Examining the worldtradeaftermath.com domain

ian neal · Post by **ian neal** » Wed Jan 24, 2007 4:58 pm

http://www.bloglines.com/blog/ewing2001?id=2652

This from Nico Haupt's blog

EDT is 4 hours behind Coordinated Universal Time (UTC).

To figure what time www.WORLDTRADEAFTERMATH.COM was created you would subtract 4 hours. This domian was created at 6:49 AM on 9/11/2001
nearly 2 hours BEFORE American Airlines Flight 11 out of Boston,
Massachusetts, crashed into the north tower of the World Trade Center
at 8:45 a.m. EDT.

Welcome to WorldTradeAftermath.com This site was created to act as a
central resource of information for people worried about friends and
loved ones in and around the World Trade Center (and Pentagon) on
September 11th, 2001....

Mark Gobell · Post by **Mark Gobell** » Wed Jan 24, 2007 5:19 pm

This from Network Solutions WHOIS http://www.networksolutions.com/whois/index.jsp

Shows a registration time of 10:49 11.9.2001

Thats in UTC, so subtract 4 hours = 06:49

EDT = UTC - 4 hours during Daylight Saving Time, and UTC - 5 hours outside of Daylight Saving Time

Daylight Saving Time is from at 2:00 a.m. on the first Sunday of April to 2:00 a.m. on the last Sunday of October.

Registration Service Provided By: Rare Ideas, LLC
Contact: dnsadmin5@fileexit.com
Visit: http://rareideas.com/

Domain name: WORLDTRADEAFTERMATH.COM

Registrant Contact:
JOHN T. HALLER
John Haller (dnsadmin@fileexit.com)
+1.0000000000
Fax:
PO Box 227
New York, NY 10009
US

Administrative Contact:
John T Haller
John Haller (dnsadmin5@fileexit.com)
+1.6465268661
Fax:
PO Box 227
New York, NY 10009
US

Technical Contact:
John T Haller
John Haller (dnsadmin5@fileexit.com)
+1.6465268661
Fax:
PO Box 227
New York, NY 10009
US

Status: Locked

Name Servers:

Creation date: 11 Sep 2001 10:49:47
Expiration date: 11 Sep 2007 00:00:00

rodin · Post by **rodin** » Wed Jan 24, 2007 8:05 pm

Bl**dy hell a smoking gun????

Lets get on it

Dstevo · Post by **Dstevo** » Thu Jan 25, 2007 10:35 am

Anyone tried emailing the administrator?

I emailed yesterday and am awaiting a reply.

IronSnot · Post by **IronSnot** » Thu Jan 25, 2007 10:53 am

I'm totally unconvinced. I have yet to see anything that indicates the time registered was UTC.

But there's some interesting source code in that post. Click on the link that looks like it's to this site;

http://www.coffinman.co.uk/smoking_gun_ ... ber_11.htm

and you actually end up on worldtradeaftermath.com

What's ewing up to?

This is the offending underlying code in ewing's post;

<table cellspacing=0 cellpadding=0 width="100%"><tr><td class="article">picked up at: <a href="http://worldtradeaftermath.com/wta/default.asp" target=_blank class=blines3 title="Link outside of this blog">http://www.coffinman.co.uk/smoking_gun_ ... br/>

But there's some more interesting code that follows;

Wed, 24. Jan<defanged-span class="jajahWraper"><a class="jajahLink" title="Click to call this number with JAJAH..." target=_blank class=blines2 title="Link to another page in this blog"><defanged-span class="jajahInLink"> 2007</a>

I've no idea what jajah is, but that is in very small font on the blog page so it's not attempting to be upfront about itself that code.

IronSnot · Post by **IronSnot** » Thu Jan 25, 2007 11:29 am

Dstevo wrote:Anyone tried emailing the administrator?

I emailed yesterday and am awaiting a reply.

You could always phone him. Mind you that number is for a wig store.

andyb · Post by **andyb** » Thu Jan 25, 2007 12:06 pm

IS, can you explain what all that means to us who don't understand computer language?

ComfortablyNumb · Post by **ComfortablyNumb** » Thu Jan 25, 2007 12:19 pm

I've contacted Network Solutions and await a confirmation that the creation time is UDT.

