embedded embedded embedded embedded dropzone dropzone updater embedded embedded embedded dropzone dropzone dropzone updater updater updater dropzone dropzone drop zone, embedded updater embedded dropzone dropzone embedded embedded embedded updater dropzone dropzone
infector js js js js js js js js
1319. 1320. 1321. 1322. 1323. 1324. 1325. 1326. 1327. 1328. 1329. 1330. 1331. 1332. 1333. 1334. 1335. 1336. 1337. 1338. 1339. 1340. 1341. 1342. 1343. 1344. 1345. 1346. 1347. 1348. 1349. 1350. 1351. 1352. 1353. 1354. 1355. 1356. 1357. 1358. 1359. 1360. 1361. 1362. 1363.
sequruty.com
serlene.com setteredradi .com shgkgwgkls.com shipportlise.com silvametinn.com simontfica.com skinze.com skjbsldkjksfhu.com slqorykvknmerkz.com sludential.com sneckstrumo.com sntdr-services.cc so47nop.com soa4gol.com softmarketvalu.corn softmarketvalue.com softrhrifty.com somanyontion.com sornebackupdomain 123 .com sonnersbale.com sop3not.com
infector js
gxwx9ur4f2be5929d2e4@w86bna54f21bffa2ff d lprivatewhois.net clo Verisign hostmaster@above.com sdfgsdfghf@msn.com admin@overseedomainmanagement.com contact@privacyprotect.org b6349815@klzlk.com jwcasher@gmail.com andpushon@hotmail.com admin@secureloggin.net admin@secwaystorage.net falkenstire@yahoo.com admin@securictychecking.com justinporten@yahoo.com admin@security-defense.com admin@secwaystorage.net clo Verisign c/o Verisign snvironment@mail.com perolsp@yahoo.com angelasavina@yahoo.com gmvjcxkxhs@whoisservices.cn clo Verisign liberral@gmail.com c/o Verisign clo Verisign clo Verisign jtmdrwze@gmaiI.com liberraI@gmail.com dt6gh2wj3 39@nameprivacy.com admin@sludential.com
kristynlauner@yahoo.com nyenaiwilliams@yahoo.com clo Verisign kovic26@gmail.com melodimatkovic26@gmail.com c/o Verisign admin@somebackupdomainl23 gmvjcxkxhs@whoisservices.cn jaffemizell@yahoo.com zanuidaaa@yahoo.com cz99x6ay7h2@nameprivacy.com meromax@online.ua albanaliaj 16@yahoo.com support@name.com hostmaster@word.net klausstork@earthlink.net yj55n8hw5nbfalnameprivacy.com c/o Verisign perolsp@yahoo.com
dropzone, infector dropzone dropzone, source, infector, updater infector infector source drop zone, infector drop zone, infector drop zone
sorbentoiq.com
sotkmnqi eoxq Hun. com spectums.corn splashnetcombizauron.corn splatsplit.corn splatspunk.com splatstamp.com sqoajponbtekil.com sqrzdjjwmlvger.net sqwed.net
1364. 1365. 1366. 1367. 1368. 1369. 1370. 1371. 1372. 1373. 1374. 1375. 1376. 1377. 1378. 1379. 1380. 1381. 1382. 1383. 1384. 1385. 1386. 1387. 1388. 1389. 1390. 1391. 1392. 1393. 1394. 1395. 1396. 1397. 1398. 1399. 1400. 1401. 1402. 1403. 1404. 1405. 1406. 1407. 1408. 1409. 1410. 1411. 1412. 1413. 1414. 1415. 1416.
