Booter Takedown - Affidavit For Seizure Warrant

Case 2:18-mj-03329-DUTY *SEALED* Document 1 *SEALED* Filed 12/17/18 Page 1 of 22
Page ID #:1
United States District Court

___________CENTRAL_ ___ DISTRICT OF CALIFORNIA_______ ________
In the Matter of the Seizure of
(Address or Brief description of property or premises to be seized)
APPLICATION AND AFFIDAVIT
The following Internet Domain: FOR SEIZURE WARRANT
defcon.pro
CASE NUMBER: 2:18-mj-3329
I, Gabriel F. Andrews, being duly sworn depose and say:
I am a Supervisory Special Agent with the Federal Bureau of Investigation (“FBI”) and have reason to believe that in the
EASTERN District of PENNSYLVANIA
there is now concealed a certain person or property, namely (describe the person or property to be seized)
The following Internet Domain: defcon.pro
which is (state one or more bases for seizure under United States Code)
subject to seizure and forfeiture under 18 U.S.C. §§ 982(b)(1) and 1030(i)(1)(A),
concerning a violation of Title 18 United States Code, Section(s) 1030(a)(5)(A).
The facts to support a finding of Probable Cause for issuance of a Seizure Warrant are as follows:
Continued on the attached sheet and made a part hereof. X Yes No
_____________________________________________
Signature of Affiant
Sworn to before me, and subscribed in my presence
Los Angeles, California

Date City and State
Hon. Maria A. Audero, U.S. Magistrate Judge

Name and Title of Judicial Officer Signature of Judicial Officer
AUSA Jonathan Galatzan:aa

Page ID #:2
AFFIDAVIT IN SUPPORT OF SEIZURE WARRANT
I, Gabriel F. Andrews, being duly sworn, hereby depose and
state as follows:
I. TRAINING AND EXPERIENCE
1. I am a Supervisory Special Agent (“SSA”) with the
Federal Bureau of Investigation (“FBI”) and have been so
employed for approximately eight years. I am currently assigned
to the FBI’s Cyber Division, where I specialize in the
investigation of computer and high-technology crimes, including
computer intrusions, denial of service attacks and other types
of malicious computer activity. During my career as an FBI
Special Agent and SSA, I have participated in numerous cyber-
related investigations. In addition, I have received both
formal and informal training from the FBI and other institutions
regarding computer-related investigations and computer
technology.
2. I am familiar with the facts and circumstances
described herein. This affidavit is based upon my personal
involvement in this investigation, my training and experience,
and information obtained from various law enforcement personnel
and witnesses, including information that has been reported to
me either directly or indirectly. This affidavit does not
purport to set forth my complete knowledge or understanding of

