(Click to enlarge)
Feb 5, 2011 update - A leaked mail shows that Evans did register thecyberwars.com domain from GoDaddy. E-mail also shows LIGATT employee Katrina Highsmith wrote some content for the site. Further, an ex employee has confirmed the site idea and content was directed by Evans.
In late June, 2010, a web-site called The Cyber Wars popped up. At first, it was a poorly created WordPress based site with seemingly obvious ties to Gregory Evans. The only account posting content was called "no1hacker" (later changed to "The Referee"). All of the initial information was about Evans, including his inflated biography and a graphic that showed him knocking out the competitor. Some reports said that advertisements would pop-up for LIGATT, but Attrition.org could not verify that.
Over the next few weeks, as changes were made and new content posted, the site lost the obvious signs pointing towards Evans' involvement. Portions of the about page changed, such as the first paragraph about "The Referee". It originally read:
"I would like to start off by saying that I am not a hacker, or even a computer geek. I am in the entertainment industry. I have worked on major film projects, I have written episodes on Law and Order and I have True Hollywood Stories on the E channel.
Curious why this went away in favor of a less glamorous introduction. For the first week, "Greg's Corner" had content including his biography, while "Chris's Corner" had no content. Over time, a few commenters started posting on the threads. Curiously, they always support Evans, including a commenter "cjohnriley" who is not Chris John Riley. "The Referee" apparently does not care about people injecting bias in such a manner. I confirmed with Chris John Riley that he is not the person posting under that handle.
From: Chris John Riley (chris.riley[at]xxxx.cc) To: security curmudgeon (jericho[at]attrition.org) Date: Fri, 16 Jul 2010 07:19:55 +0200 Subject: Confirmation I do not post on thecyberwars.com Hi, Thanks for your email. Just to confirm. I haven't posted anything under the name 'cjohnriley' on any site, including thecyberwars.com. Chris -- [Chris John Riley] [blog.c22.cc] -- --------------------------------------------- - All emails XOR'd twice for added security - ---------------------------------------------
Google Adsense and Google Analytics allow web sites to display custom advertisements and track the traffic to the site. To do this, you must sign up for the programs and create small blocks of JavaScript that will load the ads or track traffic. To faciliate this, Google uses two variables in the code; "google_ad_client" for Google Adsense and a "_setAccount" call for Google Analytics. These are unique identifiers so that Google can properly track your site versus the hundreds of thousands of others. For one Google customer using multiple web sites, they use the same identifier on all sites to aggregate the information under their one account.
Looking at ligattsecurity.com, spoofem.com and thecyberwars.com, the source of the web pages reveal a clear link between them, all tying to Evans and LIGATT. The Google Analytics user ID (UA-15022675-*) on spoofem.com and ligattsecurity.com are the same, showing they are linked. The Google AdSense user ID (pub-6816883564478937) on thecyberwars.com and spoofem.com are the same, showing they are linked. One and one equal two: thecyberwars.com is linked to LIGATT and Evans.
thecyberwars.com
google_ad_client = "pub-6816883564478937";
_gaq.push(['_setAccount', 'UA-17198257-1']);
spoofem.com/blog/
google_ad_client = "pub-6816883564478937";
_gaq.push(['_setAccount', 'UA-15022675-2']);
ligattsecurity.com
var pageTracker = _gat._getTracker("UA-15022675-1");
Jul 19 Update: After posting this entire article to thecyberwars.com site (without permission no less), they have changed the Google Analytics account from UA-17198257-1 to UA-15022675-5. This change means they are now using the same account as both spoofem.com and ligattsecurity.com. After making a weak claim that our article "is false", removing the google_ad_client to try to obscure information, while also changing the Analytics code to match LIGATT's other sites helps make our case even more.
On July 14, 2010, information regarding the SQL database was posted to Pastebin.com (Google ) and later removed. The information contained a list of users from thecyberwars.com site, including the associated e-mail address. This showed that the site is run by Evans, LIGATT and Dynasty Web Marketing out of Atlanta, Georgia. The "no1hacker" account that is no longer visible is tied to gregoryevans@ligatt.com while "The Referee" that replaced him for posts is tied to pr@ligatt.com. Below is an excerpt of the Pastebin material, with the hashed passwords removed:
INSERT INTO `wp_users` VALUES (1, 'cyberwars', '[redacted]', 'admin', 'teresa@dynastywebmarketing.com', '', '2010-06-30 19:05:08', '', 0, 'cyberwars');
INSERT INTO `wp_users` VALUES (2, 'no1hacker', '[redacted]', 'no1hacker', 'gregoryevans@ligatt.com', '', '2010-06-30 20:35:06', '', 0, 'TheReferee');
INSERT INTO `wp_users` VALUES (3, 'The Referee', '[redacted]', 'the-referee', 'pr@ligatt.com', '', '2010-06-30 20:39:15', '', 0, 'The Referee');
INSERT INTO `wp_users` VALUES (6, 'cybergeek', '[redacted]', 'cybergeek', 'info@dynastywebmarketing.com', '', '2010-07-01 00:14:03', '', 0, 'cybergeek');
With this information, we sent mail to 'Teresa' at Dynasty Web Marketing asking for confirmation of her company's involvement in the site. We also found out that a journalist had done the same, but neither of us have received a reply.
From: security curmudgeon (jericho[at]attrition.org) To: cyberwars (teresa[at]dynastywebmarketing.com) Date: Thu, 15 Jul 2010 04:16:32 -0500 (CDT) Subject: Care to comment? Attrition.org will be publishing an article in the next 24 hours showing the link between Dynasty Web Marketing, thecyberwars.com, Gregory D. Evans and LIGATT Security. Would you care to comment on the record about this? Specifically, would you like to confirm that you were hired by Evans and/or LIGATT to run the site? Based on your answer, or lack of, the article will reflect either your decision to take Evans on as a client, likely without knowing the full story behind the Evans vs Riley saga, or it will reflect that you are complicit in Evans actions in defamatory comments regarding Riley, Harlow et al. In case you are not aware, Evans has filed a law suit against several individuals including Riley. Involvement in thecyberwars.com will most likely involve your firm in the law suit. http://www.earthtimes.org/articles/press/more-alleged-stock-manipulation,1378476.html Thanks for any comments.
