(Greek: κρυπτεία / krupteía, from κρυπτός / kruptós, “hidden, secret things”)

Search Results

Revolutionmuslim: Rollup

leave a comment »

Full size map HERE

Bilal Zaheer Ahmad was charged yesterday for inciting jihadi’s to kill UK government officials. Ahmad, known only as “Bilal” was a contributor on, a now defunct site that was known to incite jihad. The call that Ahmad made ended up with the stabbing of one parliamentarian by Roshonara Choudhry. Well, just before the arrest was made I had run some Maltego analysis of the contributors list that I posted the night before the site was actually taken down by the Brits and US authorities.

Since the takedown and arrest, I have also uncovered some more tidbits about not only Bilal but, also some of his “friends and fellow contributors” Hopefully, soon there will be some more arrests as Bilal’s pals are a wonderful group of jihadi’s and jihobbyists who really aren’t too smart with their personal data.

Tsk tsk tsk


Written by Krypt3ia

2010/11/18 at 21:13

Revolutionmuslim and Its Contributors #MappingJihad

with one comment

All Maps HERE


Abu Muhammed Al Maqsud
abu bar’aa
Umm Rasheed
Abu Hassan
Abu Ayoub Al-Ghareeb
Abu Najm Muhammad
Al X  
Abu Saif
Abu Ikrimah
Abu Nusaybah

Amir/President: Yousef Al-Khattab
Spiritual Advisor: Sheikh Abdullah al-Faisel
Political Wing Analyst & Adviser: Younes Muhammad
Secretary: Abu Talhah al-Shami
Art/Poster Designer: Abu Nussrah Al Salafi

The above user names and their attendant sites are the primary contributors that I have found on With the recent stabbing of a British official by Roshonara Choudhry citing revolutionmuslim as her source of inspiration, I was contacted by an interested party, to look into the site. The site itself is not the usual fare that I am used to with jihadi’s and takfiri’s but it gets its point across pretty well without having to be as sensationalistic in imagery and content as say the Ansar boys. They do however seem to be an outlet for AQAP, serving out the Inspire magazines with fawning commentary to go along with it.

One of the itnteresting features is a capability to post anonymously… One wonders though, just how anonymous that really is given some interesting facts.

1) The site is located physically on a server on the Google domain in Mountain View

2) The titular operator claims to be located in NYC a Yousef Al-Khattab

Given these two bits of information, one has to assume that the FBI already has had contacts with Goog with the exigency arguments on getting the data from the site, who owns it, who trafficks it, etc. This I assume would include anyone who goes there to post anonymously. Unless they are using a proxy, then they are likely being tracked already. I however, do not have that kind of access, and instead began to use Maltego, Google, and my nose.

The above “contributors” pages included links to their own sites, emails, and other data that links them to their potential real identities. If you go through the maltego maps, then you can see where they also post on other forums and get a better picture of their on-line jihdist lives. There’s a TON of data to sift through, so help yourselves and if you find anything tasty, please do drop me a comment here.

It would seem that this site has been a nursery of sorts.. Chesser, Jesse Morton, etc… And the feds have been looking into them.. Maybe this data can help.

More when I have it.


Written by Krypt3ia

2010/11/05 at 16:00

Jihadist Friends of Abdullah As Saif

leave a comment »


In going through the Facebook jihadi social networks I have come across so many “jihadi friends” that it just seems inundating. Zucky never thought that his means of getting laid and being cool would ever be used in this way did he? I only wish that Zucky and company would be a bit more open and less litigious so that I could use Maltego to interface directly with facebook and run some maps of these accounts. But alas.. Zucky is.. well.. Zucky. So no joy there at present as transforms go for Maltego.

Meanwhile, it seems that AQAP has spun up with these toner bombs today. In looking at all the reporting today, I see that AQAP is up to its usual tricks with the PETN and their penchant for air attacks. Of course they did their homework on the parcel/baggage theme of the attack. Even with the upgrades and the actual checking of baggage now, we still missed the boat here. If it had not been for the intel tip off by the Saudi’s we would not have known.

One wonders if there are more packages in trucks….

Ok, back to jihadibook…I have begun to just copy the users and their links directly from the user profiles to manually perform searches… If you wish to play at home, here you go…



مسلم موحد ولا فخر 

Instituto de Formação Profissional Administrativa

Written by Krypt3ia

2010/10/30 at 00:12

Facebook Jihad

with 4 comments



So this morning I was watching “The Social Network” and thought “I wonder if the jihadi’s have facebook pages that I can cull” Well, sure enough, with a few key Google searches I was able to easily locate sites devoted to groups as well as individuals on the path to violent jihad. One has to wonder if Zucky and his minions know about these as well as perhaps are letting them exist online at the bidding of the government doesn’t one? The alternative is that they have no idea that they are there.. and… well, the way they mine our data for their profit just doesn’t allow for them not knowing these are there in my mind.

