Reader's advisory: Wired News has been unable to confirm some sources for a number of stories written by this author. If you have any information about sources cited in this article, please send an e-mail to sourceinfo[AT]wired.com.
Repeatedly tossed off the Internet, a website believed to be al Qaeda's primary online method of communication continues to resurface as an uninvited guest on other websites.
Alneda.com first appeared after the Sept. 11 attacks, hosted by legitimate Internet service providers in Malaysia and the United States who promptly evicted the site after being alerted to its contents and purpose.
Al Neda eventually lost ownership of the Alneda.com domain in August when Jon David Messner, a hacker who runs porn sites, took it over.
But the website formerly known as Alneda.com is still online. For the past eight months, it has functioned as a so-called Internet parasite -- a site that is embedded within another website without the site owner's knowledge.
Al Neda recently showed up buried inside the websites of a 14-year old student, a software security company and a horror movie fan's tribute pages to director Clive Barker.
As of late last Friday, Al Neda was hidden within the website of Educa, a small educational consultancy in the Netherlands. English and Arabic versions were buried in Educa's subdirectory files.
According to Jeremy Reynalds, a freelance writer who has been tracking the movements of Al Neda and is working on a book on terrorism and the Web, Al Neda's news section is not usually updated very regularly.
However, he noted some significant differences in the newest update, currently housed on Educa.
"Site content this time reflects the capture of some American prisoners of war by Iraqis and also makes their pictures in addition to some other distressing images available by redirecting those interested to another website," Reynalds said. "There is also a long rambling message titled 'Message to our Muslim brothers in Iraq.'"
The message contained statements such as "no prophet should take prisoners until he kills many enemies" and "if you meet the infidels (in battle) deal blows at their necks. Let your attitude to the crusaders be as the line of poetry: There is no reproach between me and you except the stabbing of kidneys and the chopping of heads."
Information provided by the Middle East Media Research Institute indicates that al Qaeda has often used the Al Neda site to urge terrorists to kill Americans and others, and has on several occasions featured messages purportedly from Osama bin Laden.
Internet Haganah, an association of U.S. and Israeli counterterrorism and Internet experts that tracks terrorist websites and online activity, describes Al Neda in its database as "reportedly the primary website of al Qaeda. Al Qaeda is said to use this site as a means of communicating with their cells."
Out of the several dozen sites Haganah lists, Al Neda is the only one without a live link. Haganah refuses to link directly to Al Neda's current location, noting that "Anyone who needs to know where Al Neda is right now, knows where Al Neda is right now."
The freeloader website moves around so much that interested parties have to be alerted to its latest hiding place through posts on radical Islamic bulletin boards and mailing lists. Reynalds relies on several mailing lists to help him keep up with Al Neda.
Educa did not immediately respond to e-mailed requests for comment on the apparent invasion of the company's website. Liquid Web, the ISP that hosts Educa's site, has housed at least one other site that has been commandeered by Al Neda.
A Liquid Web customer was startled last October when a message purporting to be from Osama bin Laden, head of the al Qaeda terrorist network, popped up on his website.
The message that turned up on Matt Rexer's Clive Barker tribute site congratulated the "... Islamic world for the heroic operations of courageous jihad carried out by its pious fighter children in Yemen, against the tanker of the crusaders, and in Kuwait, against the American invasion and occupation forces," and was signed "Osama bin Mohammad bin Laden, your brother."
Rexer speculates that familiarity with the hosting company may have allowed his site's attackers to exploit a security hole on its servers. Liquid Web hosted Al Neda for a short period last summer.
In an e-mail, Jack Flintz, security administrator for Liquid Web, said that the proper authorities had been notified about the site and that Liquid Web had been asked to leave the website in place for a short time while the FBI investigates the matter.
Liquid Web plans to remove the Al Neda pages as soon as possible.
"I’m not sure why they like us so much,” Flintz said, referring to Al Neda.
Mike Sweeney, owner of networking consultant firm PacketAttack, said it appeared that Al Neda is breaking into unsuspecting websites by cracking administrative user IDs and passwords and, in some cases, using several well-known weaknesses on the affected Web servers to bypass security measures.
Sweeney said the Al Neda site owners aren't particularly skilled at such maneuvers, adding that Al Neda's site could be inserted inside other websites with cracking tools that are available online.
