Hi Axel, Thanks for the copy of the police order. I'll do a quick translation of the document for those that are not so into Dutch. (Probably within the next 2 days. Depending on the workload in the office) For the people that didn't read the security fora and want to see how those frozen prefixes look in the www.ripe.net/whois. https://apps.db.ripe.net/whois/lookup/ripe/inetnum/85.255.112.0-85.255.127.2... https://apps.db.ripe.net/whois/lookup/ripe/inetnum/213.109.64.0-213.109.79.2... https://apps.db.ripe.net/whois/lookup/ripe/inetnum/93.188.160.0-93.188.167.2... https://apps.db.ripe.net/whois/lookup/ripe/inetnum/77.67.83.0-77.67.83.255.h... The above mentioned details can also be found in the FBI file found at : http://www.fbi.gov/news/stories/2011/november/malware_110911/DNS-changer-mal... ( Source : http://isc.sans.edu/diary/Operation+Ghost+Click+FBI+bags+crime+ring+responsi... ) Regards, Erik Bais