Clauses 5-44 from http://www.zeuslegalnotice.com/images/Complaint_w_Appendices.pdf

5. Plaintiffs are informed and believe and thereupon allege that John Doe 1 is the creator of the "Zeus" botnet code that, along with the "Ice-IX" and "SpyEye" botnet codes, comprise the Zeus Botnets. John Doe 1 goes by the aliases "Slavik," "Monstr," "IOO" and/or "Nu11" and may be contacted at messaging address bashorg@talking.cc.

6. Plaintiffs are informed and believe and thereupon allege that John Doe 2 is the creator of the "Ice-IX" botnet code that, along with the "Zeus" and "SpyEye" botnet codes, comprise the Zeus Botnets. John Doe 2 goes by the aliases "zebra7753," "lexa_mef," "gss," and "iceIX" and may be contacted at Jabber messaging address iceix@secure-jabber.biz and ICQ messaging address "610875708."

7. Plaintiffs are informed and believe and thereupon allege that John Doe 3 is the creator of the "SpyEye" botnet code that, along with the "Zeus" and "Ice-IX" botnet codes, comprise the Zeus Botnets. John Doe 3 goes by the aliases "Harderman" or "Gribodemon" and 2 may be contacted at email and messaging addresses shwark.power.andrew@gmail.com, johnlecun@gmail.com, gribodemon@pochta.ru, glazgo-update-notifier@gajim.org, and gribo- demon@jabber.ru.

8. Plaintiffs are informed and believe and thereupon allege that John Does 1 through 3, as creators of the malicious botnet code, have acted in concert with John Does 4 through 39 who have purchased, developed and/or sold such botnet code, and are currently operating or have contributed to the operation of the Zeus Botnets.

9. Plaintiffs are informed and believe and thereupon allege that John Doe 4 goes by the aliases "Aqua," "aquaSecond," "it," "percent," "cp01," "hct," "xman," and "Pepsi" and may be contacted at messaging addresses aqua@incomeet.com and "637760688." Upon information and belief, John Doe 4 recruits money mules and uses them to cash out stolen account credentials, and operates the Zeus Botnets to compromise account credentials.

10. Plaintiffs are informed and believe and thereupon allege that John Doe 5 goes by the aliases "miami" and "miamibc" and may be contacted at messaging addresses miami@jabbluisa.com, um@jabbim.com, and hof@headcounter.org. Upon information and belief, John Doe 5 is a developer of "web inject" logic for the Zeus Botnets and has been called on by other Doe Defendants in this case to develop web inject code for Zeus Botnet configuration files (e.g. injecting additional website form fields, such as ATM card number, pin, etc, as described further below).

11. Plaintiffs are informed and believe and thereupon allege that John Doe 6 goes by the alias "petr0vich" and may be contacted at email and messaging addresses theklutch@gmail.com, niko@grad.com, Johnny@guru.bearin.donetsk.ua, petr0vich@incomeet.com and 802122. Upon information and belief, John Doe 6 is a primary network administrator for other John Doe defendants in this case, handling most of the tasks relating to Zeus hosting and operations.

12. Plaintiffs are informed and believe and thereupon allege that John Doe 7 goes by the alias "Mr ICQ" and may be contacted at messaging address mricq@incomeet.com. Upon information and belief, John Doe 7 is one of the actors in Defendants' organization who handles incoming notifications of newly compromised victim information. Upon further information and belief, John Doe 7 is also connected to underground electronic currency exchange services.

13. Plaintiffs are informed and believe and thereupon allege that John Doe 8 goes by the alias "Tank" and "tankist" and may be contacted at email and messaging addresses T4ank@ua.fm, tank@incomeet.com and 366666. Upon information and belief, John Doe 8 works closely with John Doe 6 and is involved in cashing out stolen credentials.

14. Plaintiffs are informed and believe and thereupon allege that John Doe 9 goes by the alias "Kusunagi." Upon information and belief, John Doe 9 is involved in writing and obtaining web inject code. Upon further information and belief, John Doe 9 can likely be contacted at email and messaging addresses T4ank@ua.fm, tank@incomeet.com and 366666.

15. Plaintiffs are informed and believe and thereupon allege that John Doe 10 goes by the alias "Noname." Upon information and belief, John Doe 10 is associated with John Doe 4, operates the Zeus Botnets and can likely be contacted at aqua@incomeet.com and "637760688."

