It's not extremely difficult to see a relationship between Cyberangels and Martijn Bevelander. There's simply too much of a coincidence and it wouldn't be very realistic not to assume a connection between the two. However, it has been quite difficult to come up with the proof for the relationship. And, if you accuse someone, you'd better have proof of it as well. This is a listing of the cross-links (preliminary sketch) between the different pieces of evidence.
This is some of the evidence that proof there indeed was a connection between Martijn Bevelander and Cyberangels:
Suggestions? Corrections? Please send an e-mail to rejo@spamvrij.nl.
The starting point for the BBC article on the connection between Cyberangels and Bevelander is a spam that was sent for the SuperZonda domain beautifulwomentodate.com. It was sent out on May 26th 2003 using an open proxy on a computer of British Airways. The nameserver for the domain was running on 217.21.117.88, which is in the NL-CYBERANGELS range.
The same article is talking about an e-mail that they obtained:
But the clearest piece of evidence came in an e-mail written by Martijn Bevelander himself, obtained by the BBC, in which he describes himself as "an investor" in Cyberangels, and claimed that he manages their network.
I have seen this e-mail and I therefore can confirm it's existence. But who wouldn't believe the BBC anyway?
At June, 3rd 2003 a large spamrun was done by Superzonda for the domains horizonstream.net, lonelyladies.net, enlargenow.net and directadultaccess.com. The source of these spams was a dialup of a reseller of Ladot (a client of Ladot allowed to resell the services they obtain from Ladot). The Caller Line Identification logfiles make clear that the phonenumber from which the connection was setup was 020-4115066. This number is the fax number that appears in the Chamber of Commerce registry for Maps Holding B.V. and the RIPE database for NL-CYBERANGELS. To be able to login, at least two accounts were created with forged information.
There has been a legal company named Cyberangels B.V. in the Netherlands for a while. At the time the BBC and others were doing research on Cyberangels, this tradename was already dropped. Bevelander said the name was registered for a client of him, who, in the end, did not want to have it. From the registry of the Dutch Chamber of Commerce:
CyberAngels 34126054 0000 Pascalstraat 17, 2014KZ Haarlem Hoofdvestiging Naam: Domain for Web B.V. Vestigingsadres: Pascalstraat 17 Vestigingsplaats: 2014KZ Haarlem Internetadres: http://www.websociates.nl KvK-inschrijfnummer: 34126054 0000 Soort inschrijving: Hoofdvestiging Concernrelatie: Geselecteerd: Naam Postcode Plaats KvK-inschrijfnummer Domain for Web B.V. 2014KZ Haarlem 34126054 Gevonden: Hoogste concernrelatie 2 Face Holding B.V. 2014KZ Haarlem 34112884 Aantal te tonen inschrijvingen: 5 Totaal aantal niveaus in concern: 2 Naam: CyberAngels Vestigingsplaats: 2014KZ Haarlem Internetadres: http://www.cyberangels.nl KvK-inschrijfnummer: 34126054 0000 Soort inschrijving: Hoofdvestiging
This domain was registered by Megaprovider between June 26 and July 3 2003. This domain was appearing in the RIPE database as contacts for the NL-CYBERANGELS range.
Domain name: cyberangels.nl (first domain) Status: active Registrant: Cyber Angels B.V. Gyroscoopweg 2 f 1042 AB AMSTERDAM Netherlands Domicile: N/A Committed to ADR: yes Administrative contact: B. Albers +31 204117130 ba@cyberangels.nl Registrar: Interlab BV/ Prenames Lagedijk 7 2064 KT SPAARNDAM Netherlands Technical contact: B. Albers +31 204117130 ba@cyberangels.nl Domain nameservers: ns01.cyberangels.nl 217.21.112.2 ns02.cyberangels.nl 217.21.112.3 Date first registered: 24-06-2003 Record last updated: 24-06-2003 Record maintained by: NL Domain Registry
The phonenumber that is listed for the administrative and technical contacts is non-operational: "This telephone number is not in use [...]". The admin-c and tech-c emailadresses aren't working either, there simply wasn't a nameserver configured at 217.21.112.2 or .3. The address is that one of Redbus Interhousing.
