HOUSTON BASED ISP APPARENTLY HOSTING TERROR, PORN AND SPAM SITES
By Jeremy Reynalds (06/29/05)
Houston-based Internet service provider Everyone's Internet could be regarded as an example of the American dream come true.
Founded by brothers Robert Marsh, Roy Marsh III and Randy Williams, EV1 began operating on Dec.1 1998. By 2002 the company was bringing in over $32.2 million. Current income was not immediately available.
However, it appears that EV1, which touts its community generosity, has a darker side. It seems that the company is hosting terror, pornographic and spam sites in at least a portion of its business.
EXPANSION
In late 2002 EV1 began a nationwide expansion and according to its web site, by Sept. 2002 was providing Internet service to customers in 42 states around America.
"Our formula for success has been affordable prices and great service," EV1 CEO Robert Marsh told Business Wire. "We are committed to applying these principles to every market we enter."
That philosophy has paid off. According to Hoover's Company Records, EV1's 2001 revenue was $18.1 million but by 2002 that had jumped to $32.2 million.
Today, its promotional material claims (www.ev1.net/english/about/index.asp), "We've become the largest independent ISP in the United States with over 300,000 users on our service, and are on solid financial ground turning profits every month. EV1 also owns one of the largest dedicated hosting firms in the United States, EV1Servers.net."
In 2003, Business Wire reported, the EV1 Servers division managed over 17,000 servers and was home to 500,000+ Web sites. Reportedly, according to Business Wire, more than two percent of all Internet traffic worldwide is routed through the 65,000-square-foot facility.
Marsh said his company is sharing some of the results of its success with the less fortunate.
THE CORPORATE CITIZEN
On the company's web site, Marsh writes(www.ev1.net/english/about/index.asp), "Success was also meant to be shared. At EV1, we have focused our efforts on helping those that need it most. Our charitable efforts are typically targeted to charities that help underprivileged children, needy animals, and the like."
Research showed that since 2003, for example, the company has also been sponsor of the old Houston Bowl, now known as the known as the EV1.net Houston Bowl (http://www.ev1houstonbowl.net/).
Bowl President and CEO Jerry Ippoliti told Business Wire in Sept. 2003. "I am pleased to have a Houston-based corporation such as EV1 as a sponsor. EV1 has made a major impact among Houston corporations. The company brings numerous resources to enhance the bowl experience."
Then in Jan. 2004, according to the Houston Chronicle, Marsh decided to have EV1 sponsor Houston's then financially ailing wacky Art Car Parade which includes lectures and art car appearances at schools and nursing homes. The event is now called Everyone's Art Car Parade.
In addition to his company's philanthropy, the Houston Chronicle reported in Sept. 2003 that Marsh was named to the board of directors for Citizens for Animal Protection and the American Diabetes Association.
TRACKING THE MONEY TRAIL: TERROR, PORN AND SPAM
However, in addition to its more routine clientele, it appears that income from terror, porn and spam sites may have been swelling the EV1 coffers.
Here is a selection of some of the terror sites currently being hosted by EV1. (Unless a distinction is made, EV1 is used throughout this article to refer to both EV1 and EV1 Servers).
Until a few days ago there were http://fateh.org/news/index.php, www.palvoice.com/forums/index.php and http://www.kataebaqsa1.com/, all of which are official sites of the Al Aqsa Martyrs Brigade, a designated terrorist organization.
However, while this article was being researched these sites moved to Chicago.
There still is http://www.cdlr.net/ (suspended while this article was being researched and then reemerging again at EV1 under the name http://www.tajdeed.org.uk/), which terror researcher Aaron Weisburd (http://www.haganah.us/) wrote in an e-mail interview is "run by Mohammed Al Massari, a man who has made a career of fronting for terrorist organizations. Best known for distributing the homicidal ‘Dirty Kuffar' music video, his organization has also been involved in supporting the terrorist ‘Islamic Army in Iraq'" (www.sofir.org/reports/13oct04-SoFIR-1-IAI_CDLR.doc.zip).
Also hosted by EV1 is http://www.alquds.com/. The Database of Terrorist Websites and eGroups (DTWE) wrote about Al- Quds (http://atdatabase.r8.org/), "The Al-Quds newspaper ... contains pro-terrorist articles and supports terror."
According to its web site, the DTWE exists "to expose all the terrorist and pro-terrorist websites and eGroups that exist."
Then there's http://www.al-qal3ah.com/, http://www.qal3ah.net/ and a number of associated domain names such as http://www.qal3ati.biz/ and others.
These names are of concern, as they are believed to be associated with terrorist Saad Rashed Mohammed Al-Fagih.
