Softly Softly Catch a Monkey
Posted: July 13, 2011 in General, Hacker Tracker, Press Coverage
Tags: 4Chan, anonakomis, AnonOps, Anonymous, assange, blog, hacker, hactivism, Infosec Daily, ISDPodcast, jester, lulz, lulzsec, Matt Shoemaker, nakomis, on3iroi. jarred, podcast, sabu, topiaryIf you know the history, you will know they brought my attentions and that of others upon themselves. If you don’t, then you don’t.
Props to: @gr4ssh0pp3r and Web Ninja’s, Miss Mary and Indiana Jones
Regarding ‘Sabu’ AKA @anonymousabu
Anonymous Private Chat Logs leaked after HBGary Federal hack
http://www.scribd.com/doc/57141513/Consequences
The above doc mentions sabu speaking about his personal domain prvt.org
Now this prvt.org will lead us to Hugo Sabu Carvalho, let us start our journey for the TRUTH
Incident 1- Sabu is too excited about HBGary Federal hack and out of anxiety, he gives out his personal domain prvt.org instead of hbgary.com
15:24 <&Sabu> url: https://www.google.com/a/prvt.org
15:24 <&Sabu> user: reseller
15:24 <&Sabu> pass: random
15:24 <&Sabu> if you do get to login
15:24 <&Sabu> click on “manage domain”
15:24 <&Sabu> reset their passwords
15:24 <&Sabu> and leak new emails
15:24 <&Sabu> ROFLOLFROLOFLORLFRL
15:25 <&Sabu> oops
15:25 <&Sabu> wrong domain
15:25 <&Sabu> https://www.google.com/a/hbgary.com
15:25 <&Sabu> there you go
15:26 <@Nessuno834> no deal
15:26 <@Topiary> Does not work, sadfaceIncident 2 – Sabu offers his private domain to mirror HBGary federal email leaks
12:25 <&Sabu> I can setup anonleaks.prvt.org let me know
12:25 <&Sabu> its one of my private domains
12:25 <~Avunit> we have anonleaks.ru and anonleaks.com tho
12:25 <&Sabu> guess we’ll setup a whole bunch of mirror servers
12:25 <&Sabu> if you nigg3rs need me to get bulletproof servers
12:25 <&Sabu> but I have to buy prepaid visas
12:26 <@tflow> Sabu: sweet. we have 4 mirroring servers in totalFACTS:
Sabu accepted that he owns prvt.org in many occasions during the twitter interactions with lulzsec outers such as Backtrace Security and others.
Let’s go back to the history of the domain prvt.org using our favorite domain tools
The domain story starts with a person named R Paylor from GB who owned it on June 23, 2009
Domain: prvt.org – Whois History
Cache Date: 2009-06-23
Registrar:
Server: whois.pir.org
Created:
Updated:
Expires:
Reverse Whois: Click on an email address we found in this whois record to see which other domains the registrant is associated with: info@nnh.co.ukDomain ID:D87859570-LROR
Domain Name:PRVT.ORG
Created On:25-Jun-2002 16:38:43 UTC
Last Updated On:25-Jun-2008 21:18:36 UTC
Expiration Date:25-Jun-2009 16:43:58 UTC
Sponsoring Registrar:GoDaddy.com, Inc. (R91-LROR)
Status:CLIENT DELETE PROHIBITED
Status:CLIENT RENEW PROHIBITED
Status:CLIENT TRANSFER PROHIBITED
Status:CLIENT UPDATE PROHIBITED
Registrant ID:DABO-02029996
Registrant Name:R Paylor
Registrant Organization:NNH
Registrant Street1:Greenhill
Registrant Street2:
Registrant Street3:
Registrant City:BRORA
Registrant State/Province:Sutherland
Registrant Postal Code:KW9 6LU
Registrant Country:GB
Registrant Phone:+44.01408621500
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email:info@nnh.co.uk
Admin ID:DABO-22029996
Admin Name:R Paylor
Admin Organization:NNH
Admin Street1:Greenhill
Admin Street2:
Admin Street3:
Admin City:BRORA
Admin State/Province:Sutherland
Admin Postal Code:KW9 6LU
Admin Country:GB
Admin Phone:+44.01408621500
Admin Phone Ext.:
Admin FAX:
Admin FAX Ext.:
Admin Email:info@nnh.co.ukR Paylor aka nnh posted an advertisement on dnforum.com on 16th and 23rd of June. He posted twice to sell the domain prvt.org and asked the members to come up with a decent offer.
