defiantwarriof? and the nsa's use of bots otherwise noted/trea alt containel d items within...

DEFIANTWARRIOF? and the

/ / / / / / / / / / / / / / / / / / /

NSA's Use of Bots

Overall Classification: TOP SECRET//COMINT//REL FVEY Current As Of: 24 May 2010

Derived From: NSA/CSSM 1-52 Dated: 20070108

Declassify On: 20350401

TOP SECRET//COMINT//REL USA, FVEY


Unless otherwise noted/treat all contained items within slides as classified at the level of the containing slide as indicated at the top / / / / / /

SECRET//REL USA, FVEY

BotNet Background / / / / / / / / Bot Herding 101 ' / / / V/// / / ^

NSA's Adventures in Bot Herding (FAIL) Successful Endeavors /vZ / Z / Z / Z / / v^ .


UNCLASSIFIED//FOR OFFICIAL USE ONLY

^ Symantec..

• Average of 63,912 active bot network computers per day, an 11% increase. Worldwide total rose to just over 6,049,594 - a 29% increase.

• 4,746 Command and Control servers were observed; 40% U.S. based

• China has moved to the top - to 26% while the United States continues to decline. EMEA countries, with the exception of the U.K., showed the largest increase.

United K i n g d o m

C a n a d a

(10) 2%

U n i t e d S t s t e s

( 2 ) 1 4 % C t i i r a

(1) 2S% - T a i w a n

[ 7 1 4 % (5 ) 5 % (4} 6 %

Key (X) = Rank % = Current flrapitrtiôn

Brazil (9) 3 %

UNCLASSIFIED//FOR OFFICIAL USE ONLY


- it s a

Used Extensively for Illicit Means / / : / y / / / y / / - Distributed Denial of Service (DDoS)/ y y y / y ^ - SPAM Operations / / / / / V / / / V / v / / ' X Financial Fraud/; y y y / y ^ / / / a v ^ ^ ^ ^ Intelligence Collection (Brazil, Russia, China, e t c ) / / / Three Modes of Control • y y ' / / ^ -/l^hase 1 - IRC / / / y y z ^ - Phase 2 - HTTP (OLYMPUS/UNITEDRAKE are Bots) - Phase 3 - Peer-to-Peer



Master Herder Controls / Subordinate Command & Control Nodes / X / Each C2 Nodes Relays// Herder's Instructions to Bots / y X

^ individuals / / / / / / / y ^ E n - M a s s / / / /

BotNets Have Been X Observed with Millions of

Masten Herder'

Subordinate S 2 Node Subordina e tì; Node Subordii



Bot Herding 101 - Hostile Take Over

BotNets are Regularly Exchanged, via / / / R e n t / / ^

->Sale / y y y y / Z •y Hostile Take Over / / / / aka BotWar X y y / y

Sting Operations/ - Use Valid BotHerder V / Credentials • / y Take dontrol of the C2

Channel

i on

xlOO xlO.OOO



FBI Open BotNet Cas^s US Government Control / y y Bots Directed to "Bot Prison" ^ C u s t o m IRC Server Bot IPs Processed Through Quarantine Engine y - .foreign - Directed to TAO IR

Server jjov/.mil - NTOC Business Logic

- .uè^rè iX i f f ice of VictiM/ Résistance y FBI Goes Public - Avoid

BotWar

GOV/.MIL - NTOC?

US-FBI/OVA yuarentme

Engins

xlO.OOO


/ V ^ O ^ A n All SIGHMT Approach / . /

Leverage FVEY SI Gl NT Systems to Identify and Target Foreign Bots V v x / / Extensively Utilize GCHQ Mid-Point / ^ v / Collection Platforms (and Personnel) Heavy Integration with TURBULENCE/^ Architecture (aka QUANTUMBOT) / / / / -TURMOIL - Passive T i p p i n g ^ v x ^ ^ -TURBINE - High/Low/High Interaction - Snipers - Man-on-the-Side I n j e c t i o n y / v y x / / /



What the DW

"go broad" active CNE Pervasive network analysis vantage points Throw-away non-attributable CNA nodes

Doreen 13 US ScriptK 16 Rom • • • I •

I33t über

Scale of L33t



Bot

Check XKEYSCORE for exploitable bots/ Task TURMOIL to watch for such traffic / / Task TURBINE to generate MOTS packet



IRC Server

commands o —

ping-pong for commands On

r I'm here

TAO IRC Server

TAO Bot Server

m

Go download this executable: •

TURMOIL



%QBOT tipping off of INCENSER •X-- but nowhere else / / f;Have bots iir and • but nowhere else . / / / zZ ^Channel health is highly diurnal



Host?



If ^ e ^

A botnex updn which the sun never sets ^ QUANTUMBOT tipping diversification / / . - STELLABLUE / / / / / / / / / /

^ S M O K Y S I N K / V / 7 / / % / / / / / / / / / ^TURMOILS at Menwith, MSOC, YRS / / / /

Technique diversification X y ^ ^ V^Man In The Middle (vs Man On The Side) y y /

y Moré locations^ easier to exploit HTTP bots (nti race condition)

-r Throw exploits from our bots y / / / y v y y y y y Exploit toe-holds on networks to get better penetration


S T O V E P I P E S T h r o u g h e x t e n s i v e c o o r d i n a t i o n , w e w i l l b u i l d a c o m m u n i t y o f c o m p l e t e i n c o m p a t i b i l i t y .


Rube Goldbergian Challenges QBOT tasking can* get stale (bots change) TURMOIL QBOT tasking can* break TURBINE QBOT tasking can* break X ISLANDTRANSPORT can* break QUANTUM Diodes can* break Web sniper can* break / / / / A / y FESTIVEWRAPPER can* break TURBINE bot tasking can* break LPs can* break / , FREEFLOW diodes can* break / / / A ^ TAO-homed post-processing can* break TURBINE-homed post-processing can* break Security Marking Service can* break / / / / PRESSUREWAVE can* break

* do / does TOP SECRET//COMINT//REL USA, FVEY

Il l lttTlK-! M S A M e t TOP SECRET//COMINT//REL USA, FVEY


Glom onto every status feed you can Squeeze the possible problem region Know who can help you %/



y f y /

etr 43DÜ1

j K K i

Í C Í Í 1

l E í í i

z o o o

1 K > 0

1000

K B

Ti ps.' Hour

S h o t R e q u e s t s . ' H o u r

K m n f c i adEV H o u r

I L *

v.ar 29 12:00 M i r 30c:oo M i r » 1 2 : 0 0 M i r 11 0:00 v. i r 31 12:00 Apr 1 0:00 Apr 1 12:00 Apr 20:00 Apr 2 i i : o c A p r i o : o o


u 1 Botlnstances: index - Mozilla Firefox

File Edit View History Bookmarks Tools Help

£1 - c TOP SEC RE T//C O MINT//REL USA, FVEY

VF " | j*-.1! * . Google

jTl Most Visited ^ Getting Started _ Latest Headlines

Botlnstances: ¡ndew h i ¡J] Botlnstances: show

iHerds! iBots l ["Connected Botsl iBot Tvpes l [Machines] flP Usages! ["Countries! iCommand Recurrences! ["Command Types! Logged in as: ^ ^ H

n Refresh Every Miniit

For Botlnstances Located I n ^ | O f Type XTNZ ( Connected | [All] ) Displaying Botlnstances i - 30 of 1593 in total

¡M Bot I n s t an ce Bat T ype .Mach ine

1 TKtrjZl-jGIAWGLHYMiM'IAHVJIil'Bj jjjfrwz. JS&WCMYfTlBNIAkvJKIBI 1 jjjfrwz.

2 • [+] XTNZ 2 • [+] XTNZ

3 o 5 0 wjjlm 3 o 5 0 wjjlm

4 • 'F i fTMi! -^DDiB.'HBkVOIGRFPAUZA.Btf [+] XTNZ PDCi®H&KVIJIGRPPA(J2"A&D 4 • [+] XTNZ

S, • [+] M B S, • [+] M B

6 B TXTM'i l r i-.t#TNz ":|f}ftiieEFULRO Ll^^ftifUF'ilfi: 6 B ri-.t#TNz

7 o Y x T i i a - s e s ^ ^ v f a s i ^ ^ i M i U P f t ^ p m 7 o a • fgWtîFîN^cMffifteeiAcasaSsiSzp [+] INY DMWggSSr iS 'SSSS i^P a • [+]

3 TsiTfilZl - HUTA&-a i uQ f i L cS t i i V ' E i . [+] XTNZ S 11+ A f lSCBi&i i f f .CZLXVEA 3 [+] XTNZ

ID • ^ r i ^ - M K W M B k f N R U K i t M s a y ^ M d c [+] X-fNg MK i®R iew®; ;v Hvs'oiMDrts ID • [+] X-fNg

1.1 - f t ' v-a T B S ^HoSilffivfeiiwaiffifeEriisMii- [+] XTNZ 1.1 - f t [+] XTNZ

12 n - HSC S.W33 N M-lJKi: 61A LtpTH 12 n

13 o TXTfjI' l-EK'sfi lfelJURPIEli^PBDEt- [+j XTNZ E+isfiiS'SIJ URPILY TPB'DO 13 o [+j XTNZ

1. I. • [+] X-fNg 1. I. • [+] X-fNg

15 rMTfiZl-L^WMUi;iJDSHFEttf i. iPEC" gjtj fi'iTHZ 15 gjtj fi'iTHZ

16 • [+] X-*rN'Z 16 • [+] X-*rN'Z

17 0 17 0 IB • ESI XTNZ FMtShlTULXSC^-SPCiiLAlJUh IB • ESI XTNZ

1ft • -HWO^MYOsHWESff iSSMSNA [+] teî^ffl® S'HWEiiM&bOjalMA 1ft • [+]

20 n 20 n

21 ;t£ [+] XTNZ age xnmbbbqav s x j h i opa 21 ;t£ [+] XTNZ

22 n *TO to -MRS lBRS« l 6# l lM0BXV i «ae t 22 n

23 o [+j XTNZ 23 o [+j XTNZ

'.'•I. • [+] X-fNg 0 H A t e J M B STWfcSSk M tfiiftA '.'•I. • [+] X-fNg

25 0 fxtMZl^FBFliteSMEMW'-ALTYARESZ,: gjtj ' f i f a z FBFXHJGMtf«ALTTi;RE2"i;: : 25 0 gjtj ' f i f a z

••••li • T30CNZ1 [+] yfN-z VSSô tSoH^âBS i j J i f i l i t ••••li • [+] yfN-z

27 0 LN LH IJSiNl ia iW DO E LT H j l f 27 0 28 • ESI XTNZ R F E f f i l f e ^ t ^ W o i S P l e C -28 • ESI XTNZ

~ - -

; Previous 2 4 ffipt fl I t , f j l B S W f f f Per P a y e 25 < ¿f l < 1QQ < AH

Last .Observed IP F i rs t C a l l b a c k T i m e Las t Cc j I lbackT ime * L i f e t ime

•dtHO-03^6 5&: 4aiJtTC 2010-C4-21 i ; 7 •

20IQh03-£2 07;49; jlS:©TC 20.10-B4-2i, i:i9; U.TC i30d 1 th-^'lhrf s.ffs-

5«0 i Sh ' Swe l f f k ;

2Dl:0;r03-ID DO: p2;.17;:tJTC 2p . i 0 -q4^c i l 9 :20 : 54 UT c l l h JfifniiJ.?"

p l W I i f f ' i ' f l l w i l l l l l l iM lWft

l H I 05: g g g ^ l S g 2010-04^21 19: 20: 45 ij.TC I42d j p g j ( | B B [

io; ±£:34 tJTC 2G.: - -C ' i - s . i ; i c i j r e :-31d' S f c i S yM t i ;

S o s^.JjiR;- S ^ S l i os

1 ' i y l 1.! . ! flu: 54?M-:#TI: a6 io-d4T,21: i9:20:SS- t tK

s a i i S ^ S S M M B I 3 2

i f t^fc iSs iS f ' fe m H d K ^ ^ i i l i i i l W B B

20HM3-2 ;£ 10: P S ^ g T C 2010-04*21 19 :-20 1. T :

•301O-&4?.id ¿0:.S7:41 tiTC 2 0 i o - d i a i - . i 9 : 2 0 t S U i i &0d' 3h i^ in A f c

J i j f g o s u|f|S.'

•^••10-03-17 21:07: 41.-STC 2010-04^2ii;i9: 20 :-±7: U-TC ;34d::2-Sfl>12fa-3B5

•• i lr i» i f r j a s g g uffc;. SOS i l l J ^ 53s

201S-04-21 i9;19;47::JJ-TC feliEh-^Kksite

i'.. I I : . . 09: s & H ^ p j K 2 p l 0 - 0 4 l | £ l 9 : 19 !:3& U.TC

« i S f e s s g S -tW: M d & i f r f e :

20i l ih03-2'3 09: 42::;E":j11liTi: 2p l0-04%iî9: . 19 ij.tc

» M d K ^ ^ c i a j W H H I io t f : fiBW&

2010-04*21.19 :• 19 U.TC

••i'iv'i 1.! 20 i o -d i a i - . i 9 :19 : - a t : UTt ; 'Sod Sh S-fe- iSs:

• 2 D Q 9 - l l - i i t3:-S0i 34 tiTC 20IO-O4^2i:;i9: 10x30 U-TC I b i d ri- l r :•'••.-

W c S S f f i ® ? 5

•2010-03-23 04;42:Sl.'®TC 2010-04-21 i : -C 23 1. t : St0d 14fn'jSki-;'l}fa

20i0.r.04-:.§2 09: l^ jSa- t f tK 2 p l 0 - 0 4 l | t l 9 : 1 4 : g 5 U.TC


y Be awesome enough to be useful..^/Z VA//and not get caught trivially / / / '/ %/Zbut not as awesome as a state actor • ..rand notice when we do get burned



T o d a y ^ / / / / / / / / /

- Uniquely packed shipped binaries X - Uniquely keyed shipped binaries wyyy

/y Separate LPs / / / / X / v y v ^ y Tomorrow ' / / y / v X v y y ^ — _Ps shielded with commercial services - Deployment is carefully staged y y / y / - Reverse honey-nets'" / A ^ y



Useful Places T O a a i y y ^ y " ^ ^ / y y '/ / y / Z / v y y v - Put SIGDEV surveys in PRESSUREWAVE / / / - Send traceroutes to TREASUREMAP

Tomorrow /yyyy/ y / y - Enrich connect logs with P U Z Z L E C U B E • / / / / / / / / /

y Make bot data visible to MARINA ^ y y y y y y y y y y / Make file collection possible with SEEKER y / y / y y

- Put BMS on NSANet V / y y ^ y Push captured PKI to CES v a y y ^ ^ r Harvest user identifiers and marry up with other data


TOP SECRET//COMINT//REL USA, FVEY File Edit View History Bookmarks Tools Help

K3I • e x •.• ') ü - 13 | - ; Google PI l^J Most Visited ^ Getting Started Latest Headlines

Botlnstances: indeH Itul Botlnstances: show Ö'I t ' F fHerdsl fBots l ["Connected Botsl fBot Types! [Machines] flP Usages! fCountriesl fCommand Recurrences! ["Command Types! Logged in a s : 73BB2

n Refresh Every Minute

For Botlnstances Urtfiltered ( Connected | [All] ) Displaying Botlnstances 1 - 30 of 5940 in total

Previous 1 s j 4 5 6 7 8 fi..

F i r s t Ca l l back 7 ime Last C a l l b a c k T l m E T L i f e t ime

:SSfcM3-&ä®6r24: E7 Ä S M B f t i i l i f W f i f f l f f l M i f 30d l-2-b-42m-SSs

;.|liip-;03rS:l, 36: r6:'3ft IJTC: ¡ggfJ.p-p'vSiiSs:, 4JJ.TC 3 t a 2h EOm'L.Ä03

¡ ¿ f l i i M 3 - 3 1 13:53:3:3 UTiS t M f e j W ^ f e i f e ' . M k « S ¡ m u U u

M M * Q 4 - m • -i is- I t ' -H j W M :£0d Oh S7hrt-SSs

' ü ' 0 : t l M 3 -11- l i i ö 1:3 l i .Utc: ä ä S Ü i S ^ g S S ^ B i j ® ^ 4 ' W i h 5m 3S§:

4ö iü -04 -ääV i9 : afl iSitetTC ¿66 Oh 34m-aes

¡¡f- -04-D y j S ^ g ^ K 3h E4ni3S|:

: i i f e -D4 - l f l v f e : ID:D4 ä Ü ':jtäiD-04~2-4 ä ä H H r l s i äSb ' ETm-Es

i ffipptaKifH 41d Sh..30nt36f

29d 14h -SSm-3Si

•^•id'.-sfi":

¡¿ü iD-OS-B l •1.4:.2E:3SciTi.B sa id 4h- 44m-32 i

U i l

•30d 4'rtn l s

30d 12h .43111 45

« ä i f r ^ + ä ä s i ö ' i B S i M y f ö •Sßdith' l S m s S s

54TJTC 29d Sh 37m 44=

"SÄÖsfEW^äfe fe:ÄM;lJfH 3fv'4Brn'6s

32d I l h o r n I i s

;2 f l i i^D3 'SMa: .4S;34 Ü B « M V (jl i.54-ljTC 22d 8h SOm-Ses

2^igif£t3'r i I S f t S l l l I ; ® !

; f e iD -03 -24 -is: 44:3t .CftB :£0d 3h 22m- I i i

W H M Lr^g

- i M S ^ E f f & f i ; B B Ä a S f c ä e ff&iia'fSTc tSd-33h-31m-SSä-

28d Sh £3m S4s

« S i f r ^ + ä S s f e i S S i S i l f ö .iäd l l r l S m s S ä

Ute- 2Sd Oh 3£m 19§

[ f ]

• c

tX

• Ö

• •

a

• o

•

• •

THflt ri-lSH ri l l rkjy-

TMHf f i

IXI f iZ .

D-fTfae.

¡TURD

rwf t j z

tT.:.TC.

fTUP.D

TTURD

I TURD

T:,S tl-J

f i v T M

TXTNZ

[TURD

i v c r i i i

rxThiz

frnwiS

t x t n z

rxft i-z

r j.i'M^*

f i v T M

r n u .

