During the analysis period, we observed commands to attack a total of 1,968 unique URL targets. Figure 2 shows the observed lifetime of the servers after initial discovery up to 24 days. Three C&C servers were online for a longer time and operated over