A member called “visigod” responded to that advertisement and bought the domain for 50 dollars.
http://www.dnforum.com/f529/private-prvt-org-thread-372412.html
Archive http://freze.it/oD
Visigod confirms in above post that he purchased the domain and transfer was successful. So lets see who is visigod now
http://www.dnforum.com/member-visigod.html
Basic Information Ref Visigod:
Location Portugal
Country Flag Portugal
Sex Male
Business Location Portugal
Business Type Sole Proprietor
Type of Organization Private Company
Home Country PortugalSignature - www.linksquadron.com
Visigod is a citizen of Portugal and lists as a owner of a private company called linksquadron. Let’s see the WHOIS
Visigod bought the domain on June 24th, 2009 from R Paylor and transferred to his company name Host Squadron. Both linksquadron.com and hostsquadron.com are owned by him.
Domain: prvt.org – Whois History
Cache Date: 2009-06-27
Registrar:
Server: whois.pir.org
Created:
Updated:
Expires:
Reverse Whois: Click on an email address we found in this whois record to see which other domains the registrant is associated with: support@hostsquadron.comDomain ID:D87859570-LROR
Domain Name:PRVT.ORG
Created On:25-Jun-2002 16:38:43 UTC
Last Updated On:27-Jun-2009 00:08:03 UTC
Expiration Date:25-Jun-2010 16:43:58 UTC
Sponsoring Registrar:GoDaddy.com, Inc. (R91-LROR)
Status:CLIENT DELETE PROHIBITED
Status:CLIENT RENEW PROHIBITED
Status:CLIENT TRANSFER PROHIBITED
Status:CLIENT UPDATE PROHIBITED
Status:RENEWPERIOD
Registrant ID:CR5374961
Registrant Name:Host Squadron
Registrant Street1:R. Cidade Rio de Janeiro
Registrant Street2:
Registrant Street3:
Registrant City:Sao Marcos
Registrant State/Province:Sintra
Registrant Postal Code:2735-659
Registrant Country:PT
Registrant Phone:+351.351967165920
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email:support@hostsquadron.com
Admin ID:CR5374965
Admin Name:Host Squadron
Admin Street1:R. Cidade Rio de Janeiro
Admin Street2:
Admin Street3:
Admin City:Sao Marcos
Admin State/Province:Sintra
Admin Postal Code:2735-659
Admin Country:PT
Admin Phone:+351.351967165920
Admin Phone Ext.:
Admin FAX:
Admin FAX Ext.:
Admin Email:support@hostsquadron.com
Tech ID:CR5374963
Tech Name:Host Squadron
Tech Street1:R. Cidade Rio de Janeiro
Tech Street2:
Tech Street3:
Tech City:Sao Marcos
Tech State/Province:Sintra
Tech Postal Code:2735-659
Tech Country:PT
Tech Phone:+351.351967165920
Tech Phone Ext.:
Tech FAX:
Tech FAX Ext.:
Tech Email:support@hostsquadron.com
Name Server:NS1.DSREDIRECTION.COM
Name Server:NS2.DSREDIRECTION.COMOk, now its clear the owner or prvt.org on June 25, 2009 is “visigod”
Let’s see who owns it on 9/11 2009, its the same visigod with his hostsquadron email.
