Al Qaeda’s New Digital Shingle: Al-Fidaa

Thursday, July 14, 2011

Infosec Island Admin


AQ’s New Propaganda Board:

Al-Fidaa, the newest site in the Al Qaeda webring to spread the usual propaganda. This site popped up last week and I am just getting round to checking it out fully.

The site is undoubtedly a response to the takedown of Al-Shamukh a couple weeks back and this is their answer, to make even more redundant sites to pump out their agenda.

The difference so far with this site is that security wise (at first sniff) it has been upgraded. Google has been spidering the site, but even when you attempt to look at the content in the cache, you get nothing but the login page (click image to enlarge):



This is a decidedly large change from their past sites that leaked data. A further examination of the site structure and back end servers will tell if there is more to work with on Al-Fidaa (click image to enlarge):


Domain Data:

Another major change is that these site domains have been set up as privacy protected. This is a newer thing to most of these sites and the domains were set up in May of this year, probably in case they needed them, like the Al-Shamikh1 site that popped up so quickly after the original domain was capped by Godaddy and allegedly “BlackKatSec”

I would love to see the government go to these domain registries and locate how, who, and where the funds were transferred to create these sites. I am willing to bet that they were set up using cutout companies or individuals, but, maybe they will get lucky and get a line on a real person or two to ask some questions concerning ownership and connection to AQ (click image to enlarge):





Server Locations (click image to enlarge):





While the site is registered in the US, the actual servers are all located in Malaysia. So, once again we see that Malaysia seems to be a hub where the Internet Jihad is concerned. I have to wonder just how well our government gets along with the Malay government.

Could we in fact get some digital forensics love on those boxes out there? One also wonders just how many Malay jihadi’s there are out there and how many of them may in fact work for networks like Piradius. I ask this because many a server has been stealthed onto boxes run in those networks and I think from the looks of them, that they are being managed locally, not just hacked.

The Nature of AQ Sites:

Overall, it seems that this site is just another mirror like all the rest out there. They will have secret little rooms to chat amongst themselves, but the real Jihad goes on elsewhere. Primarily these sites are for the distribution of propaganda and to recruit the lone wolves in the West. I expect that it will just be the same thing with a different color scheme really… But, it will be something to watch.

If I find something tasty I’ll let you know.


Cross-posted from Krypt3ia

Possibly Related Articles:
terrorism internet Intelligence al-Qaeda jihadist Al-Shamukh Al-Fidaa
Post Rating I Like this!
Snaggle Puss Way back in 2003, the one hundredth jihadi website was forced off line...

For those people who have a genuine appreciation for "cut & paste" we have the following news from a year ago regarding Malaysia / Piradius / Taliban / and the notion of tolerance of such things.

Malaysian complicity in Taliban terrorism

Despite an apparently sophisticated attack on their online presence, the Afghan Taliban continue to operate a site here:

That IP address ( is provided to the Afghan Taliban by Malaysian company has been central to the online activities of al-Qaida and its affiliated organizations for many years.

The following is the most reasonable explanation I can come up with to explain why this is the case:

1. Piradius provides services to jihadi terrorist organizations because at the highest levels of Piradius there is substantial support for the ideology and goals of those terrorist organizations, if not for their methods. This is not the work of some rogue low-level employee, nor is it reasonable to suggest that this behavior is strictly coincidental.

2. The government of Malaysia turns a blind eye to the activities of Piradius and other Malaysian companies, because the government of Malaysia finds the threat of jihadi terrorism to be a useful tool as it pursues its own agenda, despite the fact that the vast majority of jihadi terrorist attacks occur in Muslim countries and the vast majority of the victims of such attacks are themselves Muslim.