According to the Society for Internet Research, or SOFIR, (www.sofir.org/sarchives/004190.php#004190) "Al-Fagih has been associated with Al Qaida and the global jihad since the mid-1990's. On 21 December, 2004, Al-Fagih was named a Specially Designated Global Terrorist by the United States. Al-Fagih's associates have included Osama bin Laden, Khaled al Fawwaz, Mustafa Setmariam Naser, Lewis Attiyatullah, Mohammed al-Massari and Ziyad Khalil.
"Al-Fagih provided logistical support for the 1998 embassy bombings in Africa[8]. In addition, and in particular since Sept. 11, 2001, Al-Fagih has been at the forefront of efforts to promote the global jihad by maintaining online communities of Islamic extremists and facilitating communications among Islamic extremists around the globe. He does this both under the cover of his MIRA organization, aka Al-Islah, and through a separate online entity known commonly as ‘The Castle' or Al-Qal3ah."
According to its web site (www.sofir.org/sofir/index.php), SOFIR exists in part to "To promote understanding of the nature and threat of Islamic extremist movements, with particular emphasis on the use such movements make of the Internet."
EV1 also hosts a site for the "extremist" Arab European League at http://www.arabeuropean.org/.
DTWE wrote about this group (http://atdatabase.r8.org/), "The Arab European League (AEL) is headquartered in Holland and Belgium. The AEL is a very extremist organization ... The AEL's agenda is to Islamize Europe (to turn it into an Islamic country/continent). The AEL is very anti-non-Muslim and has been known to fund terrorist organizations. The AEL has threatened Belgian Jews in the past."
Then there is also EV1's hosting of http://www.357hosting.com/, a notorious home of Islamic terror sites (www.worldnetdaily.com/news/article.asp?ARTICLE_ID=44594).
In mid- 2004, EV1 was also hosting Hosting Anime, which was the then cyber home for many radical Islamic web sites, some of which featured videos of both American and British citizens being beheaded (http://thewhir.com/marketwatch/beh081604.cfm).
An article in Britain's Daily Mail newspaper(www.mailonsunday.co.uk/pages/live/articles/news/news.html?in_article_id=322226&in_ page_id=1770) read in part, "We traced hostinganime to the computer servers of Everyone's Internet, a Houston-based firm that boasts it is the ‘world's largest dedicated hosting company,' providing space to one million web sites. The company's chief financial officer, Roy Alvin Marsh III, 45, is a flamboyant Texan whose influential friends include President Bush's Secretary of the Navy, Gordon England, Sharon Bush, the President's former sister-in-law, and her daughter, fashion model Lauren Bush. The firm's chief executive is his 44-year-old brother, Robert Marsh."
When an Aug. 2004 poster on an EV1 forums (http://forum.ev1servers.net/showthread.php?s=&threadid=47861) expressed his horror at EV1's hosting of the beheading site(s), Marsh responded on the same forums, "There is more to it than meets the public eye. That's all I have to say."
Another poster on the same forum responded sympathetically, "What many people don't know/realize/think about.. after 9/11, the FBI/Government have forced numerous hosts to keep sites like this online.. and ... I'm going to take a wild guess and assume the same thing is going on here ... The situation this puts the host in, resembles something along the lines of, ‘Damned if you do, Damned if you don't.'"
However, there are a number of terror sites that were apparently formerly housed at EV1, or indirectly by one of the company's clients, that are no longer there or operational.
They included http://www.yaislah.org/ and http://www.alkhilafah.info/, the al Qaida Forum at http://64.246.51.45/vb/, the Hamas-associated http://www.kataeb-ezzeldeen.com/ and the al Qaida affiliated http://www.mylajnah.co.uk/,
There have also been some other positive occurrences happening at EV1.
In an e-mail interview, cyberterror researcher Johnathan Galt said, "Last year, along with all the Islamist hate-sites, we noticed a large number of American neo-nazi, skinhead, KKK, hate sites hosted by EV1. This year, in double checking for this article we notice that many of those hate sites have moved to other ISPs. Currently the top NAZI ISP is ‘The Planet' in Dallas. The second-place NAZI hosting ISP is Time-Warner. Congratulations to EV1 for enforcing their AUP (Acceptable Use Policy) against neo-nazi hate sites. Now, please enforce your AUP against al-Qaeda terrorists."
The administration of EV1 did not return e-mails to a number of company addresses requesting comment on the company's hosting activities, but there is a posting from an EV1 forum member in Oct. 2004 (http://forum.ev1.net/showthread.php?s=&threadid=1248) apparently quoting from Marsh.
It reads, "We do not comment specifically about any sites that we host. However, to speak in generalities .. here goes again. We are dedicated to complying with all laws governing our business. When presented with an appropriately authenticated request or order from an empowered governmental agency, we comply without question.
"On a daily basis, we provide authorities with user data, log data, hard drive copies, and the like when presented with a properly (sic) authenticated request. In most instances, we are prohibited from disclosing the request to the end user.