Cache Date: 2009-09-11
Registrar:
Server: whois.pir.org
Created:
Updated:
Expires:
Reverse Whois: Click on an email address we found in this whois record to see which other domains the registrant is associated with: support@hostsquadron.comDomain ID:D87859570-LROR
Domain Name:PRVT.ORG
Created On:25-Jun-2002 16:38:43 UTC
Last Updated On:18-Aug-2009 19:40:28 UTC
Expiration Date:25-Jun-2010 16:43:58 UTC
Sponsoring Registrar:GoDaddy.com, Inc. (R91-LROR)
Status:OK
Registrant ID:CR5374961
Registrant Name:Host Squadron
Registrant Street1:R. Cidade Rio de Janeiro
Registrant Street2:
Registrant Street3:
Registrant City:Sao Marcos
Registrant State/Province:Sintra
Registrant Postal Code:2735-659
Registrant Country:PT
Registrant Phone:+351.351967165920
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email:support@hostsquadron.com
Admin ID:CR5374965
Admin Name:Host Squadron
Admin Street1:R. Cidade Rio de Janeiro
Admin Street2:
Admin Street3:
Admin City:Sao Marcos
Admin State/Province:Sintra
Admin Postal Code:2735-659
Admin Country:PT
Admin Phone:+351.351967165920
Admin Phone Ext.:
Admin FAX:
Admin FAX Ext.:
Admin Email:support@hostsquadron.comThe domain went private from 2009-11-06 to 2011-06-23
Domain: prvt.org – Whois History
Cache Date: 2009-11-06
Registrar:
Server: whois.pir.org
Created:
Updated:
Expires:
Reverse Whois: Click on an email address we found in this whois record to see which otherdomains the registrant is associated with: prvt.org@domainsbyproxy.com
Domain ID:D87859570-LROR
Domain Name:PRVT.ORG
Created On:25-Jun-2002 16:38:43 UTC
Last Updated On:04-Nov-2009 20:37:08 UTC
Expiration Date:25-Jun-2010 16:43:58 UTC
Sponsoring Registrar:GoDaddy.com, Inc. (R91-LROR)
Status:CLIENT DELETE PROHIBITED
Status:CLIENT RENEW PROHIBITED
Status:CLIENT TRANSFER PROHIBITED
Status:CLIENT UPDATE PROHIBITED
Registrant ID:CR25623846
Registrant Name:Registration Private
Registrant Organization:Domains by Proxy, Inc.
Registrant Street1:DomainsByProxy.com
Registrant Street2:15111 N. Hayden Rd., Ste 160, PMB 353
Registrant Street3:
Registrant City:Scottsdale
Registrant State/Province:Arizona
Registrant Postal Code:85260
Registrant Country:US
Registrant Phone:+1.4806242599
Registrant Phone Ext.:
Registrant FAX:+1.4806242598
Registrant FAX Ext.:
Registrant Email:PRVT.ORG@domainsbyproxy.com
Admin ID:CR25623848
Admin Name:Registration Private
Admin Organization:Domains by Proxy, Inc.
Admin Street1:DomainsByProxy.com
Admin Street2:15111 N. Hayden Rd., Ste 160, PMB 353
Admin Street3:
Admin City:Scottsdale
Admin State/Province:Arizona
Admin Postal Code:85260
Admin Country:US
Admin Phone:+1.4806242599
Admin Phone Ext.:
Admin FAX:+1.4806242598
Admin FAX Ext.:
Admin Email:PRVT.ORG@domainsbyproxy.comHBGary Federal is hacked by Anonymous and LulzSec popped up which is identified as same group who hacked HbGary. As the Anonymous private chat logs and LulzSec private chat logs are leaked, the lulzsec outers jumped on the group and started doxing like crazy.
People identified Sabu with different names as Hector/ Xavier / Lima / Leon and few more…
https://twitter.com/#!/TeaMp0isoN_/status/85470916825460736
@anonymousabu: If its not already obvious already: my!=hector/xavier/rafael lima/monsegur/de leon/kaotico/negron.Disinfos my game – enjoy the ridemates.
Mon, 27 Jun 2011 00:10:39 +0000
As mentioned by sabu himself, DISINFO IS HIS GAME. He exactly did that and and started changing whois as per the dox and as the names come up.