This situation will persist until the Muslim countries of the world prevail upon Malaysia to cease and desist with their support for jihadi terrorism - no one in Malaysia is going to listen to complaints from Christians, Jews, or Pagans. Other options - such as putting companies like Piradius in the crosshairs of Western intelligence services - will likely fail to have a lasting effect so long as the Malaysian government continues to allow their country to serve as a safe-haven for the communications infrastructure of the global jihad.
Posted on 15 June 2010 @ 03:15
Krypt3ia So what you are saying Snaggle is you are John Galt?
First Last I, for one, think you're doing a good job of following these sites. I appreciate the intel. BTW, sent you a message about BKS misinfo through anon service but suspect you never got it. No worries. Life goes on, and so does the mission.
Krypt3ia @First, Thanks, yeah I dunno what is up Snaggle's ass but I know Haganah, never heard anything before out of anyone. Snaggle is just unhappy with life.
First Last Sent to your gmail account on which your domain is registered. Anyway, there is a time and place - and this ain't it. BKS knows nothing. Keep up the good work. It really does help.
Snaggle Puss Here is a clue:

Read the entire thread.

Take note of the following two domains that were used in the defacement: (prominent jihadi file dumping domain, property of "Aaron Wilson" aka "Mawsuat" / "Obelisk Network"

Drop those puppies into robtex.

Take note of the first domain and the domains sharing the same IP. Take note of the geographic locale.

From the "Forum is cracked" posting:

Take note of:
Yes. You are absolutely right.

User IP -
User Name - NooFa
User Mail -

upload to VBgallery trojan (122.php.wmv). I'm the only one user who can upload images in the gallery. It was not very difficult to find him.

Blocked by IP, nick, etc....

That WAS NOT problem with the, it's Photopost problem.


Take note of this posting regarding the jihadi defacement in the discussion about the hacked forms.

I would post the codes and the filesytem section they came through but I dont believe that is a good idea lol

I am not very pc literate at all so my info might be worded different.

one group came from washington dc and the other came from saudia arabia.
When we saw the hacking going on I tried everything to get into the admin section they blocked me completely out.
I then change my config sys file ( taking out the data base name and pw left it blank making the admin deleteable) uploaded it via while they were working and they still got teh job done. they were already in my Mysql data base I guess and having a hayday.
one of my admins who was online couldnt deleted the Admin user at all. then after a few mins he got knocked off.

Snaggle Puss From the previous post we saw this comment:

"Yes. You are absolutely right.

User IP -
User Name - NooFa
User Mail -

upload to VBgallery trojan (122.php.wmv). I'm the only one user who can upload images in the gallery. It was not very difficult to find him.

Blocked by IP, nick, etc...."

Looking at the IP in robtex we see Saudi proxies.

See: ptr
Saudi Arabia ptr
Saudi Arabia ptr
Saudi Arabia a
Saudi Arabia cname
Saudi Arabia cname
Saudi Arabia ptr
Saudi Arabia a
Saudi Arabia ptr
Saudi Arabia a

See in robtex:

Base Record Name IP Reverse Route AS a
United States
United States
(none) a
United States
(none) a
United States
(none) cname
United States
(none) cname
United States
(none) cname
United States
(none) cname
United States
(none) cname
United States
com net


Host names sharing IP with A records (9)
Snaggle Puss
If you trip through the cnet for you can get a taste of where these guys hang their hats.
Snaggle Puss For those that need a refresher concerning who's radar appeared on, take note:

To: JohnathanRGalt is one of dozens of terrorist websites all hosted at the same ISP in Malaysia. Qoqaz (means Caucus in Arabic) is devoted to jehad in Chechnya. The site was strongly connected to the former The home page does not have much information (isn't that a little strange for an ISP?). If you do contact and get a reply -- please forward a copy to me. Also contact (parent company).

address: Acme Commerce Sdn Bhd
address: Cyberjaya
descr: Co-Location & Dedicated Hosting
descr: Web hosting & Email Hosting
descr: IDC-3 Cyberjaya, Malaysia
remarks: Spam/abuse contact -
person: Wong Fook Seong
phone: +60-3-9281-9329
phone: +60-19-2102-813
fax-no: +60-3-9283-2779
From: The United States of America, Plaintiff, vs. Sami Omar Al-Hussayen, Defendant: INDICTMENT:

18. AL-HUSSAYEN was either the registrant of the administrative contact for a number of internet web-sites which either belonged to or were linked
to the IANA. A number of said IANA-related web-sites were registered to AL-HUSSAYEN directly, to the IANA or to Dar Al-Asr, a Saudi Arabian company that provided web hostings on the internet. AL-HUSSAYEN registered web-sites on behalf of Dar Al-Asr, identifying himself as the administrative point of contact for Dar Al-Asr and giving his Moscow, Idaho street address and University of Idaho e-mail address for reference.