ComfortablyNumb · Post by **ComfortablyNumb** » Thu Jan 25, 2007 12:30 pm

Wed, 24. Jan<defanged-span class="jajahWraper"><a class="jajahLink" title="Click to call this number with JAJAH..." target=_blank class=blines2 title="Link to another page in this blog"><defanged-span class="jajahInLink"> 2007</a>

As far as I can see this is just a way to promote JAJAH phone calls. If you put your mouse over 2007, it provides a title. 2007 was probably counted as a telephone number and the blogging app added the title.

I doubt very much this was added by the blogger himself.

http://www.jajah.com/

Regs,
Numb

IronSnot · Post by **IronSnot** » Thu Jan 25, 2007 12:53 pm

ComfortablyNumb wrote: I doubt very much this was added by the blogger himself.

Regs,
Numb

That's perfectly possible for the jajah stuff. But the link being corrupted is a bit strange still, I'm not that great on html and have absolutely no experience in .asp or java, but there's no doubt what the result of that code is;

This is the actual link

<a href="http://worldtradeaftermath.com/wta/default.asp"

That is not closed off though and I assume this is allowing the link to disguise itself and pretend it's coffinman.co.uk but coffinman doesn't have the <a href= so it's not a link;

target=_blank class=blines3 title="Link outside of this blog">http://www.coffinman.co.uk/smoking_gun_ ... .htm</a>

Mark Gobell · Post by **Mark Gobell** » Thu Jan 25, 2007 4:00 pm

worldtradeaftermath.com

Whois Server Version 2.0

Domain names in the .com and .net domains can now be registered
with many different competing registrars. Go to http://www.internic.net
for detailed information.

Domain Name: WORLDTRADEAFTERMATH.COM
Registrar: BULKREGISTER, LLC.
Whois Server: whois.bulkregister.com
Referral URL: http://www.bulkregister.com
Name Server: DNS1.NAME-SERVICES.COM
Name Server: DNS2.NAME-SERVICES.COM
Name Server: DNS3.NAME-SERVICES.COM
Name Server: DNS4.NAME-SERVICES.COM
Name Server: DNS5.NAME-SERVICES.COM
Status: clientDeleteProhibited
Status: clientTransferProhibited
Updated Date: 19-dec-2006
Creation Date: 11-sep-2001
Expiration Date: 11-sep-2007

>>> Last update of whois database: Thu, 25 Jan 2007 15:57:11 UTC <<<

I'm guessing here but if they quote the last registry update times in UTC then it could be a pretty safe assumption that the entire domain registration system uses UTC also.

Any other way of finding out - it can;t be that difficult can it?

I've emailed the techy contact for the domain, but no response as yet.

andrewwatson · Post by **andrewwatson** » Thu Jan 25, 2007 5:51 pm

If this is in UTC it is as copper-bottomed a proof of foreknowledge as exists anywhere.

I have already started emailing some media outlets, but I will wait for confirmation of the time before I do any more .

Mark Gobell · Post by **Mark Gobell** » Thu Jan 25, 2007 7:16 pm

andyb wrote:IS, can you explain what all that means to us who don't understand computer language?

Andy it's easy.

Basically the jajah embedded active x giblet is an ISO level 4 code discombobulation with a variable offset vector array interface.

Clear ?

Mark Gobell · Post by **Mark Gobell** » Fri Jan 26, 2007 9:38 am

I've had a reply back from Network Solutions and they have said they do not understand my question.

At first I was surprised because it was a straightforward question about the time zone used in WHOIS results for domain creation date.

I have emailed them again with the specific results fomr the WHOIS for the worldtradeaftermath.com

Puzzled by their lack of understanding I then checked a few other domains to see their creation times.

I didn't see any creation times in those results, just the creation date.

Can the domain registration records be edited ?

If so, could this be a hoax ?

If anyone can find any other WHOIS results that show a creation time then can they post them please.

andyb · Post by **andyb** » Fri Jan 26, 2007 9:49 am

Mark Gobell wrote:
andyb wrote:IS, can you explain what all that means to us who don't understand computer language?
Andy it's easy.

Basically the jajah embedded active x giblet is an ISO level 4 code discombobulation with a variable offset vector array interface.

Clear ?

are you taking the mick? that still sounded like gibberish to me

Mark Gobell · Post by **Mark Gobell** » Fri Jan 26, 2007 9:56 am

Not taking the mick Andy, just having a laugh mate. It's all jibberish to me too.