He made the registration public on June 24, 2011 to feed trolls. On 24th June he is hector monsegur
Cache Date: 2011-06-24
Registrar:
Server: whois.pir.org
Created:
Updated:
Expires:
Reverse Whois: Click on an email address we found in this whois record to see which other domains the registrant is associated with: xavier@openplans.orgDomain ID:D87859570-LROR
Domain Name:PRVT.ORG
Created On:25-Jun-2002 16:38:43 UTC
Last Updated On:07-Jul-2010 13:31:52 UTC
Expiration Date:25-Jun-2011 16:43:58 UTC
Sponsoring Registrar:GoDaddy.com, Inc. (R91-LROR)
Status:CLIENT DELETE PROHIBITED
Status:CLIENT RENEW PROHIBITED
Status:CLIENT TRANSFER PROHIBITED
Status:CLIENT UPDATE PROHIBITED
Registrant ID:CR25623846
Registrant Name:hector monsegur
Registrant Street1:90 avenue d #f
Registrant Street2:
Registrant Street3:
Registrant City:new york
Registrant State/Province:NY
Registrant Postal Code:10009
Registrant Country:US
Registrant Phone:+1.9173889070
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email:xavier@openplans.org
Admin ID:CR25623848
Admin Name:hector monsegur
Admin Street1:90 avenue d #f
Admin Street2:
Admin Street3:
Admin City:new york
Admin State/Province:NY
Admin Postal Code:10009
Admin Country:US
Admin Phone:+1.9173889070
Admin Phone Ext.:
Admin FAX:
Admin FAX Ext.:
Admin Email:xavier@openplans.orgSabu changed the WHOIS to Adrian Lamo on 1st July
Domain: prvt.org – Whois History
Cache Date: 2011-07-01
Registrar:
Server: whois.pir.org
Created:
Updated:
Expires:
Reverse Whois: Click on an email address we found in this whois record to see which other domains the registrant is associated with: xavier@openplans.orgDomain ID:D87859570-LROR
Domain Name:PRVT.ORG
Created On:25-Jun-2002 16:38:43 UTC
Last Updated On:29-Jun-2011 19:14:58 UTC
Expiration Date:25-Jun-2012 16:43:58 UTC
Sponsoring Registrar:GoDaddy.com, Inc. (R91-LROR)
Status:CLIENT DELETE PROHIBITED
Status:CLIENT RENEW PROHIBITED
Status:CLIENT TRANSFER PROHIBITED
Status:CLIENT UPDATE PROHIBITED
Status:AUTORENEWPERIOD
Registrant ID:CR25623846
Registrant Name:Adrian Lamo
Registrant Street1:1 Police Plaza
Registrant Street2:#aspergers section
Registrant Street3:
Registrant City:new york
Registrant State/Province:New York
Registrant Postal Code:10007
Registrant Country:US
Registrant Phone:+1.6175003411
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email:xavier@openplans.org
Admin ID:CR25623848
Admin Name:Adrian Lamo
Admin Street1:1 Police Plaza
Admin Street2:#aspergers section
Admin Street3:
Admin City:new york
Admin State/Province:New York
Admin Postal Code:10007
Admin Country:US
Admin Phone:+1.6175003411
Admin Phone Ext.:
Admin FAX:
Admin FAX Ext.:
Admin Email:xavier@openplans.org
Tech ID:CR25623847
Tech Name:Adrian Lamo
Tech Street1:1 Police Plaza
Tech Street2:#aspergers section
Tech Street3:
Tech City:new york
Tech State/Province:New York
Tech Postal Code:10007
Tech Country:US
Tech Phone:+1.6175003411
Tech Phone Ext.:Some guy dox him as “leon”, the whois now becomes Rafael Lima with leon@2600.com as email
Domain: prvt.org – Whois History
Cache Date: 2011-07-12
Registrar:
Server: whois.pir.org
Created:
Updated:
Expires:
Reverse Whois: Click on an email address we found in this whois record to see which other domains the registrant is associated with: leon@2600.comDomain ID:D87859570-LROR
Domain Name:PRVT.ORG
Created On:25-Jun-2002 16:38:43 UTC
Last Updated On:12-Jul-2011 01:55:51 UTC
Expiration Date:25-Jun-2012 16:43:58 UTC
Sponsoring Registrar:GoDaddy.com, Inc. (R91-LROR)
Status:CLIENT DELETE PROHIBITED
Status:CLIENT RENEW PROHIBITED
Status:CLIENT TRANSFER PROHIBITED
Status:CLIENT UPDATE PROHIBITED
Status:AUTORENEWPERIOD
Registrant ID:CR25623846
Registrant Name:Rafael Lima
Registrant Street1:90 Avenue A
Registrant Street2:APARTMENT 1
Registrant Street3:
Registrant City:new york
Registrant State/Province:New York
Registrant Postal Code:10007
Registrant Country:US
Registrant Phone:+1.2122286666
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email:leon@2600.com
Admin ID:CR25623848
Admin Name:Rafael Lima
Admin Street1:90 Avenue A
Admin Street2:APARTMENT 1
Admin Street3:
Admin City:new york
Admin State/Province:New York
Admin Postal Code:10007
Admin Country:US
Admin Phone:+1.2122286666
Admin Phone Ext.:
Admin FAX:
Admin FAX Ext.:
Admin Email:leon@2600.com
Tech ID:CR25623847
Tech Name:Rafael Lima
Tech Street1:90 Avenue A
Tech Street2:APARTMENT 1
Tech Street3:
Tech City:new york
Tech State/Province:New York
Tech Postal Code:10007
Tech Country:US
Tech Phone:+1.2122286666
Tech Phone Ext.:
Tech FAX:
Tech FAX Ext.:
Tech Email:leon@2600.com
Name Server:NS1.AFRAID.ORG
Name Server:NS2.AFRAID.ORG
Name Server:NS3.AFRAID.ORG
Name Server:NS4.AFRAID.ORG
Name Server:NS5.AFRAID.ORGSo it is been concluded Prvt.org is owned by visigod aka Hugo Carvalho of Portugal from June 25, 2009 till date.