19. Of the afor-referenced web-sites, AL-HUSSAYEN was the sole registrant of websites (crested September 11, 2000), (created March 15, 2001) and (created July 8, 2002). Web-sites (created August 15, 1999), (created November 1, 1999) and (February 22, 2000) were registered to Dar Al-Asr, with AL-HUSSAYEN as the administrative contact person. Web-site (created October 2, 1998) was registered to Al-Manar Al-Jadeed Magazine, with AL-HUSSAYEN as the administrative contact person. (created August 11, 1995) was registered to IANA and designed and maintained by the web-site entity Dar Al-Asr. (created May 25, 1999) was registered to IANA, with AL-HUSSAYEN as the head of its supervisory committee and member of its technical committee. (created August 18, 1998) was registered to IANA, with direct links to AL-HUSSAYEN's web-sites including and The registration of web-sites and (both created November 18, 2000) referenced Al-Asr and AL-HUSSAYEN, with AL-HUSSAYEN as the administrative contact for These two web-sites corresponded to a radical sheikh referenced in paragraph 21 hereafter. Web-site (created March 17, 2000) was related to a radical sheikh also referenced in paragraph 21 hereafter and posted articles to some of the Dar Al-Asr and AL-HUSSAYEN web-sites.

20. One of the afore-referenced web-sites registered by AL-HUSSAYEN was On September 11, 2000, AL-HUSSAYEN registered the web-site. In about June of 2001, an article entitled "Provision of Suicide Operations" was published on the internet magazine of the website The article was written by a radical Saudi sheikh. A portion of the article read as follows:

The second part is the rule that the Mujahid (warrior) must kill himself if he knows that this will lead to killing a great number of the enemies, and that he will not be able to kill them without killing himself first, or demolishing a center vital to the enemy or its military force, and so on. Thisis not possible except by involving the human element in the operation. In this new era, this can be accomplished with the modern means of bombing or bringing down an airplane on an important location that will cause the enemy great losses. [Emphasis added].

21. and other web-sites registered to or linked to, or technically advised by AL-HUSSAYEN, including (previously mentioned), also posted other violent jihad (holy war)-related messages by other radical sheikhs, including those referenced in preceding paragraph 19.
2 posted on 04/24/2004 5:57:17 PM PDT by JohnathanRGalt (---- Fight Islamist CyberTerror at: ----)
[ Post Reply | Private Reply | To 1 | View Replies ]
Snaggle Puss
Religion, wars, charity, send money...

Dear brothers and sisters in Islam ..

Allah Subhanahu wa Ta'ala said in Quran :

" Why do you not spend in the cause of GOD, when GOD possesses all wealth in the heavens and the earth? " 57:10

"Who would like to loan GOD a loan of righteousness, to have it multiplied for him manifold, and end up with a generous recompense? " 57:11

Pictures of the Killed Muslims there and how they are treated

(Beware!! This picture is not allowed to Children and people who fear from blood )

Your brothers and sisters in Kosova had been killed and raped ..... cause they believe in one God ... your brothers and sisters had been died cause they can't find any thing to eat ..

Your brother and sisters in Kosova can't find any thing save them from the cold ...

Imagine if our Prophet Peace be upon him was living till this time .. will he accept what happening to our brothers and sisters and leave them .. in this bad thing ... oooh brothers and sisters .. let's help them .. let's give them anything we can give even our Duwa to Allah to help them .. and to destroy the enemy of Islam your brothers want you .. don't left them ... go and search for any good Islamic organization that help the Muslims in Kosova and give them some money help the Jihad there

If you want to help your brothers and sisters in Kosova, you can contact

ICNA Relief/Helping Hand at the following locations:

United States of America Offices

US Tax Exempt ID: 11-2925751
Head Office166-26, 89th. Avenue,
Jamaica, NY 11432,
Tel:(718) 658-7028
Fax:(718) 658-3434


West Coast Office
9872 Chapman Avenue, Suite # 112,
Garden Grove, CA 92841,
(714) 530-1865

Canada Office
Canadian Tax Exempt ID: 0593061-39-09391

Burnhamthorpe Road E.,
Oakville, Ontario L6J 4Z2,

Tel:(905) 257-9997
Fax:(905) 257-9996

Please note ICNA Relief just recently changed its name to Helping Hand.