Facebook Jihadist Sites:

Mujahid Indonesia Facebook

Mujahid Indonesia | Facebook
Parako mga Guraba a mga Bangsa Moro | Facebook
THORIQUNA | Facebook
Muazzam Usman | Facebook
‫الشبكة العالمية للجهاد الإعلامي THE WORLD NETWORK FOR MEDIA JEHAD | Facebook‬
Awaludin Mujahid | Fahad Ali Mujahid | People Directory | Facebook
Mujahideen Videos
Jihadi Nasheed | Facebook
Ribat Media Center | الرباط مرکز نشریات | Facebook
war against america g.a mujahideen…….! | Facebook
Afghanistan Mujahideen | Facebook
Al Mujahideen w’Al Shuhadaa | Facebook
Khalil-Mujahideen Negrophil-Army | Facebook
Muhammad Amriki | Facebook
Ansar al-Mujahideen::Stances Regarding the Method of Relief Work::By The Mujahid Sheikh / Osama bin Laden | Facebook | Facebook
Mujahidheen fi sabeelillah | Facebook
فحص أمني مطلوب | Facebook
Al Jihad | Facebook
alshabaab | Facebook
Omar Hamza | Facebook

All of the sites have anywhere from 200 to 4K users or posters who “like” them (heh) and I am going to develop a methodology to spider them all and then Maltego the shit out of all of them. Hey all you takfiri shahid wanna-be’s out there..

See you soon.


Written by Krypt3ia

2010/10/26 at 19:37

Nowhere To Run, Nowhere To Hide

with 2 comments


Full Map Here


I have begun to use Maltego in a much more macroversal but refined way. It takes time, but the triumvirate of Google, Maltego, and a little mental elbow grease gets pretty good results. In this case, I found several digital alias’s that the end user used online and set them apart on the map. Once the searches are performed, the behavioral pattern emerges.

  • Who they are
  • Where they post,
  • what emails they use and post with
  • What they are saying and to whom

Between Goog and Maltego, you get a great idea of the patterns they show and then with some reading, you can determine who these people are. Their native languages, and where they really are as opposed to where they “claim” to be.

Good stuff.

Perhaps a paper may come of all this…


Written by Krypt3ia

2010/10/19 at 19:14

“The Jihadi Social Network”

leave a comment »

The Jihadi Network


Lately I have been feeling a little overwhelmed by the sheer amount of crazies out there on the intertubes to chase. It seems like the jihadi sites are just popping up like mushrooms on piles of internet dung too. So, in a state of apathy, I decided to map out the “Top Ten” jihadi sites out there to see their interconnectivity and if indeed they were related to each other. What I found was kind of interesting. Many of the sites have links to each other, but also that many seem to have all of their eggs in one server.

One of the other features here from these searches also is an expanding of the jihadi site list that I have already. Just from this one map above, I have come across a whole slew of Indonesian jihadi sites on WordPress. These sites also have more links on them to others.. and on.. and on.. You know, its the interwebs. I will continue following them all down the rabbit hole and see if anything interesting turns up. However, I decided to let you all play at home. If you like, you can open the Maltego maps here

Meanwhile… I ran across an interesting trend.. The irahbi’s are multiplying! Irhabi’s as in irhabi001, irahbi008, and irhabi009. The interesting part seems to be a connection to the Indonesian’s again…

The irhabi iterations are all over the place and talkative on the usual sites. I guess they are just picking up where Younis left off back when he was caught and put into detention.

Full Map

It would seem that they have been busy, but I am getting the impression that the new gen of irahbi’s has just been getting started. I will drill down a bit more and see what I can locate to pass on. As I have pointed out in the past though, I do worry that the Indo Asiatic sector of Jihad is just beginning to really spin up. As such, we should be looking toward that area for more possible events as well as support to the AQAP and AQ boys.

The other troubling aspect here is just how connected these guys are to the kavkaz (Eastern European) sector too. The mujhaids in the Baltics are still very active and also have a long, distinguished history of jihad. Of course these are the same guys who brought you the attacks on the Russian opera house and the school in Beslan so, we know what they are capable of.