16. Plaintiffs are informed and believe and thereupon allege that John Doe 11 goes by the aliases "Lucky" and "Bashorg" and may be contacted at messaging address "647709019." Upon information and belief, John Doe 11 is a Zeus code vendor and has provided cashiering functions (e.g. initiator of ACH/wire transaction) to other Defendants.

17. Plaintiffs are informed and believe and thereupon allege that John Doe 12 goes by the alias "Indep." Upon information and belief, John Doe 12 is associated with John Does 1, 8 and 11 and can likely be contacted at T4ank@ua.fm, tank@incomeet.com and "366666," "647709019." Upon further information and belief, John Doe 12 operates the latest versions of the Zeus Botnets.

18. Plaintiffs are informed and believe and thereupon allege that John Doe 13 goes by the alias "Mask." Upon information and belief, John Doe 13 is involved in Defendants' money mule operations.

19. Plaintiffs are informed and believe and thereupon allege that John Doe 14 goes by the alias "Enx." Upon information and belief, John Doe 14 is involved in Defendants' money mule operations.

20. Plaintiffs are informed and believe and thereupon allege that John Doe 15 goes by the aliases "Benny," "Bentley," "Denis Lubimov," "MaDaGaSkA," and "Vkontake" and may be contacted at email and messaging addresses getready@safebox.ru, john.mikle@ymail.com, alexeysafin@yahoo.com, moscow.berlin@yahoo.com, cruelintention@email.ru, bind@email.ru, firstmen17@rambler.ru, benny@jabber.cz, "77677776," "76777776," "173094207," and "45677777." Upon information and belief, John Doe 15 specializes in money mule recruitment of young people going to the U.S., or already in the U.S., on a J1 student visa. Upon further information and belief, John Doe 15 advertizes a cash-out service known as "Hot Spot" and is believed to work with John Doe 6 on a regular basis.

21. Plaintiffs are informed and believe and thereupon allege that John Doe 16 goes by the alias "rfcid." Upon information and belief, John Doe 16 has purchased and used Zeus Botnet code.

22. Plaintiffs are informed and believe and thereupon allege that John Doe 17 goes by the alias "parik." Upon information and belief, John Doe 17 has purchased and used Zeus Botnet code.

23. Plaintiffs are informed and believe and thereupon allege that John Doe 18 goes by the alias "reronic." Upon information and belief, John Doe 18 was involved in testing and using the merged "Zeus/SpyEye" code.

24. Plaintiffs are informed and believe and thereupon allege that John Doe 19 goes by the alias "Daniel" and may be contacted at messaging address "565359703." Upon information and belief, John Doe 19 was involved in developing Zeus/SpyEye code.

25. Plaintiffs are informed and believe and thereupon allege that John Doe 20 goes by the aliases "bx1," "Daniel Hamza" and "Danielbx1" and may be contacted at email and messaging addresses airlord1988@gmail.com, bx1@hotmail.com, i_amhere@hotmail.fr, daniel.h.b@universityof sutton.com, princedelune@hotmail.fr, bx1_@msn.com, danibx1@hotmail.fr, and danieldelcore@hotmail.com. Upon information and belief, John Doe 20 has purchased and used the Zeus/SpyEye code.

26. Plaintiffs are informed and believe and thereupon allege that John Doe 21 goes by the alias "jah." Upon information and belief, John Doe 21 is associated with John Doe 20. Upon further information and belief, John Doe 21 was involved with the development of the Zeus/SpyEye code.

27. Plaintiffs are informed and believe and thereupon allege that John Doe 22 goes by the alias "Jonni." Upon information and belief, John Doe 22 is associated with John Doe 4 and can likely be contacted at aqua@incomeet.com and "637760688." Upon further information and belief, John Doe 22 specializes in money mule recruitment in the UK.

28. Plaintiffs are informed and believe and thereupon allege that John Doe 23 goes by the alias "jtk." Upon information and belief, John Doe 23 is associated with John Doe 4 and can likely be contacted at aqua@incomeet.com and "637760688." Upon further information and belief, John Doe 23 specializes in money mule recruitment in the UK.