I TURD

[TURD

TTMffif

•TURD

[TURD

ITURD

-SESLOOPYICGZYOKWIYUN

-PKeKmROSS-KUTSZHTOiN

--IUCW0TD0N0FGUAR0SV0M

iqwveLCBMTEBwaaaMWB»

-MFRDC1JWTY KZGLYC RWEFW

-BG OL GVRA F WWIJH ACJ OQG

-FMVVNTULXVOUVPCXLAUUH

-AGEXNHESBQAVGMHLQPA

t M l M ! W p i S « M «

-MRSGJRZXUSMNMUPXWNIQ

-HÜFDDPPYCKFKGDGÜAHHS

-QHTFJEDWUKFBMDMODONI

- IASTIKABAelDWyNMYSEA

-AGEXMBSBÜAVGXJHLOPA

- y Z M H 9EMSO]fleCHH"AtlS

-IIJWCJYNSTCILDHQWZAO

R i l l Typ i 1

Sff i jg;

•xtHZ

TijRtt

XTNZ

XTHZ

XTNZ

' t a r n

TURD

MrtrrflTiiti

SESLOOPYICGZVOKWIY'Jfj

"Eva EBaaBE iS ieaB igaeWE •••

MggW.GSP.aiAbQQMS.'iiiyDlfJ

PK-0 K-RNRCSSX-UTS ZHT QJ N:

IUCWOTDONOFGUAROEYO'>{

--^^vzt'EmJiTLaViesEuciRL

MFRDCUMTYKZGLYCRWEFW

BOOCGVR-AFWWIJHACJOCiG

f MWNTULXVaLVPCXLA'Uüh

AGEXIMMBSEOA'V'G^JHLOPA

MRSGJRZXLISMiMMUPXWiMLQ

CXDTLZNAZJJNTYXAQJGW

HOFDDFPYCKFtXPGOAHHS

OHTFJEDWUHFBNDMODLIMI

:iA3T.I^A'BAOtDW.YWMYSEA

AGEXIMMBSEOA'V'G^JHLOPA

VZAIH0EDBS0I-QZGHHAM5

mWCJYNSTCILDHOWZAO

Oiiitfrltry; K l r i a f V ^ & y

rvFv'ü^vcH'r'

HcOlEzE&Zh .

••BWMBfiBii'l .

yr^TYEsveP_

9G6VqP2rBq

Psi5ri7iPWC

Ä S ä i l Ä j

"LqAISSBK

•r'iril.;

K3zlDGrDmk .



CP ' c ù - a | - j Google PI l^J Most Visited ^ Getting Started Latest Headlines

Botlnstances: inde» Itul Botlnstances: show M ] + F fHerdsl fBots l ["Connected Botsl fBot Types! [Machines] l'IP Usages! fCountriesl fCommand Recurrences! ["Command Types! Logged in a s : 73BB2


For Botlnstances Urtfiltered ( Connected | [All] ) Displaying Botlnstances 1 - 30 of 5940 in total

[+] Ba t Instance. Bot T y p e Mach i ne

i 0 r feT i J -z i - rékca i îNsvéÈacFLCHXM •LCHKM i 0 r feT i J -z i - rékca i îNsvéÈacFLCHXM /••'il'>'/ Bpj-k Of Tvpe

•LCHKM i 0 /••'il'>'/ Bpj-k Of Tvpe

2 • r XTN Zi -SÊS L i® B i l CSaS&Kyj [Y ï l t l /••'il'>'/ Bpj-k Of Tvpe

' «aS i i YUM 2 • r XTN Zi -SÊS L i® B i l CSaS&Kyj [Y ï l t l V.jfes Efo t s •• A l T y p e

' «aS i i YUM 2 • V.jfes Efo t s •• A l T y p e

3 • V.jfes Efo t s •• A l T y p e

3 • 4 C [TURD iS f^^GSPPC^Sp&t^^VJSnS ' , lOMS&tVtSW-4 C

•5 n r i É l ^ P ^ M I ^ ^ f e i s f H T ® ft Ï T ^ X T M Z •5 n T ^ X T M Z

6 p 1+] a p p PDDWPtBB¥.eîGfiPPAQ2ABD 6 p 1+] a p p

7 tt r TURDl - l Û i S ë T O Û W O F i ^ À R è é Î ô i î f a f TijRtt 7 tt f a f TijRtt

a • r TO f i ' Ë^ '^ l t âNAZJ j t f T^ î sS t l j éW S È É i Œ a • S È É i Œ

g B ; ITURDfeìpVBLCRMT fejfeSëMS» M t ì é ^ B B M B P B B t e ^ t e r g B ; M t ì é

ID H 1+] ffifijjl Î R^WNTL^V ' a t ï PÇ ï&AL lUh ID H 1+] ffifijjl

i l i t [ i t s |x iNZ i l i t [ i t s |x iNZ

i ï ' • r-;.Uï''.i . l ' i ' i - i f- i: ' . ' . ' ' ! ii • i I f l S T N Z J È F! BP S^fflfSUH H i ï ' • I f l S T N Z

13 • r X T t j Z I - B ^ c S w R A R i j ï ^ H S C J Ô i j G M X T H Z a ë ô t f g ^ À p W È ï ^ M j Q a G 13 • M X T H Z

14 • U^WNTL^ t f& t t f PC i t A L l Uh 14 • IS r xT t i z i - i u c i S oTDÒ fWra i t ì ' H òeSe^ ! Î S i Ë S S i IUCîWÎÉSNOFG'UÀÎië i fe ï j ï ' IS Î S i Ë S S i

1G • 1G • n i t n i t

i s • r&TPJZ1-MRSGjftZXUSMftìfl.iPStKlMja 'XTHZ MRSSJRZ' j^lSlv l f jMÙPkMtìt" i s • 'XTHZ

19 i t I ^ Î Ï I M S A ' T U ^ & A v V - I ' r J s j 19 i t I ^ Î Ï I M S

20 E [ S - T M S t - Ê i ^ f ^ ' ^ a E i S ï i f f l e bxc [+] K I N j ''stìJfrDRÈIIftìfeYG&iRÌfiXC 20 E [+] K I N j

21 i t [XT^-Zl-HOFDfiP'fffcKFkGDGGiÀHHS: [ i t s |x iNZ H 0 F D C&P Y <2 K Ó À H H 21 i t [ i t s |x iNZ

:.'v • SQpijWËtîIUgÎJEMEqQK uf f l i :.'v • 23 • 1T U RD t t i H îfffc E D ÈÔfSi' i i N SMïjfcl l i l l M T U R B •SH'TFJ'iS'WtJii'FBfJDMODijN; 23 • M T U R B

tl.4- • I f j t j ï ï R S i f f i& î j t t a s ^ i p p ^ p j ® s ¿¡si tl.4- • I f j t j ï ï R S

25 I O

I TURDl - Ì t N ^ R M Q E & & i f t Ì © 2 B É 25 I O

20 • ÎÎURDI^GÊÎfÎlSiBSBÙAÏgÎÎJhiLOB'A i f|TU"RD 20 • i f |TU"RD

f i • r Tijf ibi - i l s i r t S i é è ó f à Ì é l i t ì t ì s i l K m B M S H f l f c l i S f l B f i • 23 • [TURD !-IUÈÎ'ËaiiNSÎ'rîILDHÎj'ï ïfeiÔ: 1+] -TURD- EJWESSçBitl! luS(IC(W2ÀO 23 • 1+] -TURD-

Previous l ay - IBS Next ; !'!!!• I'.Iljl;; ;.,..:; l'Qfl-< All

F i r s t Ca l l back l ime Last Ca l l back T ime T L i f e t ime

:fS®®0ÏSaMfi.! Z4\ ST'UTC- 2-5. UTC :30d i a i s A

{,Sìli'0-;03r 2 :| lèi: l ' S l '^JJ TÇ-: i l f Jp-p 'éî r i s^Qì iS 'à 'U.TC 3 i a 2h EOmL.£05

¿ f f i S t ì t ó ì ' i S ' ë i i ' a i â S S l l i ' t d sA 13m 415

••MiéïQ4~M iSfSS; i V s J j j :£0d Oh Sihrt SSs

K20.t^ :o3-11- t ï i o r : 3 t r y t ç : 41d-'Sh Sm 3S§:

:SMû-04-aSVÏ9: a f l i S i t ÎTC ¿66 Oh 34m-aes

s t S Î T . Ç ^ & S S ^ ' m o g u t i

: 2 S Ï & - 0 4 - l S ^ m i 0 4 - & . K ':jtiÌD-04~2-4 a^r' lBiSrC

S B I I ^ M H S i S P l i i ® 4Id Sh..30nt36f

i ï i i ô M I M ^ B î i a f S S 29d 14h -S3m-3Ss

l ^ l ^ l l p i p i p S

•Mié'iS- 3 i S ï S i i i S :2 i d 4h-44m-32i

o -JÏ3:-1 t ' ï à ;>4?.i a j f y t t i u i i

:SèÎO-04~24 19-ET6:-54,:ljTC 30d i a> 49m Is

^ ^ I t ì S f g t f i S Ì I ^ l ì l i l S E © Î 5 4 W C 30d 12h 43m 4s

« Ë i f r ^ + s s s i s ï ï ï f i M y t È •3Bdith' l i m s S s

2;'6.1 o-QS'r 2 ® ió; u t o : 54TJTC 29d Sh 37m 44=

3fv'4Brn'6s

3 2 d l l h i m l t ;

m v B Ì ^ ì ì t c 22d 8h 20m-2es

-Stóo-04-2&:£'9: SÌÌÌSSìSTI: :£0d 3h 2 2 m - l i s

sSjJipTB: (iîed-SliStntJfi'Sl

¿ ì i i i - 0 4 - M - l â i SS iê '& î i ; M y B a M e ff&iia'fSTc

48. UTC: 28d Sh 23m S4s

: ffiS'ìiSÉi: Atid lh ' l em^Sia

2Sd Oh 3 im 19§

oii-.r»-vi.;inr'.


C.nu'iitfy- PJ i i r i ry^f iy

rvFv'U^vcH'r'

HcOlEzE&Zh .

••BWMBfiBiiî .

yr^TYEsveP_

9G6VqR2rBq

Psi5ri7IPWC

"LqAISESK

•r'iril.;

K3zlDGrDmk .


d - c x ir - a | - j Google PI L J Most Visited ^ Getting Started Latest Headlines

Botlnstances: indeH Botlnstances: show M \ + F fHerds l f Bo t s l ["Connected Bo t s l fBot T ype s ! [Mach ines] f lP Usages ! f coun t r i e s l fCommand Recu r rences ! ["Command Type s ! L o g g e d i n a s : 73BB2


For Botlnstances Of Type XTNZ ( Connected | [All] ) Displaying Botlnstances 1 - 30 of 3556 in total

rti Ro t I n s t a n c e Flat T y p a M a c h i n e

i • t t

I f S H K M H ^ l H r a R i i + i y ^ E i • t t

i + i y ^ E

2 • i - a w o W s i f - i f S H W ^ A i ^ ^ a a r i A ESI XTNZ i H W i i l M J l W S f i W E ^ P s O J D N A 2 • ESI XTNZ

• [+] M B • [+] M B

4 n iK t J - j ' i i - i y . c - w a t D a p^Faa i s l f i i SK^f t IUC-W-Si-p^fJO^Til i i feoSl 'OX 4 n

5 o 5 o

6 n 6 n

7 I V S T H I -MR W S I f l S B B H B S f f l f o [+j XTNZ 7 [+j XTNZ

0 • [+] feffiE ' a n a W i z i ^ M w a r i t e a s i a s i 0 • [+] feffiE

3 0 I S T'PJ 1 V TO F DBlspY-eS 'S iE iSSIHPES [H;] 'jifewz ' kt^F B" D R R-VailiiS^ lifcitiBi 3 0 [H;] 'jifewz

ID n • F ^ N Z ^ t l h f f i Z J f f i f i K S t l ^ K M F Y ^ i A [+] i S ® 0 H t & Z J M B R i WfflHK M E i t e A ID n [+] i S ®

11 o ^ "•[{:;•:-•• T-C^.CD TN 11 o i :> n [+] ^ p g X O 61 J E M E Gpny X T i :> n [+] ^ p g

13 • iXT'MZ: iD&^HBK .Vu IGRFPA l JZ f t t e (+] XTNZ PDdWBfcv t i IGRPP. iDZS .BD 13 • (+] XTNZ

3-4 • f S N Z l - K H l ^ ^ i S i f ^ V M ' t P ^ K f i [+] mat x i S W i M I l IZ H W i i g D J RM 3-4 • [+] mat

I S m § - O G B S M 8 S S M < I B I L I 1 L R I I I S m § R I I

I S • T X T t G T - D H T F S l ^ t e F S f i D M C i D u N f [+] XTNZ :-OHTK'JBl i®Ui iFBNDMuDuNI I S • [+] XTNZ

1- i f t ' < V J K C I H i M p i F i n i f 5 0 wgjm ' S M ^ i N t VJK^ft J^ISM&W CI 1- i f t 5 0 wgjm

I B • ' f^M£ l -W6- i f i FUL f t i Su£ : S"WJ [ I FOC XTNZ "SI OTGIJEFULRO UZS WJ I r o c I B • XTNZ

IB. i ± ' T B 2 | 4 ; - B - i i . i s s i S L ' f i % k E^ ; [+] XTNZ IB. i ± [+] XTNZ

20 • W 20 • W

2 1 o r 'xT i ja i [+] XTNZ 2 1 o [+] XTNZ

¡ ? ! > •f gWt^ift:^T'V EM N B ^ f & f f e t S V U T J [+] ^ p g i C i W E M N K ^ p O O L S S S S S J T J ¡ ? ! > [+] ^ p g

23 • FX T'MZL - S Y EIM RYRRO ACFEBSDT-Z'P" (+] XTNZ INYDMRYftREtftCSSBBf iTZP 23 • (+] XTNZ

: 24 • T ^ N Z T - H O W ^ ^ t C f a f l c S l i i i V g J S ' [+] X.*rN'Z : 24 • [+] X.*rN'Z

2 5 0 'T'SNSI-MKFFIMIEFIFTYJLWSIOWDMQI' MKILHRAEKSASHWONDMA 2 5 0 26 • f i aME l -HdSf f JBVRP^WBty iS .EMESB [+] XTNZ 'HTJSKJBVRFIJM^HFIIEMSSIE-26 [+] XTNZ

21 • ' f K Y S k l - P M1 I f l ^ M - I E S ^ M - - ' i B p f : : [+] Y<ifH p M i t i m B L i n i ^ 21 • [+] Y<ifH

20 • : MCCRJFJJHMI^FKJSLALCW XTNZ ' . !SECRj i fJ3NMXttj!a4lAUCH 20 • XTNZ

Previous « a » M B | r ; P a r I ' . l l j l :; < ;--,-:: -IQtt < AU

I ¿t<t n t i s u r V m l IP H iS t -CH i l Ihjicfr. T i t ! i i i

i2D-ff l-03-2S 07:; 4 S s l 2 i i r r c

» B H f i M i p g m: : « M M 6 a

3093.-03-22 03: iBESBWSfS:

• g t tHMS . - t a « ¡ j m u n i K :

• I W I ¡08 M S I : .

•aa io -oo- i se i o : « * s » « s r r c

¿•.ga :J J 2::

2 Q l ( M H S 0 a C g k n a g H j E f i i

fflWEKaasSB Cl0:DE::17 HfTC

20UWJQK10 t » S ® S i 4 i n S !

: '2QiD-03-E2 0 0 ; 3 7 i i M i T £

'S®£H>3-5'3 C'l 44:1S.OTC

« ¡ M M S J ia;-Qf(.:,4lofiT®'

'3009-11^30 D S M S i O T H f C

a w »• H B t a a a g M i B a

i a i j f f l - 04 -04 £ ; i i ; ; J

i S M D - 0 3 - 2 9 iO ;25 :S§ - i § t c

'•KB* I J -

a a . i D - 0 3 - i j s s s a w s & r a h E

B M D - 0 3 - a i M W r t

aafED.-03-22 HUOl iOBSBTE:

Lr ts l CriTTtiift'--k Tir iII i T.i t i i t i Fi I'lJ

2010 -04 -21 -19

2010-04- :3iEi 19

H H S S t M M S & i a

2 0 1 0 - 0 4 - S i , 19

2 0 1 M 4 - 2 1 - 1 9

2 0 1 0 - 0 4 - 1 9

2010 -04 -21 -19

2010 -04 -21 -19

20W. r : 04-2£ 19

2010 -04 -21 -19

2010 -04 -21 :19

2G i B - 0§4ES&M

2010 -04 -21 -19

2 0 1 0 - 0 4 - 1 9

2© 18*04^2-1 «1»

'•0...-3 Cit-'U'" 19

R f f i t O M S S 19.