The domainname was registered to Cyberangels before and was dropped after a while. On June 26th 2003, Bevelander re-registered the name. Within a couple of days he dropped the name again, probably in order to avoid more attention. The second time he registered the name, he did so thru the registrar Interlab/ Prenames. Interlab/ Prenames stated this in Webwereld publically.
On July 3 2003 this domain was registered by spamvrij.nl. As a result of this, spamvrij.nl was receiving all e-mail initialy meant for Cyberangels. In the first three days, among more than 6.000 others, three bussiness related e-mails were received.
The first one was received at martijn@ and requesting information on hosting. The second one was also received at martijn@, saying "Hi Martijn, ..." and requesting information on BP hosting for adult websites. "BP hosting" is bullet-proof hosting, the kind of hosting where you can spam as much as wanted, without having your site disconnected. The third one was e-mailed to martijn@xxx-dollars.com (which was hosted by Megaprovider, see also this e-mail) and apperantly is forwarded to martijn@cyberangels.nl.
The domain cyberangels.be was also registed by Martijn Bevelander. , also thru Interlab BV. Martijn Bevelander dropped this domain around June 25th 2003 - while the research at Cyberangels had already been started.
Domain: cyberangels Status: Registered Registered: Fri Nov 1 2002 Licensee: Name: Martijn Bevelander Company: Mega Provider B.V. Language: N Address: Pascalstraat 17 2014 KZ Haarlem Nederland Phone: +31 23 5101094 Fax: Email: martijn@megaprovider.nl Onsite Contacts: Name: Martijn Bevelander Company: Mega Provider B.V. Language: N Address: Pascalstraat 17 2014 KZ Haarlem Nederland Phone: +31 23 5101094 Fax: Email: martijn@megaprovider.nl Agent Technical Contacts: Agent: Name: Interlab BV Website: http://www.interlab.nl/ NameServers: Name: ns.cyberangels.be Name: ns2.cyberangels.be
The netblocks 217.21.112.0/24, 217.21.113.0/24 and 217.21.114.0/24 were registered to Cyberangels BV. Only the RIPE listings for the first and the last range are available here. (If you have the / a RIPE listing for 217.21.113.0/24, please get in touch.)
inetnum: 217.21.112.0 - 217.21.112.255 netname: NL-CYBERANGELS descr: CyberAngels B.V. country: NL admin-c: MB9931-RIPE tech-c: BA9919-RIPE status: ASSIGNED PA notify: ripe@cyberangels.nl mnt-by: CYBERANGELS-MNT changed: ba@cyberangels.nl 20030204 source: RIPE route: 217.21.112.0/20 descr: CyberAngels B.V. origin: AS28706 mnt-by: CYBERANGELS-MNT changed: ba@cyberangels.nl 20030205 source: RIPE person: Mark Blokzijl address: CyberAngels B.V. address: Gyroscoopweg 2f address: 1042 AB Amsterdam address: The Netherlands phone: +31 20 4117130 fax-no: +31 20 4115066 e-mail: ba@cyberangels.nl nic-hdl: MB9931-RIPE mnt-by: CYBERANGELS-MNT notify: ripe-contact@cyberangels.nl changed: ba@cyberangels.nl 20030205 source: RIPE person: Bo Albers address: CyberAngels B.V. address: Gyroscoopweg 2f address: 1042 AB Amsterdam address: The Netherlands phone: +31 20 4117130 fax-no: +31 20 4115066 e-mail: ba@cyberangels.nl nic-hdl: BA9919-RIPE mnt-by: CYBERANGELS-MNT notify: ripe-contact@cyberangels.nl changed: ba@cyberangels.nl 20030205 source: RIPE
The address is pointing to Redbus Interhousing. The phone number is non-operational, it was used for the registration of cyberangels.nl as well. The fax number was the source of at least one spamrun of SuperZonda.