Page ID #:3
the facts related to this investigation. Unless specifically
indicated otherwise, all conversations and statements described
in this affidavit are related in substance and part only. All
figures, times, and calculations set forth herein are
approximate.
II. SUMMARY OF RELEVANT COMPUTER AND INTERNET CONCEPTS
3. The information provided below regarding relevant
computer and internet concepts is set forth based on my training
and experience:
a. “Internet Protocol address” or “IP address” is a
unique numeric address used to identify computers on the
Internet. The standard 1 format for IP addressing consists of
four numbers between 0 and 255 separated by dots, e.g.,
149.101.10.40. Every computer connected to the Internet (or
group of computers using the same account to access the
Internet) must be assigned an IP address so that Internet
traffic sent from and directed to that computer is directed
properly from its source to its destination. Internet Service
Providers (“ISPs”) assign IP addresses to their customers’
computers. ISPs typically log their customers’ connections,
allowing them to identify which of their customers was assigned
1
IP version 4, or “IPv4”, is the version of IP most commonly used today, and
is the version described above. A newer version of the protocol, “IPv6”,
wholly different in appearance to IPv4, is sometimes used, but does not
pertain to this request, and will not be referred to further.
- 2 -
Page ID #:4
a specific IP address during a particular session.
b. “Domain Names” serve to identify Internet
resources, such as computers, networks, and services, with a
text-based label that is easier to memorize than an IP address.
A domain name consists of one or more parts (or “labels”) that
are conventionally concatenated and delimited by dots, such as
example.com. The right-most label conveys the top-level domain;
for example, the domain name www.example.com belongs to the top-
level domain com.
c. “Server” is a centralized computer that provides
services for other computers connected to it through a network.
The computers that use the server’s services are sometimes
called “clients.” Server computers can be physically located
anywhere. For example, it is not uncommon for a network’s
server to be located hundreds, or even thousands of miles away
from the client computers.
d. “Name Servers” are server applications which
function like a phonebook. Name Servers will accept queries for
domain names (such as example.com) and return an IP address
associated with the domain, much as the name John Doe might be
looked up in a telephone book to determine the corresponding
telephone number.
e. “Registries” are companies responsible for
managing the assignment of domains to IP addresses within a top-
- 3 -
Page ID #:5
level domain. For example, the registry for the “.com” and
“.net” top-level domains is VeriSign, Inc., which has its
headquarters at 12061 Bluemont Way, Reston, Virginia.
f. “Registrars” sell domain names, and thus act as
the intermediary between the registry and the purchaser of a
domain name, who is known as the “registrant.”
g. “Distributed Denial of Service” attacks, or
“DDoS” attacks, are a type of network attack in which multiple
Internet-enabled devices are used to attack computers for the
purpose of rendering them inaccessible to legitimate users or
unable to communicate with the Internet. One form of DDoS
attack used in this investigation is the flooding of a website
or server with internet traffic which makes the targeted website
unable to be accessed by legitimate users or customers.
h. “Booter” or “Stresser” services are a class of
DDoS attack tools characterized by their accessibility and
affordability. These attacks are so named because they result
in the “booting” or “dropping” of the victim targeted website
from the Internet. As described in more detail below, these
attacks operate by flooding the victim targeted website with
tremendously high volumes of unsolicited traffic, effectively
preventing the victim targeted website from responding to normal
traffic and from using the Internet.
- 4 -
Page ID #:6
III. SUMMARY AND PURPOSE OF AFFIDAVIT
A. SUBJECT DOMAINS
4. This affidavit is presented in support of applications
for warrants to seize the following domain names (collectively
referred to as the “SUBJECT DOMAINS”):
a. anonsecurityteam.com
b. critical-boot.com
c. defianceprotocol.com
d. ragebooter.com
e. str3ssed.me
f. bullstresser.net
g. quantumstress.net
h. booter.ninja
i. downthem.org
j. netstress.org
k. torsecurityteam.org
l. vbooter.org
m. defcon.pro
n. request.rip
o. layer7-stresser.xyz
5. This seizure shall be effected by associating the
authoritative name servers for the SUBJECT DOMAIN names to FBI-
- 5 -
Page ID #:7
controlled name servers, 2 as described in detail within
Attachments A-1 through A-6.
6. The SUBJECT DOMAINS are associated with specific Top
Level Domains (“TLDs”) and corresponding registry organizations.
Where the SUBJECT DOMAINS’ TLDs are associated with United
States-based registries, they are as follows:
a. “.com” & “.net”:

VeriSign, Inc., 12061 Bluemont Way, Reston, VA 20190
b. “.ninja” & “.rip”:
Dog Beach, LLC, c/o Donuts Inc., 5808 Lake Washington
Blvd, Suite 300 Kirkland, WA 98033
c. “.org”:
Public Interest Registry, 1775 Wiehle Avenue, Suite
100, Reston, VA 20190
d. “.pro”:
Afilias USA, Inc., Building 3, Suite 105, 300 Welsh
Road, Horsham, PA 19044
e. “.xyz”:
XYZ.com, LLC, 2121 E. Tropicana Ave., Ste 2, Las
Vegas, NV 89119
7. The following SUBJECT DOMAINS are associated with TLDs
corresponding to non-U.S. registries, but have U.S.-based
registrars serving as intermediaries in the sale of the domain:
a. Str3ssed.me:
Namecheap, Inc., 11400 W Olympic Blvd Ste 200, Los
Angeles, CA 90064
8. As detailed in Attachments A-1 through A-6, each of
the above-described registries is capable of setting the
2 Thus the FBI will be providing the “phone book” that others will use when
connecting to the SUBJECT DOMAIN NAMES, ensuring that most visitors will be
routed to the FBI-controlled splash page.
- 6 -
Page ID #:8
“authoritative name server” for domains within their TLD group.
For example, VeriSign can set the authoritative name server
information for example.com, or any other domain ending in .com.
9. Similarly, each of the above-described registrars are
capable of setting the “authoritative name server” of domains
for which they serve as registrar.
B. Background of FBI Investigation into Booter and Stresser

