Gregory D. Evans Starts "Un-biased", Denies Involvement

Thu Jul 15 16:46:42 CDT 2010

Feb 5, 2011 update - A leaked mail shows that Evans did register domain from GoDaddy. E-mail also shows LIGATT employee Katrina Highsmith wrote some content for the site. Further, an ex employee has confirmed the site idea and content was directed by Evans.

In late June, 2010, a web-site called The Cyber Wars popped up. At first, it was a poorly created WordPress based site with seemingly obvious ties to Gregory Evans. The only account posting content was called "no1hacker" (later changed to "The Referee"). All of the initial information was about Evans, including his inflated biography and a graphic that showed him knocking out the competitor. Some reports said that advertisements would pop-up for LIGATT, but could not verify that.

(Click to enlarge)

Over the next few weeks, as changes were made and new content posted, the site lost the obvious signs pointing towards Evans' involvement. Portions of the about page changed, such as the first paragraph about "The Referee". It originally read:

"I would like to start off by saying that I am not a hacker, or even a computer geek. I am in the entertainment industry. I have worked on major film projects, I have written episodes on Law and Order and I have True Hollywood Stories on the E channel.

Curious why this went away in favor of a less glamorous introduction. For the first week, "Greg's Corner" had content including his biography, while "Chris's Corner" had no content. Over time, a few commenters started posting on the threads. Curiously, they always support Evans, including a commenter "cjohnriley" who is not Chris John Riley. "The Referee" apparently does not care about people injecting bias in such a manner. I confirmed with Chris John Riley that he is not the person posting under that handle.

From: Chris John Riley (chris.riley[at]
To: security curmudgeon (jericho[at]
Date: Fri, 16 Jul 2010 07:19:55 +0200
Subject: Confirmation I do not post on


Thanks for your email. Just to confirm. I haven't posted 
anything under the name 'cjohnriley' on any site, including


[Chris John Riley]
- All emails XOR'd twice for added security -

The Google Connection

Google Adsense and Google Analytics allow web sites to display custom advertisements and track the traffic to the site. To do this, you must sign up for the programs and create small blocks of JavaScript that will load the ads or track traffic. To faciliate this, Google uses two variables in the code; "google_ad_client" for Google Adsense and a "_setAccount" call for Google Analytics. These are unique identifiers so that Google can properly track your site versus the hundreds of thousands of others. For one Google customer using multiple web sites, they use the same identifier on all sites to aggregate the information under their one account.

Looking at, and, the source of the web pages reveal a clear link between them, all tying to Evans and LIGATT. The Google Analytics user ID (UA-15022675-*) on and are the same, showing they are linked. The Google AdSense user ID (pub-6816883564478937) on and are the same, showing they are linked. One and one equal two: is linked to LIGATT and Evans.

google_ad_client = "pub-6816883564478937";
_gaq.push(['_setAccount', 'UA-17198257-1']);

google_ad_client = "pub-6816883564478937";
_gaq.push(['_setAccount', 'UA-15022675-2']);

var pageTracker = _gat._getTracker("UA-15022675-1");

(Click to enlarge)

Jul 19 Update: After posting this entire article to site (without permission no less), they have changed the Google Analytics account from UA-17198257-1 to UA-15022675-5. This change means they are now using the same account as both and After making a weak claim that our article "is false", removing the google_ad_client to try to obscure information, while also changing the Analytics code to match LIGATT's other sites helps make our case even more.

(Click to enlarge)

The User Connection

On July 14, 2010, information regarding the SQL database was posted to (Google ) and later removed. The information contained a list of users from site, including the associated e-mail address. This showed that the site is run by Evans, LIGATT and Dynasty Web Marketing out of Atlanta, Georgia. The "no1hacker" account that is no longer visible is tied to while "The Referee" that replaced him for posts is tied to Below is an excerpt of the Pastebin material, with the hashed passwords removed:

INSERT INTO `wp_users` VALUES (1, 'cyberwars', '[redacted]', 'admin', '', '', '2010-06-30 19:05:08', '', 0, 'cyberwars');
INSERT INTO `wp_users` VALUES (2, 'no1hacker', '[redacted]', 'no1hacker', '', '', '2010-06-30 20:35:06', '', 0, 'TheReferee');
INSERT INTO `wp_users` VALUES (3, 'The Referee', '[redacted]', 'the-referee', '', '', '2010-06-30 20:39:15', '', 0, 'The Referee');
INSERT INTO `wp_users` VALUES (6, 'cybergeek', '[redacted]', 'cybergeek', '', '', '2010-07-01 00:14:03', '', 0, 'cybergeek');

With this information, we sent mail to 'Teresa' at Dynasty Web Marketing asking for confirmation of her company's involvement in the site. We also found out that a journalist had done the same, but neither of us have received a reply.

From: security curmudgeon (jericho[at]
To: cyberwars (teresa[at]
Date: Thu, 15 Jul 2010 04:16:32 -0500 (CDT)
Subject: Care to comment? will be publishing an article in the next 24 hours showing 
the link between Dynasty Web Marketing,, Gregory D. Evans 
and LIGATT Security.

Would you care to comment on the record about this? Specifically, would 
you like to confirm that you were hired by Evans and/or LIGATT to run the 

Based on your answer, or lack of, the article will reflect either your 
decision to take Evans on as a client, likely without knowing the full 
story behind the Evans vs Riley saga, or it will reflect that you are 
complicit in Evans actions in defamatory comments regarding Riley, Harlow 
et al. In case you are not aware, Evans has filed a law suit against 
several individuals including Riley. Involvement in will 
most likely involve your firm in the law suit.,1378476.html

Thanks for any comments.

main page ATTRITION feedback