Al-Qaeda Chatter on UseNet?

Free Republic Exclusive ^ | Nov. 21, 2002 | Johnathan Galt

[JohnathanRGalt]

There exists a series of 'nonsense' postings in Usenet. (Please no jokes about Usenet already being full of nonsense). Obviously computer generated.  These often have Arabic names interspersed in the content.

One speculation is they might just be 'merry pranksters' posting vast amounts of nonsense to confuse Usenet readers.

Another speculation is this might be the 'increased al-Qaeda chatter' we hear about when the Home Land Security changes the color to a redder hue. Note the increase just after Dec. 22 (the date that the Shoe Bomber was captured trying to blow up Miami to Paris, flight AA 63). We need to do a lot more research on this.

Operation Overloard ( www.leesaunders.com/html/Overlord.htm ) -- was the code name for the invasion of mainland Europe. On June the 6th 1944, D-Day, the Allies mounted the biggest naval invasion force ever seen in the history of war, with over 6,000 vessels. The successful invasion of Northern France allowed the Allies to create the long awaited second front in Europe.

The track starts with radio messages in French which were broadcasted from London. These coded messages passed on important information to the French Resistance, who were working in occupied France. Such a message would have alerted the French Resistance of the impending invasion, allowing the Resistance to create confusion and disruption within German-held France.

[Woman/Femme]:
Qu'est-ce que c'est? (What is it?)

[Radio]:
Les sanglots longs des violons de l'automne. Je repete: Les sanglots longs des violons de l'automne...
(Long sobs of autumn violins. I repeat: Long sobs of autumn violins)

[Man/Homme]:
Et cette fois vous allez combattre sur la terre de France.
Dans nos campagnes. Dans nos villages. Sous les yeux des notres.
(And this time you will fight on land of France. In our country. In our villages. Before our eyes.)

[Radio]:
Ici radio Londres. Voici notre huitieme bulletin d'information. Mais voici, tout d'abord, quelques messages personnels. Demain, la melasse deviendra du cognac. Demain, la melasse deviendra du cognac. Jean a de longues moustaches. Je repete...
(This is radio London. This is our eighth information bulletin. But first, a few private messages. Tomorrow, treacle will turn to brandy. Tomorrow, treacle will turn to brandy. John has a long moustache. I repeat...)

[Woman/Femme]:
Vite, il faut se depecher! (Lets go! We have to hurry up!)

[Radio] :
Jean a de longues moustaches. (John has a long moustache.)

---

I did some searches of Google (Usenet) groups, for example "Moustapha Rais", or "Saad Rais":  Rais is an Indonesian name. Moustapha Lebanese or Turkish. Saad is Saudi. I doubt that many male Indonesians emigrated to Saudi Arabia and had a bunch of kids.  Therefore Rais and Moustapha don't often appear together in the same name. I put in their names and then scanned the postings for nonsense text. Names of posters are often forged anyway.

Sometimes appearing in popular but unmoderated groups such as  rec.collecting.sport.hockey or soc.men always only one thread.  Mostly ignored by other people in the group -- once and a while someone complains.  

http://groups.google.com/groups?selm=%25Dea9.662%24Za.34883734%40newssvr16.news.prodigy.com

Certainly postings of garbage are 'off-topic'.

For the most part, messages are usually being sent to groups that no one reads -- or would ever complain about:

news.admin.net-abuse.email -- A high volume group that is used to used to make a record of SPAM reports, no one reads it unless they are commenting on a previous spam report.
 
alt.test or gnu.gnusenet.test -- high volume group for test postings, no one reads them.

Click 'View Original Format' on the right side of these posting.  I looked first for the 'NNTP-Posting-Host',  First put IP address in http://www.checkdomain.com/ this is usually good for American (ARIN) or Asian IPs. If the IP is 'RIPE', then check European addresses with:  http://www.ripe.net/perl/whois

If that wasn't available I report the  'X-Trace' (need some help on deciphering this).

Some posters used an anonymous services such as Cotse.net to post their nonsense text. Obviously, someone thinks it is important to keep their location secret while they post nonsense text to the internet. A court order would be required to get the actual posters IP address.

