The times may be changing. This web site is no longer maintained and may be outdated. It is retained primarily for historical reasons.

cyberangels.nl
Cyberangels connected

>> All there is to connect...

It's not extremely difficult to see a relationship between Cyberangels and Martijn Bevelander. There's simply too much of a coincidence and it wouldn't be very realistic not to assume a connection between the two. However, it has been quite difficult to come up with the proof for the relationship. And, if you accuse someone, you'd better have proof of it as well. This is a listing of the cross-links (preliminary sketch) between the different pieces of evidence.

This is some of the evidence that proof there indeed was a connection between Martijn Bevelander and Cyberangels:

  1. Redbus Interhousing has floorplans of the datacenters in it's buildings. The floorplans for the second floor, in the area assigned to Bevelanders Maps Holding B.V., clearly show two racks that are labeled "cyberangels".
  2. In June a spamrun for SuperZonda domains was done. The phonenumber from which the dialup connection was setup, is the same number as the faxnumber of Maps Holding B.V.. The starting point of the BBC article was a spamrun for another SuperZonda domain for which Cyberangels nameservers have been used.
  3. In the e-mail the BBC obtained Bevelander denies that he is Cyberangels, but he describes himself as one of the investors in Cyberangels and he claims he can manage their network.
  4. Interlab publically stated they had registered the domain cyberangels.nl for Bevelander and Megaprovider.
  5. The domain cyberangels.be was registered to Bevelanders Megaprovider as well.
  6. In the phonecalls between Telefonica and Steve Linford, Telefonica is refering to Cyberangels with "him" and "Mister Bevelander".
  7. Bevelander himself admitted to me, and probably some others, he actually was Cyberangels and that he initially understimated the fuss that would be made about the case. Bevelander has been deleting (with our help) the NL-CYBERANGELS IP range and the AS numbers Cyberangels has been using.

Suggestions? Corrections? Please send an e-mail to rejo@spamvrij.nl.

>> BBC article "Spam peddlers hijack computers"

The starting point for the BBC article on the connection between Cyberangels and Bevelander is a spam that was sent for the SuperZonda domain beautifulwomentodate.com. It was sent out on May 26th 2003 using an open proxy on a computer of British Airways. The nameserver for the domain was running on 217.21.117.88, which is in the NL-CYBERANGELS range.

The same article is talking about an e-mail that they obtained:

But the clearest piece of evidence came in an e-mail written by Martijn
Bevelander himself, obtained by the BBC, in which he describes himself
as "an investor" in Cyberangels, and claimed that he manages their
network.

I have seen this e-mail and I therefore can confirm it's existence. But who wouldn't believe the BBC anyway?

>> Another Superzonda spamrun

At June, 3rd 2003 a large spamrun was done by Superzonda for the domains horizonstream.net, lonelyladies.net, enlargenow.net and directadultaccess.com. The source of these spams was a dialup of a reseller of Ladot (a client of Ladot allowed to resell the services they obtain from Ladot). The Caller Line Identification logfiles make clear that the phonenumber from which the connection was setup was 020-4115066. This number is the fax number that appears in the Chamber of Commerce registry for Maps Holding B.V. and the RIPE database for NL-CYBERANGELS. To be able to login, at least two accounts were created with forged information.

>> Cyberangels B.V.

There has been a legal company named Cyberangels B.V. in the Netherlands for a while. At the time the BBC and others were doing research on Cyberangels, this tradename was already dropped. Bevelander said the name was registered for a client of him, who, in the end, did not want to have it. From the registry of the Dutch Chamber of Commerce:

CyberAngels
34126054 0000
Pascalstraat 17, 2014KZ Haarlem
Hoofdvestiging

Naam: Domain for Web B.V.
Vestigingsadres: Pascalstraat 17
Vestigingsplaats: 2014KZ Haarlem
Internetadres: http://www.websociates.nl
KvK-inschrijfnummer: 34126054 0000
Soort inschrijving: Hoofdvestiging

Concernrelatie:
Geselecteerd:
  Naam Postcode  Plaats KvK-inschrijfnummer
   Domain for Web B.V. 2014KZ Haarlem 34126054
Gevonden:
  Hoogste concernrelatie
  2 Face Holding B.V. 2014KZ Haarlem 34112884
  Aantal te tonen inschrijvingen: 5
  Totaal aantal niveaus in concern: 2

Naam: CyberAngels
Vestigingsplaats: 2014KZ Haarlem
Internetadres: http://www.cyberangels.nl
KvK-inschrijfnummer: 34126054 0000
Soort inschrijving: Hoofdvestiging

>> Domain cyberangels.nl

This domain was registered by Megaprovider between June 26 and July 3 2003. This domain was appearing in the RIPE database as contacts for the NL-CYBERANGELS range.