Services
10. The FBI is investigating the use of “booter” and
“stresser” services to direct floods of misappropriated Internet
traffic to unwitting victims for the express purpose of
preventing the victims from properly using the Internet, in
violation of Title 18, United States Code, Sections
1030(a)(5)(A) (Unauthorized Impairment of a Protected Computer)
and 1343 (Wire Fraud), and conspiracy to commit the same, in
violation of Title 18, United States Code, Section 371.
11. Based on my training and experience, booter-based
DDoS attack tools represent an effective advance in Internet
attack technology because they provide a relatively low barrier
to entry. These booter services accept common payment methods
such as PayPal, Google Wallet, and Bitcoin. 3 Previous work by
3 Bitcoin and similar cryptocurrencies are types of digital currency in which
transactions are made without governance by any central bank, and encryption
techniques are used to regulate the generation of units of currency and to
verify the transfer of funds. Based on my training and experience, I know
that this type of currency is often used to conceal the identities of the
parties involved in a financial transaction.
- 7 -
Page ID #:9
law enforcement and private sector partners has reduced the
ability of these booters to use payment services such as PayPal
as effectively, and so the most common payment method is now
Bitcoin or similar cryptocurrencies.
12. Based on my training and experience, the rates charged
to customers by booter services vary according to the specific
service, the desired “bandwidth” or attack size, the attack
type, and the number of “concurrent” attacks allowed. For
example, a premium, or “VIP,” account on a given booter service
might cost $100 a month and allow access to ten or more attack
types, a peak attack bandwidth of 30 Gbit/s, 4 and the ability to
attack up to four IP addresses at one time. A “basic” plan
might cost $25 to $35 a month and provide a more limited number
of attack types, while allowing the customer to attack only a
single IP address at a time.
13. Investigating agents have interviewed many of the
preeminent experts in the field of Internet attack technology,
including those at domestic ISPs who often observe thousands of
attacks a day. From these interviews, we have learned that many
domestic ISPs utilize a form of networking hardware known as an
“aggregator” to bundle downstream customer accounts; that one
4 Gbit/s, or Gigabits per second, is a volumetric measure of network data. An