srepo 1ik2O.com srimeenakshiagencies.corn srqirlswrglcrnr.net srztrvrmomsuyzp.net sshwklwjen.com ssl-autoris.com stamperglut.com standinghost.com startalertmos.com
source dropzone, infector dropzone, infector, source dropzone embedded js dropzone embedded js infector infector embedded js embedded js drop zone updater dropzone dropzone, infector, updater source updater source updater dropzone dropzone dropzone dropzone, infector dropzone dropzone, infector dropzone dropzone dropzone dropzone dropzone updater dropzone, source, infector dropzone infector infector source infector source
startancientmos.com
starosonline.net stattime.net sterientai.com sterijncom_pan.com
sticumed.corn
strohertinzeocomne.com sty lendeco .com suitionsaway.com sukablyatimes.com
sunageoshighvi.corn
contact@privacyprotect.org klmn.mohan@gmail.com ts8fu4bw89r@nameprivacy.com c/o Veri sign liberral@gmail.com voffchih@yandex.ua c/o Verisign gmvjcxkxhs@whoisservices.cn accounting@moniker.com romewarior@ymail.com admin@statosonline.net admin@stattime.net c/o Verisign c/o Verisign c/o Verisign carminatimarina@yahoo.it hslee0220@yahoo.com c/o Verisign krishnamistry73@yahoo.com c/o Verisign the.malware.cabal@gmail.com c/o Verisign contact@privacyprotect.org v56dt2ey98u@nameprivacy.com c/o Verisign wv4k596n5se@nameprivacy.com c/o Verisign titus.christopher@yahoo.com c/o Verisign craig@trexmarketing.co.za admin@weknewthatallthetime.com c/o Verisign c/o Verisign c/o Verisign hobbitgod@ymail.com hobbitgod@ymail.com hobbitgod@ymail.com hobbitgod@ymail.com admin@telephonemeonmyphone.com c/o Verisign a37zk7bv7v3@nameprivacy.com livemetal88@)hotmail.com c/o Verisign admin@the557sdeee.com c/o Verisign admin@the557sdeeel.com the.malware.cabal@gmail.com c/o Verisign c/o Verisign the.malware.cabal@gmaiI.com c/o Verisign c/o Verisign c/o Verisign --~---"
sunaitenprin.com
sustadodo.com svistoklex.com swsskhpwcqzskn.com sybilladi.com sythpvoxjztvgp.com t3a3dor.com t30s7pt.com ta4n6ar.com takers.aaa l-news. net
takethatasano.com
talettedible.com tbmtwulmmswpxzi.com teerersoru.com teleation.com te lelope.com telemonors.com teleoso.com tei<2'honemeonmyphone.com temptypath.com teqqemsccqblrmi.corn terabitscenter.cn.com tfogtwprtlupqcup.com the557sdeee.com the557sdeeeO.com the557sdeee l.com the557sdeee2.com the557sdeee3.com the557sdeee4.com the557sdeee5.com the557sdeee6.com the557sdeee7.com the557srl"p"Slcom
dropzone, infector updater dropzone, infector dropzone dropzone dropzone dropzone dropzone dropzone dropzone dropzone drop zone dropzone
1417. 1418. 1419. 1420. 1421. 1422. 1423. 1424. 1425. 1426. 1427. 1428. 1429. 1430. 1431. 1432. 1433. 1434. 1435. 1436. 1437. 1438. 1439. 1440. 1441. 1442. 1443. 1444. 1445. 1446. 1447. 1448. 1449. H*0'
the557sdeee9.com theavtechs.com theimageshare.com thernextoneter.com thesoftcheap.com throatylot.com timandjenny.com tlurionwxgynem.net tngvtxvwmkhirmfk.com tnoqypxnyijgyiss.net to365mo.com to3rtol.com toobershmui.cjb.net toplaitit.corn tpaprhttltpust.com tpsuyknjrhxwswp.com
~Oq"'PW""hgj.oom transfers-ach.com
sersouthyouth.com sfer-canceled.com
1452. 1453. 1454. 1455. 1456. 1457. 1458. 1459. 1460. 1461. 1462. 1463. 1464. 1465. 1466. 1467. 1468. 1469.