More soon…


Written by Krypt3ia

2010/10/15 at 11:25

Binyamine | Crusades | Jihadist Encyclopedias and Metadata

leave a comment »

Full Size MAP



The Darkweb Project has allowed me some more access into the jihadist world and I have been leveraging that to look a bit more closely at all of the takfiri’s out there one by one… Well at least the interesting names anyway. In this case, the map above is for a user (#75 on Ansar1’s English forum) and what I would call a “Propagandist” for the cause of Jihad. Here are the basic stats on him:

1) He’s either American or Canadian (my bet is American from the syntax)

2) He is plugged into As-Sahab, Al-Malahim, & Jundullah Studio

3) He has been not only posting videos but also editing/creating them

4) He likes pr0n and the blood finally left his head enough to make a mistake

You see, Binyamine had been pretty assiduous about keeping his personal information to a minimum on the boards and places he has been posting. I had a devil of a time actually locating an email address, AIM session, MSN session, etc on him from anywhere. That is until a little creative Googling using previous behavioral data gave me two hits. Hits which turned out to be his email addresses. I shan’t put them in here though. His downfall though was a desire to post comments (non jihadist) on a free porn site!


However, by using Maltego, I was able to not only see where he has been posting, but also make connections between names/entities/sites to give a good pattern of behavior for further investigation into ol’ Binny. Oh, and yeah, for a guy who hates the Zionists and rails against them, odd name choice there buddy.. Binyamine.. aka Benjamin in Hebrew… Go figure…

“Zionists sound the alarm: a war for Islamic Caliphate is going on in the Northern Caucasus”,“75”,”Binyamine”,“Peace mercy and blessing of Allah be upon all of us. Quote: Zionists sound the alarm: a war for Islamic Caliphate is going on in the Northern Caucasus Publication time: 9 October 2009, 10:18 Zionists sound the alarm and call to “pay attention” to the Northern Caucasus. As ITAR-Tass reports referring to an edition of Jewish State, upon performing the analysis of situation the Jewish “experts” arrived to the conclusion that Northern Caucasus “from the internal problem of Russia transformed into an international one”. In opinion of Zionists, North Caucasus is “one of the central fronts and breeding ground for the global Jihad aimed for creation of Islamic Caliphate” now. Jewish edition asserts, “the facts about connection of Chechen militants with international terrorism are becoming known more and more frequently lately”. As an example of such «connections» the edition wrote about a recent self-immolation operation in Nazran city, which resulted in dozen of disbelievers and apostates destroyed. “One of the leaders of extremists of Northern Caucasus – the ideologist of wahhabis and terrorists Aleksandr Tikhomirov, better known as Said Buryatskiy was involved in this attack”, Zionists report a “new”. Zionists from Jewish State wrote they “conducted investigation and identified that Said Buryatskiy undergone a lengthy training in Saudi Arabia”. Let us remind that critics of Said Buryatskiy assert the contrary – that he studied nowhere and is a self-taught person. Jewish State also revealed an “intel”: it turns out that Said Buryatskiy “swore allegiance” to Dokka Umarov. Certain Yossef Bodansky is presented as an “expert” investigating Jihad in Caucasus, who, as it is claimed, was before a director of the “Congressional Task Force on Terrorism and Unconventional Warfare of the US House of Representatives”. This «expert» declared, that the reason “Chechnya has become such an advanced threat are the tons of cash flowing from Saudi Arabia and the Gulf states for these kinds of operations”. We will remind that Moscow and its marionette Kadyrov assert the opposite, declaring that Mujahideen have neither money nor food, and that they will die of starvation soon. A colleague of Yossef Bodansky, an “expert” Gordon Hahn from Monterey Institute complained that western mass media got used to “frame the issue of Chechnya in terms of Russian human rights violations and the Chechen people’s autonomous yearning”. “It is actually a time to revise such approach, because it no longer represents the reality, and Chechnya has become an active hive of Islamist Jihad”, Gordon Hahn told. Department of Monitoring, Kavkaz Center Source: Quote:”,”2009″,”10″,”12″

Anyway, his data may provide more once I do some more digging. Suffice to say that he seems to be more than just the average “Jihobbyist”…


In other news… I came across this photo yesterday on a blog. The picture is from Afghanistan and I think it pertinent to show here and talk a little about…


Not unto us, o Lord, not unto us, but to Your name give glory


As you can see this image is counter productive to the GWOT because it lends credence to the arguments of the Salafist’s, that they are in a war with invading “Crusaders” What better image to say that here than the Knights Templar huh? This was left by the French Foreign Legion and not only does the imagery of the Templar give reason to the Jihadist ferver, but also note the use of the “mice” which looks a lot like a “rat” The mice/rat image is also reminiscent of the images of rats in Nazi propaganda.