2 0 1 0 - 0 4 - 1 9

2010 -04 -21 -19

2010 -04 -21 :19

2010 -04 -21 -19

2 0 1 0 - 0 4 - 1 9

'•0...-3 Cit-'U'" 19

&VTC 30d l l M S k i f f i s

® LJ.TC 29d a s a a s M B

i a u T C s a t f S B a f e a S f e

H U.TC -30d i 6 h M f t »

O t fUTC 30;d

o t u r c 29d 9h S S S U t s

O i UTC 26tt s h v s m a j e

H H 22d a f n a s b - s f e

I S i S E © 44d

SffiBKEE S s l § f F ® g g s S

i. IV. » 1 4 t a " &

ii U . 20d fih^Sjls

25 1JTC 23d 8h E3k»:is-

i.. i-.,. MitHh m m

I T : fflSd Oh 1 I S

S i l J T C 3:Ld 3h

® U.TC 30d P B f f i

0 2 IJ.TC irdd 9h M M S f l r

f l l i l l t i J r /

w t n -30d m m s m & m

a i ; y . r c ggsg

S 4 U T C 21d 2-2fi i S S i i S i s s

43 UTC -42d l l h S / e U B m i

49 U T C -30d

43 U.TC 29d M i f M S S B !

43 IJ.TC 142d 14h.9Bi3SS-

ffl« I f i l d i ft ' l i®ca®ffsi

:!5 !. i ; . as® WwrnBSm

S H p i S » 1 l i h ^ G w ^ w



ft - 13 | - j Google PI '[£} Most Visited Getting Started Latest Headlines

Botlnstances: inden L ] Botlnstances: show

fHerdsl fBots l ["Connected Botsl fBot Types! [Machines] riP Usages! ["Countries! fCommand Recurrences! ["Command Types! Logged in a s : 73BB2


For Botlnstances Of Type XTNZ ( Connected | [All] ) Displaying Botlnstances 1 - 30 of 3556 in total

[+1 Bot I n s t an ce Flat T y p a Mach i ne

1 n [+] KTt iS .AVHTNGO^j f c i iDWWYWMB ' 1 n [+] KTt iS

2 • i i i TMZ l - l l ^ B ^ M t i S M W e A i ^ ^ j i i r i A E 8 XTNZ ' i ^ s w s w s s f g B w ^ p f c a D N A 2 • E 8 XTNZ

• [+] M B • [+] M B

4 n iKtJ-j ' i 1 - . i y c w a t o a p^Faais l f i iSK^ft IUC-W-Sif^fJO^TiliifeoSl'OX 4 n

5 0 ' r x T s i i - f t l ^ ^ M l l B e A V t e V j H k ^ sv 5 0

6 n 6 n

7 IVSTHI -MR W S I f l S B B H B S f f l f o [+j XTNZ 7 [+j XTNZ

0 • [+] feffiE ' a n a W i z i ^ M w a r i t e a s i a s i 0 • [+] feffiE

3 0 IS T'PJ 1 V TO F DBlspY-eS'SiEiSSIHPES [H;] 'jifewz ' ktijiF B"EI R 3 0 [H;] 'jifewz

ID n T ^ N Z ^ t l ' H ^ Z J f f i f i K S t l ^ K M F Y ^ i A [+] i S ® 0 H t&Z J M B R i WfflHK M E i t e A ID n [+] i S ®

11 O t ^ p m ^ :r j . , : i i T-C^XD TN 11 O n> n [+] ^ p g X O 61 J E M E Gpny X T n> n [+] ^ p g

13 • ixt 'MZ: PD&WHBKVOIGRFPAlJZAte (+] XTNZ PDdWBfcvti lGRPP.ADZABD 13 • (+] XTNZ

14 • i S N Z l - K H S ^ ^ ^ ^ S / M W ® ^ [+] ij-'TN-Z x i S W i M I l IZ H J RM 14 • [+] ij-'TN-Z

I S m § - O G B S M 8 S S M < I B I L I 1 L f i l I S m § f i l

I S • TXT tGT -DHTFS l^ t eFS f iDMC iDuN f [+] XTNZ '«HtBif iKSIWSFSNDMODOHI I S • [+] XTNZ

17 f t ' < V J K C I H i M p i F i n if 5 0 wgjm 17 f t 5 0 wgjm

IB • f ^ M i l - W G i f i E U L f t i S u f e W j I I F O C XTNZ "W »i : l jEFULRO UZS WJI [FCiC IB • XTNZ

IB. i± ' T B a t - t - B - i 1.1 B i S L ' f i i . f i E ^ ; [+] XTNZ IB. i± [+] XTNZ

20 • w 20 • w

21 0 r ' x T i j a i - H i e ^ S s ^ F S i D M M s v i ^ f e W [+] XTNZ 21 0 [+] XTNZ

¡?!> if gWt^ift:^T'V EM NB^f& f f e t S V 33s U T J [+] ^ p g iC iWEMNK^pOOLSSSSSJTJ ¡?!> [+] ^ p g

23 • fX T'MZl - S Y QM RYRRU ¿ c f e s t eTZ ' P " (+] XTNZ INYDMRYftREtACSSBBSTZP 23 • (+] XTNZ

:24 • [+] X.*rN'Z :24 • [+] X.*rN'Z

25 0 ' T 'SNSI -MKf f iM iE f i f t y j lWs ioWDMqi ' MK I lHRAEkSaSHWONDMA 25 0 26 •f iaMEl -HOSffJBVRP^WBtyiS.EMESB [+] XTNZ 'HtjSKJBVRfijM^HfiiEMSSie-26 [+] XTNZ

27 • ' f KYSk l - P M1 I f l ^ M - I E S ^ M - ' i f f i p f : : [+] X'THZ p m i t i m b l l H H a w f i 27 • [+] X'THZ

2B • r MCCRjF j jHM i^ ik JS iALCw XTNZ '.!SECRjifJ3NMXttj!a4lAUCH 2B • XTNZ

Previous J t J ^ i M J S B a g S f c . . « a » M B | r ; Par I'.lljl:; < ;., ••:: -IQtt < AU

HiStTiHi l Ihjicfr. Tilt > i i

S 0 I 0 - 03 -22 O M S K

' a 0 t o - 0 3 - ^ I ' , f i l l . : : : " .

«»io-aafFfta m: : « M M 6 a

3093.-03-22 03: H E S M S f K :

• sMD ioa - sa « ¡ j m u n i K :

23 i3 - : i 3 - :2 oo: s s s & t f r c

!£0±0-O3-e3 09:29T.14-MC

• I W I |?i M S I : .

' 2 O l D - O 3 - i 3 0 1 0 : « * 3 » « s r r c

!2ttlD-03-:iS OG:Dfi::17S3TC

20UWJQK10 t » S ® S i 4 i n S !

:'2QiD-03-E2 06;37i B i S T e

'23S3-03-23 04:44:1S.OTC

m w i s f t a s s a K M W i ^ l l H

a aoa - i i -OT D S M S i r o i B f c

a w »• -;';: HB t a a agM i B a

iSMD-03-29 ic ;25:b§- i§tc

'•KB* I J - ffi:04:MK

®flso i : ..' sssaws&rahE

B M D - 0 3 - a i M W r t

# E M W t « ! 3 « i S i i T e

'aoaB.-03-sa j»:o i :oe«BrE:

l-Ftst CrjTltiihr:k Tlrii>• T T.i t i it i Fi I'll

2010-04-

a0 i0-04-

21 19

B 19

Ht lSs tMMS&HI

ao 10-04-21,19

2 0 1 M 4 - 2 1 - 1 9

2010-04-

a010-04-

m 19.

21 19

2010-04-21-19

2I.-1':- L4

2010-04-

U 19

•21 19

2 0 3 ® » $ « ® ®

2010-04-21:19

2O10-O§®i£M

2010-04-

2010-04-

21 19

S i 19

2010-M i fe& 19

R f f i t O M S £ 19.

2010-04-

2010-04-

19

2 1 19

2 0 m ® « M M

2010-04-21:19

2oaa-o#®3gi.s

2010-04-

2010-04-

21 19

S i 19

2010-M i fe&19

m IJTC 30d l l h - B S t e i S g

l i T c 29d 9h ' : sW: i s :

i a u T C sa t f S B a f e a S f e

H U.TC 30d i 6h M f t »

O t fuTc 3o;a g f l p i g | $ ;

a t l j r c 29d 9h S S S U t s

O i UTC 26d

o i u r e aad a f n a s b - s f e

I S i SE© 44d

SffiBKEE M J m i i S i f e -

1 B H H 6b 1

a 1.1. aod fih^sjis

25 IJTC 23d 8b S3te<isi

i s 1.. 1-.,. Mi-tHii m m

I T : fflSd Oh 1 I S :'•:-

2 i : UTC 3:Ld 3h

® U.TC 30d P B f f i

0 2 IJ.TC add 9h M M S f l r

f l l i l l t i J r / .

VieV" Bots Also Jri CCTUnt;t:v

View Country Stats

w t n -30d m m s m & m

111 u.rc ' a d

E4 UTC 21d 2-2b iSS i iS iss

43 UTC -42d l i b S/eUBmi

49 UTC 30d 10h:4sta-3&

43 U.TC 29d M l f M t S S S I ?

43 IJ.TC 142d 14b.9fti3ES'

ffl« I f i l d s b 'ljSnffiffss

!. 1;. 's'4d i SbSsm iaS i ?

S H p i S St id l l h ^ G w ^ w



• ù - I S | - j Google P I

L J Most Visited ^ Getting Started Latest Headlines

Botlnstances: inde» l^j Botlnstances: show M \ + F

fHerds l f Bo t s l ["Connected Bo t s l fBot T ype s ! [Mach ines] l'IP Usages ! f coun t r i e s l fCommand Recu r rences ! ["Command Type s ! L o g g e d i n a s : 73BB2


For Botlnstances Located I n ^ | O f Type XTNZ ( Connected j [All] ) Displaying Botlnstances 1 - 30 of 1593 in total

; previous i 2-3 4 S 6 7 8 9-, y s a j i t t w e t >

P a r I'.!•_;!:: - i iOp. < AH

m

• •

o

• Q

• •

O

• o

• •

• •

TKTTO

i . '

TXTMZ

V i ' T

TXTNZ

IXTNZ

V l M : '

fKT'fJZ

IXTMZ

I XTNZ

rxTN'z

K-U;

I X T N Z

'|W*RSÌ

JXJ1JZ

I XTNZ

IXTNZ

IXTNZ

r x T N z

THTSS

I X T N Z

TxT'NZ

I X T N Z

-AYHTNOCSPJWODWWYWDXB

•; JIDWHBKVQIG; ; » PAUZABD

-KH jyvePTT t i Z r tYHYPQJ f iM -

5E5LQ0PV ICGZVQKWIYUN

^ M g i f f l s c a i q t a K L G g a g E A

-HOSHJEVRPJWBNFCEMSXK

EKSHESSI jURPILYTPBDO

-FFCKJ IOMBUVFHAITRRBG

- P k Q K R N P J S S X U T B Z H T Q J N

• a a B e a a f f i S g B M B B M H g M i

-FMWNTULXVOLVPCKLALIUH

- HfcW W H ¥ S B H a e A » a B & l f l . t (

-•AGEXNMBEBOAVGXJHLQPA

CXDTLZ f JAZJJNTVXAOJGW

- Q H A ^ J M g B M W K t f M F ' B t T A

« 8 i l M l « f W 6 g

-XZABQDIQNKXLJDNCYWLL

-LNLHUONJZGAHDOELTHJU

-RFSDIDGLVYLYFTOGFYZC

ftlllXy [4i; I ¿«1 O i i s u r V m l IP . Pir», ì C r i ITT ùi ¿ jkT f i t Ì3!

e

i

i

[+

1 :

!+

[+

i s

g

[+

i s

XTNZ AYHTNOCSP JWODWWYWDXB

XTNZ E BBKO-XT

XTNZ • s a ^ B Y T J i g t f T O y E o j e w "

XTNZ SE5L00PV ICGZVQKWIYUN

' M ' M n g ' t S B B a g s s m a T t g i ? . .

XTNZ W a r A N e g B t O t i t g f c Z l M - E A

.' TNZ HOSHJBVRPJWBNFCEMSXK

XTNZ EKSHESSI-ILIRFILYTPBDO

"FF-GOOMBI jyFHALTRRBG

XTWZ a M M I W f f f f l M ^ .

XTNZ PKQKRNRQSSXUT5ZHT0JN

XTHZ

' FMWNTULXVQLVPCXLALIUH

.' TNZ AGEXNMB5B0AVGXJHL0PA

XTNZ C XDT LZNAZ JJNT VXA OJ GW

i^-fNZ Q H / I I Z J M B B B l t ^ M t g j C E * ;

XTNZ XZABOOIONKXUDNCVWLL

XTNZ LNLHUONJZGAHDOELTHJU

XTNZ RFSDIDGLVYLYFTOGFYZC

Ì20ED-03-S6 K i n H H I t

•MVi i t 0 - 7 : 4 9 : I g W K

. :3nif l -D3-&B IB: .«:J

305.0.-03-10 Off: fflW'lfflffi

a a t i 6 - n - a p o s : q t g f j g g

• I 19:Q6:2FN&RA2

aassKaasssa oe 54: » e r e

2 S K M « i i K f f f i 3 2 ® «

tì010-03-Éd t S ; 5 2 : Ì 3 # T C

• i i v i ; £5ì ? i : « S S

B M B - W H K 10:27:.41i3TC

2 0 i a i f l S 3 i i: '.if*: • • Sa f

•atKD-03- W ^ l r07:-41 OTG

' a S 0 r - 0 4 - . f i gg;QS't is m c

® £ M S « I S3 ; - S 3 I » I I I T ® '

•M.T l ! :vv 09: 36 ÌSBOTC

- S M M £ 5 s S 2 M > 3 » l M 3 T t e

! a p p - 0 3 - 2 5 M ; 4g.;3:l,^r:c

>2M0-03 -22 ao ; .23 :Sk -S t c

• i '¡»u-Si.'-sjli;. ? » i - s e X

a o i o - o o - s s ¡ s t i m a r n e

2Cll[J-03-"2.7 01 : « 3 3 3 m % 2

: - a o t » - l i - a i 8 s v a » * « r é

OS; 58:3S :OTC

a W M M S B4:.4a:,aa>BT®'

'aoaB. -04- f f i » ¡ r a f s o f e B K :

L r ts l C riTìtiih r:k T i r i i> • T l i M'it i Fi IT'j

2010 -04 -21 -19

2010-04- :3iEi 19

B & E M ^ à s s : ; «

2010 -04 -S Ì , 19

2010^04-21-19

2 0 1 0 - 0 4 - 1 9

2010 -04 -21 -19

2010 -04 -21 -19

2 0 1 0 t G 4 - 2 X 13

2010 -04 -21 -19

2010 -04 -21 :19

2010 -04 -21 -19

2 0 1 0 - 0 4 - 1 9

2© 18*04^2-1

2 0 1 0 - 0 4 i 2 f , 19

£S iB* f i4 -2 : l : 19.

2 0 1 0 - 0 4 - 1 9

2010 -04 -21 -19

2010 -04 -21 :19

2 0 1 0 - 0 4 - 2 1 1 9

2 0 1 0 - 0 4 - 1 9

2 0 1 0 - 0 4 i 2 f , 19

gmfem ¡tm sh-sgmmm'

5 4 - W t ì -42d

I T : 20d 0fl :S2fe::«i-'S-'

« ¡ a s m • i t t s M w W a i S i '

•i i. i:>'. M i £f]-.g&ffii ite.

:36:U.TC 41d 9 l l ' » 3B f®r

I r-:', ®Bd S f e s i a f f l ®

Ì 8 Ì 8 E © 298 f f iW49 f i Ì i S ÌS

Ù i lJTG 2bd Sh i5-(fc:-:i;tìs-'

s s IJ.TC i 9 d a n p N H n »

f l l i l l t i J r /

B JJTC 26d ih"

a&LJ.TC 'aod l l t K S S W s H S - '

54 IJ.TC 42D U N 'xmi:,$t<n

4S UTC a^Sd- l ' th-Snf ' - l^à'

s a u r e -3id

ÉÉ.UTC -34d IMSHESftitBSis

S f tì.rc 3 1 d 3h3 .3J» f ig i -

25 I. T : 30d Ì^v2 Ì k» : f e - -

éf-VTC -34d 2-Sfi

B i UTC 20d i h J iSf l fSSS"

® UTC '29'd

B Ì ' I JTC 30d 12h É l f a i I f F -

a È i f l f C . S K d J JHM l lMBBJs

3 0 UTC 161d:6h- l .&:EB.S

47 UTC 20d t oh asfn. l ' s -

s S ' i f J ® H t d H h v a w s M w



0 - C X , ( H i Ù - | I « - Google


Botlnstances: inde» Q Botlnstances: show L

fHerdsl fBots l ["Connected Botsl fBot Types! [Machines] l'IP Usages! fcountr ies l fCommand Recurrences! ["Command Types! Logged in a s : 73BB2


For Botlnstances Located I n ^ | O f Type XTNZ ( Connected j [All] ) Displaying Botlnstances 1 - 30 of 1593 in total

; previous 12-3 4 5 6 7 8 9.. y sa j i t twe t > Par I'.!•_;!:: - i "„'.I; do p. •:: All

F i rs t Ca l l b a ck l i m e Las t C a l l b a c k T i m e * L i tR t imc

l : :nJ - : i Ì3;ES::&|ÌTC 20_ j - iM -2_ i : 2 . 33 I .T: a e i fe'Mtóafe

•J Ù- I l l * ' 07: 2Ù10-C4^| t l 9 ; ÙTC Sod ì i h ^ a i K s f f s

| w H I # l l ! S l 5 i I I I H I M B Ì M É S H

2D1Ó.-03-1D 00: 2010-C4Ì21 19: 20: 54 IJTC 4?d flggjflggjgin

jÉtoEMJSsSS l3;-SS:5+"l f&: 2018^04-21 19 ; 20 ; 54 U-Ttì did i.

gOOgyiii'à.O OS; 15:;(jS.yTC 2010-04^21 19;-20; 4S UTC létSd Wh-.SjS-'-li&l

i ' i y l '|'.I i l t f t f l t l f t UTC. 201O-t ìÌ21-.Ì9:20; 2-9 t I K

^ j P j g ^ j g P H ^ t i j g j f j j g jg

•AU0 -03MB 06: S+M- 'STC 2010-04-21 19: 20: ^S-tere S4d lSÌi'S'Sbi-Z&s:

2t)i'0>D4-21.19 ; 20 ;:Sl; U

•aoaW)3<ii i É9;S2:Ì3Ì§TC 2018-04-2Ì-.Ì9; 20,23 U-TC ,-SOd'

|0: 01:02 « " i r o r o i f l T O s o i^. j j iR;- 'SQCK^II J ^ ^ s s

•¿OlO-O+sl i i o 187! 41.-STC 20 M M S S B b t 20 :.È;i'-tere '20d:: ail'SSkiiiSi'Si

| . i . « | o s ufg; .

013-03-17 21 ;07 !4 l4 iT£ 2010-04-21 19,20,-i :?UTC :-34d 2Sfii l2fc-3'SV

? ° m m i s ;os ' ; i s .UTc 20.1i:-B4-2 tìg ; 20 ;,[$ U.TC 20d; i h JjgÌTSIS-

p 53afe&T<t W M f f i é f S S i - i i t ì ; -1 1. IV.

•• i . i. i i . . f - 2 p l 0 - q 4 i i £ i 9 :• 19 ::-3& l , r .