inetnum: 217.21.114.0 - 217.21.114.255 netname: NL-CYBERANGELS descr: CyberAngels B.V. country: NL admin-c: MB9931-RIPE tech-c: BA9919-RIPE status: ASSIGNED PA notify: ripe@cyberangels.nl mnt-by: CYBERANGELS-MNT changed: ba@cyberangels.nl 20030204 source: RIPE route: 217.21.112.0/20 descr: CyberAngels B.V. origin: AS28706 mnt-by: CYBERANGELS-MNT changed: ba@cyberangels.nl 20030205 source: RIPE person: Mark Blokzijl address: CyberAngels address: Postbus 3385 address: 2001 DJ Haarlem address: The Netherlands phone: +31 6 22196929 fax-no: +31 84 8839425 e-mail: mb@cyberangels.nl nic-hdl: MB9931-RIPE mnt-by: CYBERANGELS-MNT notify: ripe-conact@cyberangels.nl changed: mb@cyberangels.nl 20021112 changed: ba@cyberangels.nl 20030205 source: RIPE person: Bo Albers address: CyberAngels B.V. address: Postbus 3385 address: 2001 DJ Haarlem address: The Netherlands phone: +31 6 23979999 fax-no: +31 84 8839425 e-mail: ba@cyberangels.nl nic-hdl: BA9919-RIPE mnt-by: CYBERANGELS-MNT notify: ripe@cyberangels.nl changed: mb@cyberangels.nl 20021112 changed: ba@cyberangels.nl 20030205 source: RIPE
The PO Box that is mentioned is the same as the one used by Megaprovider.
The phonenumbers in this listing are faked, probably. At the time of the research, the first one gave you voicemail, the second one (+31 6 23979999) gave you someone else than "Bo Albers" and this person claims to have this number as of begin 2002. These details are from february 2003.
One of the e-mailadresses that is mentioned is mb@cyberangels.nl, an alias with the initials of Martijn Bevelander.
Redbus Interhousing is an internet exchange, located in Amsterdam. One of it's clients is Maps Holding B.V.. As a result of this, Martijn Bevelander is allowed to go in.
The address of Redbus Interhousing (Gyroscoopweg) has been used as address to register the name cyberangels.nl, the IP range NL-CYBERANGELS and as address of the Maps Holding B.V. in the register of the Dutch Chamber of Commerce.
Maps Holding B.V. actually rented space at Redbus Interhousing, using one half of the second floor. In the floorplans of this second floor, in the area assigned to Maps Holding B.V., two racks in the upper right corner have been clearly marked "cyberangels".
And probably these two photos take away all doubts: the top half and bottom half of the list of visitors at the entrance desk of Redbus on June 30th 2003 - and yes, incidentally this connects Brian Westby to Cyberangels and Martijn Bevelander as well.
This is the main company of Martijn Bevelander.
At the time of the research (around June 2003), Megaprovider was hosting a number of spamvertized websites. One of websites was spammed for at June 5th, 2003 and is xxx-dollars.com. The web-, name and mailserver were hosted in the NL-MEGAPROVIDER netblock. Bevelander did not deny any involvement in this hosting. Very interesting, as the e-mail to martijn@xxx-dollars.com is forwarded to martijn@cyberangels.nl.
This is another company run by Bevelander. According to the registry of the Chamber of Commerce it was located at Redbus Interhousing, where it was renting racks for it's servers. Maps' space was using half of the second floor.
Reverse "Maps" for its true meaning: spam.