---

Re: they frantically excuse to Mohammed when the kind ...
... Where will you live the worthwhile handsome bandages before Al does? cheers, Yosri
Moustapha Rais -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 6.0.5 Myw ...
news.admin.net-abuse.email - Dec. 23, 2001 by Yosri Moustapha Rais - View Thread (1 article)
NNTP-Posting-Host: 192.117.153.9  -- Computerland, Israel/Palestine

who lifts happily, when Chester explains the dirty pumpkin ...
... it. What will we seek after Moustapha behaves the strange structure's candle ... kicks
mercilessly. Ismat attacks, then Yosri partly orders a lean sauce ...
news.admin.net-abuse.email - Dec. 22, 2001 by Saad Rais - View Thread (1 article)
NNTP-Posting-Host: 213.56.128.14  -- France Telecom, France

Re: these days Estefana will play the pumpkin, and if ...
... ball. cheers, Hakeem Ghassan Rais -----BEGIN PGP SIGNATURE ... Both learning now, Yosri
and Frederick expected the ... so quietly, whenever Moustapha judges the inner ...
news.admin.net-abuse.email - Dec. 23, 2001 by Hakeem Ghassan Rais - View Thread (1 article) 
NNTP-Posting-Host: 192.117.153.9  -- Computerland, Israel/Palestine

Re: she wants to kick urban buckets behind Edwin's cafe
... admiringly join Patrice too. What did Yosri mould against all the cans? We ... t proud.
Both burning now, Susan and Moustapha lifted the strong markets in ...
news.admin.net-abuse.email - Dec. 22, 2001 by Feyd Rais - View Thread (1 article)
NNTP-Posting-Host: 213.56.128.14  -- France Telecom, France

Re: they are covering below the sunshine now, won't promise ...
... it'll actually clean the sauce. Moustapha! You'll laugh spoons. Nowadays, I ... attempt
them, then we stupidly excuse Yosri and Oliver's ugly cloud. Are you ...
news.admin.net-abuse.email - Dec. 24, 2001 by Aslan Rais - View Thread (1 article)
X-Trace: 335181803332803de216e058c7070e0983c6723642c7e10b013235183c27be6d

george moves, then Moustapha angrily converses a dull pin ...
... tyrants furiously talk as the filthy porters join. She can behave neatly, unless
Moustapha fears counters on Ayaz's twig. Will you expect on the sign, if Will ...
news.admin.net-abuse.email - Dec. 24, 2001 by jeff@news.clara.net - View Thread (1 article)
X-Trace: 30ae3e2c3390803866803880023222e871153070c3118004c47721303c27bf18

try shouting the canyon's difficult enigma and Moustapha will ...
... throughout light sauces? Try not to dream a sauce! Who will we climb after Moustapha
cares the old shore's dose? Alfred fears the frame behind hers and freely ...
news.admin.net-abuse.email - Mar. 5, 2002 by Bert - View Thread (1 article)
X-Trace: DXC=33INC98fLL52A>:_e3Gd79X`1N4>^k1L3iF6BbIV4YY2LnHEXCOOR@?IeF]QLCH9C;6d`EYgl61h26[ahYg_<kV?

monolith's kind ball and Moustapha will irrigate you! Tell ...
... raindrops. Sometimes, I'll kill the pitcher. Better monolith's kind ball and Moustapha
will irrigate you! Tell Atiqullah it's change, care, and smell. Others ...
soc.men - Oct. 27, 2002 by Axolotl2 - View Thread (1 article)
Anon proxy from Cotse: http://www.cotse.net/abusepolicies.html

Re: moustapha talks, then Sharon lazily answers a shallow ...
... were hating over the hollow monument. Until Ahmed climbs the goldsmiths partially,
Moustapha won't move any younger mirrors. Almost no thin games improve Neal ...
rec.games.netrek - Jul. 24, 2002 by Lydia - View Thread (1 article)
NNTP-Posting-Host: 24.222.194.126 -- Andara High Speed Internet, Halifax, Canada

for Moustapha the ache's light, towards me it's young, ...
... kicks the humble potter in back of the morning? Until Aslan fears the games freely,
Moustapha won't love any lean stars. It can lift the active spoon and pull ...
comp.lang.limbo - Jul. 24, 2002 by opufne@OBASQAW.NE.US - View Thread (1 article)
NNTP-Posting-Host: 24.222.194.126 -- Andara High Speed Internet, Halifax, Canada

Re: until Moustapha attacks the forks undoubtably, Rose won' ...
... are all sour and dull. We burn them, then we fully seek Yosri and Moustapha's stale
unit. She wants to pour sticky jackets among Imran's sign. Otherwise the ...
rec.collecting.sport.hockey - Jul. 24, 2002 by Wally - View Thread (1 article)
NNTP-Posting-Host: 24.222.194.126 -- Andara High Speed Internet, Halifax, Canada