.£19 : » i M J E f f e B H B t i K ^ ^ c Ì B :ébSMé

0? ; t é i s i , t 3 T C : 2010-04*21.19 ;• 19 H | ii.TC

•SMtM)3*22 0 6 ; 2 3 ;M#TC 2018-04-2Ì-.Ì9; 19 :àt U-TC .-SOd 12h BSfei iÌS'

• 1 s"j%.I-:".;.-: I'.-: i?:«; " H W B ^ g p u i y g g i Ì&PC-

•¿•.10-03^2's is-M&fafhz 2010-04-2Ì:d9 19:-à7:U-TC '2bd Eh ffifefs»

^ S P ^ I g g ^ l

. ' j i > :>---- Ì3;-39ÌSÌ6lTe 2010-04-21 19;18;.3a:UTC 16 ld >11 1- L. 'rJ:

20là<i4».$l OS; S S i M OTC 201i:-B4-21.19 ; 16 ; 47 0.TC 20d. iOfti lBhiS'S-

.•i'lr'ii^'i':-..« ¿4; I M I ! É S ' i i i r i i i i l i i i v i e i. iv . « 0 ^ d i i B n a K

2 p l 0 - 0 4 i i £ i 9 14:-2;s ij.Tc

m

• •

o

• Q

• •

O

• o

• •

• •

TV tSB

' n i . '

TXTMZ

C i ' T

TXTNZ

IXTNZ

V l M : '

fKT'fJZ

IXTNZ

I XTNZ

rxTN'z

' t K T j E

JXJINZ

JXJ1JZ

I XTNZ

vflM.-'

IXTNZ

IXTNZ

TXT"MZ

THT&S

IXTNZ

TxTNZ

JXJ1JZ

-AYHTNOCSPJWODWWYWDXB

•; JDWHBKVQia-; ! : 3A.UZASD

-KHjyvePTTtiZrtYHYPQJfiM-

5E5LQ0PVICGZVQKWIYUN

-HOSHJEVRPJWBNFCEMSXK

EKSHESSIJURPILYTPBDO

-FFCKJIOMBUVFHAITBBSG

-PkOKRNP.CiSSXUTBZHTOJN

-FMWNTULXYQLVPCXUAL1UH

- HfcW W H ¥ S B H a e è » a B & l f l J (

-AGEXNMB5BCAVGXJHLQPA

CXDTLZfJAZJJNTVXAOJGW

-QHAI^JMgBMWKtfMF 'BtTA

-XZABQDIQNKXLJDNOVWLL

-LNLHUONJZGAHDOELTHJU

-RFSDIDGLVYLYFTOGFYZC

ftlltXy [;ri;

e

i

i

[+

1 :

!+

[+

i s

g

[+

i s

XTNZ AVHTNOCSPJWODWWYWDXB

XTNZ E BBKO-i-PT

XTNZ j ew "

XTNZ SE5L00PVICGZYQKWIYUN

'M 'Mng ' tSBBagssmaTtg i? . .

XTNZ Wa tÀNegB tO i j g f c Z lM -EA

.' TNZ HOSHJEVRPJWBNFCEMSXK

XTNZ EKSHESSIjURPILYTPBDO

"FFGOOMBIjyFHALTRRBG

XTWZ i ^ W W M f f l E F S a f f i i M ^

XTNZ PKQKRNRQSSXUT5ZHT0JN

XTMZ

' FMWNTULXVOLVPCXLALIUH

.' TNZ AGEXNMB5B0AVGXJHL0PA

XTNZ C XDT LZNAZ JJNT VXA OJ GW

TNZ QH/HeJMBeO(MMIiMeSeB*;

XTHZ-

XTNZ XZABOOIONKXUDNOVWLL

XTNZ LNLHUONJZGAHDOELTHJU

XTNZ PFSDIDGLVYLYFTOGFYZC


C o u n t r y B i na r y Key


l^J Most Visited ^ Getting Started Latest Headlines

Botlnstances: ¡ndeH tyj | Botlnstances: show

.A THerdsl TBotsl r .ConnBctsd Bo t s l TBot T y p e s l TMach ines l TIP Usages ! r coun t r i s s l TCommand Recu r rences ! r command T y p e s l L o g g e d i n a s : 73BB2


For Botlnstances Located I ^ l o f Tvoe XTNZ ( Connected I rAll 1 ) Displaying Botlnstances 1 - 30 of 1593 in total

« previous It ®SsiUtffitS5SlSS£... S i -SS lSe ' s t :» P a r P a g e : £5 £0 < 100 < AH

[+] B a t I n s t a n c e Flat T y p e M a c h i n e L a s t O b s e r v e d IP F i r s t C a i i h a c k T i m e * L a s t C a l i b a c k T i m e L i f e t i m e CoLcntry B i n a r y K e v

1 0 [XTNZI-tmpPNZNJTDMT :pW-Sff i tJDF i + l g ^ j S S m ^ N Z N J T D M T H W a i N D F

L a s t O b s e r v e d IP

« # M H 8 8 ® J S $ ? I S : 3 i -^iTc 2C ) i o - 0 4 - 2 i 13; 34:3&ihc ^ c J I b is-

CoLcntry

2 R raTWZl- tmpS'Z&LL*JU3?WgKTHDLG [+] XTNZ


S S N i S S l B ^ : flKRisS o - p i ^ i ' . o o : a q s H S ^ r c l h l a . r t i ' f e

CoLcntry

a • ( » T N ^ W M B p i U p H S H [+ ] W W ' t mo i SFMOl J H Y


JSFEIM)«-® 03: IRK .U:-:'-.^-' n t t M n i o :-44 r i f f i i f f e S f f i M M

CoLcntry

4 R r B l ^ S l - t m p E l i T ' i Z H E E a K S l C i y j L G C H •..;: V v -


r S f c U t C ' ^p ' lO-Oi rSD 19:52:47=ii!TC l h t i l " 57^

CoLcntry

•5 £ 5 S ' M ^ T B t e f e t e ^ M i B T H

L a s t O b s e r v e d IP CoLcntry

6 R [Smz!-tmpRRJS0£KVMRRG!i£ttR" i -H V n . r i : =.-:•:i:i"rc : L::


l l g l l S l j K 1 2 : 1 ' t l S J JTC f p ^ p

CoLcntry

^ Q rXTNZ l - - tmpG&2 f i : EVGCG i LVLPJM [+j XTNZ i l m p S S z i ^ V Q i i ' e z L Y L P J M


'•:J.'.I •!•• • 1:2: 33fiS:'fatTC :i:em:S9s

CoLcntry

n • [+] KTWE l i m ^ c c f f i M i e s B t s i s a s - i


2 o i o - ® s ^ S l ^ f S i ' ^ f i f i ! ' : U f i J sh ^ S g f g g "

CoLcntry

Q B [XTNZ l - tm f tEOT f i f t^^bBa^SHtoGS , - - [+] ' j f e j Z S m ^ S T O f c ^ i f e e G S i i i i l W i f e


¿ i f e - 0 4 - i : S - a3: 47: 11 S T t 2 Q i 0 - 0 4 - l S 0 4 : 4 9 : M S T C l h £tn 20s

CoLcntry

ID ! R


2 01 l^f i i f j 14< !£);;> j s ^ J i t B : ; i4;. i j t ;43 u f j g

CoLcntry

11 Q iXTNZI - t i n i sSGEFAteVRTLLUI t i E I [+1 XTNZ


:aSfe -04-14 0 4 i 3 9 i B 7 i i T C 2f ldO-04- ik4 09 :Sk s JS ! i i TC 3h 1-Sirr-SOs

CoLcntry

12 R r K ^ ^ t r f i t f f l J P l f P F F i S Q jWW iS i i t t [+] gygg


2 0 1 i g p s g g g s p i i p s y i S •ijili':!^.".:.: 1 •

CoLcntry

13 • i XTNZ 1 - t m p K j V t i f E R Z F i J i h V i i s W B (+j XTNZ i l m p K S i E R z r e S S S s W ^


j S i t r - O i - f ^ i i ' S a ' : £7 S T L 2 i is io-04- ia: ' i s - : '26::I i i 'STC sa-rtim 12s

CoLcntry

1 4 • [+1 y r i j z


201 B j j | i i S 3 i t & 5: ^ J & H O ^ I ^ . T I G : U T J

CoLcntry

15 S3 [XTNZ 1 - tmpIOUDBW^f i iARSjBKCD iHijjij K ' l np IOUMl&CP jMR iODKCQ


: i i : f e r 04 - : i 3 ' SB : 41:22 S T G 2 Q i o - 0 4 - & = i l ; 3S:-^3iSTC

CoLcntry

16 R [+] XTNZ \ imc0f f lOECDHRPGSe3i iTJFI


05!:2:&;47 UTC :gt? i0-04 ' - i3 03:®;47 ' ; iS rC 10m Os:

CoLcntry

fes u i X T N Z T - l m p L b M i ' P F f i ^ k ^ r t i N ® r+ifili


IB • r a T ^ z i - t m D u r w f S p M p ^ M j . w j t s i XTNZ ^mpG'WWI&PU&fhi-MJWt^S1;


3h '23;pl -40s

CoLcntry

l a P [+ ] P L B I tmuTGGKQOf i aEDMsuMVGs


2 0 R [STWZl- tmpUBiVOft f f l^f f i ' feMf iWtRX ' i m p l J B C V M V Z M i l B M G W t J R K


0: i j i UTC •;2lh l S i j l ^ E

CoLcntry

2 1 P i XTNZI - t lT ip i lMaVO! - IUSSJG iH i iM#I [+1 XTNZ j t m p f e N S F O H U B M G f t R M F L


• m m - i i 1-0T:. 3 3; 33 i - T C 2 f l dO -04 - i i ' ? i o : S4:S7S!iiTC 3h l.Srrr'-24s

CoLcntry

¡£2 R [ + ] G Y G G ln-i.: 'i,l.Vi:::;'. '*!.l: J''. :;\V1


201 •¡Jjli' .:..:. 1.. - ' J - " ! ' ' - FPJFPWIJG'

CoLcntry

2 3 • r x T N z i (+J XTNZ


; S I T R - 0 4 - : I I - t e I T : 1 4 t i T i : i i s i o - 0 4 - l 4 OS-:20,® ! i 'STC •im I ••••

CoLcntry

,24 R [+] y r r JZ i i i i . Y R ^ s i ^ p P H I M M


201 44: J j l j l f i ! : l h m ^ n g

CoLcntry

2 5 0 [XTNZ I - tmpMG^ZcSS l t J i l - J ZDVGJ f J f i r n pHENZC l f t^ i l S t j Z&Y J i j r j


« S B W W E S Y S S & S & I S I 2Q lO-04 - i i := l4 ; O i r K c S T C lOh l i r t 2 2 s ?

CoLcntry

2 5 R i^THZl-tmii^JF]ZPS®VPJtLfirff ir%J [+] XTNZ


: 3 : ! V ; . T : 17h 23tti"s;2s

CoLcntry

• • XTN z Y - i m g t f e & Q ^ i ^ W j H , n i [+ ] Y<ift2 t m p ^ f i & i t i i S f c R T & H A ® ®


A B B M M I I S W F C ' A L L I E N

CoLcntry

2 6 • XTNZ " tempi^ iFKSf f iewt i i i l SC LKJI


-.•^¿•fjS'.fiiS 1; ¿S: 34. l lTC

CoLcntry



ft- i | | ' Google P I


Q Botlnstances: indew kui Q| Botlnstances: show n

THsrdsl iBots ! ¡"Connected Bots l fBot Tvpes l fMach ines l TIP Usaaes! fCountrie s i rCommand Recurrences! rcommand Types l

Listing Herds New herd

L o g g e d in a s : 738B2

H e r d A c t i o n • netblock Show All / Show Connected j Edit / Hide

xtnz Show All / Show Connected J Edit J Hide

Some Awesome Herd Show All / Show Connected J Edit / Hide

New herd



Cf i i - c ft- i | | ' Google P I


Q Botlnstances: indew lyl Q| Botlnstances: show n

THsrdsl iBots ! fConnected Bots l fBot Tvpes l fMach ines l TIP Usaaes! fCountrie s i rCommand Recurrences! rcommand Types l

Listing Herds New herd


H e r d A c t i o n • netblock Show All / Show Connected j Edit / Hide

xtnz Show All / Show Connected J Edit J Hide

Some Awesome Herd Show All / Show Connected J Edit / Hide

New herd



É3I - c X . è - i ü ' Google PI L £ J Most Visited Getting Started Latest Headlines

1 "I Botlnstances: new Itjl Q Botlnstances: show M L f"

fHerdsl fBots! ["Connected Bots! fBot Types ! [Machines] l'IP Usages! ["Countries! fCommand Recurrences! fCommand Types ! L o g g e d in a s : 73882

New herd N a m e

I My New Herd| 11 Create



© ' C ft - I * | - i Google P |

\£] Most Visited # • Getting Started Latest Headlines

Q Botlnstances: edit ISI | G Botlnstances: show

fHerdsl fBotsI ["Connected Bots l fBot Types ! [Machines] f lP Usages! [Countries] fCommand Recurrences! fCommand Types ! L o g g e d in a s : 73882

Editing Herd My New Herd7 < vi 3 •

Bo t T y p e s ( A n y ) C u r r e n t l y In C o u n t r y ( A n y ) C u r r e n t l y [n Me tb l o c k ( Any )

Update and .., Choose A Bot Type V Choose A Countiy 4 ! A d d K g & o c K j 1

| Stay Here E v e r I n C o u n t r y ( A n y ) H i s t o r i c a l l y In NetbSnck ( A n y )

| View Herd ] Choose A Countiy tH i - J . I ' ;;L;[vy., 1

| View Connected Herd |

Bo t I n s t a n c e s ( A n y ) 1 View Index

Bo t I n s t a n c e s ( A n y )

j Add Bot Instance ]



H I ' C . Ù ' l l f f l | - ; Google PI L J Most Visited ^ Getting Started Latest Headlines

Q Botlnstances: edit fcoj []] Botlnstances: show

THerdsl TBotsl ¡"Connected Bo t s l TBot T v p e s l TMach ines l TIP Usages l l"Countrlesl TCommand Recu r rences ! TCommand Type s ! L o g g e d in a s : 738B2

Editing Herd My New Herd7 < vir •

B o t T y p e s ( A n y ) C u r r e n t l y In C o u n t r y ( A n y ) C u r r e n t l y In N e t b l o c k ( A n y )

Update and ..,

| Stay Here~~|

V iew Herd

V iew Connected Herd

- Choo se A Bo tType -

i H E P B INZYT T U R D

- Choose A Bo tType -

— Choose A Countiy

E v e r I n C o u n t r y ( A n y )

— Choose A Countiy

| Add Netblock

H i s t o r i c a l l y In N e t b l o c k ( A n y )

f Add Ne tb l ock "


| Add Bot Instance"



£§ e x , ù - IS! | - j Google PI l^J Most Visited ^ Getting Started Latest Headlines

Q Botlnstances: edit y j | Q] Botlnstances: show I I 1 1 -

fHerdsl fBots l ["Connected Bots l fBot Types ! [Machines] riP Usages! fcount r ies l fCommand Recurrences! ["Command Types ! L o g g e d in a s : 73882

Editing Herd TMy New Herd7 < v^ •

Update and ..,

| Stay Here~~|

View Herd

View Connected Herd

B o t T y p e s ( © A n y Of | O N o n e O f )

j Choose A.BgtJjf l je j v

0 XTNZ

Cu r r e n t l y In C o u n t r y ( A n y )

-Choose A Country -

E v e r In C o u n t r y ( A n y )

— Choose A Country

Cu r r e n t l y In Net b l o ck ( A n y )

I A dd Netblock

H i s t o r i c a l l y In Ne t b l o c k ( A n y )

I I A dd Netblock


| | Add Bot Instance



ù -IIS | - ; Google PI L J Most Visited ^ Getting Started Latest Headlines

Q Botlnstances: edit fcoj []] Botlnstances: show

THerdsl TBotsl r c onns c t sd Bots l TBot Tvpes l TMachinesl TIP Usages l r count r i ss l iCommand Recurrences! rcommand Types ! L o g g e d in a s : 738B2

Editing Herd My New Herd7 < v i r •

Hot T y p e s ( © A n y Of I O N o n e O f ) C u r r e n t l y In C o u n t r y ( A n y ) Cu r r e n t l y In N e t b l o c k ( A n y )

-Choose A Countiy | | Add N e l b b d T ]

Evfil- i n .Gauntry ( A n y > H i s t o r i c a l l y In Me t b l o c k ( A n y )

-Choose A Countiy ~ | | A d d N e 1 b b c l T |

Bo t i n s t a n c e s ( A n y )

| Add Bet Instance"]

Update and ..,

| Stay Here~~|

View Herd

View Connected Herd

0 XTNZ



û - IS | - i Google PI L J Most Visited ^ Getting Started Latest Headlines

Botlnstances: indeH Itul Botlnstances: show M ] + F fHerds l f Bo t s l ["Connected Bo t s l fBot T ype s ! [Mach ines] r iP Usages ! fCount r i es l fCommand Recu r rences ! ["Command Type s ! L o g g e d i n a s : 73BB2


For Herd 'Mv New Herd' ( Connected | Displaying Botlnstances 1 - 30 of 3556

[All] ) in total

S . B o t I n s t a n c e B o t T y p a M a c f i i n e

i r | [SSHZl-BOGPMhlÏÏ^LHVÀOS'SÔVeiM ¡ ¡ ^ B Î H a é i S P i l H m ^ f t i i i i i j X F O v é M i r | ¡ ¡ ^ B Î H

2 • rXTNZ 1 - ICBJRÉTOCKTEH^S^ÎtSîjaKlG 1+] XTNZ J C B J f e B w G i î T S H ^ M i Ë f l l f J I Î 2 • 1+] XTNZ

a • [ ^ j i ' S f r f f i . Î f t l F - j E : C i W t i y F B ® â o ® ' f i i a • [ ^ j i ' S f r f f i .