- Sabu’s connection to Brazil and portuguese language is well know with his antics and handles
- Sabu used “visigod” nick during his early anonymous days.
- Sabu used “god” as his handle during lulzsec which is a short for visigod
On May 29, 2011, Sabu tweeted flaming me from lulzsec twitter account and in response to that atopiary said this
BINGO, here comes the name HUGO from topiary
Hugo Carvalho
Domains
Domain Name: VISIGOD.COM
Registrar: MONIKER ONLINE SERVICES, INC.
Whois Server: whois.moniker.com
Referral URL: http://www.moniker.com
Name Server: NS1.HOSTSQUADRON.COM
Name Server: NS2.HOSTSQUADRON.COM
Status: clientDeleteProhibited
Status: clientTransferProhibited
Status: clientUpdateProhibited
Updated Date: 07-jan-2011
Creation Date: 13-jan-2006
Expiration Date: 13-jan-2012>>> Last update of whois database: Wed, 13 Jul 2011 15:53:11 UTC <<<
Queried whois.moniker.com with “visigod.com”…Domain Name: VISIGOD.COM
Registrar: MONIKERRegistrant [3592563]:
Host Squadron domains@twd.pt
TWD Lda
Avenida Dr. Antonio Rodrigues Manito
N.73, R/C Dto
Setubal
Setubal
2900-067
PT
Domain Name: HUGO-CARVALHO.COM
Registrar: MONIKER ONLINE SERVICES, INC.
Whois Server: whois.moniker.com
Referral URL: http://www.moniker.com
Name Server: NS1.HOSTSQUADRON.COM
Name Server: NS2.HOSTSQUADRON.COM
Status: clientDeleteProhibited
Status: clientTransferProhibited
Status: clientUpdateProhibited
Updated Date: 27-oct-2010
Creation Date: 17-jan-2010
Expiration Date: 17-jan-2012>>> Last update of whois database: Wed, 13 Jul 2011 15:53:56 UTC <<<
Queried whois.moniker.com with “hugo-carvalho.com”…Domain Name: HUGO-CARVALHO.COM
Registrar: MONIKERRegistrant [3592563]:
Host Squadron domains@twd.pt
TWD Lda
Avenida Dr. Antonio Rodrigues Manito
N.73, R/C Dto
Setubal
Setubal
2900-067
Domain Name: LINKSQUADRON.COM
Registrar: MONIKER ONLINE SERVICES, INC.
Whois Server: whois.moniker.com
Referral URL: http://www.moniker.com
Name Server: NS1.HOSTSQUADRON.COM
Name Server: NS2.HOSTSQUADRON.COM
Status: clientDeleteProhibited
Status: clientTransferProhibited
Status: clientUpdateProhibited
Updated Date: 11-apr-2011
Creation Date: 23-apr-2009
Expiration Date: 23-apr-2012>>> Last update of whois database: Wed, 13 Jul 2011 15:54:59 UTC <<<
Queried whois.moniker.com with “linksquadron.com”…Domain Name: LINKSQUADRON.COM
Registrar: MONIKERRegistrant [3592563]:
Host Squadron domains@twd.pt
TWD Lda
Avenida Dr. Antonio Rodrigues Manito
N.73, R/C Dto
Setubal
Setubal
2900-067
PTDomain Name: HOSTSQUADRON.COM
Registrar: MONIKER ONLINE SERVICES, INC.