trawwers.comlu.com tremunicu.co tripolefourgaz.com trucktrumpet.com trucktugboat.com trucktulip.com trucktwirl.com truckunzip.com trupledoublehardcore.com truwofhvwslmsiv.com tskktvrxjSqopqo.com ttgtwm ittvsqapo. com tubehub.net tuzhintonrszdews.net tweetwinner.com twistloft.com twistplex.com typqgj hpjroteq i.net
dropzone updater dropzone updater embedded dropzone updater dropzone, dropzone, dropzone, dropzone dropzone dropzone embedded drop zone, dropzone, dropzone, infector source source dropzone dropzone dropzone infector source infector source source source dropzone, drop zone, drop zone, dropzone dropzone, source source
js infector source, infector infector
tywinderdamaku.com tzmaxi.com ufrlmuknqyvopf.com uhahaka.corn
uhnuomrrxqjsth.com uitqfowjrhwtrzkx.com
ukrainewskill.com
uljnnlhshkhlkdt.com ulowzvirxysntmyn.com umwmpwulypvudok.com undercovermimimi.com uosvzyppolqpjmql.net uptonxtwealth.com urbantoprtunitiesforme.com ursubstootin.com
source dropzone, infector updater dropzone dropzone, infector dropzone, source, infector dropzone, source, infector dropzone, infector updater dropzone, infector dropzone, infector dropzone, source, infector dropzone dropzone, source, infector source source dropzone
c/o Verisign theavtechs.com@domainshyproxy.com dns@videotron.ca c/o Verisign melodimatkovic26@gmail.com c/o Verisign info@goldencarat.com w72p35dd5tt@nameprivacy.com hy4r394j6ja@nameprivacy.com equilateralftanklingayahoo.com c/o Verisign c/o Verisign cjb@cjbmanagement.com bet222win@gmail.com mx6np6jy4dc@nameprivacy.com c/o Verisign mclainfibrosis@yahoo.com mckeesummon@yahoo.com derewsater@yahoo.com dstvpbwbr@whoisprivacyprotect.com awex@hostprince.com c/o Verisign admin@ikeainyourmindgiraf.com marvol@gmx.net annie@dentand.com riverrat@rochester.rr.com trucktwirl.com@privacy.above.com hostmaster@word.net admin@jajahbinksdiesforyou.com d97f84nn9rq@nameprivacy.com f76ah 7 cb4 72@nameprivacy.com wm6vn79m42s@nameprivacy.com dean@lakefrontmedia.net k87td33t8xf@nameprivacy.com support@neturf.com rmzf5vi4f25da87bd976@w86bna54f21bffa2ffd l.privatewhois.net twistplex.com@domainsbyproxy.com k35hx8dk6nc@nameprivacy.com c/o Verisign c/o Verisign w72p35dd5tt@nameprivacy.com admin@uhahaka.com de69d4d63er@nameprivacy.com xy96q63g6sy@nameprivacy.com clo Verisign kh3te68h3mx@nameprivacy.com yj55n8hw5nb@nameprivacy.com mw73n8ed7n4@nameprivacy.com adminfalikeainyourmindgirafcom k63we9nm3yx@nameprivacy.com uptonxtwfajgmail.com admin@iajahbinksdiestol)'_ou.com c/o Verisign
1470. 1471. 1472. 1473. 1474. 147S. 1476. 1477. 1478.
urtlhcpdotfrkxp. net usa-itunes.com us-ccsecurity.com us-credit-securitv.com userbrick.com userdata-distribute.com userinfo-nacha.com usernacha-alarm.com usernacha-bills.com
479 . 480. 1481. 1482. 1483. 1484. 148S. 1486. 1487. 1488. 1489. 1490. 1491. 1492. 1493. 1494. 149S. 1496. 1497. 1498. 1499. IS00. IS01. IS02. 1503. 1504. 150S.
usemacha-wireinfo.com
usersea.com utugkoykmwjquzg.com uvxzzkspqxfbqpls.com uxqpvcmoqxyutkp.net uzkrtoomtnjpohn.com vacantitechip.com value tory .com var3S7.com varioldinnics.com vasexz l fhiklwa.com
dropzone, source source source source source source source source source embedded dropzone, dropzone, dropzone, dropzone, updater infector embeddedjs updater
js infector infector infector infector
dropzone dropzone dropzone updater updater updater updater dropzone infector
vasexzfhiklwa.com
vavasasvb 1klwa, info vavvb lklwa.com vcstitumediana.com veandlifronanonetwceq.com vegatorkspeps.com vemaxxlionna.corn veonset.com veriary.net veroabelosO.com vesryop.com vetrucomneticeiestreq.com vfrqsiekewtckden.com vibeapnesbu.com victori l.net viewcheapetsways.com viewediesolver.corn viewfdiccustorner.com vigetectrockset.com vikingwer5.com vincent-world. com vipplacetv.com virgull.com vivaforelifenetcombie.com vizonix.com