4 m [XTNZT-FT^ lDJZMWWMH^GTYEi f fG [ | + ] x r r j z ' 4 m [ | + ] x r r j z '

•5 ' H r ^ f r r N g ffi^iÔMiSFKÎÈîMNMtiàS-•5 ' H r ^ f r r N g

6 E I J R - i s s t s t , ' S&UkDHyTiSiffiSMïHASiÎYTL 6 E I J R - i s s t s t , '

7 S M X . T N Z ô f e j L É Î ' T Q O Z N K L D P i i v M Z 7 S M X . T N Z

a • i X T N i l v F M W M ^ i i t j & S S S t X L A U U H i p S B j U I . . S'fflî iffjTEtSVÎiltïvSËSÊAUUH a • i p S B j U I . .

g r . [ S M Z I - i i e B P b a l S p i V t i ^ I S ' S & F i : : riS-SvTNZ j E f e B P D B E D P f Î I S w b M y H -g r . riS-SvTNZ

i ts " f t i ^ N Z l - r tHOËÏ i3FTÏ Ï3SÎWiOi 5 R2S , H i ts " f t

i l " H M ; XTNZ K i i l b f J HPCH TSWiiZÏÎ t l i iPPR i l " H M ; XTNZ

i i E r X T N Z l v O H A S Z J Î ^ R Y t ^ Î Ï K ! Y l F ¥ & A 1 + ] i j g ^ g ^ ^ f e â S ï h B Î S l V l ^ i t ^ YKTA i i E 1 + ] i j g ^ g ^

13 • I W K T N Z S O T . w ï è p P : : A D O O M S V I V ® S ' : 13 • I W K T N Z

1 4 • f XT H E F lilllRD iiZ S WJ1 IfSWS, ' JF+] -kTNZ • / ( f ÎSÉnfââ î tBâé i âS i i J i ffit&É: 1 4 • ' JF+] -kTNZ

I S r ; ÏÛé'WOT ÈO f i s F G : t i i R Û s M < I S r ;

16 E I XT NZL-S-FIÉIHS B SBOAVG x)HT»I*A\ ' I E S X T N Z 16 E ' I E S X T N Z

17 T J RIÉÀZI W T I S ^ ^ H F F I B T O J ^ B NTO FC^-PRBJ M R S G i ^ x t i S M N P i B P x w N i o 17 T J FC^-PRBJ

I B • RXTNZ1-ÇJTOTLÏÎFLAZJJNT8IM®ÎASI i + ] XTNZ I B • i + ] XTNZ

19 • T I R S I M I À P [ a S É E ® , ^PLNC-Ë'A'RUÊIKOT.BIAIÎT'TRI 19 • T I [ a S É E ® ,

20 E ^ÉILFI;Î3ÉIYTFS&ÎMTP0'JRM 20 E

2 1 r , RÈIWZLMNYDMRÏSSMSÀÏBB&TZP r » t x.TNz I NY IMM^ RROÂéÉ 'SBBDfep 2 1 r , r » t x.TNz

: > ; •.• E r x T N Z i - B Ë ^ ^ p p ' v p s i ï a â K ^ ^ u ^ 1 + ] i j g ^ g ^ T S Ë ^ I ^ P Ï L S ^ ^ S L W Î Y UN : > ; •.• E 1 + ] i j g ^ g ^

2 3 • R^LWZI-OGBCUWGTUBUNC-A^TIPL I M X T N Z Â S ' Â M S F L ^ J N C I J V É M O P L 2 3 • I M X T N Z

V4 E f XT NZJTT) F FZDHZVJKOHZJÎOJXFHU ' J+] -KTNZ DEEÎSFI^SSIÎILÎSZA ®&FIHU ' V4 E ' J+] -KTNZ

2 5 r ; [SFHZL-ÈFESKESËÎÏTIFÏPLLYTPBDCÎ r J p f M E'KSHESSUIJRPIIIYTPBSO 2 5 r ; r J p f M

2 6 E I X T N Z1 - CTA1 F M L ^ P A T S B LS : Î2S CFFIL ' J J F X T N Z 2 6 E ' J J F X T N Z

:-'./ • [AFS XTNZ :-'./ • [AFS XTNZ

2 6 • r XTNZ l - POUU^ lT i aE t i TYRJ l lM JBAL I + ] XTNZ P jSÉ) U C G IrDE Ci T Y PJ U M j B"À L 2 6 • I + ] XTNZ

P r e v i o u s « a » M B | r I P a r I ' . l l j l :; < ;., ••:: -100.-<AU

F i r s t C a l l b a c k T i m e L^st C a l l b a c k T i m e * L i f e t i m e

2 3 1 0 - 0 3 - i f i 1-: s S : 2010 -14 -21 13 ;-4te52=fi'T'C •:-'2.:i 21

.•' i i i hfj^jg! 10 49:3%l i+C 3Sd.pH;":£pti'cp|l

!••• S i s âË i î t l l i â î - È l Ï W s f f l t e& i ï f f i s

20: 34: i f e l i t c 2010-0-^21 19: 40; 4Ss

I K M I SO: 34; . H S l f t : 2010-S f Î -21 l ' S i f e s S i i i M 19d,-£.3(itÎ4tn<:&36

2 0 1 0 - 0 4 - 0 1 20; 52 53:131 C ' 2010-Egh21 Î 9 ; .49; 52 .MtS -

>'i .i ¡I D 20 lu-H.4-21 19 ¡ , ' H s S S Î f Î ë 12di fa? i f&m,46s

St i- iq '^-^-21 19; 4B;3 / ' î g ; ip ; ï I t t S W l ^ i l 9 5

i f f i J M 1 3 v l 4 S i i S f e - £010 -0 -4 -21 19 c MSÈtë&til .• ri-,.' a -, -.u..

¡ ¡ ¡ g g s i j § 3 | g ' i s P H w m 1 9 ; M ^ W Ê 2 9 d t ï â h i | ï J p i T 4 a s

20.<:- :<!-22 i o ; 3 9 i S ? ® r c 2010-0-4-21 19 ; 4 Î ; Î O Î T C - 30d Tl '.Vf-z:

2D n f 4 ' ® 2 7 ;o.l; 46 ; i p t f r j i j ^ s i t i H H S U 3 7 s

•2010-03-2.9 1 0 : 2 5 ; 2 S S J f e 2010 -0-4-21 Mi-m 1013TË. 23d gfifSfem ,42s

15: 05 l g < J W l S M B I 2 ^ ^ 0 1 VW$

2010-03^22 03:17; S 8 & 2010-0-4-21 19 ; 4 7 v 5 ï l ï i e SOd léit ;Slm<'£s

2 010 - 03 - 2 2 O6;23;a5.:0TC ' 20 l o - q # 2 i 19 ; 4.7; 5 9 " W e ; 30d

•/iti.t••• l:'-: •• MSÎï l 'S i f f i -21 l 9 ; 4 î i - ; ! f i i m >

2 d l i 3 - 0 3 ^ & J3 : 21: iB.:13TC ' 8 0 1 0 - ^ 2 1 19: 47 X g y p ' 2bd j n y y g g g j

H m b : 0 7 T: ffififfi H u l s w n B < • i v

2 o i 0 - 0 3 - i f t 13; 55' 13TC ' 2 0 1 0 - î | f 2 1 19 ; 47 f ï g ^ ' e ; i à d - s t i ' î S f f i î - S f e

2 0 1 0 - 0 3 - l i 19;O6'.SS.0TC : 2010-0-4-21 19 ; 47; 39. ly'TC- 3Sd Bh-AÏf l î c ' ià i

2 0 1 .Ifi! 16 i S i ^ S j 19; 4 7 ; | ^ | g 3 P i 31m 5s

2010-03-22 . 0B-! 37? f l s B f e : 2010-0.4-21 19 dB&asBili SOd litMnfe&s

2 0 S 3 ; 0 4 Ig t i - jq - i^-s 1.19 ; .47

2 0 1 0 - 0 4 - S t 10:27;- '2010-0-4-21 19 ; - 4 7 ; i S à : # Î e • • i g

2 0 0 9 - 1 2 - & i l S ; O 4 ; l g : 0 T C ' 2 o i o - g^is- l 19 ; 4 7 1 4 l d 4h i 3 . i | £ p

S & i i O - S i - » ; t i i 5.4: mus& MSÎï l 'S i f f i -21 l 9 ; 4 i â f i i ' m >

i d l i j - o a ^ l f ; 2 1 : 1 6 : H i l i t c ' 2 0 1 0 - ^ 2 1 19.1 47;0[} :1

:UÏ&

•GJiljnt r y iRinfiry.^f^y.



ft - | - ; Google P I


Botlnstances: ¡ndew kui Q| Botlnstances: show M ] + F

fHerds l f Bo t s l ["Connected Bo t s l fBot T ype s ! [Mach ines] f lP Usages ! f coun t r i e s l fCommand Recu r rences ! ["Command Type s ! L o g g e d i n a s : 73BB2


For Herd Mv New Herd' ( Connected | [All] ) Displaying Botlnstances 1 - 30 of 3556 in total

S B o t I n s t a n c e Ho t T y p e Mac:h ine

I R | [ SSHZ l - BOGPMh l i i f e LHV f tOS l SVC iM r w j p f ^ . a ^ i S P i i H m ^ f i - i i i & F o v e M I R | r w j p f ^ .

2 • rXTHZ 1 - ICBJRfeTOCKlEH^SîtSsjaKlG 1+] XTNZ JCBJ fe&wi i i T^f tS i 'M 'B f l l t J i i 2 • 1+] XTNZ

a • i ^ T f e l - D H T ^ E O f e w M B W O l i l S I S l I [^ji'Sfrffi.. SFTTF-JE:I3WTIYFB®(IF6®'FII a • [^ji'Sfrffi..

4 m [ X T H Z l - F T ' i l D J Z H W W H H ^ G T V E l f f G [G+] XTFJB ' S f ' V i ' f f i j ^ f t i i ' f i l l f t S t V p V P i S 4 m [G+] XTFJB '

•5 ' H [ÎFRFFLE. •5 ' H [ÎFRFFLE.

6 E S&UKDHyTiS i f f iSMSHASi iYTL 6 E

7 S M X . T N Z S K j o L E i ' T Q O Z N K L D P i i v M Z 7 S M X . T N Z

a • i K T N Z ' l v F M W M T . i i t j & S S S t H L A U U H I P S B M I . . S'ffl i iffJ.TEtSViiltivSfeSBAUUH a • I P S B M I . .

9 R . - i i B B P D f t l S p i V t i ^ ^ ' S & F i : : M X I N Z j E f e B P D B E D P f i l S w b K i y H -9 R . M X I N Z

its " f t i ^ N Z l - W H o i i i j F T f f j S i W i O F ' R S S H |+1 its " f t |+1

1 1 " H ri M ; X T N Z K i i l b f J HPCH TSW i i Z t t tOPPR 1 1 " H M ; X T N Z

i i E r X T N Z l v D H A S Z j i S i R i t ^ B g K l Y l F T i i ' A 1+] i j g^g^ Vl iTA i i E 1+] i j g^g^

13 • I M K I N Z SOT-WiSpPCADOOMSVIV®®' 1 13 • I M K I N Z

1 4 • f aT N a S i 2 ® ® E F lilllRD i iZ S WJ1 IfSWS, ' ) |+] -KTNZ •/(f iSinSSJtBdieiSiSi i J i ffitSjS; 1 4 • ' ) |+] -KTNZ

I S R ; r^FNtzi IUE'WOT EO (IS F G:TII R D & M K I S R ;

16 E r XT NZL-S-SEISS B xJHt»i»ft\ ' GPSWJTT AGeSf f lMBSBS4V iS i iM .0P 'A 16 E ' GPSWJTT

17 T r S ^ i ® u t o 17 T

I B • 1+] XTNZ I B • 1+] XTNZ

19 T I r f e i S s ^ P [ j p r l ^plNc-P'a'RueiKOT.Biai it 'tr i 19 T I [ j p r l

2 0 E I f u j i ^ i , . ; 2 0 E I f u j i ^ i , . ;

2 1 r , r ^ l f + Z l ^ i N Y D M R i f t f t M S ^ B B E i f z P r»t XTNZ I NY iHSs i RROACS ' SBBD fep 2 1 r , r» t XTNZ

: E 1+] i j g^g^ UN : E 1+] i j g^g^

2 3 • r^ lwZ l - uGBCUWGTUBUNC -a^ i S t i P L I M X T N Z S S B M S T ' I ^ J N C U V B M O P L 2 3 • I M X T N Z

V4 E f XT n33kd F i ^ i W a S K e M t f K b c F i H U ' J+] -KTNZ V4 E ' J+] -KTNZ

2 5 R ; [ S f H Z l - f t S K E S g i i t i R P l L Y T P B D C i r j f f f M FTSHESSUURPIIIYTPBSO 2 5 R ; r j f f f M

26 E r x'T N z - C.T,V i M L s : ISS A N ' JFF XTNZ 26 E ' JFF XTNZ

• [s® -fenifc riUTANSCBIOMfteS-Mfefc. • [s® -fenifc

26 • (XTHZ l -PuUU l f f lT iaEBTTRJLIMJBAL I + ] XTNZ 'PCSfjUCEitDEDTYPJUI'TljBAL 26 • I + ] XTNZ

Previous « a » M B | r :

P a r I ' . l l j l :; < ;., ••:: -10Q.-< All

F i i 'v l1 Crt llf frti^kTii t'n i:

2010--03-1S 16

••' i i i IB

® S t l - S l 5 S £14

S l-.l 14 J : 20

3 & M ' 0 4 - a i so

2 0 1 0 - 0 4 - 0 1 20

>1.1 I I I) l i t

20 L M F F ®

•••iii r ••.' 13

| B p - 0 3 ? | g 2-1

2Zi.<:-:<!-22 10

20 1B"0.3t:27>C.1

•2010-03-2.9 10

•2010-03^22 03

2 010 - 03 - 2 2 06

•• 111 H :•:. 13

2 0 1 0 - 0 3 - 1 9 13

W & M M 19

2D i B ^ i M s s a s

:.:-r.i i s .;•.• OB

2D i f lôa^s i a s

2010 - 04 - 01 10

2009 -12 -&£ i s

» » - 8 3 * ® :.M

201O-O3n2 i 21

2 & H T C

3%0:TC

s i I T :

S&BT-&

S S w s

SSHSSJB

Ef t i i iTC

S3 501C

« A W E

J& . l i TC

2010404-

2010-04-

21 19

.2.1 19

i f f i - s a W C -

S f e s f l f e t g

2010 -04 -21 19:4B: 5-2,-UTe;

•201QS34-21 P t e f f i O B U B

2010-04-

2010-04-

21 19

21 19

H; ; E z . y f g ;

® S a ® g 4 - 2 1 jK®:

2010 -04 -21 19;4B: SB - FTC

"•gPlffHSM"

2 0 1 0 ^ 4 -

& 1 9

21 19 .iff; 17 L g p i

10 S f f c

S toCE j04 -E i t , i 9 : .43; IO.UTC

2010 -04 -21 19i-4B: flMSTC.

2010-04-

2010-04-

21 19

21 19

| « N L

§ § s s w g ;

• ®10Sff i4:-2l 19 ¡42 i S S S g i f e

2010-04-21 , i 9 i 47: B a m e : :

n i i i — i i i i i i «hxiummBi

2010-04-

2 0 1 0 ^ 1 -

21 19

21 19

4 7 i ; s g g j p

B 3 9 M L

2010 -04 -21 19:-47:-39.B i t

M M S H S I E I 1 9 : 4 » ® « ! ®

2010404-

2010-04-

21 19

21 19

W 5 S M ®

• ®10Sff i4:-2l 19 !4v!-i3B WTK-.'

2010-04-21 , 19: 47:-3CT«Te;

f i f i j i ilfn>:''

» d « t t t t f l h

i 9 d " sg t i v a s i : 46s

1J-.1 S H ? 14 -. J J Z

19d"52Fii;5SBtf|is

I2d S ' S i ' S -

i H Mfc tSSHSss

SSd ffliStei 1 9 s

i 'J.I g g F p p i ; 4 Q s

30d Tl •:.',? 3 :

S ® I ® ® m 37s

. J.I l r :h -'.-6-<- M

30d l i H i S

i W J f f l M l

26d S H ' f f l S i S H

.1 • <•• sps

3Sd feeiMISs

3 i d - ® 31m 55

30d l l f e i i& lw 'S&s

I41d 4 h : 4 3 W S § 5

30D i a m v f f l t *


C o u n t r y B i n a r y K e y

142d 14h 32m 56s


ù - I S | - j Google P I

M^.V'sited Getting Started S Latest

BoMnstannes: inde» lyj J hIilim M ] + F

fHerdsl fBots l ["Connected Bots! fBot Types! [Machines] riP Usages! fCountries! fCommand Recurrences! ["Command Types! Logged in a s : 73BB2


For Herd Mv New Herd' ( [Connected] | M ) Displaying Botlnstances 1 - 30 of 40 in total

: Previous 1 2 Next ;

[+] Bot : I r. 1 .i MI Bat T ypg Mach i ne

i • ! r » f É i ( 4 B T F j a f W 0 Ì ! F B M É W i 4 c i f l i + i y S E •OHTFjÉM&XÌ&NDMODÒNI i • i + i y S E

H • rSÌ te l - JERBPDBEDPl fKÙWDjUHH ESI XTNZ JpFIBPCl fet lPI r tBSMUHH H • ESI XTNZ

a • [+] M B :Obtóstì$tRiV KHKRZSÌfP<5C a • [+] M B

+ • i ~ ( p n i m m i n i t i P H I P + •

5 • W i ^ F M w j ^ i b F K ^ & N H S a f e - i W i M o f t i M F f S S i i ^ S M ì t ì 5 •

G • G •

7 • [+j XTNZ 4»H<i Stfeff l l f j ¿ t ì à é c F M Z-SH 7 • [+j XTNZ

8 • [+] feffiE itfi^ffiS'SîCìtìtiOlvIÉtóteD'W'f 8 • [+] feffiE

9 • t w T f ì a - f l ^ S t o ^ c S i S S ® « OPPR [jg 'jifewz LO i f f i HPéHTÔZ ' S tOPPR 9 • [jg 'jifewz

10 • [+] i S ® 0 H t&Z J M B R i Wffiftì M Kft fe i , 10 • [+] i S ®

11 • l i i f tósii ^ E X ^ f e i ^ ^ ^ jÌFÌD t ^ p m 11 •

12 • m m ? ! -JCBJRBI/ÌI,disili S H f ^ S B t ì N G 12 •

i a I l i rXTNZ : - lUSrtOtDÓiliOFGILARBS'tò1» (+] XTNZ i a I l i (+] XTNZ

14 • i p p p i 1 - MÌÈSN M B ^'yesSff lSSè® [+] yrN-z 14 • [+] yrN-z

IS n TST S a - W & S S M S S Ì M I « J P S WHi 11 r i l MRSSJÈaKU^fet lMUPXi i iÉà IS n r i l

I S • 'MtNZi-SkZ'JLZNÀZmktVKAOòSW. [+] XTNZ T i i K D T l S l S i i S i j N T . S i » ^ ^ IS • [+] XTNZ

17 • 5 0 Wgm 17 • 5 0 Wgm

10 • ! XTNZ i - INYÉWBVRROACÉS^pÌ ZP XTNZ INYDMRYRRdiÀCS"BtaSteP. 10 • XTNZ

19 • T S r S p i f e é L ^ S i S i S e i i dèi; tiiiiv UN [+] XTNZ 19 • [+] XTNZ

20 • w ffiiffij? :<:f'l(i;""J.i; VU:C TN 20 • w ffiiffij?

