the majority of victims. An analysis of connections after transfer suggests that the attackers may have used a thirdparty service to try to understand why they had suddenly lost almost all of their traffic. Figure 1 shows that tool, a