Also dontations can be sent to:

Albanian Islamic Cultural Center
117 Vanduzer St.
Staten Island
NY 10301, NY
(memo: for Kosova)


Staten Island Savings Bank
81 Water St.
Staten Island N.Y 10304
Acct. no. 0190100773 enclosure 16

The Albanian Islamic Cultural Center coordinates contributions with ICNA
and has an office in Albania under ICNA Albania.

For more information you can contact 1 718-816-9865

jazakum Allahu Khiran ...

Pictures of the Killed Muslims their and how they were treated

(Beware this picture is not allowed to Children and people who fear from blood )
Snaggle Puss Please return to the main hall of the exposition and if you need to use the facilities, please do so at this time.

The Kufar in the audience may now visit their favorite beer repository.

The second part of the tour will start shortly.

Snaggle Puss From the Wayback Machine we can see what kind of personalities were part of the ecology:

Take note of this snippet from the above archive material:

As-Sudais wa As-Shuraim full Quran Recitation in MP3

New ! 10 English Lessons

Shaikh Salman Al-Ouda
Arabic Lectures

Anasheed in MP3 !

Join our Mailing List

We might want to ask ourselves...
Who is that charming fellah, "Shaikh Salman Al-Ouda"

If you follow this link you may have a better idea:

ACCORDING TO A NEWLY-RELEASED DOCUMENT from the former Iraqi regime, during a February 1995 meeting with members of Iraqi intelligence in Sudan, one of bin Laden's first requests was for "the broadcasting of Sheikh Salman al-Ouda [who has influence both in Saudi Arabia and outside as a religious personality] and dedicate a program for them through the station directed inside the country." While bin Laden's desire to see a radical Saudi cleric broadcast on Iraqi TV has been known since the New York Times first reported on the existence of this document in the summer of 2004, the identity of that cleric has not been revealed until now.

Salman al-Ouda, like his better-known colleague Sheikh Safar al-Hawali, has long been known as a leading figure in the world of Islamic extremism. During the Gulf War, the two men were jailed in Saudi Arabia for criticizing the government and calling for an end to the U.S. military presence in the Kingdom. They were released after five years and today, their worldviews seem largely unchanged. In the case of al-Ouda, a growing pattern of evidence seems to indicate that he has continued to support violence against the United States and its allies since his release.

While al-Ouda has long been characterized as a "friend" of Osama bin Laden, federal investigators told the Seattle Post-Intelligencer in March 2003 that he and al-Hawali "have direct contact" with Osama bin Laden. In a number of al Qaeda propaganda videos, bin Laden has praised al-Ouda for "enlightening" the Muslim youth as well as for his support of jihadi causes.

In April 2003 following the invasion of Iraq, al-Ouda joined a group of 225 Islamist clerics, scholars, and businessmen--led by al-Hawali--in establishing a new organization that respected Israeli academic Dr. Reuven Paz described as nothing less than "the Supreme Council of Global Jihad."


Of course that ties in with this reference as well:

The “Global Campaign Against Aggression”: The Supreme Council of Global Jihad? (H.Q. in Canada?)
Project for the Research of Islamist Movements ^ | May 1, 2003 | Reuven Paz

Posted on Thursday, May 01, 2003 8:36:17 PM by JohnathanRGalt

Are Canadian Taxpayers subsidizing Islamist Global Jehad?
Innovation Place The mentor of Osama bin Laden, Safar al-Hawali, has set up a new organization -- The "Global Campaign Against Aggression" -- we trace the ISP hosting his website to "Innovation Place", (shown at left) a high-tech incubator program funded by the taxpayers of Saskatchewan, and the Canadian government.

We also trace at least one other jehadi website to Innovation Place.