21 • iWf iZÊf i èHEBSIJURP ìLV tPS i ì o [+] XTNZ EtiSHÉS'SiÌÙRFl LYTPBDO 21 • [+] XTNZ

22;' • §Hj||§Sl - i p p p t e i ^ s ^ i l . [+] ¿ S t j g 22;' • [+] ¿ S t j g

23 Hi r iaHZl-DFFZ^' i Ìa i iGHZAàaKFhHIJ (+] XTNZ 'tlSÌZEiNZVJK£iHÌsSÌSi:FH& 23 Hi (+] XTNZ

2 4 • •ÌWMSl - e r a ™ P oKB t i s t ì s v W W w . [+] i t l t e T1v E M N I J SS sS s L ¿SÈso t r j 2 4 • [+] i t l t e

25 n [+ lg§S f i | 25 n [+ lg§S f i |

26 • [+] XTNZ POUOi|^TDEi3Ttiy.Uf«BAL 26 • [+] XTNZ

17 • [+] '¿ini 17 • [+] '¿ini

2B • rxT'Hzi-&SLii:iE,[jwè'À3D'iiVtw:iiiiQ'T XTNZ aSi itOBN w B-^sEig « LE QQGÌÌ 2B • XTNZ

F i rs t " I r i l l Im i T i ine Las t Ca l l b a ck T ime t r i l f : l i nn i

•2Q10-Q3-2ÌÌÌ4;-IM:I0 UTC-' 2&ÌI!it<34-2Ì i f fV io i iae iUTe i S t

'20ÌQ-33.-.27 l'3':'14:09 U t 13?. '^sd 6h .36m 20s

<®MÌEM-a i ÉSsSÉ M'i'tì'fe- S a i oh «foi iefe.

20 i0 -04-0 i ,20 :34: i i 6 UTC? |0JD-04-21 :;i.sa.'i'3ii ìemâs1

' 2 E Ì Ì M 4 - 0 Ì SSi'34:19 M S P M É 23+i lem ìos

; : : c - : i - l - : n 20:E2:EÌ UT® 201:0^64-21 a f i - S O ^ f f K . :l®.'2'2h .Si'mÌSJiiÌ;'

UTC: atì-ÌD-04-2Ì S ^ & à i IJT& ' 1 22h i-3m:+is.

i o i o - g s m m ® o r^^-B i ì i SS i . - i f t ?

2Q10-EÌ3-22 10:35:07 UT'C- ae-lD-04-21 S i ic i 9fi l i n i 9SI

UTg i H i 0 " ( i l 9 l " f W . 1 8 h 3ni <>Hs

B£:15:0S UTC- iM i i i i n i f i ' ì i i i d 42d i S s 3Sm i s

' a t ì i o - aà i i j^ S | 4 9 g g y 3 $ o - 0 li Ùé: a s c e t i B j i g H S

•2aiO-S3-22.S3:-:17i.B3 UTC: •20-1D -04-2 i': ì 04. Lit Si S d d ib l v i i i r a l l s .

1 0 1 0 - ¡ - S i ' ; o : 041

2Q10-B3-2§5f9:i29:10 UTC- ae-ÌO-04-21 1&"ÌB;04 Ut® i i - J Ì0h 20rfk-SÌÌi.

'•SP.10-SSr.2S 13:21; 48; UTCf. 2010^0.4^21 ì f liS.B 104 .JJT£ •2Sd oh 2ÌITI tó's.

i S M i S a W i i i i & ì ® : B ' i f i ' i i '1 •Sh.SÌfelrllÌÌS'.

10^03.-17 19:06:23:UTi3;i ]|BtJ Oh :43rn j^f.'

M l f i f t i a i à l f K à A s i . Wtm s f c f i M S i a s i i asm i ì s ,

'2O.ÌO-0Ì-3O 21:07:00 UTCii SB lB -04-21 'îa.aah

2010-04-01 1B;.27;41 UTC- iMi i i l i ì i l i i ' ì l l i ig:-49;.4£.UTO 2 Od 9\i

i i i p i p S i 0 B : U t ^ 2 010 - | S Ì l ^ Ì | 8 Ì Ì | i 8 ! i l l l ?

2Q10-S3-31 13I-04I41 UT'C- •20-1B -04-2 i': f9f-49 ! 44.-litSi ;:2:id bh 4sra.3s

15:04: l ^ W g i ; | o i ¡¿ '¿iSj i-. iii?.-; 1.0d:.'4h tÈr-

•2Q1O-O3-Igi06::i4:-£B UT'C-' ae-10'04-21 W K H , l f c i 8 ) f f V P d i-2tl

'•SOiO-ESÎ. 21;,a'B; 16 UTC?. 283,8^0.4^21Ì9 : '4.9 iSOif lTj i 'fO'D.22h :33ITÌ I H

B s f e t t ì i ^ S ' M ^ S i i S i i ì ' t ó S i S tà Men àSs.

?0 ioôt i ? : i i .9 /$a: 09 UT i i i | 0 j B -04-21 'J.:9 : "4.9 iSOiffT-p; '-29d 9h .S}m 2,1's

Coun t r y B ina ry Key



FT - 1 3 | - j Google P I


Botlnstances: inde» lyl Botlnstances: show 1 I | I fHerds l fBo ts l ["Connected Bots l fBot Types ! [Machines] l'IP Usages! f count r i es l fCommand Recur rences ! ["Command Types ! L o g g e d in a s : 73BB2


For Herd Mv New Herd' ( [Connected] | M ) Displaying Botlnstances 1 - 30 of 40 in total

P a r P a g e : ¿5 •.•¿p.-di ;100 < AH

F i r s t f a l l b a c k Talnes L a s t C a l l b a c k T i m e ¥ r i l f : l ¡un:

2 0 1 0 - S 3 - 2 ì i Ì 4 V t ì : 1 0 UT'C-

'2010-d3-.27 1'3: ¡14:09 UTiJ: gBJO'-04-2 ' ^ S d 6 h . 3 6 m 2 0 s

S l f f i t t ì à i ^ i i i S & f e É f i i ì M S a i oh « fo i icfe.

2010-04-01, 20:34:06 UTg: g010 -04 -21 m ^ ^ M ^ B i I S ^ f i 16m235

2 - .HMI4 J 1 26:34:19 I W 14.1 23+i l em ì o s

20.10-04-01, i0:S2:52 UTE:

•20l0-S3-22,- 'S l :3é;S? UTC a t ì - i o - o4 - 2 i S ^ & à i UT& » 1 22h i-3m:+7s.

g K H P S M f s p ^ l K z ^ f M P 1010 - 0 : r i%iffS5

2010 -03 -22 10:39:07 UT'C- ae-10-04-21 Soc i 9fi l ' i n i 9S-'

H i 0 " ( i l 9 l

ffiSSfcÈà B E ; i s ; o s UTC. iM i i i i i ì i f i ' ì i i i : i42d 14li 3Sm i s

S|££j331j$ljSi>1B : 49 0 - 0 :, 06;. i j ^

2010-S3-22..B3:-17i.S3 UT'C ao-j o - 04 -2 i': i 04. Lit Si l i d i - ien •ààm n s .

2tìÌJ3iiià;-22 Q.Sil^'l-Sct'U^E*-: 1010 - i i g È 0:04i

2010 -33 -23^9 :29 :10 UT'C- ae-10-04-21 i & " i B ; 0 4 u t ® i ì s i i O h 20rfk-S4s-

20.10-5^-26 r s ^ i ^ . u T . c : 2010^0.4^21 104 JJT£ •30d 6H 2i|ti Ì6'S.

a S ^ y y w i e a H

2010-03 -17 19:06:23:UT.S':: ]|BtJ Oh :43rn l ' i i

¿ ^ f i s s a r s i Sét i e i a i I n S a m m M B B S i a s i i aSwi i ì s ,

20.10-0^-30 21:07:09 U.T.e: 5010-0^-21 [QSBfffiii Ì 9 I W . 1

2010 -04 -01 10:27J,-41 UTC- iM i i i l i ì i f i ' ì l l i 19:49;.4£.UTO 2 Od 9h 22m: i s .

2 t ì ì o - S i - 2 2 o f ^ f ; 13 uf;^/ 2 010 - 3 0 C @ P &ÌTÌ.SÌ5

2010 -S3 -31 13:04:A1 UT'C- •20-10 - 04 -2 i': l:9f-49 ! 44.-li'fSi ;:2:id 6h 4Sm.3S'.

101 ¡¿ '¿¡5). i-.ifeiio.J 1.0d:.4h IÈS

2OlO-B3- lS i06:E4; : :Sa UT'C- s e - f e ' 04 -21 W K H , l f c i 8 ) f f V p d ia t i éStì:3Ì-E-

'20 l0-s^-;2| . 21; IS; 16 UTC! 203,0^6.4^2 Ì Ì 9 : '4.9 iSO i f lT j i '.F0,D.22h :33ITÌ

2010-03 -22 ID :GI :02 u t c S i S W Meti .à&$>.

201O-O372?:ÌI.9.;:-5BÌ09 UTK: | B J 0 - 0 4 - 2 1 : "4.9 i30:aT-p; '-29d 9h .5}m 2,1'S

9

10

11

12

i a

14

15

I S

17

10

19

20

21

32 .

2 a

2 4

25

2.0

n

20

[+]

a •

•

• •

•

c i

•

•

•

•

•

• •

•

•

Full: tn>.l:riiiiii;

m m

rXTHZ

TXTOB,

TXTNZ

f S B l Z

p f f i i E

TXTN-S

TXTNZ

TXTHZ

TXTMZ

m r S s

TXTHZ

TXTN-S

TXTNZ

rXTHZ

TXTMZ

rXTHZ

-JERBPDBEDPIYKOWDjUHH

-AFWIQMQQFKVKTZNMJDUC

-WHOBtgFYHjSMBGCFMZSH

-^GWaSBP t r fDBeWSV tTOW ' -

- lOKMHP f f iHTSWga t LS i PPR

•YWGCEFULROUZSWJIIFOC

ILICWOTDONOFGUAROSVOX

•CXIDTLZNAZJJNTVXAOJGW

-IMYDMRYRROACSSBBDTZP

-SESLQQPVIGGZVOKWIY J N

"EKSHESSIJURPILYTPBDO

OFFZDNZVJKCHZAOJXFHU

-CTVEMNPOOQQQLSV25UTJ

•P0UUC0TDEQTYPJUMJ3AL

-HCCRJFJJNWKUXjBrAUOH-

-OSLIuENWBASOUVLEUOGT

ftlltXy [4i; IVlrixiti ir i jj

e

i

i

[+

1 :

!+

[+

i s

[+

i s

XTNZ JERBPDBEDPIYKOWDJUHH

XTNZ i q ^ S B Y t R i Y a H K B a B T i P ^

ffTNZ " F T V I Q J Z M W ^ M G T g f e y P G

XTNZ -A RW iQMOQFKW TEN WJBUC-

XTNZ WHOBIGFYHJSMBGCFMZSH

XTNZ .wevw.ssT?paftDaqMewwDW.-

L ^ M m p e - H ' i a ^ ' z ' Q L o p p R

XTNZ Y WG CEFULRO UZS § f i ! IFOC

XTNZ lUCWOTDOMOFGUAROSVOX '

X-TNZ

XTWZ . « « W g M K M

XTNZ CXDTLZNAZJJNTVXAOJGW

XTMZ M M p M M ^ ^ f

INYBMRYRRQACSSBBDTZP

; • 5E5LQQPVIG6ZVOKWIYUN

X TNZ EKSHESSIJURPILYTPBDO

XTNZ DFFZDNZVJKi jHZAOJXFHLI

TNZ CTVEMtJPQOQOQLBYZSUTJ

XTNZ POUUCOTPEDTYRJUMJBAL

WC-CRJFJ3NWX-UKJB1AW:H

XTNZ OSLIOEIMiA/BASuUVLEUOGT


C o u n t r y B i n a r y K e y


Ü - C X Ú • i s l - J :-. P I

\ß] Most Visited # • Getting Started Latest Headlines

Q Botlnstances: edit ÉÜ | Ü ^Instances: show

fHerdsl fBots! ["Connected Bots l fBot Types ! [Machines] riP Usages! [Countries] fCommand Recurrences! fCommand Types] L o g g e d in a s : 73882

Editing Herd My New Herd7 < vi g •

Hot T v p e s ( © A n y OP I O N o r e O f ) Cu r r e n t l y In C o u n t r y ( A n y ) Cu r r e n t l y In Net b l o ck ( Any )

1 - e k o o s d Á É o t J y p e v Choose A Country v ( Add Nelblock |

I I K i ÂIÎSJ^ E v e r In C o u n t r y ( A n y ) H i s t o r i c a l l y In Me tb l o ck ( A n y )

i M a y Hand ¡ Choose A Country v ( Add Netblock |

I ¿ H S ! l l í . ' : I B o t I n s t a n c e s ( A n y ) Bo t I n s t a n c e s ( A n y )

( Add Bot Instance |



û - Iii 1 - ; Google PI tifi M^.Vßited Getting Started S Latest H e i l i g

Q BoMnstanizes: edil lyj Q ^nstàrçè?: slw;; a f ï 1 -

rHerdsl fBots l ["Connected Bots l fBot Types ! [Machines] riP Usages'! ["Countries] fCommand Recurrences'! fCommand Types] Logged in a s :

Editing Herd My New Herd7 < vi g •

Bo t Types ( © A n y Of | O N o n e O f ) C u r r e n t l y In C o u n t r y ( A n y ) Cu r r e n t l y In Net b l o ck ( Any )

Update and .., Choose A Bot Type v Choose A Country V I I Add Netblock 1

1 Stay Here 0 XTNZ -A-

1 View Herd ] H i s t o r i c a l l y In Ne t b l o c k ( A n y )

( Add Netblock |

1 View Connected Herd |

[ View Index j B o t I n s t a n c e s ( A n y )

( Add Bot Instance |

-

V


TOP SECRET//COMINT//REL USA, FVEY Fit Edit View History Bookmarks Tools Help

€ 1 e x ft • a l-j • :-• P| \£] Most Visited #• Getting Started Latest Headlines

Q Botlnstances: edit y j j Q Botlnstances: show

fHerdsl fBotsI ["Connected Botsl fBot Types! [Machines] riP Usages! ["Countries! fCommand Recurrences! fCommand Types! L o g g e d in as


Bot Types ( © A n y OF I O N o n e O f ) Cu r ren t l y In Coun t r y ( © A n y Of I O None Of ) Cur ren t l y In Ne tb lock ( Any )

-„' i,;- If tzt:^. . . 1 •e jwosdABotJype •» 'C'i 6 jrT'.r- V [ Add Netblock ]

I I H S H I S l S i i^l1®^ H is to r i ca l l y In Ne tb l ock ( Any )

| Mew Herd | E ve r In Coun t r y ( Any )

| Mew Herd | E ve r In Coun t r y ( Any ) | [ Add Netblock ]

M . Bat I n s t an ce s ( Any ) Bat I n s t an ce s ( Any )

|[ Add EotInstance |



- e x ft - a l - J

\£] Most Visited # • Getting Started Latest Headlines

Q Botlnstances: edit y j j Q Botlnstances: show

fHerdsl fBotsI [Connected Bots l fBot Types ! [Machines] f lP Usages! [Countries] fCommand Recurrences! fCommand Types ! L o g g e d in a s


Bo t T y p e s ( © A n y OF I O N o n e O f ) Cu r r e n t l y In C o u n t r y ( © A n y Of I O None Of ) Cu r r en t l y In Ne t b l o c k ( A n y )

1 • e jwo sdABo t J ype •» 'C'i 6 jrT'.r- V [ Add Netblock ]

I - ^ ' J i f f i S I S i i^l1®^ H i s t o r i c a l l y In N e t b l o c k ( Any )

| V iew Herd j E v e r In C o u n t r y ( A n y )

| V iew Herd j E v e r In C o u n t r y ( A n y ) | [ Add Netblock ]

M . Ba t I n s t a n c e s ( Any ) Ba t I n s t a n c e s ( Any )

|[ Add Eot Instance |

<



ù • acicBB ?;: P I


Botlnstances: ¡ndeK tyj BotInstances: show

THerdsl TBotsl [Connected Bots l TBot Types 1 [Mach ines! TIP Usages! r count r les l rCommand Recur rences ! rcommand Type s l

F o r H e r d M v N e w H e r d ' ( C o n n e c t e d 1 T A I I 1 )

D i s p l a y i n g B o t l n s t a n c e s 1 - 3 0 o f 1 6 5 5 i n t o t a l

« previous It ®SsiUtffitS5SlSS£... M f f i l ^ ® P a r P a g e : £5 £0 < 100 < AH

A L a g g e d in a s : &'§®S Ì5

C ¿ i ^ f i ^ ^ ^ ^ r ^ . 'Minute

[+] B o t I n s t a n c e flat T y p e M a c h i n e L a s t O b s e r v e d :t" F i r s t C a l l b a c k T i m e L a s t C a l l b a c k T i m e * L i f e t i m e C o u n t r y B i n a r y Key

V

1 • [XTNZ1 -OSK l SF'VLRÌXHKR2 V TPO C iS i ' jpSf iEÌ ODRiSFYLRYXHKRZVTPOC

L a s t O b s e r v e d :t"

2 0 - Ì M 4 r O t J K 1 5 UTC v ¿as A i ? • UTC 20d Oh-^Sirr-ife:

V

2 • [S iT f JZ l - JERBPDBEWffeS i 'M ja jWH ESI XTNZ J p R B P E f e D P i r k S S t M U H H


i ap IO-03- ÌCÌESg l4 i 09 UTC W B r l f S l i W P ^ Ì l J T i ? 25d oh f g j j f t / g g

V

a • r ' fÉÉ ' fo^jwW^.SSî?'' [+] M B


S & i & b S i t É M a M T i & t ì - t l w n l B i ^ d r a b n ^ l É É i f iho is& i - '&A?