From the Dutch Chamber of Commerce:
Naam: Maps Holding B.V. Vestigingsadres: Gyroscoopweg 2f Vestigingsplaats: 1042AB Amsterdam Internetadres: http://www.mapsholding.nl KvK-inschrijfnummer: 34186891 0000 Soort inschrijving: Hoofdvestiging Dossiernummer: 34186891 Blad 00001 Uittreksel uit het handelsregister van de Kamer van Koophandel en Fabrieken voor Amsterdam Deze gegevens zijn bijgewerkt tot 16-06-2003 16:31:19 ________________________________________________________________________ Rechtspersoon: Rechtsvorm :Besloten vennootschap Naam :Maps Holding B.V. Statutaire zetel :Amsterdam Eerste inschrijving in het handelsregister :10-06-2003 Akte van oprichting :30-05-2003 Maatschappelijk kapitaal :EUR 250.000,00 Geplaatst kapitaal :EUR 60.000,00 Gestort kapitaal :EUR 60.000,00 ------------------------------------------------------------------------ Onderneming: Handelsna(a)m(en) :Maps Holding B.V. Adres :Gyroscoopweg 2f, 1042AB Amsterdam Correspondentieadres :Postbus 3385, 2001DJ Haarlem Telefoonnummer :020-4117130 Faxnummer :020-4115066 Domeinnaam :www.mapsholding.nl E-mailadres :info@mapsholding.nl Datum vestiging :20-02-2003 De besloten vennootschap drijft de onderneming sinds:30-05-2003 Bedrijfsomschrijving :Beheeractiviteiten Werkzame personen :0 ------------------------------------------------------------------------ Enig aandeelhouder: Naam :2 Face Holding B.V. Adres :Pascalstraat 17, 2014KZ Haarlem Inschrijving handelsregister onder nummer :34112884 Enig aandeelhouder sedert :30-05-2003 ------------------------------------------------------------------------ Bestuurder(s): Naam :2 Face Holding B.V. Adres :Pascalstraat 17, 2014KZ Haarlem onder nummer :34112884 Infunctietreding :30-05-2003 Titel :Algemeen Directeur Bevoegdheid :Alleen/zelfstandig bevoegd
This tells us that the company Maps is ran by another company, 2 Face Holding B.V.. The address of Maps is that of Redbus Interhousing. Maps has rented rackspace there officially.
The fax number was involved in a spamrun by SuperZonda on June 3rd 2003. There is one hole in this connection: Maps Holding B.V. has been founded June 10th. The predecessor of this company, Maps Holding I.O., has been terminated at May 30th 2003. There is no record in the registry of the Chamber of Commerce for the period of May 30th to June 10th and neither can they tell if the number was in use by Maps Holding I.O.
This is another company of Bevelander, run by him as well, according to the registry of the Dutch Chamber of Commerce:
Enig aandeelhouder: Naam :Bevelander, Martijn Pieter Geboortedatum en -plaats :31-01-1980, Haarlem Adres :Rollandslaan 86, 2015GG Haarlem Enig aandeelhouder sedert :21-04-1999 ---------------------------------------------------------------------------- Bestuurder(s): Naam :Bevelander, Martijn Pieter Geboortedatum en -plaats :31-01-1980, Haarlem
The Chamber of Commerce also reveals the tree of companies involved:
-=> 2 Face Holding B.V. (Haarlem) (34112884) | + Tijncom B.V. (Haarlem) (34099859) (*bestuurder*) (*enig aandeelhouder*) | + Mega Provider B.V. (Haarlem) (34126027) (*bestuurder*) | + Chat Plaza (Haarlem) (34126053) (*bestuurder*) (*enig aandeelhouder*) | + Domain for Web B.V. (Haarlem) (34126054) (*bestuurder*) (*enig aandeelhouder*) | + Maps Holding B.V. (Amsterdam) (34186891) (*bestuurder*) (*enig aandeelhouder*)
From the Dutch Chamber of Commerce:
