of the AS4808 netblocks famous for espionage activity. In fact, it is remarkably close to 123.120.127.159, an IP used by Enfal C2 v2.windowsaupdate.net (one of the "Tawnya Grilth" domains) on September 27, 2010. The last account activity for king-z as shown in the rootkit.com