V

4 • [ K Ì f j z i -^TF JgÈ^ fSSBH i SHO t i C i ' f l l ; ¡ j SH t JÈ tó lMÌ Ì Ì^HDMODONI


g | i i : c 4 4 : i o ¡JTG '."MÌO r V & i ) ; ,19: 5 6:: 2 "29,d 15h 12( t i ; l l S "

V

• [+] ;X'T%Z


• . f f i f e 04-3:1 19 : - SSL£4 l im ; S i d 22h:-4am(.4£s

V

6 • [STN ZI -ÓgBCU WG T UBUNCCf i/p i iWtj OGBCUtt iGTUfiUNCOVÉXGPL


2010 -03 -32 D9r37:13 UTC ' i M P - E i l t ^ E W c 30.d l l h IS:-..4Ci

V

1 • [ X T t j Z l - D F F Z t f e t ì j f e W S f t ó r f f f t ) [+j XTNZ DFÈàÈNZVJKÌ iHàs i i f eFh l Ì f


2 f l - i o - 03 r 3 i : l S f È4 ; 4 l UTC UTC edd 6h Elrrr 12s

V

8 • [+] feTfiE SÉSWÈ MN5ÓJOOQOI L SSStìOtTJ


| o 0 9 ' f l S P M S S - s ^ i l M t e K 3 8

V

9 • [-X'TfJzl - f i É L i nENWSAS ÌWVLEUnGT [jg 'jifewz •OSLI C ^ F E F ASTITI WFIISHÀIR


20- iO-03r2ÌSg:^È-!09 UTC •.-31330-04^1 19:-.E5:;3é''LÌTC 29d 9h S7m 2Ss-

V

1Q • [+] ¡ ¡ S B ^ é H K S S f D M P Z H S ^ È f a i & Ì ;


2010 - g p g g g p g 17 u t à 1 g2.d Sh l am 21s

V

11 • r XTU LBWL [+ ] XTNZ -WFMOPEWÌUHS-ZFMIBLSÌWI


zci:<':-K :JT -o u f c -.•sbaoô4 Jai:Ì9:-s5f38'LÌTc 22d 2h 22irf-£Ss

V

Ì ÌS • TÎTFETE^ ffl AS iS^j i^t ì iHK ì iE i j^SP; [+] ¿ S t j f r Ì V l j l ABFK^ 0 j cKB 'K i SSQ . 1


8 B ° " H P f i S 3 ! l 8 5 S S U S B Sp®4rrfg|gfJ

V

13 • r x n f z : ^ L ^ f f l i ' i c s L E i f E S i i i ù ' É (+] XTNZ . S 'EGIEI f f i - t ó ÌTLFYSVUE


2&ÌO-OSsàS' j ìà-ÌÌ l :OS UTC 22d Bh-4irr 17s

V

1 + • [+] mot x TO TDFESÈSITÌRMKIIÌÌISÌY


| | § 0 - ^ 2 9 5 ? ; 34:;Hif U f f }

V

I S • [ X T & I j S ^ T f r i l BSFDCIPRYISFÈSDGOÌÉJFISI


2 f l - io -03;àè ¿ 0 : 4 5 :-34 UTC •. -St ìSO-O^l 19: 43: S l ' L i TC 22d- Oh S7m l & i

V

16 • ÌS ÌWZL-MNPROSÙIMISFFI I Ì&ÈIFT ' ' ' [+ ] XTNZ PMINPRi jBL iaSfe iaÀWff i f iM:


; 2 0 L I I 0 3 - I I I } 7 ; 2 9 ; ' . 3 5 UTC ' : "43 :: a s • ,1-TT C SOd 12h 13.th'47£

V

17 • [ K T F I S ^ y ^ f e i ^ f i f e é ^ ' I S S G T ' 5 0 Wjjm "TLVO^ÉRMTLLBLVIQISSIIÈRL


S i A t ì s J i S s f e t ó - U F L j j B M a l P f t i t e ì i S W l É É SSd ah I w t i j a n

V

I S • . i s ™ z i - v z A i w s n a A a y p a g t i y a e XTNZ "ÌM 7, ArHEfÈDBSdiÌAZGtìÉlA^fé..


2010-03'-22fÌÌ9 : ÌLI 26 UTC agd 9h 4a;!ti'-so'i

V

19 • [ ' " " J l i •• • trM-L-l* [+ ] XTNZ M I W W ^ S B T U 1 . I J


SÈ-Mi-BiiitÉÌB iffi: l £ : È Ì 4 JTB l i d Oh-E ' ind ls

V

2 0 • [ S T N Z l - X i t ó D L l H Z S Z W V B O M K H T f t w ffiiffij? XLDIZÉJUHZS^WYBUMKHTF


2 0 I O - 0 3 - S S 5 3 r . l 4 : Ì 9 UTC •MiÔ^.Ì. I S ! ® R P W C 2E.d 6h lrti 4Ss

V

2 1 • r XTU z i S ^ f f i Ó ì A L L W À R Ì C T H I E M [+ ] XTNZ SVFEKUJAÌ^WKÌOCTHELSA


2 C Ì : - c : - £ £ •:•: i s ; i 2 u f c M d 9h E4irf;S0s

V

• [+] ¿ S t j g ' B SS t l P i S^^ W i S U M ì i i a S E


;éoi o-SSPSSNiiÌSfc2 tt I IS® B B r o P " i u t T ' n T f i '

V

2 3 L i i KT t j z ì - G j p D p a a M ì i i B y i i à i f t e S s c (+] XTNZ •IMDFSZHMÌB-ÌSO[RCÉÌ<£


2O-iO-O3TÌÈ:ir0::'64::43 UTC UTC 22d l l h 2 m l i s

V

tl.4- • I^FIIASTIIÙII^ SÉSBS LISSBPFFFESESFC [+] i t l t e


:0 J 4 R A f f i WhS f t i 4 1g '

V

2 5 • [XTNZ! - L U ^ W W S T C I L D H O È Z A © M ^ S S É l UWe -WNSTè l LDHS 'WZÀn


20 ÌB - :D3 -2 Ì ' f l 9 i l 8 ; B ® S ^ K H - .• i tó f tss ' ' UTC 2Sel 911-i(SFrr-£6E

V

2 6 • ÌXTNZl-NBajJNFLTJS^SGJLFGMB©., [+] XTNZ NSGjaff f i£TJSÀ^GJFGMD&


2 c i : - C ! - c r UTC - M i & ^ l ^ . T I S F L ^ 44 UTC 22d 21h 29LS;jlSs

V

f t • [+ ] '¿ini M H & J W ' - ' l ¡ Ì W I B K W


SIATÌRTITSLT !ÌLITÌFC3Ì-'UTL M B r o h ' i f r i B i l t i i M & i B t l É É

V 2B • T i fT f j z : f B B m p W M * » ^ 1 ) a f l B B f ò XTNZ r^ - i ì j p^WKZMv^ i ì ' A f j a f ì i i z


;2OIO-03--AI;;I4:03:-II7 UTC i l d 4h so.m 4ps V



0 - c x • L £ ] Most Visited Getting Started Latest Headlines

Botlnstances: ¡ndew Q Botlnstances: show

fHerds l fBo ts l ["Connected Bots l fBot Types ! [Machines] riP Usages! [Countr ies] fCommand Recur rences ! fCommand Types !



P revi 0 u J!...,. iBIÈ 56" Next at P a r y.Mjl:: • :. "„'.I; 10 0 < All

[+] B o t I n s t a n c e flat T y p e M a c h i n e L a s t O b s e r v e d IP F i r s t C a l l b a c k T i m e La s t C a l l b a c k T i m e T L i f e t i m e C o u n t r y B i n a r y Kev

1 • [XTNZ l -ÖÖK1SF'YLRÌXHi iRZV TPO C r+i y ^ E ODRÌ^YLRYXHLRZVTPOC 2 C i : - C - - c : « i f UTC 7::-' 17 ' LlTC 20d 0i i-4Sirr-£fe:

2 • [8TNZl-JERBPDBE [>PlSf i®MMlJWH ESI XTNZ JpRBPCt feDPIYköS lUUHH 2010-03-'2Ì;;Ì1&Ì:14:09 UTj3 W B r l f S l i W P ^ Ì l J T i ? 25d oh f g j j f t / g g

a • r ' fÉÉ ' [+ ] W » ; i f f i f i s ' i s ^ ^ i f Ä i S & i i ä s f f i i f iho i s&i - '&A?

4 0 [K i f j Z l - äÄTF JgÖ^ fSSBHäHOÜC i ' f l l ; r * - t # f w z ÔH t j l E j SS f j j^SNDHnDnNI ; 2 0 1 0 - 0 3 J g ^ 4 : 44:10 UTC ' ."Mìo r V & i ) ; 6:2 l i i t C ' '29.d 15h 12( t i ; l l S "

1 0 [+1 ;H'T%Z È 0 Ì # i 0 3 r J Ì i M e ? i O 9 - U + S S i d 22h:-4arnt-4££

6 0 iSTN 21 -<pBCß WG T U B U N C C ß / p i K Ä ES fflMS OGBCUVilGTUtìUNfit iVÈXOPL 2010 -03 -S f f l ' g r 37 :13 UTA ' i M P - E i l t ^ . 1 . ^ E i f S g W c 30.d l l h 13:-.-tCi

1 H [ X T t j Z l - D F F Z ^ Z Ì j f e W z ^ r f f f t i [ + j XTNZ DFÈZ[SNZVJK6HZSMÌF|Ì ÌJ 2 0 - 10 - 0 3 r 3 B ì S f É 4 ; 4 l UTC 2dd 6h Elrrr 12s

8 • iSTt feÄ .TWEiv l IMf l 'B l^ iöSi i& ' i ^ge iS 1 [+] SvTNE 'SS1« E MN5ÖJOOQOI L SSgS'Qfrj go 0 9 - S^^SJt&i f i ' l : U f g ' f l H P W S S - s ^ i l M t e K 3 8

9 • [-Ä'TfJzl - öÖL i nENWßAS iÄ i V LEUnGT [jg 'jjfrwz S LI Ctèwfei SWSiiS WÌitiSétGT 2 0 1 0 - 0 3 r 2 ; £ & . 5 6 : 0 9 UTC 19:-E5:;äÖ''LiTC 29d 9h S7m 2Ss-

1Q • [+i ¡ s ® ^ P H K S S f D M P Z H S ^ i i a i E l i ; S M 0 - OSiäß; %36:17 U | g u t à 1 g2.d Sh l am E l s

1 1 • r XTU LBWL [+1 XTNZ -WFMOPEWÌUHS--ZFMIBLBÌWL 201üt03"3(3 :i?;ä2;-4o UTC vSÒ'SC^b4J2!Ì':Ì9:-35f38'LÌTC 22d 2h 22 i r r£Ss

§g£ O [+1 Ä ' L j l A B F K ^ 0 j j3KB'ÜiSßQ. : p S t o - t ì i p C ì I S I ^ i i i i o UlSä I M t ^ n t j K ^

13 • r x n f z : ^ L ^ s i t c s L E i f E ^ i i à ' É (+] XTNZ . Ä ' E G I E K Ä M T L F Y A V U E • m J::-'» • • I I UTC 22d 6h-4irr 17s

1 + • [+i m m x TO TDfeSÈSIt ì rMki i ì Ì is ìy g f l S o - ^ - 2 9 ^ 1 3 4 : t j | f j f f g l l j g

I S 0 [ X T & I - |8É§ j S ^ T f b S F D C i P R Y i S f è s D G o i É j t ì S i 2 0 1 0 - 0 3 i à È i iD:45:34 UTC • . -äÜäO-O'^ l 19: 43:51'ÜTC 22d- Oil 57m 17£i

16 o ¡ X™Z I - PM INPRJBL IEXAOAWWYDN ' [+ ] XTNZ PMINPRüBLiaSfeßÄW.®&ßW: 2 0 l i J i Ö 3 - ^ a i ; 29;-35 UTC SOd 12h 13.th'47£

17 0 I i i ] Wgjm " t i v O ^ f i R M i i l b i v i o i s ä i ö R L S - i S i f t S t Ü Ä ü f l j j B M a l P f t i t e ì i S W l É É S i d ah i w t i a h

JG • '..IS-TN ZI - VZÄI tJfÊiifeaÔÌfiiHIfMftì" XTNZ "TM 7, ArHGfÈDBS&ÌiiiZGtìtlÀ^fé. 2010-03- - i 2 09:31:26 UT;G aod 9h

19 o [+ ] XTNZ B p f f l T a m i r B i s : I n H i S f c ' i i i ^ i - t e t - s a ^ i ö ä Ä l i d Oh-E ' ind ls

20 0 [ STNZ l - X i C f l i DÜHZSZWVBÜMKHT f t w ffilffij? XLDIZÉJUHZS^WYBUMKHTF 2oi0-03-äs;:ä '3r . l4:29 UTC •Miä'O^ß.i. ¡ I f t l ® r P W C 2E.d 6h lrti tes

21 o r XTU ä i p H S S k u M R Ì C T H I E M [+1 XTNZ SV f eKU JA i^WÄTOCTH i l S a 201ÖT03--22:FL9-; 18:12 UTC vS&3C^b4J2!Ì':Ì'9;--Ì2:;42'LÌTC 30d 9h l^rc f f l S s

0 T^ i t f e l^D l^äP ' eÄ - F i v p JnHa ^ f âg ' ' [+1 ' B ^ t f P ^ j ^ w Ä Ä ä ä ö S B GÖITO - ^ t p p p u i ^ S : 31$ ÜLÄÄ B B R O W I "1U IT T ' N T F I ' § | § ••Si}

2 3 L i ÌXTfjZÌ (+] XTNZ • l i B D F S ^ S i B Ì S ' O I R C É X e 2010-03- ÌéSèS :: '64 :43 UTC UTC 22d l l h 2 m l i s

tl.4- O F Ä I Ä A I I Ü I ® S6@BS LSÌPHVAFHCJH [+] yfN-z "OtWXYEOOSL^FHVAFHCjH g g t p - G g O l g g ^ : 0 J 4 S m WhSfD 41G'

25 0 rXTNZ! - l Ü ^ Ö Y W S T C I L D H ö ä / Z A O lUWe-WNSTèlLDHS'WZÀn 2 0 i e - : D 3 " 2 3 i M 4 8 ; S UTC - . • i tó f tss ' ' L i te 2Sel 9H-i(SFrr-E6E

2 6 0 iSiMZl-NBiSJJNFLTJS^BGlFGMßO.. [+ ] XTNZ NSGjafffi£TJSÄ^GJFGMD& - M i & ^ l ^ . t i K f l a ; 44 UTC 22d 21h 29lS;j l8s

f t p [+1 Y < i m ® - i S i t ì r t t S l a i m f l M B r o h ' i f r i S i l t i i B & i B t l É É

2B • TÄTfjz • f B B m p w M * » ^ 1 ) XTNZ 2oi0-03--à5.' : ; i.4 :03:-i7 UTC 2 l d 4h so.m 40s'


3

L o g g e d in a s :


0 - c x • : _ J

MsSS.VHtsd Getting 5tartsd Latest He^djuip!

ôtlnstarKes: inde» |yj ^ Bciipstarce?: slw?;

Ù ' • «Se

fHerds l fBo ts l ["Connected Bots l fBot Types ! [Machines] riP Usages! f count r i es l fCommand Recur rences ! ["Command Types ! L o g g e d in a s : ^ ^ ^ ^



1 Flat T y p g M a c h i n e s! lc~-lMmt h^t^ With .. Flat T y p g M a c h i n e

1 B&t L _ i " 3n r r : i K t t Z ' i ' t W i i 1+1 j f t l i g S 8 m S B L R V XHKRZ VTPOC 1 B&t L _ i " 3n r r : 1+1 j f t l i g

2 Bat Tvp^r ffiMitO®^ ESI XTNZ j p R B P C l f e t l P i r k B S M U H H 2 Bat Tvp^r ESI XTNZ

a . CW ih i l V 'H&E IP [+] 'W-mz. i u b w ^ S w i S l ù s É S S i S f a . CW ih i l V 'H&E IP [+] 'W-mz.

4 BNDMODQNI |>Rt#TNZ i t ìH t f l l S f t i VWFSNDHnDOWI 4 |>Rt#TNZ

5 Q R B N a f f # sv 5 rt i r rént iv In i~ótjritiv

Q R B N a f f # sv 5 rt i r rént iv In i~ótjritiv

e r t i r rént iv In i~ótjritiv

J H ® S i ^ O P L -JCÌZ tMi&t U Ì - t W f i M K Ó P L e Ever l ivCcrunirv

J H ® S i ^ O P L -JCÌZ tMi&t U Ì - t W f i M K Ó P L e Ever l ivCcrunirv

7 Ever l ivCcrunirv

[+j XTNZ 7 [+j XTNZ

8 M U I H U R [+] X-fNg JTSW ÈMN HKWSEI L SSKCFFII 8 [+] X-fNg

9 • [-X'TfJzl - e É L i n E N W S A S i i i V L E U n G T •OSLI C ^ & l i S t ì U V Ì i ' i Ì ^ t G i r

]Q • [+] i S ®

11 • [ X I I & R i M B p ^ H S & i LB WL -WFMOPÌEWfeHSéFMIBliSiff l i . 11 •

§g£ • Tît fete^ ffl AS iS^j i^t ì iHK ì iE i j^SP; [+]

13 • [ KTSZ : yL ' i SS i tCGLE i T l i S r i V UE (+] XTNZ .S tÉ 'EG lEI f f i LEnLFYSVUE 13 • (+] XTNZ

14 • 1+1 mat x TO TDFESÈSITÌRMKIIÌÌISÌY

I S • [ X T & I j S ^ T f b S F D D P R Y i S f è s D G o i É j f j S i

16 • ' v i a i N r i H i a N P R i W E a a i a i s w ì S i w i r 1 [+1 XTNZ P M I N W O B U E K A O A W W Y B N 16 • [+1 XTNZ

17 • r + i f i l i ; "ÓVO^ÉRMTLLTILVIQISSIIÈRL

I S • .t-s™ z i - 1 v z a i w s n a A a y p a g t i y a e XTNZ "7, ArHEfÈDB£6Ìi!iZGtìtlÀ^(É-

19 • [: • / S B j i B s . r - j - 5 [+ ] XTNZ 19 • [+ ] XTNZ

20 • 'VtSttMZI w ffiiffij? Xîta i5 'U l3 iS?WYBUMKHTF 20 • w ffiiffij?