dropzone dropzone updater
dropzone, updater dropzone infector
ernbedded js
updater source updater
1506. IS07. 1508. 1509. 15lO. 1511. IS12. 1513. ISI4. 1515. 1516. 1517. 1518. 1519. 1520.
source infector dropzone updater source dropzone, dropzone, dropzone, dropzcne, dropzone, dropzone, infector infector, source infector infector infector infector
vjzljyvmvqhflrjl.com vkrrllufqweinm.net
vpxquhxtxhnqrfmg.corn vqitqvunhrevlso.com vqpfnhspltysgeig.com vqwpfveyyxjhxgri.com
cb3mu9k97eu@nameprivacy.com marina. santa 13@yahoo.com info@premiumregistrations.com info@premiumregistrations.com capri@maiIl3.com userdata-distribute.com@lcontactprivacy.com richardmeggers@yahoo.com tahboub m@yahoo.com info@premiumregistrations.com info@premiumregistrations.com bunts@fxmail.net dt6gh2wj339@lnameprivacy,com jr7vS3ge4pk@nameprivacy.com rd9cp4t73dq@nameprivacy.com kh3te68h3mx@nameprivacy.com c/o Veri sign jorimelodey@yahoo.com contact@myprivateregistration.com c/o Verisign j.c.angeldeath@ymail.com j .c.angeldeath@ymail.com c/o Verisign l·c.angeldeath@'ymail.com vcstitumediana.com@lprivacy.above.com c/o Verislgn c/o Veri sign c/o Verisign admi~@naliora.com jessemccurdy@yahoo.com quiz@mailae.com perolsp@yahoo.com paolosassi71@yahoo.com wv4kS96nS se@nameprivacy.com c/o Verisign admin@victoril.net at32tgf4ea6939035bd3@oqjij874d9300dS4bd9 51'_rivatewhois.net c/o Verisign lIekperic@cY_ahoo.com c/o Verisign salts@mailti.com kasinakosfine@yahoo.com paulacobb56@yahoo.com jhnvns.92@Jgooglemail.com vivaforelifenetcombie.com@domainsbyproxy.c om gu79p6a88z8@networkso!utionsprivateregistra tion.corn contact@privacyprotect.org clo Verisign screechydorseY@2'.~hoo.com dt6gh2wj339@nameErivacJ::.com wv4k596n5se@nameprivacy.com z34jb9zq2aS@nameprivacy.com
1521. 1522. 1523. 1524. 1525. 1526. 1527. 1528. 1529. 1530. 1531. 1532. 1533. 1534. 1535. 1536. 1537. 153S. 1539. 1540. 1541. 1542. 1543. 1544. 1545. 1546. 1547. 1548. 1549. 1550. 1551. 1552. 1553. 1554. 1555. 1556. 1557. 155S. 1559. 1560. 1561.
vrgoryutlqnjpod.com vrkmifksfoqungwu.com vulxkncvstfukrow.com vvxriolskjgrsrs.net wantpint.com waweaime.com wealthnxtreimbursement.com wealthnxtupdate.corn webjanse.com weddingbee.com weighan.com westansgualiti.com westarray.com westdirect.net westemunlon.net westwiserce.com wgewygkn.com whatixemieldin.com wheredoyouplayloveme.com whitemite.com white-shopping. com whole-sale2011.com wickissievele.com winlaps.net
dropzone, dropzone, dropzone, dropzone, dropzone dropzone,
infector infector infector source, infector updater
infector source dropzone
updater infector, source dropzone source
dropzone updater dropzone, updater infector dropzone dropzone, updater dropzcne, dropzone, dropzone dropzone, source source source source dropzone, dropzone, embedded dropzone, dropzone, dropzone, dropzone, updater updater source source
visitus@bitandjazzdanceclub.com b52fp2qw5ys@nameprivacy.com d67rg3d97jp@nameprivacy.com k87td3 3 t8xfl@nameprivacy.com the.malware.cabal@gmail.com admin@waweaime.com c/o Verisign c/o Verisign newdomains@siteground.com mknapp@intemetbrands.com c/o Verisign c/o Verisign kitkatwilou@yahoo.com attic@cutemail.org westernunlon, net@privacy.aboab.com c/o Verisign contact@privacyprotect.org c/o Verisign pescifabio83@yahoo.fi hexagenoid@yahoo.com viscolas@gmail.com real.host50@yahoo.com c/o Verisign gmvjcxkxhs@whoisservices.cn rt7ph2w73 fw@nameprivacy.com abcI234@qq.com admin@macro-store.com wonderfulwom.com@privaey.above.com coortus@t-online.hu hostrnaster@word.net Iacq I ud4f088961 d534d@oqjijS74d9300d54bd 95.privatewhois.net aS6af8ueSca@nameprivacy.com benavideseuripides@yahoo.com exytihazonac@yahoo.com ptSgt97uSx5@nameprivacy.com random68@live.com contact@PrivacyProtection.org delcore@gcn.cx H2024700065.COM@domainsbyproxy.com msoe@yahoo.fr frt57pmkq4fiu7sslywrvoallyyzdSfrnegonkpawn nx05kyOc@nacha-
