Previous EpisodeWe have identified Sabu as Visigod aka Hugo Carvalho from Portugal but Visigod claimed on our blog that he got nothing to do with LulzSec hacker Sabu. Visigod also said he sold the domain "prvt.org" to a guy called Xavier in November 2009 and sent us the email conversations as proof.
Our conversations with Visigod here -
http://lulzsecexposed.blogspot.com/2011/07/job-done.htmlPresent EpisodeWe have analysed the emails and here is the "Kick-Ass Special Report"
Reference 1http://office.microsoft.com/en-us/outlook-help/view-e-mail-message-headers-HA001230300.aspx1. The practice of providing false information in message headers is a growing problem. This is also known as spoofing.
2. X-Mailer: Microsoft Office Outlook, Build 12.0.4210
This information indicates that the message was sent by using Microsoft Office Outlook with a build version of 12.0.4210.
Reference 2http://www.slipstick.com/exs/versions.htmOutlook 2010
14.0.4760.1000 - Released to Manufacturing April 16 2010
Outlook 2007
12.0.6341.5000 - February 24, 2009 pre-SP2 Cumulative Update
12.0.6504.5000 - SP2
12.0.6510.5000 - June 30 2009 hotfix - see KB 970944
Based on the above references1. Email headers can be spoofed
2. One can identify the mail program and time period of the build by checking the X-mailer of email headers.
The emails sent by visigod are dated from
June 25, 2009 till Nov 16, 2009. According to visigod, this is the time period he owned prvt.org domain.
First email sent by Xavier to Visigod after winning GoDaddy Auction is dated on Thu 2009-10-29 04:00 PM
The X-Mailer is Microsoft Outlook 14.0
Visigod sent reply to the email on Thu 2009-10-29 11:17 PM
Even here the X-Mailer is Microsoft Outlook 14.0
- Whether GoDaddy sends email to Visigod or Xavier sends email to Visigod or Visigod sends email to Xavier, all X-mailers are Microsoft Outlook 14.0
- IP headers are missing in the emails sent by Visigod. When you save the emails, you get complete headers including IP's.
FACT - X-mailer build "Microsoft Outlook 14.0" was released on April 15, 2010.
Source http://en.wikipedia.org/wiki/Microsoft_Outlookhttp://www.slipstick.com/exs/versions.htmAll the emails sent by Visigod aka Hugo aka Sabu are FAKE and SPOOFED
Thank you for playing with Ninjas and confirming that our DOX are 100 percent correct.
You could fool the world and reporters with your stories but not NINJA'S. Daniel aka Topiary also tried to fool us two weeks back in a similar fashion but miserably failed and now
We caught you BUTT NAKED.Hugo - You challenged some one on twitter to extradite you from Portugal. Take our word, It won't be a BIG DEAL for the Law Enforcement.
Having said that, Get ready for the Party Van. Our "Game Over" list is waiting for you. .....ROFL....
Hugo Carvalho aka Sabu
Bio
Past - Anonymous and Captain of LulzSec Boat
Present - Leader of Antisec
Age : 36 years old
Birthday : June 15, 1975
Gender : Male
Location : Portugal
Interests : Metallica and Network security
Occupation - Webmaster, Coder and Network Admin--------------------------------------------------------------------------------------------
Emails sent by Visigodhttp://www.visigod.com/prvt.zipArchive -
http://www.sendspace.com/file/um7uhyFrom GoDaddy support to VisigodThu 2009-06-25 03:21 PM
Return-Path: <bounced@godaddy.com>
Reply-To: <support@godaddy.com>
From: <support@godaddy.com>
To: <visigod@gmail.com>
Subject: DOMAIN CONTACT UPDATE
Date: Thu, 25 Jun 2009 12:20:52 +0100
Message-ID: <709901cb6cc5$4d0c25f0$e72471d0$@godaddy.com>
MIME-Version: 1.0
Content-Type: text/plain;
charset="utf-8"
Content-Transfer-Encoding: quoted-printable
X-Mailer: Microsoft Outlook 14.0Thread-Index: AQGTAanTnJP3U+cKZfyowaJpzgnOJg==
x-mimeole: Produced By Microsoft MimeOLE V6.00.3790.2826
x-originalarrivaltime: 25 Jun 2009 11:20:52.0804 (UTC) FILETIME=[001CB040:01C9F587]
content-class: urn:content-classes:message
Dear Hugo Carvalho,
Changes to your registrant and/or administrative contact information have been initiated for the domain name(s) listed below:
PRVT.ORG
You *do not* need to respond to this email.