Re: otherwise the book in Moustapha's coconut might arrive ...
i am a demon from She can smell once, grasp believably,
then laugh alongside the poultice ...
alt.test - Nov. 2, 2002 by Tariq_Marwan_al-Jabbar@bocvu.org.my - View Thread (1 article)
NNTP-Posting-Host: 24.27.21.19 -- Road Runner, Herndon, VA

will you nibble outside the morning, if Moustapha lovingly ...
i am a demon from Almost no closed thin oranges will
believably promise the jugs. She ...
alt.test - Nov. 2, 2002 by Ziad_al_Makhoul@leqman.org.pe - View Thread (1 article)
NNTP-Posting-Host: 24.27.21.19 -- Road Runner, Herndon, VA

i was opening grocers to pretty Moustapha, who's scolding ...
i am a demon He might weekly promise for glad smart
shores. They partly grasp light ...
alt.test - Nov. 2, 2002 by demonspawn@aol.com - View Thread (1 article)
NNTP-Posting-Host: 24.27.21.19 -- Road Runner, Herndon, VA

(... many more examples are available, more research needed ...)

[JohnathanRGalt]

What happens is a spammer gets his peepee whacked with a mallet by his ISP, and he throws a tantrum, trying to flood the nanae newsgroup in a fit of pique. They also issue forged cancels.

Makes sense. That explains why news.admin.net-abuse.email would a target. Why do they attack alt.test or gnu.gnusenet.test?

I wonder what program they're useing to generate the nonsense text?

[TLBSHOW]

SORRY! I SHOULD OF WARNED YOU ALL
HERE IS THE STORY AND LINK

The body of Bonnie Witheral, an American nurse who was shot dead by an unknown gunman at a clinic in Sidon


Spate of attacks raises Arab terrorism fears


AMERICANS came under attack across the Middle East yesterday, prompting fears of a new wave of terrorist strikes at vulnerable Western targets in the Arab world.
An American nurse was killed by a gunman in Lebanon. Two US soldiers were shot and injured in Kuwait by a fugitive policeman. In Saudi Arabia a gunman burst into a McDonald’s restaurant and set it alight.

http://www.timesonline.co.uk/article/0,,3-488755,00.html

[knighthawk]

BUMP!

[TLBSHOW]

bttt

Uppity? not me

[GiovannaNicoletta]

:)- No problem! I thought that there were actually some kind of settlements in Lebanon- like maybe a missionary settlement or something- and I just hadn't heard about it.

Thanks for responding to my post-:)

[Ben Hecks]

Would it be normal for a spammer to have addresses in Israel, France, Canada and Herndon, VA?

[DoctorMichael]

Hmmmmmmmmm...........Interesting stuff. Does the FBI know about this stuff? Is this what they've been talking about when they mean "chatter" or is this the usual nonsense that the internet breeds?

I went to one of the Threads you recommended........
http://groups.google.com/groups?selm=%25Dea9.662%24Za.34883734%40newssvr16.news.prodigy.com

If this is in fact code it's pretty complex for non-english speaking foreigners. The al Qaeda were pretty anal about keeping notebooks. Notebooks with observations on how long dogs took to die when exposed to cyanide gas; notebooks with chemical formulas; notebooks with inventories of weapons and who had checked them out; etc., etc. Were there any notebooks recovered that covered standard code words for their operatives to use?

Some clean farmers inside the rural store were talking near the thin monolith. Don't even try to change the butchers hatefully, hate them cruelly. Nowadays, it cares a spoon too lost without her upper house. He will fill blank enigmas on the glad quiet summer, whilst Abu stupidly believes them too. These days, go kill a tailor! I was tasting to talk you some of my sick dusts. All lazy dirty onions will loudly sow the shopkeepers.

Farmers=?; store=?; monolith=?; butchers=?; spoon=?; upper house=?; enigmas=?; tailor=?; dusts=?; onions=?; shopkeepers=? There has to be a decoder for all this uninteligible crap.

[Diogenesis]

Thank for the PICTURE. It is what is going on.

[LibWhacker]

Hmmmm . . . Quite possibly correct. One of the newsgroups I used to read on a regular basis is often unreadable for weeks and months on end because of these flooding attacks.

I always dismissed it as the work of some kook named Thomas Boschloo who lives in the Netherlands and apparently has some kind of grudge against the group. But now I see the words 'Moustapha' and 'Boschloo' often appear together in these posts. It was a big mistake to educate ragheads at our universities, and it is an even BIGGER one that we're still doing it. We're teaching them how to kill us for crying out loud.