This does not help our cause…

Just one of the perception issues that we face that is fueling this fire.. Thought I would share…

Jihadist Encyclopedias


While doing background on “CENSORED31” I came across this file set from 2008/09 that I was able to perform a full metadata investigation on. The file is called “Maosoet Eltadreeb Alaskary” and is a full series PowerPoint show with video tutorials and PDF’s on how to carry out Jihad. It’s much the usual fare you see out there to teach the takfiri how to perform tradecraft without the benefit of going to a camp somewhere in Peshawar or Waziristan. What was different about it was that it had a sole author and all the files had been bundled together….


Using FOCA, I was able to import all of the files in and see what the PC name was of the machine this guy was using as well as his username, system OS, and file structures that he as using:

System: PC_Mojahed

OS: Windows Vista

User1: Mojahed

User 2: ZAK

Etc etc… You can see from the jpg’s here the rest of the data. I am still looking into tracing this guy down a bit more so look for updates later on.

Overall, I really like using FOCA to get this data not only from local files but the web too. I will be using this in the next stage of the Binyamine investigation.. He has been posting more than a few photos… I wonder what his metadata is like….

More soon.


Written by Krypt3ia

2010/10/07 at 11:20 Follow The Emails

leave a comment »

With all of the stuxnet he said, she said, I thought I would approach the problem on what is really happening there in Iran by taking the bull by the Maltego. So, I located the aeoi site in Iran and stared my digging. Interesting how you can get so much information to start with when you use this tool to footprint people with email addresses there huh?

More later.. Just a taste for now….


Written by Krypt3ia

2010/09/29 at 14:53

Cyber Jihad: Malaysia and Indonesia

with 4 comments

Just a couple weeks ago, a paper was put out by the Bipartisan Policy Center that looked back at where we were on 9/11 and how far we have come with regard to dealing with terrorism. The paper did not really have a wholly heartening tenner and in fact pointed to some new areas of concern. One of the areas of concern was Asia and Jihad. As coincidence would have it, I just stumbled onto a new site that has been set up by an Indonesian group and has connections to the Ansar boys via our old pal Ansar007, or is it now al-ansar007? Or how about irhabi007 redux, a new player with an old name who is trying to emulate Younis Tsouli?

The site in question is and it was started in July:

Domain ID:D159760330-LROR
Created On:28-Jul-2010 04:19:08 UTC
Last Updated On:18-Sep-2010 07:57:42 UTC
Expiration Date:28-Jul-2013 04:19:08 UTC
Sponsoring Registrar:Melbourne IT, Ltd (R52-LROR)
Registrant ID:D128027988480526
Registrant Name:cyberjihad
Registrant Organization:cyberjihad
Registrant Street1:2804 S. Lincoln Ave
Registrant Street2:
Registrant Street3:
Registrant City:Sioux Falls
Registrant State/Province:SD
Registrant Postal Code:57105
Registrant Country:US
Registrant Phone:+1.6059884611
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Admin ID:D128027988480523
Admin Name:Alexis Ricci
Admin Organization:cyberjihad
Admin Street1:2804 S. Lincoln Ave
Admin Street2:
Admin Street3:
Admin City:Sioux Falls
Admin State/Province:SD
Admin Postal Code:57105
Admin Country:US
Admin Phone:+1.6059884611
Admin Phone Ext.:
Admin FAX:
Admin FAX Ext.:
Tech ID:D128027988480525
Tech Name:YahooDomains TechContact
Tech Organization:Yahoo! Inc
Tech Street1:701 First Ave.
Tech Street2:
Tech Street3:
Tech City:Sunnyvale
Tech State/Province:CA
Tech Postal Code:94089
Tech Country:US
Tech Phone:+1.4089162124
Tech Phone Ext.:
Tech FAX:
Tech FAX Ext.:
Name Server:NS2469.HOSTGATOR.COM
Name Server:NS2470.HOSTGATOR.COM

The site sits on a server in Houston:

NetRange: -
OriginAS:       AS36420, AS30315, AS13749, AS21844
NetHandle:      NET-174-120-0-0-1
Parent:         NET-174-0-0-0-0
NetType:        Direct Allocation
NameServer:     NS2.THEPLANET.COM
NameServer:     NS1.THEPLANET.COM
RegDate:        2009-03-23
Updated:        2009-03-23

OrgName: Internet Services, Inc.
OrgId:          TPCM
Address:        315 Capitol
Address:        Suite 205
City:           Houston
StateProv:      TX
PostalCode:     77002
Country:        US
RegDate:        1999-08-31
Updated:        2008-05-20