Domain name:
   cyberangels.nl (first domain)

Status: active

Registrant:
   Cyber Angels B.V.
   Gyroscoopweg 2 f
   1042 AB  AMSTERDAM
   Netherlands

Domicile:
   N/A

Committed to ADR: yes

Administrative contact:
   B. Albers
   +31 204117130
   ba@cyberangels.nl

Registrar:
   Interlab BV/ Prenames
   Lagedijk 7
   2064 KT  SPAARNDAM
   Netherlands

Technical contact:
   B. Albers
   +31 204117130
   ba@cyberangels.nl

Domain nameservers:
   ns01.cyberangels.nl  217.21.112.2
   ns02.cyberangels.nl  217.21.112.3

Date first registered: 24-06-2003
Record last updated: 24-06-2003
Record maintained by: NL Domain Registry

The phonenumber that is listed for the administrative and technical contacts is non-operational: "This telephone number is not in use [...]". The admin-c and tech-c emailadresses aren't working either, there simply wasn't a nameserver configured at 217.21.112.2 or .3. The address is that one of Redbus Interhousing.

The domainname was registered to Cyberangels before and was dropped after a while. On June 26th 2003, Bevelander re-registered the name. Within a couple of days he dropped the name again, probably in order to avoid more attention. The second time he registered the name, he did so thru the registrar Interlab/ Prenames. Interlab/ Prenames stated this in Webwereld publically.

On July 3 2003 this domain was registered by spamvrij.nl. As a result of this, spamvrij.nl was receiving all e-mail initialy meant for Cyberangels. In the first three days, among more than 6.000 others, three bussiness related e-mails were received.

The first one was received at martijn@ and requesting information on hosting. The second one was also received at martijn@, saying "Hi Martijn, ..." and requesting information on BP hosting for adult websites. "BP hosting" is bullet-proof hosting, the kind of hosting where you can spam as much as wanted, without having your site disconnected. The third one was e-mailed to martijn@xxx-dollars.com (which was hosted by Megaprovider, see also this e-mail) and apperantly is forwarded to martijn@cyberangels.nl.

>> Domain cyberangels.be

The domain cyberangels.be was also registed by Martijn Bevelander. , also thru Interlab BV. Martijn Bevelander dropped this domain around June 25th 2003 - while the research at Cyberangels had already been started.



Domain:      cyberangels
Status:      Registered
Registered:  Fri Nov  1 2002

Licensee:
   Name:     Martijn Bevelander
   Company:  Mega Provider B.V.
   Language: N
   Address:  Pascalstraat 17
             2014 KZ
             Haarlem
             Nederland
   Phone:    +31 23 5101094
   Fax:
   Email:    martijn@megaprovider.nl

Onsite Contacts:
   Name:     Martijn Bevelander
   Company:  Mega Provider B.V.
   Language: N
   Address:  Pascalstraat 17
             2014 KZ
             Haarlem
             Nederland
   Phone:    +31 23 5101094
   Fax:
   Email:    martijn@megaprovider.nl

Agent Technical Contacts:
Agent:
   Name:     Interlab BV
   Website:  http://www.interlab.nl/

NameServers:
   Name:     ns.cyberangels.be
   Name:     ns2.cyberangels.be

>> IP range NL-CYBERANGELS

The netblocks 217.21.112.0/24, 217.21.113.0/24 and 217.21.114.0/24 were registered to Cyberangels BV. Only the RIPE listings for the first and the last range are available here. (If you have the / a RIPE listing for 217.21.113.0/24, please get in touch.)

inetnum:      217.21.112.0 - 217.21.112.255
netname:      NL-CYBERANGELS
descr:        CyberAngels B.V.
country:      NL
admin-c:      MB9931-RIPE
tech-c:       BA9919-RIPE
status:       ASSIGNED PA
notify:       ripe@cyberangels.nl
mnt-by:       CYBERANGELS-MNT
changed:      ba@cyberangels.nl 20030204
source:       RIPE

route:        217.21.112.0/20
descr:        CyberAngels B.V.
origin:       AS28706
mnt-by:       CYBERANGELS-MNT
changed:      ba@cyberangels.nl 20030205
source:       RIPE

person:       Mark Blokzijl
address:      CyberAngels B.V.
address:      Gyroscoopweg 2f
address:      1042 AB Amsterdam
address:      The Netherlands
phone:        +31 20 4117130
fax-no:       +31 20 4115066
e-mail:       ba@cyberangels.nl
nic-hdl:      MB9931-RIPE
mnt-by:       CYBERANGELS-MNT
notify:       ripe-contact@cyberangels.nl
changed:      ba@cyberangels.nl 20030205
source:       RIPE

person:       Bo Albers
address:      CyberAngels B.V.
address:      Gyroscoopweg 2f
address:      1042 AB Amsterdam
address:      The Netherlands
phone:        +31 20 4117130
fax-no:       +31 20 4115066
e-mail:       ba@cyberangels.nl
nic-hdl:      BA9919-RIPE
mnt-by:       CYBERANGELS-MNT
notify:       ripe-contact@cyberangels.nl
changed:      ba@cyberangels.nl 20030205
source:       RIPE