"In other cases, we are requested to take down sites for various reasons, in which we promptly comply. In other cases, subsequent to the information request, we are requested to maintain the status of a server. In these cases, we also promptly comply."
Marsh made similar comments in another post he made in Feb. 2005 on the EV1 Forums (http://forum.ev1servers.net/showpost.php?p=334633&postcount=1).
However, in that response he also added, "On some occasions, we have been asked to terminate a user's service. On others, we have been forbidden from interrupting the operations of certain web sites – even when the customer has long past-due payments."
But in a telephone interview, an official from the FBI's Houston Bureau said that the FBI is legally unable to order a business to host or continue to host a web site. A court order would be required to do so, she said, and that would only be granted in exceptional circumstances.
A comment similar to Marsh's statement was made in July 2002 by Jeff Lowenberg, vice-president of operations for EV1. At that time, EV1 was hosting a web site which included an appeal for donations by the outlawed Hamas organization to buy guns and bullets (www.qassam.net/tabaro3.htm#en).
That appeal read in part, "Martyr Izz el-Deen el-Qassam Phalanxes, your own defending phalanxes, the military wing of Hamas movement in Palestine, is calling upon you to donate with what you can to assist the cause of Jihad and resistance until the occupation is eliminated and every span of the Muslim Palestine is liberated.
"While Martyr Izz el-Deen el-Qassam Phalanxes is calling upon you for donation, we put between your hands some of the difficulties that your mujahideen brothers are facing to get the equipments and logistics.
"The price of Kalashnicov bullet is $3 and the price of the Kalashnicov gun itself now is $2,000 and it was $3,500 couple of months ago, and do you know that the the price of R-B-G is $12,000 and the price of T.N.T that's used by your mujahideen brothers is $100 a kilo, also Martyr Izz el-Deen el-Qassam Phalanxes now manufactures Al-Qassam land-to-land missiles in different sizes and also the anti-shields Al-Banna bomber, Martyr Izz el-Deen el-Qassam Phalanxes also supervises the development of fighting, defensive and attacking weapons and other much projects mustn't be elaborated for confidentiality purposes."
Lowenberg told this writer (www.opinionet.com/article.php?id=1069) that all he was able to say was the company does "cooperate to the best of our ability with all law enforcement requests."
When asked if he could comment further, Lowenberg said he would not disagree with comments made by a company spokesman some weeks ago that appeared in the Houston Chronicle.
In that story, company officials said while they initially blocked the (terror) sites when they were brought to their attention, that they put them back on line when requested to do so by the U.S. Customs Service.
The quote from Marsh continued in his apparent on-line statement.
"We are good citizens in our community. We are proud corporate sponsors of the local Jewish Community center, and sponsor their annual children's carnival. This is only one of the many ways that we support the local community with millions of dollars in our history to support local charitable organization. That is all we have to say on the matter."
But while they're giving dollars to the Jewish Community Center children's carnival, EV1 is also busy apparently hosting "adult sites."
PORNOGRAPHIC WEB SITES IMPORTANT TO EV1
While the company bans adult materials for customers who choose to house just one web site on its equipment, (www.ev1.net/english/about/aup.asp), individuals or organizations who lease a "dedicated server" (basically a computer dedicated to displaying your information) are apparently given much more freedom by EV1.
Then, according to the company web site (www.ev1servers.net/english/faq/index.asp), there is apparently no ban. In answer to the question, "Can I host adult material?" the company answers, "Legal, uncopyrighted material is allowed on a dedicated server. We highly recommend you contact both your local authorities and the State of Texas for more detailed information regarding different types of adult content."
Marsh even told Hosts for Porn (http://hosts4porn.com/profiles/ev1.cfm) that pornographic web sites play an important role in his company's business.
"Adult customers represent a significant proportion of EV1Servers' user base," Marsh said. "I can't give you exact stats, because we don't review and rate content hosted on our network. But I can tell you that adult users are highly valued members of our community."
Some of the sites hosted by EV1 at press time included
http://www.cindertrack.com,www.gallerylisting.com/, http://www.upskirt-babes.com/, http://www.exposedteenbabes.com/ and http://www.nastyteenwhores.net/.
Others included http://www.gaytraffictrades.com/, http://www.xxsexnow.com/, http://www.clitdoctor.com,www.oldersorgies.com/, http://www.fillmoms.com,www.directsexdvd.com/ and http://www.adultx.nl/.
Then about two years ago, EV1 gained some unwelcome attention when Russian- based spammers turned home computer owners "into unwitting hosts in a pornography and spam distribution ring, say security experts" (www.pcworld.com/news/article/0,aid,111543,00.asp).
According to the IDG News Service (www.pcworld.com/news/article/0,aid,111543,00.asp), the source of the problem was traced to equipment owned by EV1. The company did not respond to a request for comment.