Mark Gobell · Post by **Mark Gobell** » Fri Jan 26, 2007 10:05 am

At last I've found one with a creation time and it's shown as UTC, funnily enough, Tony Gosling's site http://www.bilderberg.org

Domain ID:D4153009-LROR
Domain Name:BILDERBERG.ORG
Created On:07-Mar-1999 05:00:00 UTC
Last Updated On:21-Feb-2006 18:58:20 UTC
Expiration Date:07-Mar-2007 05:00:00 UTC

and another st911.org

Domain ID:D111620550-LROR
Domain Name:ST911.ORG
Created On:13-Jan-2006 23:46:21 UTC
Last Updated On:15-Jan-2007 11:57:03 UTC
Expiration Date:13-Jan-2008 23:46:21 UTC

and another 911truth.org

Domain ID:D93963989-LROR
Domain Name:911TRUTH.ORG
Created On:14-Jan-2003 03:26:01 UTC
Last Updated On:12-Oct-2006 23:56:23 UTC
Expiration Date:14-Jan-2011 03:26:01 UTC

It seems that the WHOIS results are not consistent then.

Some show times and other do not.

Some show times with the time zone, and others do not.

I'm waiting on responses from Network Solutions and ICANN

Mark Gobell · Post by **Mark Gobell** » Fri Jan 26, 2007 10:20 am

Good game this:

http://alsaha.com the PR channel of choice for Al Qaeeda, is hosted in the USA.

Registrant: Make this info private
fares.net
P.O Box 85
RAK, NA
AE

Domain Name: ALSAHA.COM

Administrative Contact , Technical Contact :
fares.net
nic.master@fares.net
P.O Box 85
RAK, NA
AE
Phone: +97172332383
Fax: +97172336966

Record expires on 13-Apr-2007
Record created on 14-Apr-1998
Database last updated on 23-Jun-2006

Domain servers in listed order: Manage DNS

N2.ALFARES.NET 69.16.237.151
N1.ALFARES.NET 209.172.49.81
NS1.FARES.NET 66.98.148.180

Show underlying registry data for this record

Current Registrar: NETWORK SOLUTIONS, LLC.
IP Address: 69.16.237.153 (ARIN & RIPE IP search)
IP Location: US(UNITED STATES)
Record Type: Domain Name
Server Type: Apache 1
Lock Status: clientTransferProhibited
Web Site Status: Active
DMOZ 1 listings
Y! Directory: see listings
Secure: No
E-commerce: No
Traffic Ranking: 1
Data as of: 25-Jul-2006

==============================

ARIN Details.

ALSAHA.COM

69.16.237.153
Record Type: IP Address

OrgName: Liquid Web, Inc.
OrgID: LQWB
Address: 4210 Creyts Rd.
City: Lansing
StateProv: MI
PostalCode: 48917
Country: US

ReferralServer: rwhois://rwhois.liquidweb.com:4321/

NetRange: 69.16.192.0 - 69.16.255.255
CIDR: 69.16.192.0/18
NetName: LIQUIDWEB-4
NetHandle: NET-69-16-192-0-1
Parent: NET-69-0-0-0-0
NetType: Direct Allocation
NameServer: NS.LIQUIDWEB.COM
NameServer: NS1.LIQUIDWEB.COM
Comment:
RegDate: 2005-05-26
Updated: 2006-03-28

OrgAbuseHandle: ABUSE551-ARIN
OrgAbuseName: Abuse
OrgAbusePhone: +1-800-580-4985
OrgAbuseEmail: abuse@liquidweb.com

OrgTechHandle: IPADM47-ARIN
OrgTechName: IP Administrator
OrgTechPhone: +1-800-580-4985
OrgTechEmail: ipadmin@liquidweb.com

IronSnot · Post by **IronSnot** » Fri Jan 26, 2007 10:22 am

.info names seem to come up with UTC times as well. But considering .com names started out as Network Solutions monopoly and they were originally Eastern State based, I'm assuming the time is actually EST.

Also Bulk Register domain registrations don't have the timezone on the whois records. They don't seem to provide any info about the whois timezones on their website either.

A search around whowas providers (you have to pay) might or might not help.

Personally I think this is a red herring.

As for the ewing (Nico Haupt - personally I don't think this is a real name either) code, well I'm still intrigued about why it's there. The Jajah stuff is not as interesting as the redirect.

IronSnot · Post by **IronSnot** » Fri Jan 26, 2007 10:28 am

Mark re Alsaha.com

Ask this guy;

Khaled Aal-Ali
Neurosurgery resident
Dalhousie University
Halifax, NS
Canada

I suspect he's the owner.

