The GSPC Homepage returns to the Internet

As I noted in an earlier post regarding the GSPC website and what I found to be extremely interesting links to other “legitimate” corporations, the GSPC website “Jihad-Algeria.com” was offline. It resurfaced as “jihad-algerie.com”, went offline and is now back as “jihad-algerie.net“.The following is a quick workup of what the current site has to offer.While the initial website was registered to an individual in Indonesia, the current domain name owner would appear to be based in California, USA but the chances are great that this information is false.
Technical details are below the break:

DNS Lookup to follow:
#begin lookup
Registration Service Provided By: SecurityWay.Net
Contact: domains@SecurityWay.Net
Visit: http://domains.SecurityWay.NetDomain name: jihad-algerie.netRegistrant Contact:
irhaby
irh 007 (irhaby007@yahoo.com)
+1.001933316363
Fax: +1.001933316363
U.S.A
california, 93331
USAdministrative Contact:
irhaby
irh 007 (irhaby007@yahoo.com)
+1.001933316363
Fax: +1.001933316363
U.S.A
california, 93331
USTechnical Contact:
irhaby
irh 007 (irhaby007@yahoo.com)
+1.001933316363
Fax: +1.001933316363
U.S.A
california, 93331
USStatus: LockedName Servers:
ns137.websitewelcome.com
ns138.websitewelcome.comCreation date: 25 Sep 2005 01:05:03
Expiration date: 25 Sep 2006 01:05:03
Whois-Services: e90c071b-affa-4318-a486-12d1b38456cf@whois-services.com#end of dnslookupNote that the contact email address is for one “irhaby007@yahoo.com”, which translates into “terrorist 007”, a known Al-Qaida sypathizer with a fair amount of technical skill, this person is a known to have assisted many terror groups and has made quite a contribution to the terrorist cause on the Internet.

The contact number, fax number, area code and zip code are identical and seem to be blatantly fake as the area code 193 doesnt exist, the zip code of 93331 is false as well (although the 331 telephone prefix belongs to Santa Barbara California).

An IP-WHOIS of the website reveals that it’s IP number (70.86.17.194) is hosted in a netblock that belongs to “ThePlanet” Internet Services (web hosting) in Dallas, Texas.

“OrgName: ThePlanet.com Internet Services, Inc.
OrgID: TPCM
Address: 1333 North Stemmons Freeway
Address: Suite 110
City: Dallas
StateProv: TX
PostalCode: 75207
Country: US

ReferralServer: rwhois://rwhois.theplanet.com:4321

NetRange: 70.84.0.0 – 70.87.255.255
CIDR: 70.84.0.0/14”

The server it is hosted on also hosts 2071 other websites (they have the shared hosting plan). After I finish this research I intend to contact The Planet and notify them that they are hosting the website of a Salafist group listed as a known terrorist organization by the US Department of State as the Salafist Group for Preaching and Combat. This may or may not have a result as I have had the displeasure of working with The Planet’s staff in the past and if not outright hostile, they were far less than cooperative. If the result of my notification to them is not positive I will notify the proper authorities and see if they are interested.

Now, regarding “irhaby007”, his activities have been noted by several others including Internet Haganah and Infovlad. A google search for irhaby007 show’s quite a bit of activity, mostly on jihadist forums posting the links ot files he has placed around the web. It’s interesting to see that he is involved in the GSPC homepage after it has been online for so long in so many different forms.
Additionally, there is a website listed under the domain name of “irhaby007.ca“. This website is registered under the following information:

#begin dns lookup
Status: EXIST
Registrar: eNom Canada Corp.
Registrar-no: 505567
Registrant-no: 1256035
Domaine-no: 1256036
Subdomain: irhaby007.ca
Renewal-Date: 2006/06/26
Date-Approved: 2005/06/26
Date-Modified: 2005/06/26
Organization: stuart taylor
Description:
Admin-Name: Stuart Taylor
Admin-Title:
Admin-Postal: Stuart Taylor
30 Beck View
Starston Norkolf IP209NN United Kingdom
Admin-Phone: +44.1379855267
Admin-Fax:
Admin-Mailbox: stuart_taylor2005@yahoo.com
Tech-Name: Stuart Taylor
Tech-Title:
Tech-Postal: Stuart Taylor
30 Beck View
Starston Norkolf IP209NN United Kingdom
Tech-Phone: +44.1379855267
Tech-Fax:
Tech-Mailbox: stuart_taylor2005@yahoo.com
NS1-Hostname: ns1.myhostcenter.com

#end dns lookup

The contact information above is probably false as well but it may be worth looking into.

That being said, on to the analysis fo jihad-algerie.net. As usual there is a directory of files on this server that is publicly available, the web masters must assume that these files are “hidden” but that isnt always the case.

For this example, direct your browser to “jihad-algerie.net/DOC” and there you have it. “Most” jihadi websites have something similiar and those that don’t usually have thier files uploaded to temporary download sites. I have archived all files found there (and on sites linked from there), as is my norm, for future analysis.

I will continue to update this topic as I perform additional research, I’ll also update the results of my communications with The Planet regarding the hosting of this site.

Please leave any questions in the comments section.

Advertisements

3 Responses to “The GSPC Homepage returns to the Internet”

  1. FYI, “Irhaby” means “terrorist” in Arabic. irhaby007@yahoo.com is having a good time with us here.

  2. Indeed he is, while an “Agency” with the appropriate clearances may have access to the server logs where these websites are hosted the source IP’s for his activity is almost certainly through open proxies and therefore useless. One could only hope for a simple mistake like that to lead to his capture and subsequent all expenses paid Gitmo Vacation.

  3. […] Internet Haganah reports via the SITE Institue that “irhaby007″ has been identified and busted. This is excellent news. I previously mentioned irhaby007 in a previous article regarding the GSPC’s website and his identity being used for the domain name registration for that site. […]

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: