Government release

# 911 S5 Botnet Dismantled and Its Administrator Arrested in Coordinated International Operation

United States Department of Justice, May 29, 2024. Arrest of YunHe Wang, domain and server seizures, 19 million compromised IP addresses including 613,841 in the United States.

**Source type:** Government release

**Published:** May 29, 2024

**Research grade:** P1

**Used in entries:** 9

## Bibliographic record

**Publisher:** United States Department of Justice

**Published:** May 29, 2024

**Source type:** Government release

**Research grade:** Source grade P1

**Language:** English

**Official record:** Official publication

**Address:** No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher.

**What it supports:** Arrest of YunHe Wang, domain and server seizures, 19 million compromised IP addresses including 613,841 in the United States

**Dataset id:** src\_doj\_911s5\_2024

## Research notes

- URL not re-verified in this pass.

How this source is used

Cited 9 times across 4 record types.

The role on each citation records what the source was relied on for. A primary source establishes the fact, a supporting source corroborates it, technical evidence describes the infrastructure, and a later outcome records what happened afterwards.

Sources were reviewed to a research cutoff of August 20, 2026. Addresses recorded after that date are not reflected here.

## Cited by

### Takedown records

1 citation

Cited on the takedown record itself.

-
[911 S5 botnet dismantlement](https://takedownindex.org/takedowns/911-s5-botnet-dismantlement)

Malware and botnets, May 2024

Primary source

### Organization roles

3 citations

Cited for an organization's recorded role in a takedown.

-
[Federal Bureau of Investigation](https://takedownindex.org/takedowns/911-s5-botnet-dismantlement)

Operational lead, 911 S5 botnet dismantlement

Primary source
-
[Defense Criminal Investigative Service](https://takedownindex.org/takedowns/911-s5-botnet-dismantlement)

Investigating, 911 S5 botnet dismantlement

Primary source
-
[Singapore Police Force](https://takedownindex.org/takedowns/911-s5-botnet-dismantlement)

Arresting, 911 S5 botnet dismantlement

Primary source

### Legal actions against people

2 citations

Cited for a recorded legal action against a named person.

-
[YunHe Wang](https://takedownindex.org/people/yunhe-wang)

Arrested, 911 S5 botnet dismantlement

Primary source
-
[YunHe Wang](https://takedownindex.org/people/yunhe-wang)

Charged, 911 S5 botnet dismantlement

Primary source

### Infrastructure

3 citations

Cited for infrastructure recorded as acted on.

-
[23 domains](https://takedownindex.org/takedowns/911-s5-botnet-dismantlement)

Domains seized, 911 S5 botnet dismantlement

Primary source
-
[more than 70 servers](https://takedownindex.org/takedowns/911-s5-botnet-dismantlement)

Servers seized, 911 S5 botnet dismantlement

Primary source
-
[more than 19,000,000 IP addresses](https://takedownindex.org/takedowns/911-s5-botnet-dismantlement)

Ip addresses disabled, 911 S5 botnet dismantlement

Primary source

[All sources](https://takedownindex.org/sources)