21 • r XTU 8 I P I S 8 K L I J M T S È T H I E M [+1 XTNZ S i f e KU JA i^WKTOCTHE l S a

• [+] ¿ S t j g ' B SS t l P i S^^ w i i U M ì i i a S E

2 3 L i i K T f j z i - G j p D p a a M ì i i E y i i à i f t e S s c (+] XTNZ •IMDFSZHMÌB-ÌSO[RCÉÌ<£

W-M • [ ^ H t ì a i a j i ® s 6 @ b s liSSBpfffeSesfc [+] ffTNZ OBéXYEOQSL ' . /FHVAFHCjH

2 5 • [XTNZ! - l U ^ W W S T C I L D H o i / Z A © lUWe-WNSTè l LDHS 'WZÀn

2 6 • ÌXTNZl -NBajJNFLTJS^SGlFGME©., [+1 XTNZ NSGJJtffiETJSA^GJFGMDffi:

f t • [+1 X'THZ '•È AFavS fe f JY HJRKB0a-HWti f t • [+1 X'THZ

2B • TifTf jz • f B B m p w M * » ^ 1 ) X B B B f ò XTNZ r^ - i ì j p^WKZMV^ i ì ' i f j a f ì i i z

; previous 1 2 - 3 4 5 6 7 8 9.. S M i B : P a r I'.!•_;!:: - i "„'.I; -10a-< All

F i r s t C a l l b a c k T i m e L a s t C a l l b a c k T i m e * L i f e t i m e C o u n t r y B i n a r y Keu

2 0 i i M i 4 r 0 i J K 1 5 UTC v i d s ;-£ 7 i 17 ' ÌJTC 20d 0Ti-4Sirr-£fe:

i ap IO-03- ÌCÌESg l4 i 09 UTC W B r l f S l i W P ^ Ì l J T i ? 25d oh f g j j f t / g g

S & i & b S i t É M a M T i & t ì - t l w n l B i ^ d r a b n ^ l É É i f iho is& i - '&A?

g | 1 1 : C-.;;:',;.'. 44: i o UTC ' . "Mìa r V & i ) ; ,19: 5 6:: 2 i | | 3 | | '29.d 15h 12( t i ; l l S "

• . f f i f e 04-3:1 19:-3SL£4.Lim; S i d 22h:-4arnt-4££

2010 -03 -32 D9r37:13 UTC ' i . i ì p - ' f l t ^ H M 5 30.d l l h 18rtl:4C^'

2 f l - i o - 03 r 3 i : l S f È4 ; 4 l UTC UTC edd 6h Elrrr 12s

| o 0 9 , t ( fg 'flSPMSS-sîlMteK38

20 ÌO -03 r2 ÌS s Ì 3È - ! 09 UTC •.-31330-04^1 19:-.E5:;3é''LÌTC 29d 9h S7m 2 9 s

2010 - g p g g g p g 17 U t S 1 g2.d sh l am 2 i s

2CÌ:<':-K :J7 32 ••:> UTC -.•Sba0404 JaÌ':Ì9:35f38' l iTC 22d 2h i^ i r f S S s

8 B ° " H P f i S 3 ! l 8 5 S S U S B I M t ^ n t j K ^

20 ÌO -O3 t i ( i É1- ' Ì1:0E UTC 22d 6h-4irr 17s

0 - ^ 2 9 5 ? : t i f f }

20 - Ì0 ' 03 ;àè :ÌD:4S: 34 UTC • . S t ìM -Oè^ l 19: 43: 31'LÌTC 22d- Oh S7m 17£i

; 2 0 l i i 03 - i i i } 7 ; 2 9 ; ' . 3 5 UTC 43:;;2B',UTC SOd 12h 13.th'47£

S i A t ì s J i S s f e t ó - u f l j j M B M w l P f t i t e ì i S M K l É É SSd ah I w t i a h

;S0ID-03--2;if lg:S'L:26 UTC agd 9h 4a;!ti'-so'i

R g ^ y i ' j s ^ w i i '. sSg f i jH I l i d 0h-E ' in: l l£

2 0 I O - 0 3 - S S 5 3 r . l 4 : Ì 9 UTf l • M i ^ O ^ . Ì . i l f f i f r P W C '2E.d 6h lrti 4Ss

2ÙÌ0-€3'22'09:18:12 UTC vStja0404 Jai ':Ì '9;-- iS;42' l iTC 30d 9h E:4irf;S0s

g^ t o - S f S S D Ì ® ^ 2 W i i P B B r o P " i u t T ' n T f i ' ••Si}

2O-iO-O3tÌÈ:ir0::'h]4::43 UTC UTC 22d l l h 2 m l i s

: 0 1 - S i ulijji1 H H l l l 4 I S

20- iB- :D3-2Ì ' f l9 i l8 ; Ì34Ì-TC ^ K H - .• i tó f tss ' ' UTC 29el 9H-4SFrr £6E

2 c i : - c ! - 2 c UTC - M i & ^ f ^ . i K f l a ; 44 UTC '2'2d 21h 29lS;jl8s

S i A t ì r t i t S l t i i l i t ì f c a i - ' U T l M B r o h ì f r i B i l t i i M & i B t l É É

;SOID-03--'3i;;i4:03:-Ì7 UTC i l d 4h so.m 40s



p - C X . l |

'[¿} Most Visited Getting Started Latest Headlines

Ù_ zi r ! l ' -Google

Botlnstances: ¡ndew Igjj Botlnstances: show

I" Herds! fBo t s l [Connec ted Bo t s l fBot T y p e s l [Mach ines] riP Usages ! [Coj jntnes] I" Command Recu r rences ! [Command Type s ! L o g g e d in a s : 73BB2

U Refresh Every Minute

For Herd Mv New Herd' ( Connected j [All] ) Displaying Botlnstances I - 30 of 1655 in total

S o t I n s t a n c e &ot T y p e M a c h i n e L

I • [SrtNZl-ODKISWtM^lffiEVTRiJC CEKlSFYLR'fXHKRZÌrtPOC- 1

% • rSfNZl-StìftàPCl&EDPIYIÌDWDJVHH ' K^'XTNZ JERBPDBEOPlYiSJi^lfljUlMffi 1

3 ¡ 3 [ M H Ì M B Ì Ì M B Ì B X K MTUI Z

m I^TiìIZl-QHTRJEBWjJiiFBNqiMOD^fJl g$»KTNZ- 'iWtF3Eb®S'FBtìDMQGLqiilt. 1

1 ^ 1 H fefXTNZ SpfN£SÉRUfeIfiSiiBWCBf:Ì'f 1

6 H [KfNZl-OCBCy.WGTUBUMCOVEXEipL ] Ì B :bGBCIJ®i3TIJ!llJHCOVS:^0Ì5L 1

i a I - I - DFFZeNZvk-ófSA'étSSFtìlJ 1

.3 • W g a t s a g «a? jgwwBa(aw6t t t i asaM& Il

'8 • [SÉM21-®flEI0ÉÌJWBABQU1/LE0QST [ l i t ' x i y z ÓSLIQENWBAB^JLEUÌSGT

ID • Ì ^ ^ ^ W H S O ^ P C D T a p g H S A D S ' ^ gi f ffTtjg UUPHÉOÓflCEJMPÉlìSACtìOI,

11 • ik^NZl^WFMC'PEKFUfeZFMIBLBWL K KITE W FIHÈPEKFUH^FÌWI B LB-WL

12 ' • !'XfNZl-<iLNABRMD203QKBK(JZDIÌ iSfiBfiiE'1 ^ Ul J

13 • i»* : l 'i,- NLE'ÌÈIEXSLE i M H b $ Uff

1 + • W B | r a p XTOTDFKIZELINKOIÌLVW

15 • [JfCHa^ÌÌtìFDDPPYCf<Fj<GDGOAHH%. i S i i S i § HOFDDPFTVCKFKQOGOIIFITÌTE

16 • iS?l\IZl-F!M[faPtìOBt.IEÌÌffSÀ1®WYON B I S Ì S 5 PM]NPROBtIESSe»:W»VDN

Vl. p rS^^-L^&ISUeRMTLDUJ^tìtiSHL P I »

10 • E I K U J Z VZAlHéfiMSQiezGHMAtai

l g • M r i > •MMTéYcyttóeiÌ imEMafe-

2 0 • [Kf NZI'^XLD IZDU HZS ZWYBUttffi;H"R F XLDIZDIRUZSZWI/SGHKHTF

2 1 • IK^HZI-SYBKWJÀLJLIRTFITS-GTFLLE® K KITE

•sz" • iSfiBfiiE'1

2 3 • rsfttai-GjPDFÉaHi&Sf'Guifidèàs: i»* : l 'i,- GJPnfezBklBViJQfRGBÌiI

• ( K M S P P S P ^ . SS&ISLVF HVAFHCJH ,*' i . UBiSSVEé^lStfHVS'PHÉJH-

2 5 • [SÌENZL-IU\A!CÌYNSTEILD!HOWZAC5 feTfe ] UWCJVN STC ILDHOW'ZÌS

2 6 • FL#NRP»SU NFLT:SFIS:AJ'F GMHCÌ ' >,* : T'iz MBGJJNFLTJS'ASEJFGMtìt)

.y'jt. • r^ t ì^ ' ^ t ó j y S i i È t ì v f f l M i i B H w t j - FTF XTNZ DÀris^tLrfyHJRIiBDBRBftÌ .y'jt. • FTF XTNZ

a a • rSfrizi-iÈS< i r iD?i&S2twot A f t ó x t a [+ ] XTMZ T'BFIHLDXVFE ZM VIJT ÀtfffiÌL-Z

i B M H S S ' " ! # 3 I B . . I BB-J&Went Per P a g a : ¿¿-TI LDD -<-AU



P I

Movis i ted ^ Getting Started ¡ f i Latest

Q BotlnstarKes: edit lyj Q >F.L.;"' a [ 4 I -

fHerdsl fBots l ["Connected Bots l fBot Types ! [Machines] l'IP Usages! fCountr ies! fCommand Recurrences! ["Command Types !

Editing Herd My New Herd7 « j m •

1 -•SlgytfejS B

'View;H'erd

tìot T y p e s C © A n y OF I O N a n e O t y

;ÉÌK!QsdASft iType v

H i f f i S S i

C u r r e n t l y In C o u n t r y ( © A n y O f l O N o n e O f )

C'iciQ:= E.A'-Ì- Jì; ti.'- y

E v e r In C o u n t r y ( A n y )

Cu r r en t l y In N e t b l o c k ( A n y )

| | L^dd I !•••:. .

I-Ustori GjJlly In N e t b l o c k ( Any )

I I [ A d d N&'b!uck

Bu t I n s t a n c e s ( © A n y Of | O l i a n e O F )

1 [Ad i i f i s l . l f iS tape i 0

@ t x t r i z H u i

0 B W ^ B ^ E ^ I f i i ^ M S ^ ^ ^ E i .

0 fej.NZ] -DFFZ&N2S3Rt ìH2 : SQWHU.


L o g g e d in asz. ' feees


Its* * e x tè 'j3 ft - | I « - Google


Botlnstances: inde» y i Q Botlnstances: show R

fHerds l fBotsI ["Connected Bo t s l fBot T ype s ! [Mach ines] r iP Usages'! f coun t r i e s l fCommand Recu r rences ! fCommand Types ] L o g g e d i n a s : 73882


For Herd Mv New Herd' ( Connected | [All] ) Displaying all 5 Botlnstances

[+] n o t I n s t a n c e a a t T y p e M a c h i n e L a s t O b s e r v e d IP F i r s t C a l l b a c k T i m e L a s t C a l l b a c k T i m e r L i f e t i m e C o u n t r y B i n a r y K e v

ì n r x T r i z i - I È ^ ^ T S Ò T Ì C I ' G i j ' s R C S T O ' X F J J X T N Z I S y i f e T D O N Ò f S S S i B O è t ó M


£0 l O ^ Ì f e S - O à j> 17;S3 i i ÌTG • £010-&$-£- l 20:00: '30:IJ tC •50fl :I!S|:'42fn- Ì J S . f c t ' PK

2 n I K ^ S W M ^ ^ H W I ÌÌPHiIBSSRU.aitiaB&WEfflWl


^ s t i f p 3 f S E ® : w ' P ? u T c g t f f i 0 "D4 -g i 20:00: 00 UTC [+] EE

a • , I I I S I Z ÓSf lCUWÈTUBUBCOVÈ's fc ip t


£ 0 : ' 3 7 : i Ì ^ i i T e £010 7 D f c21 L B : ' ^ ! | L G § G S ¡U„ 1 i-*'.. ri 46S l l S f f l ,

4 • r K I N Z l - D F - F Z D W S / i f i S H Z A O J S F m . | + ] XTNZ ©FFZDfJZV3KOMSAi32KFHU


J 0 lO- f fgsJA 13 ; 04; 4 Ì Ì2 Ì0K 2010 -34 -21 15:39:39 UTC f i ! EK

5 •


S . ' T ' V ' i y jì/-1'-^.-,-! • S t M s f l S . L & M I S I S ' T ^ R i M i i l i [+] 8 &



j y * 1 c x ^ ft • a- p

L £ ] Most Visited Getting Started Latest Headlines

Q Botlnstances: indew kjl Q Botlnstances: show + | -

fHerdsl fBots l ["Connected Bots l fBot Types ! [Machines] f lP Usages! ["Countries! fCommand Recurrences! fCommand Types ! L o g g e d in a s : 73882

Listing CommandRecurrences New Command Recurrence

Ed i t E r a s e

C Dirwalk Erase

demo for bob Erase

Get Process Info Erese

GetProc2 Erase

more dirwalks Erase

More dwalks Erase

more dwalks 2 Erase

Mew Command Recurrence



i| i - c x • ft- i Google PI L £ J Most Visited Getting Started Latest Headline*

| "I Botlnstances: new Itjl Q Botlnstances: show Ml* f"

fHe rds l fBotsI [ Connec t ed Bo t s l fBot T y p e s ! [Mach ines ] f lP U sages ! [Countr ies] fCommand Recu r r en ce s ! r c ommand Types ] L o g g e d i n a s : 73882

New Command Recurrence

M a i n e

C o m m a n d T y p e

| — Select Comma id .Type — v

H e r d

| — Select Herd —

| • :'.V:.-|-: fl



- e x * H E ] 1 3

L £ ] Most Visited Getting Started Latest Headline*

Q Botlnstances: new fcjl Q Botlnstances: show

fHerds l fBotsI ["Connected Bo t s l fBot T y p e s ! [Mach ines ] r iP U sages ! [Countr ies] fCommand Recu r r en ce s ! r c ommand Types ] L o g g e d i n a s : 73882


N a m e

|Dirwalks F T W [


— Select Command Type — j v

— Select Command Type — G e l D H W a k GelProclnfo



m * c x & ft -| | a - Google


Botlnstances: new y i |_] Botlnstances: show r ?

fHerdsl fBotsI ["Connected Botsl fBot Types! [Machines] riP Usages! ["Countries] fCommand Recurrences! fCommand Types] Logged in a s : 73882


Mame

|Dirwalks FTvY


| G e t D i r W a l k

H e r d

M y N e w H e r d

i p a k i n e t b l o c k

I p a k i i r t n z

; S o m e A w e s o m e H e r d



fc- i Google PI LA] Most Visited Getting Started . Latest Headlines

Q Botlnstances: edit lui j Q] Botlnstances: show y I --- 1 1

fHerdsl fBots l [Connected Bots l fBot Types ! [Machines] l'IP Usages! [Countries] fCommand Recurrences! [Command Types!

CommandRecurrerce was successfu l ly created.

L o g g e d in a s : 73882

Editing Command Recurrence TDirwalks FTWr

R e c u r r e n c e N a m e C o m m a n d Type N a m e H e r d N a m e

lH| I My New Herd v | Dirwalks F W I GetDirWalk

E a r l i e s t E x e c u t i o n T i m e L a t e s t E x e c u t i o n T i m e

[Yes v

Yes v

C y c l e C o m m a n d s ?

B r o a d c a s t C o m m a n d s ?

M a x i m u m To ta l E x e c u t i o n s F o r He rd

M a x i m u m To ta l E x e c u t i o n s P e r Bot

M a x i m u m C o n c u r r e n t E x e c u t i o n s F o r H e r d

M a x i m u m C o n c u r r e n t E x e c u t i o n s P e r Bo t

De l ay I n t e r v a l F o r H e r d ( s e c o n d s )

De l ay I n t e r v a l F o r Bot ( s e c o n d s )

Update ] [ update And Activate j [ Add ACommand Spec ]



• e x A

[£\ Most Visited # • Getting Started ¿ u Latest Headlines

,-j " | £ 1 I Google 3 Botlnstances: edit lui Botlnstances: show

fHerdsl fBots l ["Connected Bots l fBot Types ! [Machines] riP Usages! fCountr ies! fCommand Recurrences! ["Command Types!

Comm-andRecurrerce was successfu l ly created.

L o g g e d in a s : 73882



lH| | My New Herd v | Dirwalks F W I GetDirWalk


A p r i l 2 0 1 0

h S i i Mo Tu WE Th F r Se

E 1 2:

[ 1 M i • & 7 8 9 10

r i i • 12-: 14 •itì 17 L

18 m f a » 22 E.jJ •24

L .as: •26 28 29: •30. |

Fo r He rd

P e r Ba t

u t i o n s F o r H e r d

M a x i m u m C o n c u r r e n t E x e c u t i o n s P e r Bot



Update ] [ update And Activate j [ Add ACommand Spec ]



û - : I ) ' Google PI LA] Most Visited Getting Started . Latest Headlines

Q Botlnstances: edit hjj Botlnstances: show IB THerdsl TBotsl TConnected Bots l TBot Tvpes l TMachinesl TIP Usages! rcountr ies l TCommand Recurrences! TCommand Types l

CommandRecurrer ice was successfu l ly created.


Editinq Command Recurrence 'Dirwalks FTW


lH| | My New Herd v | Dirwalks F W I GetDirWalk


04/22/2010

[Yes v

Yes v









Update j [ Update And Activate | | Deactivat [ Add ACommand Spec )



0 • c x i i Google PI L £ J Most Visited Getting Started Latest Headlines

• Botlnstances: edit l y Q Botlnstances: show ML f "

fHerdsl fBots l [Connected Bots l fBot Types ! [Machines] f lP Usages! [Countries] rcommand Recurrences! [Command Types !

Editing Command Spec _ Command Recurrence

Previous Spec ~~ ; , ~ . -* — De ete This Spec

L o g g e d in a s : 73882

r n o t p a t h

r eeu r^eDep th

Update and go to.. .

| Previous | | Command Recurrence | 1 Next 1



ÉÉ * e x tè 'H Ù - iH'ià»; PI LA] Most Visited Getting Started . Latest Headlines

Botlnstances: edit y i I Q Bot Inst an ces: show F fHerdsl fBots l ["Connected Bots l fBot Types ! [Machines] riP Usages! fCountr ies l fCommand Recurrences! ["Command Types!

CommandSpec was successfu l ly updated.

L o g g e d in a s : 73882



lH| I My New Herd v | Dirwalks F W I GetDirWalk


[Yes v

Yes v









Update ] [ Update And Activate | [ Add ACommand Spec ] [ View Command Specs



* * s ' C X f t d ù - f i - i * P I


Botlnstances: show y i Q Botlnstances: show I f

fHerdsl fBots l ["Connected Bots l fBot Types ! [Machines] riP Usages'! ["Countries] fCommand Recurrences'! fCommand Types] L o g g e d in a s : 73882

Comm-andRecurrerice was successfu l ly updated and ac t iva ted.

Executions for Command Recurrence rDirwalks FTW1

E x e c u t i o n S p e c Bot I n s t a n c e C r e a t i o n T i m e * T r a n s m i s s i o n T ime A c kn o w 1 e d g e m e n i T i m e C o m p l e t i o n T i m e S t a t u s


defiantwarriof? and the nsa's use of bots otherwise noted/trea alt containel d items within...

Documents