The idea with phase two was that the virus uploaded a key to one of the twenty servers. This then replied with the real address of the phase two virus (in the form of a URL). However, until the download time (8pm GMT) these 20 servers had the wrong URL (purposefully). This meant that the 'real' virus couldn't be found and analysed before it was downloaded and run.

The list of the 20 URL servers were stored in the program in an encrypted list, to slow/stop the authorities from shutting them down. However this was decrypted and the list of the 20 URL servers can be found here .