DOPPELGANGER

Thank you for visiting our special presentation about the Doppelganger Campaign

Case 2:24-mj-01395 Document 4 Filed 09/04/24 Filed Under Seal

IN THE UNITED STATES DISTRICT COURT FOR THE EASTERN DISTRICT OF PENNSYLVANIA
UNITED STATES OF AMERICA
V
CERTAIN DOMAINS
AFFIDAVIT IN SUPPORT OF SEIZURE WARRANT

I, (REDACTED) being duly sworn, hereby declare as follows:

TECHNICAL INFORMATION

  1. TECHNICAL INFORMATION

    1. Based on my training and experience and information learned from others, I am aware of the following:
    2. Internet Protocol Address: An Internet Protocol (“IP”) address is a unique numeric address used by computers on the Internet. An IP Address is a series of four numbers, each in the range 0-255, separated by periods (e.g., 121.56.97. 178). Every computer attached to the Internet must be assigned an IP address so that Internet traffic sent from and directed to that computer may be directed properly from its source to its destination. An IP address acts much like a home or business street addressit enables computers connected to the Internet to properly route traffic to each other. The assignment of IP addresses to computers connected to the Internet is controlled by Internet Service Providers (“ISP”).
    3. Domain Name: A domain name is a string of text that maps to an IP address and serves as an easy-to-remember way for humans to identify devices on the Internet (e.g., justice.gov”). Domain names are composed of one or more parts, or “labels,” delimited by periods. When read right-to-left, the labels go from most general to most specific. The right-most label is the top-level domain” (TLD”) (e.g., “.com” or “.gov”). To the left of the TLD is the “second-level domain” (“SLD”), which is often thought of as the “name” of the domain. The SLD may be preceded by a “third-level domain,” or “subdomain,” which often provides additional information about various functions of a server or delimits areas under the same domain. For example, in “www.justice.gov,” the TLD is “.gov,” the SLD is justice,” and the subdomain is “www,” which indicates that the domain points to a web server.
    4. Domain Name System: The Domain Name System (“DNS”) is the way that Internet domain names are located and translated into IP addresses. DNS functions as a phonebook for the Internet, allowing users to find websites and other resources by their names while translating them into the IP addresses that their computers need to locate them.
    5. Domain Name Servers: Domain Name Servers (“DNS servers”) are devices or programs that convert, or resolve, domain names into IP addresses when queried by web browsers or other DNS “clients.”
    6. Registrar: A registrar is a company that has been accredited by the Internet Corporation for Assigned Names and Numbers (ICANN”) or a national country code top-level domain (such as .uk or .ca) to register and sell domain names. Registrars act as intermediaries between registries and registrants. Registrars typically maintain customer and billing information about the registrants who used their domain name registration services.
    7. Registry: A domain name registry is an organization that manages top-level domains, including by setting usage rules and working with registrars to sell domain names to the public. For example, the registry for the “.com” and “.net” top-level domains is VeriSign, Inc., which is headquartered at 12061 Bluemont Way, Reston, Virginia.
    8. Registrant: A registrant is the person or entity that holds the right to use a specific domain name sold by a registrar. Most registrars provide online interfaces that can be used by registrants to administer their domain names, including to designate or change the IP address to which their domain name resolves. For example, a registrant will typically “point” their domain name to the IP address of the server where the registrant’s website is hosted.
    9. Virtual Private Network: “VPN” means a virtual private network. A VPN extends a private network across public networks like the Internet. It enables a host computer to send and receive data across shared or public networks as if they were an integral part of a private network with all the functionality, security, and management policies of the private network. This is done by establishing a virtual point-to-point connection through the use of dedicated connections, encryption, or a combination of the two. The VPN connection across the Internet is technically a wide area network (“WAN) link between the sites. From a user perspective, the extended network resources are accessed in the same way as resources available from a private network-hence the name “virtual private network.” The communication between two VPN endpoints is encrypted and usually cannot be intercepted by law enforcement.
    10. Virtual Private Server: “VPS” means a virtual private server. A VPS acts as an isolated, virtual environment on a physical server operated by a provider. VPS hosting providers use virtualization technology to split a single physical machine into multiple private server environments that share resources. Hosting companies maintain server computers connected to the Internet. A server is a computer that provides services to other computers. Customers may use those servers for various functions, depending on the services offered by the hosting company. Some hosting companies offer simple cloud storage, which allows users to store files, much like an external hard drive, and share or edit those files with other persons. Other hosting companies allow users to operate and host websites on the Internet. Other hosting companies enable users to operate a virtual private server, which allows the customer to run virtualized operating systems from their computer over the Internet. Each VPS runs on a physical server but has its own self-contained disk space, bandwidth, processor allocation, memory, and operating system. Multiple VPS’s can run on one physical server. A hosting company can offer any combination of the above. In the case of a VPS, each subscriber to a hosting company’s services has full administrative control over the subscriber’s VPS, which enables the subscriber to choose to install software from a menu the hosting company offers or store and run the subscriber’s own software.
    11. Who.is: A “Who.is” search provides publicly available information as to which entity is responsible for a particular IP address or domain name. A Who. is record for a particular IP address or domain name will list a range of IP addresses that the particular IP address falls within and the entity responsible for that IP address range and domain name. For example, a Who.is record for the domain name XYZ.COM might list an IP address range of 12.34S.67.0-1 2.345.67.99 and list Company ABC as the responsible entity. In this example, Company ABC would be responsible for the domain name XYZ.COM and IP addresses 12.345.67.0-12.345.67.99.