Naam: Domain for Web B.V. Vestigingsadres: Pascalstraat 17 Vestigingsplaats: 2014KZ Haarlem Internetadres: http://www.websociates.nl KvK-inschrijfnummer: 34126054 0000 Soort inschrijving: Hoofdvestiging History Domain for Web B.V.: Oude statutaire namen zoals vastgelegd sinds 01-10-1993 *** Geen historie voor dit onderdeel*** Oude handelsnamen zoals vastgelegd sinds 01-10-1993 -------------------------------------------------------------------------------- Handelsnaam Domain for Web B.V. i.o. Datum ingang 01-01-2000 Datum einde 28-08-2000 -------------------------------------------------------------------------------- Handelsnaam Domain for Web Datum ingang 28-08-2000 Datum einde 01-11-2002 -------------------------------------------------------------------------------- Handelsnaam Domain 4 Web Datum ingang 28-08-2000 Datum einde 01-11-2002 -------------------------------------------------------------------------------- Handelsnaam CyberAngels Datum ingang 01-11-2002 Datum einde 15-04-2003 -------------------------------------------------------------------------------- Handelsnaam Cyber Angels Datum ingang 01-11-2002 Datum einde 15-04-2003 Oude vestigingsadressen zoals vastgelegd sinds 01-10-1993 Adres Entrada 305, 1096ED Amsterdam Datum ingang ***Onbekend*** Adres Folkstoneweg 10, 1118LM Luchthaven Schiphol Datum ingang 28-09-2000 Oude rechtsvormen zoals vastgelegd sinds 01-10-1993 Rechtsvorm Rechtspersoon in oprichting Datum ingang 01-01-2000 Oude bedrijfsomschrijvingen zoals vastgelegd sinds 01-10-1993 Datum ingang 01-01-2000 Bedrijfsomschrijving Wereldwijde domeinregistratie Functionarisgegevens Uitgetreden functionaris(sen) rechtspers. Enig aandeelhouder: -------------------------------------------------------------------------------- Naam Bevelander.Com Holding B.V. / 3 Adres Herengracht 425 - 429, 1017BR Amsterdam Inschrijving handelsregister onder nummer 34110462 Enig aandeelhouder sedert 28-08-2000 Uit functie 29-12-2000 Functionarisgegevens Uitgetreden functionaris(sen) onderneming Bevoegde functionaris(sen): -------------------------------------------------------------------------------- Naam Bevelander.Com Holding B.V. / 1 Adres Herengracht 425 - 429, 1017BR Amsterdam Inschrijving handelsregister onder nummer 34110462 Infunctietreding 01-01-2000 Uit functie 28-08-2000 Functionarisgegevens Uitgetreden functionaris(sen) rechtspers. Bestuurder(s): -------------------------------------------------------------------------------- Naam Bevelander.Com Holding B.V. / 4 Adres Herengracht 425 - 429, 1017BR Amsterdam Inschrijving handelsregister onder nummer 34110462 Infunctietreding 28-08-2000 Titel Algemeen directeur Bevoegdheid Alleen/zelfstandig bevoegd Uit functie 29-12-2000 Overige functionarisgegevens Uitgetreden *** Geen historie voor dit onderdeel***
Telefonica is a Spanish ISP that has been the upstream for Cyberangels for a long time. In other words, they were selling spam supporting services to Bevelander. The day before the BBC article was sent out, they terminated the contract with Cyberangels for breaking their AUP.
That only happened after Steve Linford had been listing the corporate mailservers of Telefonica in his SBL. In news.admin.net-abuse.email, Steve Linford writes:
In fact Spamhaus listed telefonica-data.net's corporate mail relays on the SBL last night (we sent them an SBL warning last Tuesday which they responded to but only with excuses for why they couldn't terminate Cyberangels - actually they referred to Cyberangels as "him" and "him" as "Mister Bevelander"). Additionally as of this morning we increased the escatation to include a further /24 of telefonica-data.net relays we've seen corporate communications from. 195.235.39.0/14 : http://www.spamhaus.org/sbl/sbl.lasso?query=SBL9600 194.224.58.0/24 : http://www.spamhaus.org/sbl/sbl.lasso?query=SBL9608 Those two should now be causing telefonica-data.net to rethink the Cyberangels spam hosting situation, although it'll probably take them a day or more before their executives realize the extent of the block.
The fact that Telefonica is refering directly to Bevelander when talking about Cyberangels says enough.
| reacties@spamvrij.nl | http://www.spamvrij.nl | |
| Last update: Mon, 17 Sep 2007 21:35:01 +0200 |