average US domestic cable Internet subscriber might experience speeds of 10-
50 Megabits per second (Mbit/s). One Gigabit is equivalent to 1000 Megabits.
- 8 -
Page ID #:10
common network implementation results in up to 10,000 domestic
ISP customers downstream of a single aggregator; and that many
aggregators can only sustain incoming Internet traffic volume of
40 Gigabits per second (Gbit/s) and below. Internet traffic
exceeding 40 Gbit/s thus can result in the inability of an
aggregator to route any further traffic.
14. As described below, the FBI conducted testing of
numerous booter/stresser sites as part of this investigation.
While testing the various booter services, the FBI usually
purchased the cheapest attack plans available, merely to
determine whether their attack functionality could be verified.
That testing showed that these services could achieve attack
volumes up to 25 to 30 Gbit/s. However, many of the services
advertised the ability to perform much higher volume attacks,
typically in the range of 50 Gbit/s but sometimes as high as 200
Gbit/s. Even at the lower volumes verified, the simultaneous
use of two such services, at a combined cost of under $50 month,
could result in an Internet outage for up to 10,000 ISP
customers, for as long as the attacker wanted to implement the
attack.
15. Booter services advertise their attack capabilities
publicly, on web pages, criminal forums, chat platforms, or with
video services such as YouTube. In some cases, what appear to
be distinct booter services (with different names and branding)
- 9 -
Page ID #:11
are merely different front ends for the same underlying attack
architecture.
16. Based upon my training and experience, I know that of
the types of DDoS attacks offered by booter sites, among the
largest, in terms of sheer volume, tend to be Reflective
Amplification Attacks (“RAA”). RAA DDoS attacks function as
follows:
a. First, the attacker learns the victim’s IP address.
This can be done through a variety of methods, including
“resolvers” offered by the DDoS-for-hire sites themselves.
These resolvers can, for example, discover the true IP
associated with a web server so that an attack can bypass anti-
DDoS defenses such as Cloudflare, determine on which IP address
a given website or domain is hosted, or determine an IP address
associated with a given Skype username.
b. Second, the attacker chooses a “protocol,” i.e., a
type of communication between computers, which enables the
attacker to send a very small request to a neutral third party
and get a very large response. There are several Internet
services which – though created for legitimate purposes - are
commonly misused by booter services to craft large RAA DDoS
attacks. Examples include SSDP, also known as Simple Service
Discovery Protocol, which allows for the advertisement and
discovery of network services; NTP, or Network Time Protocol,
- 10 -
Page ID #:12
which allows clock synchronization between computer systems;
DNS, or Domain Name System, which facilitates the translation of
domain names to IP addresses; and Chargen, or Character
Generation Protocol, which facilitates testing and debugging.
c. Third, the attacker crafts and sends such a request,
but in doing so “spoofs” the request’s origin: rather than using
the attacker’s own IP address, the attacker falsifies the
victim’s IP as the source, thus ensuring that the victim, rather
than the attacker, receives the resulting flood of data from the
protocol request.
d. Fourth, the neutral third party receives the request,
and is tricked by the “spoofed” origin IP – the third party
returns its much larger response not to the attacker, but to the
victim.
e. The attacker then replicates this process many times a
second, often using many different third parties to reflect and
amplify the attack, hence the name “Reflective Amplification
Attack.”
f. As a result, the victim receives an overwhelming
amount of unsolicited Internet traffic, saturating its ability
to communicate, and effectively taking it offline for the
duration of the attack.
17. RAA DDoS attacks, as described above, are
characterized by amplification factors - the size of the
- 11 -
Page ID #:13
response data relative to the given query. For example, issuing
the command “dig ns fbi.gov”, a single line of query, results in
approximately 20 lines of text returned from the third party
“reflector” service. This command/query can thus be said to
have an amplification factor of approximately 20. Using similar
procedures, RAAs magnify the bandwidth available for attack by
factors of 10, 20, 100, and even more. By doing so, RAAs
appropriate bandwidth resources from the third-party reflectors,
resources that the attacker does not pay for, and which far
exceed “normal” use of those third parties, offloading the costs
of RAAs to those third party servers and their upstream
providers.
18. Further, as described above, an additional essential
component of RAA is fraudulent misdirection. It does the
attacker no good if the requested data is directed back to the
attacker. The “spoofing” of the victim IP address is a central
component of the attacks conducted by the booter services being
investigated by the FBI.
19. The last component of an RAA is one of distribution.
Instead of issuing the query to a single third party reflector,
the query may be issued to hundreds or thousands of such third
party reflectors simultaneously, each of which return with
“amplified” responses. The resulting deluge of attack data
saturates the network connection of the victim target website,
- 12 -
Page ID #:14
and often negatively affects many other Internet users or
servers that stand between the attacker and the victim.
20. It should be noted that most, though not all, booter
services that I have reviewed will offer some token language
within their Terms of Service which attempts to absolve the
booter service from responsibility for attacks launched by their
customers. This language may include statements such as “Under
this license you may not intentionally send a DDoS flood to an
IP address not owned by yourself.” Based on my training and
experience, I believe this language is essentially a pretense.
Because RAA DDoS attacks by definition rely upon external
services to act as “amplifiers,” they must flood traffic to
those external services en route to the victim, impairing and
degrading the capacity of those services, for which they have
received no permission. Furthermore, many of the booter
services I studied offered services known as “resolvers” – the
purpose of which is to obtain the IP address of a victim; such
resolvers would be entirely unnecessary if any customer was
targeting their own infrastructure.
21. During the course of this investigation I have studied
the effects of these attacks, as well as those targeted by DDoS
attacks. Over the last several years, databases from booter