The data from the whois turns up a name, email address and phone for one Alexis Ricci, which when put into Maltego gets the following hits:

Which in turn gives a hit on an SBCglobal address that puts this person in Texas, not in South Dakota… The phone number that is listed in the WHOIS comes up in databases as a cell phone, but that is about all I am getting at the present time without actually spending money on a backtrace of the number. I suppose I could call it… In the end, I am pretty sure that this is just some hacked data that they used to enter the whois data and set up the site. It would be interesting though to see who and how this domain was paid for. A Google map of the address does put it in a residential neighborhood and in fact there is a house there… More can be done on this but I think its just a red herring.


The site as I said is new, and now has 157 members… All of which I have enumerated because the site is poorly constructed security wise. One can just poll the php tree by ticking a number into the php=? area of the url. Here are some examples of the kiddies!

I have them all now, and many of them were kind enough to give not only email addresses, but also their websites as well as one poor bastard actually used his REAL photo in his! Yeah, hi there, the Indonesian security forces will be coming to see you soon! There is a lot there to wade through with Maltego, but eventually I will have it all collated and post the results on each and every member.


Now, on to the whole connections thing and import here. This site, while crude, is just a hint of the movement that has been happening in the Asia area for some time now. As you may recall, some of the 19 hijackers had meetings in Malaysia and Indonesia before they actually started the operation. Malaysia in fact, is the host country to many of the Jihadi sites on the net now and I suspect that is not only because of the sympathetic groups there, but also the lax computer law in the countries that they reside in. Piradius net has been one of the bigger sites and in this case the site is actually not there, which is a surprise of sorts.

The members of this site also have been active in hacking and defacing sites. Some, like Karkoon above, also have Facebook pages and connections to their other hacking sites. It would seem that at best, these guys are just capable of page defacements at best and not much else. However, the ranks have grown quickly and in fact, with the connections to Ansar (at least one of the members here I have seen before and is in Palestine) could be another arm of the Jihad online. If they got direction and support from the others on similar jihadi sites, then they could be another fly in our collective ointment… That is, once they learn more than just page defacing.

Another thing to note here is that Asian connection again. So far the general populace and the news really haven’t gotten it into their heads yet that the Malay and Indonesian (Asiatics) are also a group to be on the look out for with regard to up and coming jihad movements. What if cells of new Asian Muslim Jihadists start to make inroads at the behest of AQ?

Something to think about…

What also, if these guys are reaching out to the likes of the Baltic jihadis too? Yep.. I have seen traffic… It’s a nightmare of data….

I will continue the sifting and point out the interesting bits…


Written by Krypt3ia

2010/09/22 at 20:06

The ersatz tarek_bin_ziad_army: Alleged Creator of “Here You Have” Virus

leave a comment »

Since this virus/malware “here you have” has made the mainstream news feeds, I thought it an interesting experiment to see what I could see with Maltego and Google on this character. The malware evidently had a sig in it that had the email in it, so plugging that into Maltego I came up with some related email addresses. Extrapolating further the searches also came up with an interesting website hit that our boy had posted to. Google however came up with more data that lead in a different direction and a new email address that eventually gave up the tarek_bin_ziad_army name/account that I think this guy was planning on using to create a Yahoo group. So far though, he has no group out there that I could find.

He did post this little missive though on another islamist site laying down the goals for his organization…

By plugging in the tarek_bin_ziad_army name as a “phrase” into Maltego I was able to come up with the email address I believe he is going to be using to start the yahoo group: This yielded some ancillary email addresses that he has chatted with on certain sites that include the —> which relates to a hacker who has been defacing pages from the arab hackers network.

In all, the guy who is alleged to have had a hand in creating the “now you have” bug has been around the islamic jihad and Arab hacking scene since around 2006-2006. At first he was asking around for coders to make malware for jihad.. Now, he has been posting less under these accounts.. In fact he really hasn’t posted all that much under it or Iraq_Resistance (his usual handle) Most of what I have found is he signs up for boards and then posts nothing. No real user data either so he is being mostly smart about it. He certainly doesn’t have the pinache of Dr.Kasber…

All in all, this guy is more an annoyance than anything else from what I am able to see. However, given time and perhaps fame from this particular bug and the news cycle’s “Electronic JIHAD!!!” he may get more traction. Lets see though if he sets up the site and if he gets some takers on that. I will continue looking into him… Lets see what he does next.


Written by Krypt3ia

2010/09/14 at 22:53