29. Plaintiffs are informed and believe and thereupon allege that John Doe 24 goes by the alias "Veggi Roma." Upon information and belief, John Doe 24 is associated with John Doe 6 and can likely be contacted at aqua@incomeet.com and "637760688." Upon further information and belief, John Doe 24 specializes in money mule recruitment in the UK.

30. Plaintiffs are informed and believe and thereupon allege that John Doe 25 goes by the alias "D frank" and may be contacted at messaging addresses d.frank@jabber.jp and d.frank@0nl1ne.at. Upon information and belief, John Doe 25 is involved in hosting Zeus Botnet code.

31. Plaintiffs are informed and believe and thereupon allege that John Doe 26 goes by the alias "duo" and may be contacted at messaging address duo@jabber.cn. Upon information and belief, John Doe 26 is involved in hosting Zeus Botnet code.

32. Plaintiffs are informed and believe and thereupon allege that John Doe 27 goes by the alias "Admin2010" and may be contacted at email addresses fering99@yahoo.com and secustar@mail.ru. Upon information and belief, John Doe 27 is involved in purchasing and using the Zeus Botnet code.

33. Plaintiffs are informed and believe and thereupon allege that John Doe 28 goes by the alias "h4x0rdz" and may be contacted at email address h4x0rdz@hotmail.com. Upon information and belief, John Doe 28 is involved in purchasing and using the Zeus/SpyEye code.

34. Plaintiffs are informed and believe and thereupon allege that John Doe 29 goes by the alias "Donsft" and may be contacted at email address Donsft@hotmail.com. Upon information and belief, John Doe 29 is involved in purchasing and using the Zeus/SpyEye code.

35. Plaintiffs are informed and believe and thereupon allege that John Doe 30 goes by the alias "mary.j" and may be contacted at email address mary.j555@hotmail.com. Upon information and belief, John Doe 30 is involved in purchasing and using the Zeus/SpyEye code.

36. Plaintiffs are informed and believe and thereupon allege that John Doe 31 goes by the alias "susanneon" and may be contacted at email address susanneon@googlemail.com. Upon information and belief, John Doe 31 is involved in selling PDF exploits to deliver the Zeus/SpyEye code.

37. Plaintiffs are informed and believe and thereupon allege that John Doe 32 goes by the alias "kainhabe" and may be contacted at email address kainehabe@hotmail.com. Upon information and belief, John Doe 32 is involved in purchasing and using the Zeus/SpyEye code.

38. Plaintiffs are informed and believe and thereupon allege that John Doe 33 goes by the alias "virus_e_2003" and may be contacted at email address virus_e_2003@hotmail.com. Upon information and belief, John Doe 33 is involved in purchasing and using the Zeus/SpyEye code.

39. Plaintiffs are informed and believe and thereupon allege that John Doe 34 goes by the alias "spanishp" and may be contacted at email addresses spanishp@hotmail.com. Upon information and belief, John Doe 34 is involved in purchasing and using the Zeus/SpyEye code.

40. Plaintiffs are informed and believe and thereupon allege that John Doe 35 goes by the alias "sere.bro" and may be contacted at email address sere.bro@hotmail.com. Upon information and belief, John Doe 35 is involved in purchasing and using the Zeus/SpyEye code. 41. Plaintiffs are informed and believe and thereupon allege that John Doe 36 goes by the aliases "muddem" and "mechan1zm" and may be contacted at email addresses lostbuffer@hotmail.com and lostbuffer@gmail.com. Upon information and belief, John Doe 36 is involved in purchasing and using the Zeus/SpyEye code.

42. Plaintiffs are informed and believe and thereupon allege that John Doe 37 goes by the alias "vlad.dimitrov" and may be contacted at email address vlad.dimitrov@hotmail.com. Upon information and belief, John Doe 37 is involved in purchasing and using the Zeus/SpyEye code.

43. Plaintiffs are informed and believe and thereupon allege that John Doe 38 goes by the alias "jheto2002" and may be contacted at email address jheto2002@gmail.com. Upon information and belief, John Doe 38 is involved in creating injection code to deliver the Zeus/SpyEye code.

44. Plaintiffs are informed and believe and thereupon allege that John Doe 39 goes by the alias "sector.exploits" and may be contacted at email address sector.exploits@gmail.com. Upon information and belief, John Doe 39 is involved in selling Adobe Flash exploit code to deliver the Zeus/SpyEye code.