If, however, you think these changes may have been made in error or fraudulently, please contact
us within 15 days at mailto:support@godaddy.com.
Sincerely,
GoDaddy.com, Inc.
-----------------------------------------------------------------------------------
From GoDaddy Auctions to VisigodWed 2009-10-28 03:23 AM
Return-Path: <bounced@godaddy.com>
Reply-To: <auctions@godaddy.com>
From: <auctions@godaddy.com>
To: <visigod@gmail.com>
Subject: Your Domain, prvt.org, Has Sold
Date: Wed, 28 Oct 2009 01:23:11 +0100
Message-ID: <70f101cb6cc5$4d719e80$e854db80$@godaddy.com>
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_70F2_01CB6CCD.AF36F0E0"
X-Mailer: Microsoft Outlook 14.0Thread-Index: AQKtZC1lnQOQtyuAp1r1XK7DORRYpQ==
x-mimeole: Produced By Microsoft MimeOLE V6.00.3790.2826
x-originalarrivaltime: 28 Oct 2009 00:23:11.0439 (UTC) FILETIME=[D4F0FDF0:01CA5764]
content-class: urn:content-classes:message
x-mid: fac7778a-3b57-4f02-b501-8d7e0f07dfda
Domain sold
--------------------------------------------------------------------------
From Xavier to VisigodThu 2009-10-29 04:00 PM
Return-Path: <xavier@openplans.org>
From: <xavier@openplans.org>
To: <visigod@gmail.com>
Subject: Important information regarding PRVT.org
Date: Thu, 29 Oct 2009 13:59:37 +0100
Message-ID: <70f601cb6cc5$4d78f180$e86ad480$@openplans.org>
MIME-Version: 1.0
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
X-Mailer: Microsoft Outlook 14.0Thread-Index: AQN6p4ks+42PEgxZ2GDsSvzE1aK94Q==
hey there. money was paid. how long do authorizations usually take? its already been 3 days.
regards,
~xavier
----------------------------------------------------------------------------------------------------------
From Visigod to XavierThu 2009-10-29 11:17 PM
From: "VisiGod" <visigod@gmail.com>
To: <xavier@openplans.org>
References: <4ae991ba.1c67f10a.5c14.fffffba7SMTPIN_ADDED@mx.google.com>
In-Reply-To: <4ae991ba.1c67f10a.5c14.fffffba7SMTPIN_ADDED@mx.google.com>
Subject: RE: Important information regarding PRVT.org
Date: Thu, 29 Oct 2009 21:17:04 +0100
Message-ID: <209601cb6cc4$c89bbab0$59d33010$@gmail.com>
MIME-Version: 1.0
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
X-Mailer: Microsoft Outlook 14.0Thread-Index: AQL6zXAV2iO9+NOO+jVMZL/6Q3q0KwIGNz/9
Content-Language: pt
Hello Xavier,
We now must wait until godaddy allows me to transfer the domain to you. The domain is locked and I cannot do anything with it. Usually this takes about 10 days. In the meanwhile if you want I can redirect the domain to you, just tell me which nameservers you would like to use.