source, infector source, infector infector infector
wmrnwempyipqymfl.net
womidfer.com wonderchat.net wonderfulwom.com wonderful wreath. corn wonderfulwrench.com wonderfulyard.com wrmultsorqrjsolp.com wtuqiwwqsskojuft.com wviosppfhslqyyvn.com
wvzvdibqpiqpg.net
atlas5 7. corn
backorderru.com
france- facebook.corn h2024 700065 .com kwalai.com nacha-rejected.com
source, infector infector js source, infector updater updater infector,
rejected.com. whoisproxy .org
1562. 1563. 1564. 1565. 1566. 1567. 156S. wznrifvicsipbmnv.com xndmnojimsojqx.net xpadv.net xpousnnulhihoer.corn xprlxottijelpvl.com xviadovilyhltry.com xxvwinjqarjrnw.com dropzone, infector dropzone, infector embedded js dropzone, dropzone, dropzone, dropzone, infector infector source, infector infector c/o Veri sign su3 te7 gw94s@nameprivacy.com cgecexq4 Be 7713 7f2ab@wS6bna54f21 l.privatewhois.net ea4cy5zc9n8@nameprivacy.com r793 d9ww3 fr@nameprivacy.com u65dt7 q82a7@nameprivacy.com dt6gh2wj339@nameprivacy.com
1569. 1570. 1571. 1572. 1573. ~ 1575. 1576. 1577. 1578. 1579. 1580. 1581. 1582. 1583. 1584. 1585. 1586. 1587. 1588. 1589. 1590. 1591. 1592. 1593. 159.:1 1595. 1596. 1597. 1598. 1599. 1600. 1601. 1602. 1603. 1604. 1605. 1606. 1607. 1608. 1609. 1610. 1611. 1612. 1613. 1614. 1615. 1616. 1617. 1618. 1619. 1620. 1621.
yazarcanyucel.com
yettaillarfic.com yftuornlonknooigt.net
ymrhuwgpfmscvf.corn
you-ach-report.com younggirIsdomovie.com younona.com yournachareport.com your-nacha -report. com ypqgwphsfi inoqau.com ypqhrijclijnnoyg.net yregmst.com ytmvsfsijnxjnm.net ytpseiqmednisids.com ywilkswylnvufje.net ywtgytkejnke.com zauxszqulsxryw.com zq,vuloqppyymwuf.com ziiditnmcmlvjp.net zjhwjnpkxqtjlqq,com zi snoklkbethqkpt, com zkqgrwspdxuuprcrn.net zooourglprftvqkd.com zqffthhnuivonkz.net zqnirpqupuqrnksnq.corn zuvqpugmmmqrdskd.com
zxyopetnzktkknd.com
zzgpmmzspzrtzood.com 123002915.cn.com 423654m.cn.com 90fd78b9078bdOg.com 98DFGR994883798df.com googlezuju.com accoukierlism.com achecad.com achyroransib.com activedent.net advdomain.com aeractraspac.com aeronitrex.com akronisltd.com alconichill.com all-nacha-datainfo.com amberschool.com amberschool2.com amersterin.com anaiyticdns.com angebrethetcombiznet.com anissaeve.com answertels.com antiglobalgg.com antiglobalggz.com antisorit.cn.com
source dropzone, updater dropzone, infector dropzone, source, source dropzone drop zone source source dropzone, infector dropzone, source, embedded js dropzone, infector dropzone, infector ne, source, drop zone dro_p_zone, source, dropzone, source, dropzone, source, dropzone, infector, dropzone, source, dropzone, source, dropzone, source, dropzone, source, embedded js dropzone, source, dropzone, infector dropzone, infector infector, dropzone infector, dropzone infector, dropzone infector, dropzone infector updater dropzone updater infector, dropzone updater updater infector infector updater infector infector, dropzone infector, dropzone updater infector, dropzone updater infector
infect()r
infector infector infector infector source infector infector infector infector infector
dropzone dropzone, source, infector updater infector, UIVPLUllC;