services have been leaked online, and/or have in other instances
been obtained lawfully by law enforcement. These databases can
- 13 -
Page ID #:15
contain data on attack targets and the individuals that ordered
them, as well as the subjects involved in the day-to-day
operation of the services. I have examined several leaked
and/or seized booter databases. The data contained within those
databases indicates that DDoS attacks affect every district in
the United States, and that customers of these services exist
all over the United States and in other countries. I have also
learned through my investigation and review of these databases
that booter services are responsible for attacking large numbers
of sensitive targets, among them websites belonging to federal,
state, and municipal government, military websites, websites
belonging to the media, and websites belonging to universities
and secondary schools.
IV. APPLICABLE LAW
22. There is probable cause to believe that the SUBJECT
DOMAINS are subject to seizure and forfeiture to the United
States pursuant to 18 U.S.C. §§ 982(b)(1) and 1030(i)(1)(A)
because the SUBJECT DOMAINS constitute personal property used to
facilitate the commission of attacks against unwitting victims
for the express purpose of preventing the victims from properly
using the Internet, in violation of 18 U.S.C. § 1030(a)(5)(A)
(Unauthorized Impairment of a Protected Computer). A protective
order under 21 U.S.C. § 853(e) may not be sufficient to assure
the availability of the property for forfeiture because there is
- 14 -
Page ID #:16
reason to believe that the property is under the control of the
targets of this investigation, who cannot reasonably be relied
upon to abide by an order to maintain the property in
substantially the same condition as it is at the present time,
in order to ensure that it will be available for forfeiture.
More particularly, providing notice may allow the targets to
frustrate further efforts of law enforcement by transitioning
their enterprise and infrastructure to jurisdictions beyond the
reach of United States law enforcement.
V. STATEMENT OF PROBABLE CAUSE
23. Between June and December 2018 the FBI visited
approximately 60 “booter” sites purporting to offer DDoS attacks
for sale, including each of the SUBJECT DOMAINS. Some of these
booter sites would offer test DDoS attacks for free; some
required a paid subscription in order to send DDoS attacks.
During repeat visits, it became obvious that many of these
booter sites were inconsistently available, up one day and down
the next; therefore, the FBI focused on and created user
accounts at approximately 40 sites. From those 40 sites, the
FBI further narrowed its focus to the sites that were
consistently available, and proceeded to purchase and test DDoS
service packages at those sites.
24. The FBI evaluated approximately 20 such booter
services to verify that they functioned as advertised (with the
- 15 -
Page ID #:17
permission of the targeted “victims”). Most such services
offered a selection of attack protocols, including protocols
which I recognize as commonly associated with RAAs, as described
above, including NTP, DNS, CHARGEN, and UDP (a category of
protocols including, but not limited to, the first three). In
each case, the test attacks were either initiated from or
targeted protected computer systems located within the Central
District of California. The testing of an attack would be
considered successful if it was observed at the “victim,” and/or
at one of the third party reflectors used by RAA DDoS attacks.
25. I know from the testing of these services, and from
previous investigations and consultation with other agents and
Internet security experts who specialize in booter services,
that many such services have poorly functioning Application
Program Interfaces (“APIs”). As a result of the poorly
functioning APIs, not all booter services function properly with
100% consistency, nor are they certain to deliver the promised
attack volumes and types. Therefore not all testing was
expected to be successful, nor was it. If a booter service
could not be verified to generate attacks, it was not included
in the list of SUBJECT DOMAINS to be seized.
26. While true volumetric testing of DDoS attacks can
require highly specialized software and hardware, based upon
their training and experience, and based on conversations with
- 16 -
Page ID #:18
private sector experts and other FBI colleagues, the testing FBI
agents were able to observe whether or not a booter service in
fact generated attack traffic when an attack was requested.
Through this testing, the FBI narrowed the original list of
approximately 60 domains associated with booter services to the
15 SUBJECT DOMAINS, each associated with DDoS services which
were functioning and capable of delivering, either solely or
through concurrent use of other such services, sufficient attack
volume to saturate a typical commercial Internet connection.
This indicates a sizeable attack volume, as the bandwidth of a
typical commercial Internet connection usually exceeds that of a
residential connection.
27. Below is a screenshot from the May 30, 2018 testing of
the downthem.org service. Each of the SUBJECT DOMAINS is
functionally similar to this example, but with cosmetic
variations in their user interfaces. The website depicted below
is configured such that a user enters the IP address of the
intended victim target website, in this case identified by the
“Server IP Address” field. The user then enters a port number
(“Port”), duration (“Interval Time”), type of Internet Protocol
to be used in the attack (“Method”), and initiates the attack
(“Start operation”).
28. At the bottom of the screenshot are several tools
designed to better facilitate a user’s ability to conduct DDoS
- 17 -
Page ID #:19
attacks. As described above, these services, known as
“resolvers,” assist the attacker in learning the victim’s IP
address. The first such tool attempts to resolve Cloudflare
IPs, that is, discover the true IP associated with a web server
so that the DDoS attack can bypass Cloudflare defenses. The
second resolver takes a given website or domain and determines
on which IP address it is hosted. The third attempts to
determine an IP address associated with a given Skype username.
Investigating agents are familiar with all of these resolving
tools and know them to be part and parcel of criminal DDoS
services.
- 18 -
Page ID #:20
29. Each of the tested services at each of the SUBJECT
DOMAINS contained similar user interfaces and attack tools.
Therefore, combined with the data generated through the testing
of each of these domains, I believe that each SUBJECT DOMAIN is
being used to facilitate the commission of attacks against
unwitting victims to prevent the victims from accessing the
Internet.
VI. CONCLUSION
30. For the reasons stated above, I submit there is

