EXCELLENT WORK:G.

HACKERS PAL is a Palestinian Hacker. Hackers Pal
hack websites and deface them by leaving behind a
message. he is one person and have website which isSoQoR.net,
he is well knowing programming languages and discovers vulnerabilities
he is one of milw0rm vulnerabilities discovery (his milw0rm archive)
and he also add vulnerabilities on security focus and many other websites
he hacked many famous websites like t-warez and counter-strike and other governments websites
and companies and many of his defaces remains for months .

ATTENTION: this page contains raw data at the moment
and has not been structured or analysed. It also contains
links that may not be sanitized, do your part in sanitizing
them correctly (see the counter-intel page on how to do this).

Defaced page image

Alternate name: "The palestinian hacker"
Catchphrase: "your security is too weak .. be careful next time"



The above two lines were encoded with the following links:
security@soqor.net (Vaild email) Looks like its a hotmail account.
www.soqor.net/
Websites affiliated with the group

Link below goes to internal wiki entry.

SoQoR.net


List of affiliated individuals

The following list of persons was found on the disfigured hacked webpage.

HACKERS PAL
The Hacker himself

Name: ?
Sex: Male
Date of Birth: 1990-02-22
Location: Gazza
Religion: Muslim
Profession: Programmer.

Emails for HACKERS PAL

• security@soqor.net
• s2b@hotmail.com

Note: In August 2008, Palestinian hackers attacked the HAMAS Military Wing's website on behalf of FATAH. An Israeli news outlet discussing the ongoing conflict showed a defacement page that looks exactly like Hacker's Pal's.


Devil-00

Possible hacker. Posts on numerous hacker and security sites.

Emails for devil-00

• stranger-killer@hotmail.com (Invalid email address)
• devil-00@s4a.cc (Invalid email address)

• It appears that s4a.cc = Security 4 Arab (source)
  • Todo: new page on security 4 arab. What is it etc.
    

Mohajali

Name: ?
Sex: Male
Date of Birth: 1984-07-13 (source and here)
Location: Ramallah
Religion: Muslim
Profession: Programmer.
Works for or worked for:

1. Madek

• A Ramallah-based computer hardware company:

http://anonymouse.org/cgi-bin/anon-www.cgi/http://www.madek.com/MaDeK/default.asp

http://anonymouse.org/cgi-bin/anon-www.cgi/http://www.pipa.gov.ps/view.asp?id=493 **Note the contact email**

2. Noursoft -- http://anonymouse.org/cgi-bin/anon-www.cgi/http://www.noursoft.com

• A computer software company - based in Egypt

http://anonymouse.org/cgi-bin/anon-www.cgi/http://www.pipa.gov.ps/view.asp?id=497

Noursoft

[Egypt]
Street Address : 23 Othman Bin Afan St. From El-herfa St. From El-geish St.
City : Damanhour
Province/State : Elbehira
Country/Region : Egypt

http://anonymouse.org/cgi-bin/anon-www.cgi/http://www.alibaba.com/member/alaa2000/trustpass_profile.html

3. NCS -- Most likely "NCS" refers to this Singapore based computer company

http://anonymouse.org/cgi-bin/anon-www.cgi/http://www.ncs.com.sg/

4. Jaffal Group

• A Ramallah-based Telecommunications company.

http://anonymouse.org/cgi-bin/anon-www.cgi/http://www.pipa.gov.ps/view.asp?id=468

http://anonymouse.org/cgi-bin/anon-www.cgi/www.jaffalgroup.com#http://www.jaffalgroup.com#

todo: who does he currenty work for now? possibly a social engineering type mission when we find his name

Email

• mohajali2k4@gmail.com

Primary Internet Handle: Mohajali
Alternates: deadheart2k5, mohajali2k4, godofdeath_2003

• todo: search google for these alternates

Instant Messaging ids

• MSN: godofdeath_2003
• Yahoo: deadheart2k5

Other hackers affiliated with Mohajali that arn't with Pal Hacker.

• nEt^DeViL
• XTech Inc [Sys7ech]
• Eno7
• Eddy_BAck0o

Strengths: Seems to be a key hacker in the group for writing code. He will know computer security and programming inside-out,
probably a formidable opponent in computer offensive attacks and possibly defense. All the other members seem like script kiddies.