bjk habibe 22@hotmail.com repossesseddomain@godaddy.com c/o Verisign clo Verisign stevecremers@yahoo.com mantaphosting@gmail.com contact@privacyprotect.org melissaamott93@yahoo.com boggskarla@ymaii.com clo Verisign tu2f838h73z@nameprivacy.com contact(a}myprivateregistration.com vv73a9jm5wh@nameprivacy.com kh3te68h3mx@nameprivacy.com c/o Verisign liberral@gmail.com sw5ct9bh7sg(a}nameprivacy.com cr65g2ap483@nameprivacy.com gv9st8nk4ka@nameprivacy.com am9zr2nq3p8(ti)nameprivacy.com armeniangillespieeayahoo.corn k86c98xv6bx(ti)nameprivacy.com k87td33t8xf(ti)nameprivacy.com e255f24x5pb(a}nameprivacy.com exytihazonacteryahoo.com c/o Verisign yj5 5n8hw5nb@nameprivacy.com ch67 e4ve6tz ~nameprivacy.com livemetal88~ ghotmail.com livemetal88~ ghotmail.com oi@ppmail.ru jenny@fxmail.net liuwei 1000@gmail.com c/o Verisign keys@fxmail.net c/o Verisign achuleta salomon@yahoo.com info@advdomains.com c/o Verisign aeronitro@ymail.com jcv s@yahoo.com c/o Verisign crystoiwiedeman@yahoo.com alisonspencer95@yahoo.com brooksal!en71@yahoo.com repossesseddomain@godaddy.com dfghrter(a}hotmail.com c/o Verisign Ofgecd 140a 1612330b421 f33ef9ffae5@domain discreet.com admin@answertels.com zhongguancun@yahoo.com clo Verisign livemetaI88@11utmail.com
1622. 1623. 1624. 1625. 1626. 1627. 1628. 1629. 1630. 1631. 1632. 1633. 1634. 1635. 1636. 1637. 1638. 1639. 1640. 1641. 1642. 1643. 1644. 1645. 1646. 1647. 1648. 1649. 1650. 1651. 1652. 1653. 1654. 1655. 1656. 1657. 1658. 1659. 1660. 1661. 1662. 1663. 1664. 1665. 1667. 1668. 1669. 1670. 1671. __l673. 1674.
anualiverk.ccm aptitude.name aquaedition.com aquajaunt.com aquaskiff.com aquasrc.com ariodtalk. com articityxp?qua.com assmitizeree.com astrawebservice.com asus7.com atlancentuage.com
au-business-customer.corn
audubideonetity .com avectintemottis.com quizclub.net rollingthemydicenetbe.com secstat.com sepnower.net sludential.com springautumnernetbiz.com sqwed.net teamten.net
updater infector, drop zone infector infector dropzone infector infector dropzone, source, updater up dater infector updater updater infector updater updater dropzone dropzone, infector, source embedded js embeddedjs embedded js updater
updater dropzone dropzone updater dropzone dropzone dropzone dropzone, infector embedded js
vesryop.corn yagijakes.corn
youthinktoolovenotneco.com leveI-3.net edge02.net core02.net basedmarket.com basic-auth.com battlewright.com bespar.net bestlongnet.net bestvideoworld.com betswinstrategy .cn. com betterheousermy.com biggestcoin.com ~stfunds.com cheerful.corn billyd.com.au bisiteles.com bisonbuy.com blackbuckseri.com blogoettindia.com blueberrymo.com boatorldenoras.com borsteksavalu.com hppp:1!l 73 .44.34. I 84/el/loadlload.exe to lbarqueries-googlez .net loploples.net net retyuloploples.net
infector dropzone, dropzone, dropzone, updater dropzone dropzone infector infector dropzone infector infector updater updater dropzone, updater infector infector infector
source, updater
~¥.=~ft,;
anualiverk.com@domainsbyproxy.com contact@privacyprotect.org domains@netfirms.com barmintual@ymail.com barmintual@ymaiI.com barmintual@ymail.com admin@vistapromblog.com alanmcwilliams@live.co.uk assmitizeree.com@privacy.above.com astraweb@gmail.com gmvjcxkxhs@whoisservices.cn c/o Verisign krolando26@yahoo.com c/o Verisign c/o Verisign zealot@mail13.com lauraboschetti@aol.com contact@privacyprotect.org perolsp@yahoo.com adm in@sludentiaLcom c/o Verisign perolsp@yahoo.com vomit@mail13.com perolsp@yahoo.com c/o Verisign lauraboschetti@aol.com contact@myprivateregistration.com perezbrittany93@yahoo.com ada.shapiroretyahoo.com swansonjudy83@yahoo.com admin@basic-auth.com howellinsuperableeayahoo.com mousavisepehreayahoo.corn dOgOrOn@gmail.com contact@myprivateregistration.com livemetaI88@hotmail.com c/o Verisign gogofreeze@hushmail.com gogofreeze@hushmail.com c/o Verisign c/o Verisign hobbitgod@ymail.com gvgkqqrsm@whoisprivacyprotect.com seamy@mail13.com c/o Verisign blueberrymo.com@privacy.above.com repossesseddomainssgodaddy.corn borsteksavalu.com@privacy.above.com sysop@iptelligent.com vshostmaster@verisign.com dOgOrOn@gmail.com dOgOrOn@gmail.com dOgOrOn@gmail.com
1675. 1676. 1677. 1678. 1679. 1680. 1681. 1682. 1683. 1684. 1685. 1686. 1687. 1688. 1689. 1690. 1691. 1692. 1693. 1694. 1695. 1696. 1697. 1698. 1699. 1700. 1701. 1702. 1703.
