Clauses 5-44 from http://www.zeuslegalnotice.com/images/Complaint_w_Appendices.pdf

5. Plaintiffs are informed and believe and thereupon allege that John Doe 1 is the creator of the "Zeus" botnet code that, along with the "Ice-IX" and "SpyEye" botnet codes, comprise the Zeus Botnets. John Doe 1 goes by the aliases "Slavik," "Monstr," "IOO" and/or "Nu11" and may be contacted at messaging address [email protected].

6. Plaintiffs are informed and believe and thereupon allege that John Doe 2 is the creator of the "Ice-IX" botnet code that, along with the "Zeus" and "SpyEye" botnet codes, comprise the Zeus Botnets. John Doe 2 goes by the aliases "zebra7753," "lexa_mef," "gss," and "iceIX" and may be contacted at Jabber messaging address [email protected] and ICQ messaging address "610875708."

7. Plaintiffs are informed and believe and thereupon allege that John Doe 3 is the creator of the "SpyEye" botnet code that, along with the "Zeus" and "Ice-IX" botnet codes, comprise the Zeus Botnets. John Doe 3 goes by the aliases "Harderman" or "Gribodemon" and 2 may be contacted at email and messaging addresses [email protected], [email protected], [email protected], [email protected], and gribo- [email protected].

8. Plaintiffs are informed and believe and thereupon allege that John Does 1 through 3, as creators of the malicious botnet code, have acted in concert with John Does 4 through 39 who have purchased, developed and/or sold such botnet code, and are currently operating or have contributed to the operation of the Zeus Botnets.

9. Plaintiffs are informed and believe and thereupon allege that John Doe 4 goes by the aliases "Aqua," "aquaSecond," "it," "percent," "cp01," "hct," "xman," and "Pepsi" and may be contacted at messaging addresses [email protected] and "637760688." Upon information and belief, John Doe 4 recruits money mules and uses them to cash out stolen account credentials, and operates the Zeus Botnets to compromise account credentials.

10. Plaintiffs are informed and believe and thereupon allege that John Doe 5 goes by the aliases "miami" and "miamibc" and may be contacted at messaging addresses [email protected], [email protected], and [email protected]. Upon information and belief, John Doe 5 is a developer of "web inject" logic for the Zeus Botnets and has been called on by other Doe Defendants in this case to develop web inject code for Zeus Botnet configuration files (e.g. injecting additional website form fields, such as ATM card number, pin, etc, as described further below).

11. Plaintiffs are informed and believe and thereupon allege that John Doe 6 goes by the alias "petr0vich" and may be contacted at email and messaging addresses [email protected], [email protected], [email protected], [email protected] and 802122. Upon information and belief, John Doe 6 is a primary network administrator for other John Doe defendants in this case, handling most of the tasks relating to Zeus hosting and operations.

12. Plaintiffs are informed and believe and thereupon allege that John Doe 7 goes by the alias "Mr ICQ" and may be contacted at messaging address [email protected]. Upon information and belief, John Doe 7 is one of the actors in Defendants' organization who handles incoming notifications of newly compromised victim information. Upon further information and belief, John Doe 7 is also connected to underground electronic currency exchange services.

13. Plaintiffs are informed and believe and thereupon allege that John Doe 8 goes by the alias "Tank" and "tankist" and may be contacted at email and messaging addresses [email protected], [email protected] and 366666. Upon information and belief, John Doe 8 works closely with John Doe 6 and is involved in cashing out stolen credentials.

14. Plaintiffs are informed and believe and thereupon allege that John Doe 9 goes by the alias "Kusunagi." Upon information and belief, John Doe 9 is involved in writing and obtaining web inject code. Upon further information and belief, John Doe 9 can likely be contacted at email and messaging addresses [email protected], [email protected] and 366666.

15. Plaintiffs are informed and believe and thereupon allege that John Doe 10 goes by the alias "Noname." Upon information and belief, John Doe 10 is associated with John Doe 4, operates the Zeus Botnets and can likely be contacted at [email protected] and "637760688."