Best regards,
Hugo Carvalho
-----Original Message-----
From: xavier@openplans.org [mailto:xavier@openplans.org]
Sent: quinta-feira, 29 de Outubro de 2009 13:00
To: visigod@gmail.com
Subject: Important information regarding PRVT.org
hey there. money was paid. how long do authorizations usually take? its already been 3 days.
regards,
~xavier
---------------------------------------------------------------------------------------------------
From Xavier to VisigodSun 2009-11-01 08:52 AM
Return-Path: <xavier@openplans.org>
From: <xavier@openplans.org>
To: <visigod@gmail.com>
Subject: Important information regarding PRVT.org
Date: Sun, 1 Nov 2009 06:52:03 +0100
Message-ID: <70f701cb6cc5$4d7b1460$e8713d20$@openplans.org>
MIME-Version: 1.0
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
X-Mailer: Microsoft Outlook 14.0Thread-Index: AQJIabja2SpYQv8js+f2LkAsfzIXjw==
hi. I'd like to take ownership of the domain.
if you're not giving it up then refund my money.
---------------------------------------------------------------------------------------------------
From Visigod to XavierSun 2009-11-01 02:42 PM
From: "VisiGod" <visigod@gmail.com>
To: <xavier@openplans.org>
References: <4aed2204.1367f10a.2645.ffff9063SMTPIN_ADDED@mx.google.com>
In-Reply-To: <4aed2204.1367f10a.2645.ffff9063SMTPIN_ADDED@mx.google.com>
Subject: RE: Important information regarding PRVT.org
Date: Sun, 1 Nov 2009 12:42:11 +0100
Message-ID: <209c01cb6cc4$c8a53090$59ef91b0$@gmail.com>
MIME-Version: 1.0
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
X-Mailer: Microsoft Outlook 14.0Thread-Index: AQI8Irvx8vl8aNyFgf7edaaHJu2DPwHaACqc
Content-Language: pt
Hello Xavier,
We now must wait until godaddy allows me to transfer the domain to you. The domain is locked and I cannot do anything with it. Usually this takes about 10 days. In the meanwhile if you want I can redirect the domain to you, just tell me which nameservers you would like to use.
Best regards,
Hugo Carvalho
-----Original Message-----
From: xavier@openplans.org [mailto:xavier@openplans.org]
Sent: domingo, 1 de Novembro de 2009 05:52
To: visigod@gmail.com
Subject: Important information regarding PRVT.org
hi. I'd like to take ownership of the domain.
if you're not giving it up then refund my money.
-----------------------------------------------------------------------------------------------
From Xavier to VisigodWed 2009-11-04 08:05 AM
Return-Path: <xavier@openplans.org>
From: <xavier@openplans.org>
To: <visigod@gmail.com>
Subject: Important information regarding PRVT.org
Date: Wed, 4 Nov 2009 06:04:41 +0100
Message-ID: <70f801cb6cc5$4d82b580$e8882080$@openplans.org>
MIME-Version: 1.0
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
X-Mailer: Microsoft Outlook 14.0Thread-Index: AQI3KS/fVSxvLdX6uy6dRhbRG6S3VQ==
Thank you.
Can you please point the domain to:
ns1.afraid.org
ns2.afraid.org
ns3.afraid.org
ns4.afraid.org
ns5.afraid.org
Thank you!