A reply from an unidentified individual (http://forum.ev1servers.net/member.php?userid=8288) in the EV1 Servers Forum to a question posed about EV1's hosting practices by this writer in a number of threads read in part, "the majority of the people on EV1 are here because of the generous bandwidth allocations (translation: they run porn sites)."
HOME TO SPAMMERS?
EV1 has also had problems with spammers.
Back in late 2002 a new kind of pop-up advertisements began appearing on the computers of Microsoft Windows users.
Wired News reported (www.wired.com/news/technology/0,1282,55795,00.html) that "Some of the ads, which hit Windows systems through backdoor networking ports and not by e-mail or Web browsing, appear to have been generated by Direct Advertiser, a $700 software program developed by Florida-based DirectAdvertiser.com.
"By tapping into Messenger, a Windows service originally designed to enable system administrators to send messages to users on a network, Direct Advertiser can deliver ‘completely anonymous and virtually untraceable' ads ‘straight to the screen of your client,' according to
the company's website."
Participants in a project designed to investigate the intrusion (http://www.mynetwatchman.comn/) reported receiving repeated contacts (www.mynetwatchman.com/kb/security/articles/popupspam) from a handful of electronic Internet addresses assigned to EV1.
EV1 officials did not respond to requests for an interview from Wired News.
A blogger is also complaining about EV1. He alleges (www.rojisan.com/spam/archives/2004/10/blogspammer_host_ev1net_everyones_internet.html) that EV1 is providing "hosting services and network access (via IP 207.44.234.22 ) for the automated tools of blog spammers. I've been hit no fewer than 64 times today by this tool, (sic) from the everyone's internet network. so not only are they hosting the websites, now they're hosting the weapons as well. and that just won't be tolerated."
Electronically checking 207.44.234.22 revealed that at press time these web sites were using that number as their computer home. http://www.cherrycokerulz.net/, http://www.contentwriter.net/, http://www.darwinwaterpolo.com/, http://www.liquidbit.com/, http://www.mvertigo.org/, http://www.ozyshops.com/
The computer server assigned the Internet numbers 207.44.234.22 was last cited for spam on April 10 2005. There is more information at http://dsbl.org/listing?207.44.234.22 and http://dsbl.org/sender.
At press time, three of those sites had no content, one had a number of baby pictures and the remaining two featured information about a product called "Contentwriter."
According to its web site (www.liquidbit.com/index.php/ContentWriter%20Overview), Contentwriter "allows you to quickly and efficiently build and manage content-rich websites. Users without any technical expertise can manage their entire website over the internet. This makes ContentWriter, ‘Useable by anyone, Accessible to everyone.'"
The sites were listed to addresses in Australia.
Another individual also had problems with a spammer reportedly using EV1. That report is at http://spam.gunters.org/archive/2005/05/
There appear to be limited options for individuals who have difficulties with the customers of clients of EV1 Servers.
Typically, EV1 Servers will lease a computer server (that can house a number of web sites) to an individual or organization which then becomes the client of EV1 servers. The EV1 Servers client may then sell space on that computer server to someone else who has no direct relationship to Ev1. That secondary customer pays EV1's customer.
However, problems have arisen (both for EV1 Servers and other Internet Service Providers), when the secondary customer becomes dissatisfied with, in this case, EV1's client. Unable to resolve the issue with EV1's client, the secondary customer then goes to EV1.
Here is part of a reported transcript of a June 2004 "live support" conversation between a secondary customer and EV1 Servers (www.hosthideout.com/archive/index.php/t-11384.html).
After welcoming John the customer to EV1 Servers, Aamir from EV1 Servers Customer Support asked how he could help.
John said, "There's a hosting company by the name of Hosting24-7.com which has a server at ev1. They have over charged us and are not giving us a refund. They have cut off communication with us. Since ev1 is the server provider I thought I would come to you and see if ev1 is willing to help with this problem."
Aamir A responded, " I'm sorry but there's nothing we can do for you. You must contact the server administrator/owner."
John said, "Like I said they have cut off communication with us. They are not answering phone calls, emails, faxes..etc. Seems to me they are more of a scam company then a hosting company."
Aamir A replied, "As I said before, there is nothing that we can really do on this end since we don't manage our servers. Everyone that rents a server from us does only that. We have nothing to do with their business end (i.e. what they do with their server). I understand that they cut off contact with you but even so there's nothing that I am allowed to do from this end. You still must get in contact with the server administrator. How you can do that I'm not sure."
After a lot of discussion both for and against the stance taken by EV1, one forum participant responded (www.hosthideout.com/showthread.php?t=11384), "The main reason I never got an EV1 server, they don't care what's hosted on it, even if it spams your server to death, as long as they get paid."
(Printer friendly version) Email: Jeremy Reynalds
