January 23, 2007
The Voice of the Caliphate channel is back up, and still broadcasting from Germany. Presently, they are showing an Islamic Army in Iraq compilation video of various "operations" against U.S. targets. Not shown is the video of the Islamic Army in Iraq murdering Italian Red Cross worker Enzo Baldoni. That would be bad PR.Do your part in the global war against Islamofascism: just click here and suck some of the jihadis bandwidth. Hell, just turn off the sound, minimize it, and leave it on all day. The purpose of the broadcast is to spread the message to would-be jihadis, but there is only so much bandwidth to go around. The more bandwidth we suck, the less available to the would-be mujahideen of the world.
Update by Howie: The stream is now dead. Not sure why the site may have been removed or we could have sucked up all their bandwidth. Whatever the reason, Good riddance.
Update II by Howie: I Was was able to access this stream today. It died after a few seconds. So it's not dead just badly wounded. Earlier: Voice of the Caliphate (GIMF): Jihad TV online.....from Germany
Posted by: Rusty at
11:56 AM
| Comments (7)
| Add Comment
Post contains 200 words, total size 1 kb.
Posted by: Darth Odie at January 23, 2007 01:06 PM (2cR/Y)
Posted by: Randman at January 23, 2007 01:12 PM (Sal3J)
Posted by: Rusty at January 23, 2007 01:29 PM (JQjhA)
Posted by: Fred Fry at January 23, 2007 01:49 PM (JXdhy)
Posted by: Henry at January 23, 2007 04:13 PM (Q0YFL)
Posted by: templar knight at January 23, 2007 04:14 PM (qmQtL)
The Ip address listed in the link you provided resolves to this:
87.118.96.168
Hostname: ns.km22224-05.keymachine.de
Now, a hostname starting with NS is using the standard definition for a Name Server. In other words, this is a DNS server in Germany.
A quick port scan shows that UDP port 53 is indeed open, which indicates this could be functioning DNS server. I was able to successfully do a DNS request against this server:
> server 87.118.96.168
Default Server: ns.km22224-05.keymachine.de
Address: 87.118.96.168
> www.google.com
Server: ns.km22224-05.keymachine.de
Address: 87.118.96.168
Non-authoritative answer:
Name: www.l.google.com
Addresses: 209.85.135.147, 209.85.135.99, 209.85.135.103, 209.85.135.104
Aliases: www.google.com
This confirms this as a functioning DNS server.
The port scan further showed that there were several other open ports on this machine. Ports that should NOT be open on a machine that is only hosting DNS.
TCP ports (16) 21,25,53,80,88,110,135,443,1025,1755,3306,3389,7070,8000,8001,8080
It looks like this is a compromised public DNS machine.
Just to be sure, I checked the hostname against a WHOIS search, and came up with this:
Domain: keymachine.de
Descr: Keyweb AG
Descr: Neuwerkstrasse 45/46
Descr: 99084 Erfurt
Descr: DE
Nserver: ns.keymachine.de 62.141.48.94
Nserver: ns2.keymachine.de 62.141.60.11
Status: connect
Changed: 2004-09-03T14: 23: 4502: 00
So this is owned by www.keyweb.de, a german hosting company.
It's looking more and more like a compromised DNS server that was doing the hosting. This also means that any hits going to this were simply taxing the DNS server, causing the local DNS to failover to the secondary one. Meaning that all anyone was doing here was killing an ISP's DNS, not sucking up paid-for bandwidth.
This also means that the jihadis are realizing that they will be unable to stay for any length of time on a legitimate ISP connection, and are resorting to hijacking unsecured servers to host their filth.
This is both good news and bad news. Good news, in that we have driven them out of the legitimate market. Bad news, in that we will now have to be much more careful and investigative when going after them so as not to harm an innocent victim of a server hijack.
In this case, we may want to e-mail the ISP in question, and advise them that their DNS has been hijacked by terrorist sympathizers in order to host Windows Media videos that support terrorism. The only contact e-mail they list is as follows: keyweb@keyweb.de
Posted by: Wearyman at January 24, 2007 11:44 AM (puky3)
34 queries taking 0.0257 seconds, 162 records returned.
Powered by Minx 1.1.6c-pink.