[Sender]

Somehow the actual picture carries more impact than a lame description. Go ahead and look. It's coming to America.

[Gorzaloon]

Would it be normal for a spammer to have addresses in Israel, France, Canada and Herndon, VA?

Even if they are not forged, usually these mean little. Many spammers have software that probes for open relays or formmail scripts that can be hijacked.

I have a couple of attempts on my site every day.

Herndon, VA is where Network solutions and AOL live. France is spam-friendly (Wannadoo.fr is one of the worst spam spigots on earth; Their abuse department is useless.) Canada has long been a troublesome source, even before spam mail, they ran telemarketing boiler room operations there.

[dennisw]

thanks

[meyer]

Dude Thats Bizzare, It reads like a thousand poems strung together. The FBI should have a looksy.......

The FBI has had a look-see. What they've done with the information is beyond my reach.

[dinodino]

Looks like some of the stuff the Scientologists post in code.

[Cindy]

re post #22:

LINKS OF INTEREST:

***US. DEPARTMENT OF STATE: "WORLDWIDE CAUTION" (112002)***

USA TODAY.com (AP): Sidon, Lebanon. "AMERICAN MISSIONARY KILLED IN SOUTH LEBANON" (ARTICLE SNIPPET: "...The clinic provides medical care and help to local people and Palestinian refugees in camp nearby. "Bonnie died because she loved the people of Sidon," he told reporters outside the center. "May God forgive them," Dagher said of the attackers. Muslim clerics have criticized the Unity Center in the past, accusing it of preaching Christianity and trying to indoctrinate Sidon's youth...") (ARTICLE NOTE: The victim is identified as Bonnie Penner, age 31, wife of Gary Whitherall.) (112102)

FOX NEWS.com: "TWO GIs SHOT BY KUWAITI POLICEMAN" (ARTICLE SNIPPET: "KUWAIT CITY - Two U.S. Army soldiers were shot and seriously wounded on Thursday, when a Kuwaiti policeman opened fire after a highway traffic stop, the Kuwaiti government said. The Kuwaiti Interior Ministry said the policeman, identified as a junior officer, fled to Saudi Arabia shortly after the shooting.") (112102)

[Gorzaloon]

That explains why news.admin.net-abuse.email would a target. Why do they attack alt.test or gnu.gnusenet.test? I don't know about the .gnu group, but alt.test is specifically for trying such things, and testing the posting abilities of newsreaders, and uploads, etc, so it makes sense they would try a dry run there.

Hipcrime was the writer.program that was later perverted into a weapon, something like AOHELL, if anyone remembers that..Heh heh.

BUt nanae gets hit a lot with such things. Last time the poster was using some unsecured relay in India. This latest I have not seen , because I stopped downloading headers when I saw the message count. My newsserver will filter them all out overnight.

Why even MY posting name is in some of the datafiles, and shows up once every blue moon in these. To the 14-year-old self abuser, putting something fearful like Arabic or terrorist sounding names in such a file would be irresistable.

[hole_n_one]

Young teens are not only are active in this forum, they are encouraged to participate.

It's not too much to expect that a simple warning be placed in advance of posting such a graphic photo, or a hot link to the pic as D. Squat suggested.

I'm not suggesting censorship, however, a pic such as that does NOT need to be simply tossed in a thread without any consideration to any of the members of this forum.

[LibWhacker]

Of course, what I do not understand is why they would bother with this crap. For instance, why don't they encrypt all their communications, usenet and otherwise, with PGP? It's simpler and more secure to boot.

[JohnathanRGalt]

Herndon, VA is where Network solutions and AOL live. France is spam-friendly (Wannadoo.fr is one of the worst spam spigots on earth; Their abuse department is useless.) Canada has long been a troublesome source, even before spam mail, they ran telemarketing boiler room operations there.

These are just a sampling, there are hundreds more.

The IP in Herndon, VA is owned by RoadRunner (another moderately large ISP). France and Canada also have large, vocal, populations of Muslims as well as spammers. I often trace Palestinian hackers back to ISPs in Israel.

Right now, it appears to be a mystery. I think more research is needed.

[JohnathanRGalt]

Of course, what I do not understand is why they would bother with this crap. For instance, why don't they encrypt all their communications, usenet and otherwise, with PGP? It's simpler and more secure to boot.

In these posts, they often use PGP to verify their signature, so the receiver of the message knows exactly where the nonsense text came from -- check a few of them out.

Don't know why they don't just encrypt the whole message (but maybe it is encrypted).