Mark Gobell · Post by **Mark Gobell** » Fri Jan 26, 2007 10:30 am

This is not the only claim that I have found suggesting http://alsaha.com is based in Dubai.

Am I mistaken in saying it is hosted by LIQUIDWEB in Lansing, Missouri ?

Co-operative reasearch are quoting this from Newsweek.

http://www.cooperativeresearch.org/enti ... alsaha.com

Profile: Alsaha.com

Alsaha.com participated in the following events as an active participant:

September 9, 2001: Internet Forum Message Warns of 9/11 AttackA message is posted on Alsaha.com, a website based in Dubai, United Arab Emirates, warning of the 9/11 attack. It proclaims that in the next two days, a “big surprise” is coming from the Saudi Arabian region of Asir, the remote, mountainous province that produced most of the 19 hijackers who struck on September 11. Since 9/11, the FBI and CIA have closely monitored this website as “a kind of terrorist early-warning system” due to its popularity with Muslim fundamentalists. However, it is doubtful if they were monitoring the site before 9/11, or noticed this message. [Newsweek, 5/25/2003]

Entity Tags: Federal Bureau of Investigation, United Arab Emirates, Central Intelligence Agency, Alsaha.com

Timeline Tags: Complete 911

IronSnot · Post by **IronSnot** » Fri Jan 26, 2007 10:36 am

Whois info for, NEUROSURGERYZONE.COM:

Registrant:
alrazi.net
PO BOX 85
RAK, NA NA
AE

Domain name: NEUROSURGERYZONE.COM

Administrative Contact:
net, fares nic@fares.net
PO BOX 85
RAK, NA NA
AE
+97172332383
Technical Contact:
net, fares nic@fares.net
PO BOX 85
RAK, NA NA
AE
+97172332383

IronSnot · Post by **IronSnot** » Fri Jan 26, 2007 10:37 am

http://www.neurosurgeryzone.com/nsx/?page_id=2

Khaled Aal-Ali
Neurosurgery resident
Dalhousie University
Halifax, NS
Canada

Mark Gobell · Post by **Mark Gobell** » Fri Jan 26, 2007 10:47 am

IS - how did you tie up this Khaled Aal-Ali chap with alsaha ?

Also, am I correct in understanding that alsaha is hosted in the USA ?

IronSnot · Post by **IronSnot** » Fri Jan 26, 2007 11:34 am

Just luck I guess Mark. If you google fares.net you'll eventually find neurosurgery.com and as their domain records have the same information, it's pretty reasonable to assume they're owned by the same guy. At the very least they've used the same webmaster to register their domains.

and;

http://www.dnsreport.com/tools/dnsrepor ... Alsaha.com

seems to indicate the main server is in Canada and the backup servers are in the States.

IronSnot · Post by **IronSnot** » Fri Jan 26, 2007 11:40 am

Actually you're right, the domain eventually resolves to;

69.16.237.153

and that's US based.

http://whoisx.co.uk/69.16.237.153

Mark Gobell · Post by **Mark Gobell** » Fri Jan 26, 2007 11:58 am

OK understood. Cheers IS.

I noticed the fares.net portal and did wonder myself about owenership.

It's suprising to find a website that Al Q uses and is invariably referred to as an extremist hate sate, is hosted in downtown Missouri, US of A.

Or is it ?

IronSnot · Post by **IronSnot** » Fri Jan 26, 2007 12:00 pm

Here's the telephone number from the Domain registrations, it's based in a free trade zone in UAE

http://www.ameinfo.com/66790.html

For further media information, please contact:
Mohammed Hamad Abdullah
Tel: 07 233 2383
Fax: 07 233 6966

He's a rich prick;

http://www.mhalmanagroup.com/index2.htm

IronSnot · Post by **IronSnot** » Fri Jan 26, 2007 12:07 pm

Websites can be hosted anywhere.

The guardian's talkboard for example is hosted in the US.

Mark Gobell · Post by **Mark Gobell** » Fri Jan 26, 2007 12:11 pm

Yes I'm aware they can be hosted anywhere, but alsaha is consistently referred to in the media as "the Dubai" or "the UAE" based web site.

When in fact it seems that it is only administered from there and the owner is registered in Canada and it's hosted in the USA.

Surely, the US would want this Al Qaeeda PR channel shut down wouldn't they ?