16. Plaintiffs are informed and believe and thereupon allege that John Doe 11 goes by the aliases "Lucky" and "Bashorg" and may be contacted at messaging address "647709019." Upon information and belief, John Doe 11 is a Zeus code vendor and has provided cashiering functions (e.g. initiator of ACH/wire transaction) to other Defendants.

17. Plaintiffs are informed and believe and thereupon allege that John Doe 12 goes by the alias "Indep." Upon information and belief, John Doe 12 is associated with John Does 1, 8 and 11 and can likely be contacted at [email protected], [email protected] and "366666," "647709019." Upon further information and belief, John Doe 12 operates the latest versions of the Zeus Botnets.

18. Plaintiffs are informed and believe and thereupon allege that John Doe 13 goes by the alias "Mask." Upon information and belief, John Doe 13 is involved in Defendants' money mule operations.

19. Plaintiffs are informed and believe and thereupon allege that John Doe 14 goes by the alias "Enx." Upon information and belief, John Doe 14 is involved in Defendants' money mule operations.

20. Plaintiffs are informed and believe and thereupon allege that John Doe 15 goes by the aliases "Benny," "Bentley," "Denis Lubimov," "MaDaGaSkA," and "Vkontake" and may be contacted at email and messaging addresses [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], "77677776," "76777776," "173094207," and "45677777." Upon information and belief, John Doe 15 specializes in money mule recruitment of young people going to the U.S., or already in the U.S., on a J1 student visa. Upon further information and belief, John Doe 15 advertizes a cash-out service known as "Hot Spot" and is believed to work with John Doe 6 on a regular basis.

21. Plaintiffs are informed and believe and thereupon allege that John Doe 16 goes by the alias "rfcid." Upon information and belief, John Doe 16 has purchased and used Zeus Botnet code.

22. Plaintiffs are informed and believe and thereupon allege that John Doe 17 goes by the alias "parik." Upon information and belief, John Doe 17 has purchased and used Zeus Botnet code.

23. Plaintiffs are informed and believe and thereupon allege that John Doe 18 goes by the alias "reronic." Upon information and belief, John Doe 18 was involved in testing and using the merged "Zeus/SpyEye" code.

24. Plaintiffs are informed and believe and thereupon allege that John Doe 19 goes by the alias "Daniel" and may be contacted at messaging address "565359703." Upon information and belief, John Doe 19 was involved in developing Zeus/SpyEye code.

25. Plaintiffs are informed and believe and thereupon allege that John Doe 20 goes by the aliases "bx1," "Daniel Hamza" and "Danielbx1" and may be contacted at email and messaging addresses [email protected], [email protected], [email protected], daniel.h.b@universityof sutton.com, [email protected], [email protected], [email protected], and [email protected]. Upon information and belief, John Doe 20 has purchased and used the Zeus/SpyEye code.

26. Plaintiffs are informed and believe and thereupon allege that John Doe 21 goes by the alias "jah." Upon information and belief, John Doe 21 is associated with John Doe 20. Upon further information and belief, John Doe 21 was involved with the development of the Zeus/SpyEye code.

27. Plaintiffs are informed and believe and thereupon allege that John Doe 22 goes by the alias "Jonni." Upon information and belief, John Doe 22 is associated with John Doe 4 and can likely be contacted at [email protected] and "637760688." Upon further information and belief, John Doe 22 specializes in money mule recruitment in the UK.

28. Plaintiffs are informed and believe and thereupon allege that John Doe 23 goes by the alias "jtk." Upon information and belief, John Doe 23 is associated with John Doe 4 and can likely be contacted at [email protected] and "637760688." Upon further information and belief, John Doe 23 specializes in money mule recruitment in the UK.

