Tracing terror videos on the Net

Tracing the Web page host

It is often the case that the company that sells a domain name doesn't actually store the website that users see when the enter its address.

The domain company can simply forward users to any Web server specified by their customer and this is exactly what Inktomi & Performance Systems have done for Iaisite.

This redirection is quite obvious in the case of iaisite.org. The Web address displayed in the browser visibly changes to a new site, when the user presses "enter".

However, the redirect of iaisite.net is a little more cunning. The domain name stays in the address bar, but target web page still loads. 

This is achieved by use of a special sort of web page called a "frame set". Frames allow various different pages to be loaded into one window, but the address of the master Frame page stays the same - even if the user clicks on links within the site. 

It is quite easy to establish the genuine addresses of pages within a frame set - all you do is right click on the pages and choose "properties".

When we do this with iaisite.net we find the genuine address of the page containing the noticeboard part of the site.

This page can, if necessary, be displayed independently of the frame set.

You will notice that the genuine address of the noticeboard is iairaqws.temp.powweb.com - the same address that iaisite,org redirects to.

The domain powweb.com belongs to the host of the page and, it transpires, this too is a run of the mill American company with no apparent political links to Al-Jaysh al-Islami. 

Powweb sells space on their server so customers like "iairaqws" can get their sites up on the net. 

So Powweb may store the page that directs people to Al-Jaysh al-Islami's videos, but where exactly are these videos stored?

next>

<previous 

Please note, the layout of some screengrabs in this tutorial have been altered for reasons of clarity, space and explanation. The hosting details are accurate at the time this report was written (February 2006) but may change at a later date. We do not suppose or allege that any of the sites or services mentioned in this report are connected with illegal activity. .