- 19 -
Page ID #:21
probable cause to believe that the SUBJECT DOMAINS are subject
to seizure and forfeiture to the United States pursuant to 18
U.S.C. §§ 982(b)(1) and 1030(i)(1)(A) because the SUBJECT
DOMAINS constitute personal property used to facilitate the
commission of attacks against unwitting victims for the express
purpose of preventing the victims from properly using the
Internet, in violation of 18 U.S.C. § 1030(a)(5)(A)
(Unauthorized Impairment of a Protected Computer).
//
- 20 -
Page ID #:22
31. A protective order under 21 U.S.C. § 853(e) may not be
sufficient to assure the availability of the property for
forfeiture because there is reason to believe that the property
is under the control of the targets of this investigation, who
cannot reasonably be relied upon to abide by an order to
maintain the property in substantially the same condition as it
is at the present time, in order to ensure that it will be
available for forfeiture. More particularly, providing notice
may allow the targets to frustrate further efforts of law
enforcement by transitioning their enterprise and infrastructure
to jurisdictions beyond the reach of United States law
enforcement.
______________________________
GABRIEL F. ANDREWS
Supervisory Special Agent,
Federal Bureau of Investigation
Subscribed to and sworn to me

this __ day of December, 2018
______________________________
United States Magistrate Judge
- 21 -

Booter Takedown - Affidavit For Seizure Warrant

Uploaded by

Copyright:

Available Formats

Booter Takedown - Affidavit For Seizure Warrant

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Booter Takedown - Affidavit For Seizure Warrant

Uploaded by

Copyright:

Available Formats

Case 2:18-mj-03329-DUTY *SEALED* Document 1 *SEALED* Filed 12/17/18 Page 1 of 22

United States District Court

I, Gabriel F. Andrews, being duly sworn depose and say:

The following Internet Domain: defcon.pro

subject to seizure and forfeiture under 18 U.S.C. §§ 982(b)(1) and 1030(i)(1)(A),

concerning a violation of Title 18 United States Code, Section(s) 1030(a)(5)(A).

Continued on the attached sheet and made a part hereof. X Yes No

Sworn to before me, and subscribed in my presence

Los Angeles, California

Hon. Maria A. Audero, U.S. Magistrate Judge

AUSA Jonathan Galatzan:aa

AFFIDAVIT IN SUPPORT OF SEIZURE WARRANT

I, Gabriel F. Andrews, being duly sworn, hereby depose and

I. TRAINING AND EXPERIENCE

1. I am a Supervisory Special Agent (“SSA”) with the

Federal Bureau of Investigation (“FBI”) and have been so

employed for approximately eight years. I am currently assigned

to the FBI’s Cyber Division, where I specialize in the

investigation of computer and high-technology crimes, including

computer intrusions, denial of service attacks and other types

of malicious computer activity. During my career as an FBI

Special Agent and SSA, I have participated in numerous cyber-

related investigations. In addition, I have received both

regarding computer-related investigations and computer

2. I am familiar with the facts and circumstances

described herein. This affidavit is based upon my personal

involvement in this investigation, my training and experience,

and information obtained from various law enforcement personnel

and witnesses, including information that has been reported to

me either directly or indirectly. This affidavit does not

purport to set forth my complete knowledge or understanding of

the facts related to this investigation. Unless specifically

indicated otherwise, all conversations and statements described

in this affidavit are related in substance and part only. All

figures, times, and calculations set forth herein are

II. SUMMARY OF RELEVANT COMPUTER AND INTERNET CONCEPTS

3. The information provided below regarding relevant

computer and internet concepts is set forth based on my training

a. “Internet Protocol address” or “IP address” is a

unique numeric address used to identify computers on the

Internet. The standard 1 format for IP addressing consists of

four numbers between 0 and 255 separated by dots, e.g.,

149.101.10.40. Every computer connected to the Internet (or

group of computers using the same account to access the

Internet) must be assigned an IP address so that Internet

traffic sent from and directed to that computer is directed

properly from its source to its destination. Internet Service

Providers (“ISPs”) assign IP addresses to their customers’

computers. ISPs typically log their customers’ connections,

allowing them to identify which of their customers was assigned

a specific IP address during a particular session.

b. “Domain Names” serve to identify Internet

resources, such as computers, networks, and services, with a

text-based label that is easier to memorize than an IP address.

A domain name consists of one or more parts (or “labels”) that

are conventionally concatenated and delimited by dots, such as

example.com. The right-most label conveys the top-level domain;

for example, the domain name www.example.com belongs to the top-

Case 2:18-mj-03329-DUTY SEALED Document 1 SEALED Filed 12/17/18 Page 1 of 22