29. Plaintiffs are informed and believe and thereupon allege that John Doe 24 goes by the alias "Veggi Roma." Upon information and belief, John Doe 24 is associated with John Doe 6 and can likely be contacted at [email protected] and "637760688." Upon further information and belief, John Doe 24 specializes in money mule recruitment in the UK.

30. Plaintiffs are informed and believe and thereupon allege that John Doe 25 goes by the alias "D frank" and may be contacted at messaging addresses [email protected] and [email protected]. Upon information and belief, John Doe 25 is involved in hosting Zeus Botnet code.

31. Plaintiffs are informed and believe and thereupon allege that John Doe 26 goes by the alias "duo" and may be contacted at messaging address [email protected]. Upon information and belief, John Doe 26 is involved in hosting Zeus Botnet code.

32. Plaintiffs are informed and believe and thereupon allege that John Doe 27 goes by the alias "Admin2010" and may be contacted at email addresses [email protected] and [email protected]. Upon information and belief, John Doe 27 is involved in purchasing and using the Zeus Botnet code.

33. Plaintiffs are informed and believe and thereupon allege that John Doe 28 goes by the alias "h4x0rdz" and may be contacted at email address [email protected]. Upon information and belief, John Doe 28 is involved in purchasing and using the Zeus/SpyEye code.

34. Plaintiffs are informed and believe and thereupon allege that John Doe 29 goes by the alias "Donsft" and may be contacted at email address [email protected]. Upon information and belief, John Doe 29 is involved in purchasing and using the Zeus/SpyEye code.

35. Plaintiffs are informed and believe and thereupon allege that John Doe 30 goes by the alias "mary.j" and may be contacted at email address [email protected]. Upon information and belief, John Doe 30 is involved in purchasing and using the Zeus/SpyEye code.

36. Plaintiffs are informed and believe and thereupon allege that John Doe 31 goes by the alias "susanneon" and may be contacted at email address [email protected]. Upon information and belief, John Doe 31 is involved in selling PDF exploits to deliver the Zeus/SpyEye code.

37. Plaintiffs are informed and believe and thereupon allege that John Doe 32 goes by the alias "kainhabe" and may be contacted at email address [email protected]. Upon information and belief, John Doe 32 is involved in purchasing and using the Zeus/SpyEye code.

38. Plaintiffs are informed and believe and thereupon allege that John Doe 33 goes by the alias "virus_e_2003" and may be contacted at email address [email protected]. Upon information and belief, John Doe 33 is involved in purchasing and using the Zeus/SpyEye code.

39. Plaintiffs are informed and believe and thereupon allege that John Doe 34 goes by the alias "spanishp" and may be contacted at email addresses [email protected]. Upon information and belief, John Doe 34 is involved in purchasing and using the Zeus/SpyEye code.

40. Plaintiffs are informed and believe and thereupon allege that John Doe 35 goes by the alias "sere.bro" and may be contacted at email address [email protected]. Upon information and belief, John Doe 35 is involved in purchasing and using the Zeus/SpyEye code. 41. Plaintiffs are informed and believe and thereupon allege that John Doe 36 goes by the aliases "muddem" and "mechan1zm" and may be contacted at email addresses [email protected] and [email protected]. Upon information and belief, John Doe 36 is involved in purchasing and using the Zeus/SpyEye code.

42. Plaintiffs are informed and believe and thereupon allege that John Doe 37 goes by the alias "vlad.dimitrov" and may be contacted at email address [email protected]. Upon information and belief, John Doe 37 is involved in purchasing and using the Zeus/SpyEye code.

43. Plaintiffs are informed and believe and thereupon allege that John Doe 38 goes by the alias "jheto2002" and may be contacted at email address [email protected]. Upon information and belief, John Doe 38 is involved in creating injection code to deliver the Zeus/SpyEye code.

44. Plaintiffs are informed and believe and thereupon allege that John Doe 39 goes by the alias "sector.exploits" and may be contacted at email address [email protected]. Upon information and belief, John Doe 39 is involved in selling Adobe Flash exploit code to deliver the Zeus/SpyEye code.