------------------------------------------------------------------------------------
From GoDaddy support to VisigodWed 2009-11-04 02:36 PM
Return-Path: <bounced@godaddy.com>
Reply-To: <support@godaddy.com>
From: <support@godaddy.com>
To: <visigod@gmail.com>
Subject: Status Alert: Domain Change Notification
Date: Wed, 4 Nov 2009 12:36:00 +0100
Message-ID: <70f901cb6cc5$4d865f00$e8931d00$@godaddy.com>
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_70FA_01CB6CCD.AF4CE9E0"
X-Mailer: Microsoft Outlook 14.0Thread-Index: AQHApFtJa23gQwdHaIVPgcAwcPLwuw==
x-mimeole: Produced By Microsoft MimeOLE V6.00.3790.2826
x-originalarrivaltime: 04 Nov 2009 11:36:00.0810 (UTC) FILETIME=[FBDA68A0:01CA5D42]
content-class: urn:content-classes:message
x-mid: e8dfe037-2c32-432f-bd96-c418f9703cad
Name Servers changed
----------------------------------------------------------------------------------------
From GoDaddy Auctions to VisigodWed 2009-11-04 10:55 PM
Return-Path: <bounced@godaddy.com>
Reply-To: <auctions@godaddy.com>
From: <auctions@godaddy.com>
To: <visigod@gmail.com>
Subject: Domain Transfer Authorization
Date: Wed, 4 Nov 2009 20:54:33 +0100
Message-ID: <70fd01cb6cc5$4d891e20$e89b5a60$@godaddy.com>
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_70FE_01CB6CCD.AF4EBEA0"
X-Mailer: Microsoft Outlook 14.0Thread-Index: AQMmNYzkyt3CeDa4hm3a7Ur42qWf3A==
x-mimeole: Produced By Microsoft MimeOLE V6.00.3790.2826
x-originalarrivaltime: 04 Nov 2009 19:54:33.0889 (UTC) FILETIME=[A1700910:01CA5D88]
content-class: urn:content-classes:message
x-mid: 5187f0dd-ea2a-44c6-9cfb-7d4fa7e6e104
Domain Transfer Authorization
-------------------------------------------------------------------------------------------------
From GoDaddy Support to VisigodWed 2009-11-04 11:30 PM
Return-Path: <bounced@godaddy.com>
Reply-To: <support@godaddy.com>
From: <support@godaddy.com>
To: <visigod@gmail.com>
Subject: DOMAIN OWNERSHIP TRANSFER
Date: Wed, 4 Nov 2009 21:30:26 +0100
Message-ID: <710101cb6cc5$4d8acbd0$e8a06370$@godaddy.com>
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_7102_01CB6CCD.AF4F81F0"
X-Mailer: Microsoft Outlook 14.0Thread-Index: AQHiMXNWYZctGL90kJmwW6SAGitcbw==
x-mimeole: Produced By Microsoft MimeOLE V6.00.3790.2826
x-originalarrivaltime: 04 Nov 2009 20:30:26.0540 (UTC) FILETIME=[A48482C0:01CA5D8D]
content-class: urn:content-classes:message
x-mid: eba73ffe-c634-45df-b249-07b202a01665
This email is to confirm the recent change of registrant of the following domain name(s):
PRVT.ORG
The change has been completed and the available information has been recorded in our system.
If you feel this change is incorrect, please immediately contact undo@godaddy.com, and provide any information you may have that will assist in reviewing your issue.
Sincerely,
GoDaddy.com, Inc.
-----------------------------------------------------------------------------------------------------------
From Godaddy Auctions to VisigodFri 2009-11-06 03:04 PM
Return-Path: <bounced@godaddy.com>
Reply-To: <auctions@godaddy.com>
From: <auctions@godaddy.com>
To: <visigod@gmail.com>
Subject: Domain Transaction Status
Date: Fri, 6 Nov 2009 13:04:21 +0100
Message-ID: <710501cb6cc5$4d8c0450$e8a40cf0$@godaddy.com>
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_7106_01CB6CCD.AF512FA0"
X-Mailer: Microsoft Outlook 14.0Thread-Index: AQKmrkspRn5RzLTS1p2EfjGLB8Zg/g==
x-mimeole: Produced By Microsoft MimeOLE V6.00.3790.2826
x-originalarrivaltime: 06 Nov 2009 12:04:21.0040 (UTC) FILETIME=[46186B00:01CA5ED9]
content-class: urn:content-classes:message
x-mid: 3ecf5472-3ad1-4cd5-8c9e-4efd85a04745
Customer No. 13436062
Dear Hugo Carvalho,
This is a courtesy notice to let you know that the transaction for prvt.org will be completed on 11/16/2009. At this point, the domain has been paid for and the domain can be transferred. If you have not negotiated the details for the domain transfer, please contact us.
