computers at locations that are routinely targeted by (similar) attackers, we aim to identify portions of command and control infrastructure that the attackers use for particular targets as well as document the type of