Internet Security Team Finds Jihadist Website Related to Zarqawi's "Successor"

By Andrew Cochran

Jim Melnick is director of threat intelligence for iDefense, the security intelligence arm of VeriSign, Inc., which operates the systems that manage the ".com" and ".net" domains. (Note: VeriSign is a client of GAGE LLC, the consulting firm where I am a Vice President). Jim provided excellent intel for us when Muslim hackers were targeting Danish and other Western websites during the "cartoon jihad." He has the following report from iDefense's Weekly Threat Report on a jihadist website that his team recently discovered (and e-mail addresses for further information):

"One of our analysts, Andretta Summerville, in researching and assessing post-Zarqawi developments in Al Qaeda in Iraq and especially the Internet side of things, has come up with what I think is a unique insight into a website that is a play off the same root name as the name of Zarqawi's successor, Abu Ayyub al-Masri, or "Muhajir" (or "Mohajir"), which means "emigrant." Andretta found a site that is similar to Muhajir's name in its Arabic derivation but which is called Mohajroon.com. The site does not deal with Islamic notions of emigration or refugees but rather foreign fighters (jihadists) and hacking issues. It is not a brand-new site but we found it to be quite interesting and are speculating that, following Zarqawi's death, many pro-jihadists and pro-terrorists worldwide who might now be seeking to link up with Al Qaeda in Iraq or similar groups might do searches in Arabic on Mujahir's name and find this site.

This website contains forums with a mix of threads covering items from the latest information on the militants in the Middle East, such as a video of militants in Syria, to hacker education, such as Microsoft Word documents available for downloading that detail CGI, unicode and php exploits. The members appear to be interested in physical and cyber-related threats. The membership of the site is growing and is already over 10,000+ members. Plus, we at iDefense/VeriSign are very interested to see what hacking issues or levels of cyber expertise may be covered on this site. We are still assessing that. Registration information for the website is given as Dubai, UAE, though it actually appears to be hosted by a company in Utah! Here is a graphic of the hit counter; within a recent two-day span. membership jumped from 9,939 to 10,130 and continues to increase:

For more information about mohajroon.com, you can contact Andretta directly at: asummerville@idefense.com. For persons wanting to know how to obtain a copy of the full Weekly Threat Report, they can contact Andy DiFazio at: adifazio@idefense.com."

TrackBack