> Search domain listings expiring soon
> See today's featured domain listings
If you have any questions, Customer Support is available 24 hours a day, 7 days a week:
– Email: auctions@godaddy.com
– Phone: (480) 505-8892
– Online Support
Sincerely,
Go Daddy Auctions Team
--------------------------------------------------------------------------------------------------------
From Godaddy Auctions to visigodWed 2009-11-11 03:05 PM
Return-Path: <bounced@godaddy.com>
Reply-To: <auctions@godaddy.com>
From: <auctions@godaddy.com>
To: <visigod@gmail.com>
Subject: Domain Transaction Status
Date: Wed, 11 Nov 2009 13:04:31 +0100
Message-ID: <710901cb6cc5$4d8e0020$e8aa0060$@godaddy.com>
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_710A_01CB6CCD.AF532B70"
X-Mailer: Microsoft Outlook 14.0Thread-Index: AQG7dWxgyY/uB98hulWLaj0zrTRSBA==
x-mimeole: Produced By Microsoft MimeOLE V6.00.3790.2826
x-originalarrivaltime: 11 Nov 2009 12:04:31.0810 (UTC) FILETIME=[20948A20:01CA62C7]
content-class: urn:content-classes:message
x-mid: 000f28cf-3503-4e51-bc05-d386f29f4cc3
Customer No. 13436062
Dear Hugo Carvalho,
This is a courtesy notice to let you know that the transaction for prvt.org will be completed on 11/16/2009. At this point, the domain has been paid for and the domain can be transferred. If you have not negotiated the details for the domain transfer, please contact us.
> Search domain listings expiring soon
> See today's featured domain listings
If you have any questions, Customer Support is available 24 hours a day, 7 days a week:
– Email: auctions@godaddy.com
– Phone: (480) 505-8892
– Online Support
Sincerely,
Go Daddy Auctions Team
------------------------------------------------------------------------------------------------
From Godaddy Auctions to visigodMon 2009-11-16 03:08 PM
Customer No. 13436062
Dear Hugo Carvalho,
The following transaction(s) is now complete:
Item number 26978043 for prvt.org
Thank you for selling your domain through Go Daddy Auctions! We appreciate your business and hope to be of service to you again in the future.
If you have any questions, Customer Support is available 24 hours a day, 7 days a week:
– Email: auctions@godaddy.com
– Phone: (480) 505-8892
– Online Support
Sincerely,
Go Daddy Auctions Team
---------------------------------------------------------------------------
From GoDaddy Paypal to visigodTue 2009-11-17 04:31 AM
Return-Path: <payment@paypal.com>
From: <paypal@tdnam.com>
Sender: <sendmail@paypal.com>
To: "Hugo Carvalho" <visigod@gmail.com>
Subject: Domain Sale Proceeds
Date: Tue, 17 Nov 2009 02:30:54 +0100
Message-ID: <711101cb6cc5$4d94ddf0$e8be99d0$@tdnam.com>
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable
X-Mailer: Microsoft Outlook 14.0Thread-Index: AQHBboKWG7SdcRnIzrxdYu1NAGkQiQ==
x-xpt-xsl-name: email_pimp/default/en_US/transaction/seller/TransactionCounterparty.xsl
x-email-type-id: PP274
x-maxcode-template: email-transaction-counterparty
Hello Hugo Carvalho,
Go Daddy - TDNAM just sent you money with PayPal.
-----------------------------------
Payment details
-----------------------------------
Amount: $45.00 USD
Transaction Date: Nov 16, 2009
Transaction ID: 5RA79242AH255245T
Subject: Domain Sale Proceeds
Custom note: Payment for PRVT.ORG to member 26978043.
You can view the details for this transaction by logging in to your PayPal account and clicking the "History" tab.
https://www.paypal.com/pt/vst/id=5RA79242AH255245T
Go Daddy - TDNAM is a Verified buyer.
Go Daddy - TDNAM has completed the PayPal Verification process to help confirm their identity, and
they have a confirmed bank account, or been approved for a PayPal Plus Credit Card.
The PayPal Verification process is a security measure to confirm that a user is the owner of the bank account or credit card they are using in PayPal. Confirming each user's identity helps prevent fraud, such as identity theft, and increases the security of payments in PayPal.