tynegertyonioloki.net esterraspa.com savetirneon.com sdfkj348923rI131.com fds3 23rwe4823 7rhkaj.com 11132erfw23rwqasdfd.com asiaseniconline.com sdfkjkfdsklf34j348.com fds32jfkwj43rewf3r.com 1I 132erfw23rjkvsdf.com justbigtoyss.net downloadertempfull.net savetimeforyoulife20 l Lnet freejumpcomptell.com freesecuritycheckname.net alabamaislandsfree.net asiasoniconline.com sdfkjkfdsklf34j348.com fds32ifkwi43rewf3r.com 11132erfw23rikvsdf.com asiasoniconl ine.com sdfkikfdsklf34j348.com fds32jfkwj43rewf3r.com 11I32erfw23rjkvsdf.com kslidfkaz.Lcom sjxu297x-a.com
vShostmaster@verisign.com
webmasterrdisunstream.com
tswzyyx4 f21e81 beadS f@w86bna54f21 bffa2ffd Lprivatewhois.net vshostmaster@verisign.com brianbrodyjr@yahoo.com 11132erfw23rwqasdfd.com@domainsbyproxy. com superpuper56@yahoo.com atlon atlon@yahoo.com vshostmaster@verisign.com atlon atlon@yahoo.com doughertyi32fa?yahoo.com atlon atlon@yahoo.com atlon atlon@yahoo.com atlon atlon@yahoo.com atlon atlon(aJyahoo.com atlon atlon(aJyahoo.com superpuper56@yahoo.com atlon atlon@yahoo.com vshostmaster@verisign.com atlon atlon@yahoo.com superpuper56@yahoo.com atlon atlon@yahoo.com vshostmaster@verisign.com atlon atlon@yahoo.com billhrodriguez18423@gmail.com vshostmaster@verisign.com vshostmaster@verisign.com vshostmaster@verisign.com bobgolfsen@yahoo.com
yho-finan-ce-update.corn
g297xx-n.com trono_pays.~om
More From This Userflyer opposing French gay marriage lawOracle-Google Jury Verdict 2012-05-07Zeus botnet TRO Seizure Order Part 2Microsoft complaint against Zeus botnet operators20090507 Google and Competition Preso
Zeus botnet TRO Seizure Order Part 1 by stshank29K viewsEmbedDownloadDescriptionPart one of the temporary restraining order against operators of the Zeus botnets.Part one of the temporary restraining order against operators of the Zeus botnets.Read on Scribd mobile: iPhone, iPad and Android.Copyright: Attribution Non-Commercial (BY-NC)Download as PDF, TXT or read online from ScribdFlag for inappropriate contentShow moreShow less
Relatedflyer opposing French gay marriage lawby stshankOracle-Google Jury Verdict 2012-05-07by stshankZeus botnet TRO Seizure Order Part 2by stshankMicrosoft complaint against Zeus botnet operatorsby stshankMore from stshankflyer opposing French gay marriage lawOracle-Google Jury Verdict 2012-05-07Zeus botnet TRO Seizure Order Part 2Microsoft complaint against Zeus botnet operators20090507 Google and Competition Preso