Whois Server: whois.moniker.com
Referral URL: http://www.moniker.com
Name Server: NS1.HOSTSQUADRON.COM
Name Server: NS2.HOSTSQUADRON.COM
Name Server: NS3.HOSTSQUADRON.COM
Name Server: NS4.HOSTSQUADRON.COM
Name Server: NS5.HOSTSQUADRON.COM
Name Server: NS6.HOSTSQUADRON.COM
Status: clientDeleteProhibited
Status: clientTransferProhibited
Status: clientUpdateProhibited
Updated Date: 09-may-2011
Creation Date: 11-jan-2007
Expiration Date: 11-jan-2012>>> Last update of whois database: Wed, 13 Jul 2011 15:55:30 UTC <<<
Queried whois.moniker.com with “hostsquadron.com”…Domain Name: HOSTSQUADRON.COM
Registrar: MONIKERRegistrant [3592563]:
Host Squadron domains@twd.pt
TWD Lda
Avenida Dr. Antonio Rodrigues Manito
N.73, R/C Dto
Setubal
Setubal
2900-067
PT
Social Networks
http://www.myspace.com/visigod
http://www.youtube.com/visigod
http://metpage.hi5.com/friend/p56230820–Hugo_Carvalho–html
Hi5
http://www.facebook.com/visigod
http://www.linkedin.com/in/hrscarvalho
Linkedin Bio
IP Operation & Configuration Team
Lisbon Area, Portugal TelecommunicationsCurrent
CEO at Host Squadron
Network and Security Technician at TMNPast
Internal Network Support at Compta
Address
Street: R. Cidade Rio de Janeiro
City:Sao Marcos
Province:Sintra
Postal Code:2735-659
Country: Portugal
Registrant Phone:+351-967165920
Some trolls identified him as Hugo from Portugal and he accepted because of his BIG EGO
@DustLavaRockSan @deadmanflying @KungFuCage OK You found me. I am Hugo. I am in Portugal. Next question is: Can you stop me? ;)
— The Real Sabu (@anonymouSabu) July 12, 2011
UPDATE
From the @anonymousabu twitter accout minutes ago, after this release:
And then:
In closing:
Sabu openly gave the names hector, xavier, rafael lima, monsegur, de leon, and kaotico as disinfo. No Hugo, never Carvalho
“Like I said – we don’t need you, we have a voice & vote. Fuck off.”
ANOTHER UPDATE
IF or when the time to apologize to Hugo comes. I will humbly be the second to do so. @anonymouSabu will be the first …..
Lulzsec have a history of stealing real folks ID’s and using them as their own to mis-direct doxing attempts. It’s standard really. Why should they go to the bother of fabricating personas, when they can just use REAL people online lives.
Here’s a link to give you an idea.
and here’s a transcript that link:
this is Topiary AKA Daniel from NAMESHUB by Backtrace he is trying to cover it up in these old logs and pin it on someone else he STOLE the topiary name from <[removed]> S'up Daniel <Topiary> s'appening [removed] <[removed]> You OK? <Topiary> could be better, you seen the pdf table thing with all the names I take it? <[removed]> Saw that, but you seen the thing today? <Topiary> bro I've been playing it off since fakegregg said something about Zelda <[removed]> ah, well, you should keep low man <Topiary> I can't at this point, I need to just straight up deny it 100% and flaunt it everywhere <Topiary> but I trust you, you know how it is <Topiary> if I go hide then people will assume the dox are right <Topiary> so I'll just act like they failed hard <[removed]> True that - so you need to make a big show of disproving them <Topiary> yeah well, this is my plan: <Topiary> (as you know I stole this nickname from a troll last December, didn't work out so well) <Topiary> I'll just keep denying it until they try to go after the troll <Topiary> then they'll think that's me and harass him <[removed]> then he harasses back? <Topiary> yeah but if I deny my real dox enough, people will go looking for other dox <Topiary> then nobody will believe I'm me <Topiary> and all you bastards told me my Brit voice was good, damnit <Topiary> did they get voice recognition? <[removed]> well when you talk the Swedish accent comes out a bit <[removed]> but not for a couple of minutes <Topiary> these faggots aren't hitting the UK nigger Topiary <Topiary> why aren't they? <Topiary> I'm hoping someone will go after him and think it's me, then I'll act all scared etc <[removed]> then boom - you drop all the heat on him <Topiary> ANYTHING to divert attention from that fuckign nameshub <Topiary> I'm assuming they put that to Feds <Topiary> so I might be raided soon <Topiary> fucking shit <Topiary> goddamnit <[removed]> that "nameshub" thing exposed a few peopl <[removed]> have the feds any jurisdiction in Sweden? <[removed]> ohwait <[removed]> shit :/ <Topiary> don't know but I'm shitting bricks <Topiary> so I don't know what to do <Topiary> so I'm just playing it off <Topiary> "Who the fuck is Daniel Sandberg?", the whole story <[removed]> well, hopefully someone will go after the troll you stole the name off <Topiary> they should have already <Topiary> hoping so dude <Topiary> because I don't want this shit <Topiary> but yeah I deleted everything recently <[removed]> rm -rf <[removed]> fuck, I hope you DBAN-ed <Topiary> I'd like to make it to the end of the month, how long do they take to raid? <Topiary> better not hit me on April fool's day <Topiary> but yeah maybe they'll just think backtrace is a joke and not go after me <[removed]> Well shit, how long before they raided no that time? <Topiary> not very long <Topiary> bro why haven't you done what I did? <Topiary> find some network and steal someone's nick <Topiary> like someone you don't like <Topiary> then do illegal shit <Topiary> and they hit them instead <Topiary> you're using a real name <[removed]> never thought to do it... <[removed]> I'd advise taking a hammer to your drives though <Topiary> wouldn't that look suspicious if they come? <Topiary> maybe things just have to be normal <[removed]> hmmmm. use a guttmann pass - you know, like DBAN on crack? <[removed]> then reload windows or something <Topiary> yeah <Topiary> just hoping that they'll take the bait <Topiary> the fucker has been using Topiary for like a year <Topiary> trolling everyone <Topiary> for no reason <Topiary> so now we troll him, hope he's getting raided <Topiary> well whatever, we both discussed this like last year <Topiary> so... <Topiary> then I'll stop my twitter and everything <Topiary> but it isn't FUCKING WORKING <[removed]> make it look like they got the right guy <Topiary> yup <[removed]> it is also <Topiary> fucking tired of people adding me on Facebook <Topiary> to be honest I'm just gonna continue the Zelda casts as normal <Topiary> it would look REALLY weird if they stopped <[removed]> it shouldnt fsck with your normal life <Topiary> yeah, right, right <Topiary> agreed <Topiary> so that's what I'll do <Topiary> just keep it cool and carry on with it <[removed]> frame up this damn trollfaggot, and "carry on" <Topiary> hope it blows over and they start doxing Ireland fag or Scotland fag or wherever the fuck UK part he's from <Topiary> anyway I trust you so yeah <Topiary> we can keep this between us <[removed]> Wont say a word bro <[removed]> just take care <Topiary> okay gotta go <Topiary> thanks for advic <[removed]> bye!
Now regarding the doxing of one Hugo Carvalho
@anonymousSabu openly gave the names hector, xavier, rafael lima, monsegur, de leon, and kaotico as disinfo (these are real people btw). Yes that’s right he also practises identity theft. What a true hero.
But never in that list of nicks/Id’s he stole did he mention ‘Carvalho’ openly. Hmmm???
If Carvalho has been identified wrongly, there is only one reason it’s because @anonymouSabu put him in that position in the first place for that very reason, Carvalho even says in the gawker article ‘somebody’ stole his ID.
“I’m Hugo Carvalho, and the story behind me and this nick guy @anonymouSabu is a complete lie. Someone stole my photo from one of my Web sites and started to spread the rumor that I was affiliated with this hacking group,” he said in an e-mail to CNET’s Elinor Mills.
So only 2 scenarios exist:
1). Either @anonymouSabu is Hugo Carvalho and is desperately trying to mis-direct and deny.
2). @anonymouSabu used Hugo Carvalho’s ID as another scapegoat hoping he would get doxed to hell and back.
Which of those scenarios makes @anonymouSabu a good person?
BTW SABU – the first thing I always think of doing when ‘wrongly doxed’ (9 times now) is run to GAWKER/GIZMODO to refute???
http://www.theatlanticwire.com/technology/2011/07/quest-unmask-ringleader-anonymous/39977/
.
.
Props to: @gr4ssh0pp3r and Web Ninja’s, Miss Mary and Indiana Jones
X-Post Source and Mirror: http://therealsabu.blogspot.com/
.
more later...
Comments
Post a Comment