Weaknesses: Penchant for approaching women online and messaging them. Way too open, has left way too many links between
his virtual self and his real self, stands in opposition to his probably high computer security skills (if that is the case are his virtual
presences accurate? or disinfo? or is it a case of gloating and ego driving him to leave his virtual self all over the place?.

Mohajali has presence on the following sites:

Metacafe (video social networking)

• He has a metacafe page which states he is a "23 Years Old Male From Ramallah Palestinian Authority". He doesn't have any videos,
  
• and has one comment. site: http://anonymouse.org/cgi-bin/anon-www.cgi/http://www.metacafe.com/channels/MoHaJaLi

MindViz (video social networking)

• http://anonymouse.org/cgi-bin/anon-www.cgi/http://mindviz.com/mohajali

Broadcaster (music social networking)

• http://anonymouse.org/cgi-bin/anon-www.cgi/http://www.broadcaster.com/video/profile.php?view=62996

Yahoo

• He has a yahoo answers profile which shows he has answered six questions pertaining to hacking.
  
• Link: http://anonymouse.org/cgi-bin/anon-www.cgi/http://ca.answers.yahoo.com/my/profile.php?show=PQ0AOTOOaa
  

FriendCircles (social networking)

• The guy also has a photo online and a social network of his friends which will probably end giving us his real identity.
  
• Website with his photo and friends:http://anonymouse.org/cgi-bin/anon-www.cgi/http://mohajali.friendcircles.com/

Flickr (photography and social networking)

• http://anonymouse.org/cgi-bin/anon-www.cgi/http://www.flickr.com/people/50117255@N00/

Hi5 (social networking)

• http://anonymouse.org/cgi-bin/anon-www.cgi/http://nuaumzi.hi5.com/friend/10061286--Mohajali--Profile-html

Lezr

• Mohajali is linked to this Islamic Hacker community

Facebook (social networking)

• Email address mohajali2k4@gmail.com is associated with "Mohammad Abd Hajali", located in Palestine, attending Birzeit University as a Graduate student, and graduating in 2008.

J-Hacker



Dr.Exe

Email

• phpshell@hotmail.com

Crack3r
Webcracker
gacker
Sp1der_Net
Black AttaCk
MiniMan

JareeH BaghdaD

Hundreds of google hits on this guy, however they are all affiliated with page defacements. Very little information on him on the open web.
Possibly more within the close communities.

Dr Hacker


HaCoOr

Prolific script kiddie web page defacer, is affiliated with palestinian hacktivists.

Name: ?
Sex: ?
Location: Possibly in Egypt. He defaced several members of an engineering department in the Cairo university, reason for this is unknown,
but considering this guys usual MO is to deface websites the targeting of individuals within university seems to specific.

Emails

• wnx@hotmail.com
• HaCoOr_x_root@hotmail.com
• Zvd@hotmail.com
• HaCoOr-r00t-PS@hotmail.com
• UT9@hotmail.com
  

Possible website

• mafia-hack dot com
• todo: whois etc, possibly new wiki page if it contains anything of interest

Other hackers associated with Hacoor

• jeen hacker -- http://anonymouse.org/cgi-bin/anon-www.cgi/http://www.photorage.info/demo/
• cold z3ro
• Unix Cracker
• Php Emperor
• ThE EmBeR
  
• TiTaNiChAcKeR
• Kaher ELhkr
  • email: H_14e@hotmail.com
    
• Al.GhAmEd
  • email: a1.ghamed@hotmail.com
    
• The Big Hackerz
  • email: m39z@hotmail.com
    

By_Ogmass

• banned from this website:

http://anonymouse.org/cgi-bin/anon-www.cgi/http://www.pirator.net/forums/members/by_ogmass.html

• to see what By_Ogmass leaves behind when he/she hacks, look here:

http://anonymouse.org/cgi-bin/anon-www.cgi/http://www.intershow.com/index.htm

• appears to be Turk - there is reference to Armenian lies and "Our second operation will be for Greeks" at this hacked website: http://anonymouse.org/cgi-bin/anon-www.cgi/http://www.museauxmedia.com/

• Still another hacked site: http://anonymouse.org/cgi-bin/anon-www.cgi/http://defaced.serapis.net/deface/07/12/19/www.encasoft.com/

This one says "You is Security Get Down! WeB SiTeS SeCuRiTy TesTing You: 0 My : 1 You To LoSe...! xD Astalavista Bebegim (H)"and "HACKED By_Ogmass & S4S_7"

• Who is S4S_7?