Although the website of the "Global Campaign Against Aggression" provides an innocuous English translation -- the Arabic side delivers a different message.

Snaggle Puss It's a little more complex than Dos'ing jihadi message boards in far flung Arab colonies, like Malaysia.

The “Global Campaign Against Aggression”:
The Supreme Council of Global Jihad?
By Reuven Paz* (PRISM Series of Global Jihad, No. 6)

Introduction In April 28th 2003, a forum of 225 Islamist clerics, scholars, and businessmen established in Makkah/Saudi Arabia a new body of supporters of global Jihad against the United States and the "Crusader" West. They opened a special web site - -- in both Arabic and English, and published their existence through the Al-Jazirah TV channel. The new forum was meant to be the first global Islamist reaction to the American war against Iraq.

Out of the 225 original founders, 99 are Saudis, 15 are from Australia, 13 are Yemenis, 10 are Pakistanis, 10 are Moroccans, 7 are Kenyans, 5 are Mauritanians, 4 are Nigerians, 4 are Kuwaitis, and two are from the United States. Five of the founders are Saudi women. Since the announcement, as to May 1st 2003, 25 scholars joined the founders, 18 of them are Egyptians, including three senior clerics of Al-Azhar, and one Palestinian.

The secretary General of the forum is the known Saudi Dr. Safar al-Hawali, who is regarded by many scholars as one of the main mentors of Osamah bin Laden. The campaign is not limited by time, and according to its founders "The Campaign will continue as long as necessary to achieve its goals. Any projects or committees issuing from it will only be endorsed or developed after consultation with and study by the thinkers and scholars of the Islamic World."

The web site of the new forum (IP is registered through Innovation Place, 15 Innovation Blvd. Saskatoon, Saskatchewan CANADA, S7N 2X8, Tel. (306) 933-9825. The servers are: and
Snaggle Puss It's a tedious landscape.
Ali Baba Thanks for the cut&paste tour. I must now go to the facilities to wash my hands, for they stink from chopping onions all morning.
Snaggle Puss Ali Baba,

While we are on the subject of vegetables...

There is an expression in the Arab world that translates as:

"There is only one cucumber,it is either in your hand, or in your ass."

I see that many salads are being made.

15 July 2011

al-Fidaa? Down

The newly minted al-Fidaa forum, set up by al-Qaida itself, is currently down due to adverse action.

Four domains on one IP ( are unreachable, while two domains (the *.info's) on a second IP ( are nominally available, but are throwing database errors - presumably because the database resides on the first IP address.

Precise cause of the site's (likely temporary) downfall is uncertain, but there is no sign that either Namecheap of Los Angeles, or Telekom Malaysia, have taken decisive action to cease providing services to al-Qaida. So be prepared for the site to re-emerge with little, if any, change in service providers. Fire and adjust as necessary.

HT: Darth Odius


Oh, and a note to al-Qaida: The hudna is over, boys. We ended it.
Krypt3ia Snaggle, long winded copy paste pedantry aside, What's your point? So you or your pals took down a proto AQ site and once again you have copy and pasted from Haganah.

You utterly fail to get your point across because you are too busy copy/pasting and being hostile.
Krypt3ia When you have something constructive to add, drop us a line.
Snaggle Puss Please clarify the definition of "us".

The point is very clear concerning the true origins of what you ascribe to "Malaysia".

The Chinese have an expression as well...

"If you want to kill a dog, don't cut off its' tail."

Maybe an investigation of the prominent wellsprings of jihadist ideology fueling the global jihad movement would be a worthwhile undertaking.

Dollars to donuts, if their sites fell down there would be a lot of gnashing teeth.

Just a thought.

Snaggle Puss Now that the forums are weakened it seems logical to head to the next layer. That would be disheartening.
Page: « < 1 - 2 > »
The views expressed in this post are the opinions of the Infosec Island member that posted this content. Infosec Island is not responsible for the content or messaging of this post.

Unauthorized reproduction of this article (in part or in whole) is prohibited without the express written permission of Infosec Island and the Infosec Island member that posted this content--this includes using our RSS feed for any purpose other than personal use.