It appears that the following page is a list of sites hacked by By_Ogmass and if you notice, the next to the last column to the right looks like it gives a reason for the hacking...

http://anonymouse.org/cgi-bin/anon-www.cgi/http://www.turk-h.org/defacement/list/filter/attacker/By_Ogmass

Eğlence = diversion, amusement
Politik Sebepler = Political Cause
Protesto = protest
Vatansever/Milliyetçilik = Patriotic / Patriotism
İdeolojik Fikirler = The ideological ideas
İnanç Ahlaki Değerler = İnanç Ethical Value
Uyarı = Warning

List of possible affiliated websites

anarchistblackcross dot org
Picture used on front page of hacked websites was taken from this website
todo: whois info, sanitize link done

DomainID:D78695017-LROR
DomainName:ANARCHISTBLACKCROSS dot ORG
CreatedOn:17-Oct-200112:39:20UTC
LastUpdatedOn:22-Mar-200508:06:13UTC
ExpirationDate:17-Oct-200812:39:20UTC
SponsoringRegistrar:CSLComputerServiceLangenbachGmbHd/b/ajoker.comaGermanGmbH
(R25-LROR)
Status:CLIENTDELETEPROHIBITED
Status:CLIENTTRANSFERPROHIBITED
Status:CLIENTUPDATEPROHIBITED
RegistrantID:CORG-10622
RegistrantName:AnthonyRayson
RegistrantOrganization:ChicagoABC
RegistrantStreet1:P.O.Box721
RegistrantStreet2:
RegistrantStreet3:
RegistrantCity:Homewood
RegistrantState/Province:IL
RegistrantPostalCode:60430
RegistrantCountry:US
RegistrantPhone:+555.5551212
RegistrantPhoneExt.:
RegistrantFAX:
RegistrantFAXExt.:
RegistrantEmail: anthonyrayson at hotmail dot com
AdminID:CORG-113268
AdminName:AnthonyRayson
AdminOrganization:ChicagoABC
AdminStreet1:P.O.Box721
AdminStreet2:
AdminStreet3:
AdminCity:Homewood
AdminState/Province:IL
AdminPostalCode:60430
AdminCountry:US
AdminPhone:+555.5551212
AdminPhoneExt.:
AdminFAX:
AdminFAXExt.:
AdminEmail: anthonyrayson at hotmail dot com
TechID:CORG-113268
TechName:AnthonyRayson
TechOrganization:ChicagoABC
TechStreet1:P.O.Box721
TechStreet2:
TechStreet3:
TechCity:Homewood
TechState/Province:IL
TechPostalCode:60430
TechCountry:US
TechPhone:+555.5551212
TechPhoneExt.:
TechFAX:
TechFAXExt.:
TechEmail: anthonyrayson at hotmail dot com
NameServer:DNS1.MUTUALAID dot ORG
NameServer:DNS2.MUTUALAID dot ORG

http://anonymouse.org/cgi-bin/anon-www.cgi/http://whois.domaintools.com/anarchistblackcross.org

Anomalies and unanswered questions

[T]o[A]

what does the author mean by the phrase at the end "and very special One [T]o[A]"
todo1: search the net for that term, possible that [T]o[A] is an internet handle and/or group that might be of importance.
It might also mean [T]o [A] as in "and very special one to A".

• handle searched for, unable to get hits, the way name is structured makes it near-impossible to search for
  
  • (possibly set up this way for counter-intel/security purposes).
    

todo2: keep an eye out for this internet handle when searching affiliated sites and/or groups
todo3: who is "A"?

• i should have seen it when i asked the question ... A is for Allah? So maybe this whole toa to a thing is a dead end?
• Maybe the Authority? as in palestine authority?
  

Anarchists

Did the Hacker Pal group steal the picture from the anarchist site or are they somehow affiliated?
Was the anarchist link left as a false lead?

• probable it was left as a deception to feed our preconceptions that they might be in cahoots, will have to dig up more
  
• to refute or support that.