The address is pointing to Redbus Interhousing. The phone number is non-operational, it was used for the registration of cyberangels.nl as well. The fax number was the source of at least one spamrun of SuperZonda.

inetnum:      217.21.114.0 - 217.21.114.255
netname:      NL-CYBERANGELS
descr:        CyberAngels B.V.
country:      NL
admin-c:      MB9931-RIPE
tech-c:       BA9919-RIPE
status:       ASSIGNED PA
notify:       ripe@cyberangels.nl
mnt-by:       CYBERANGELS-MNT
changed:      ba@cyberangels.nl 20030204
source:       RIPE

route:        217.21.112.0/20
descr:        CyberAngels B.V.
origin:       AS28706
mnt-by:       CYBERANGELS-MNT
changed:      ba@cyberangels.nl 20030205
source:       RIPE

person:       Mark Blokzijl
address:      CyberAngels
address:      Postbus 3385
address:      2001 DJ Haarlem
address:      The Netherlands
phone:        +31 6 22196929
fax-no:       +31 84 8839425
e-mail:       mb@cyberangels.nl
nic-hdl:      MB9931-RIPE
mnt-by:       CYBERANGELS-MNT
notify:       ripe-conact@cyberangels.nl
changed:      mb@cyberangels.nl 20021112
changed:      ba@cyberangels.nl 20030205
source:       RIPE

person:       Bo Albers
address:      CyberAngels B.V.
address:      Postbus 3385
address:      2001 DJ Haarlem
address:      The Netherlands
phone:        +31 6 23979999
fax-no:       +31 84 8839425
e-mail:       ba@cyberangels.nl
nic-hdl:      BA9919-RIPE
mnt-by:       CYBERANGELS-MNT
notify:       ripe@cyberangels.nl
changed:      mb@cyberangels.nl 20021112
changed:      ba@cyberangels.nl 20030205
source:       RIPE

The PO Box that is mentioned is the same as the one used by Megaprovider.

The phonenumbers in this listing are faked, probably. At the time of the research, the first one gave you voicemail, the second one (+31 6 23979999) gave you someone else than "Bo Albers" and this person claims to have this number as of begin 2002. These details are from february 2003.

One of the e-mailadresses that is mentioned is mb@cyberangels.nl, an alias with the initials of Martijn Bevelander.

>> Redbus Interhousing

Redbus Interhousing is an internet exchange, located in Amsterdam. One of it's clients is Maps Holding B.V.. As a result of this, Martijn Bevelander is allowed to go in.

The address of Redbus Interhousing (Gyroscoopweg) has been used as address to register the name cyberangels.nl, the IP range NL-CYBERANGELS and as address of the Maps Holding B.V. in the register of the Dutch Chamber of Commerce.

Maps Holding B.V. actually rented space at Redbus Interhousing, using one half of the second floor. In the floorplans of this second floor, in the area assigned to Maps Holding B.V., two racks in the upper right corner have been clearly marked "cyberangels".

And probably these two photos take away all doubts: the top half and bottom half of the list of visitors at the entrance desk of Redbus on June 30th 2003 - and yes, incidentally this connects Brian Westby to Cyberangels and Martijn Bevelander as well.

>> Megaprovider B.V.

This is the main company of Martijn Bevelander.

At the time of the research (around June 2003), Megaprovider was hosting a number of spamvertized websites. One of websites was spammed for at June 5th, 2003 and is xxx-dollars.com. The web-, name and mailserver were hosted in the NL-MEGAPROVIDER netblock. Bevelander did not deny any involvement in this hosting. Very interesting, as the e-mail to martijn@xxx-dollars.com is forwarded to martijn@cyberangels.nl.

>> Maps Holding B.V.

This is another company run by Bevelander. According to the registry of the Chamber of Commerce it was located at Redbus Interhousing, where it was renting racks for it's servers. Maps' space was using half of the second floor.

Reverse "Maps" for its true meaning: spam.

From the Dutch Chamber of Commerce:

Naam: Maps Holding B.V.
Vestigingsadres: Gyroscoopweg 2f
Vestigingsplaats: 1042AB Amsterdam
Internetadres: http://www.mapsholding.nl
KvK-inschrijfnummer: 34186891 0000
Soort inschrijving: Hoofdvestiging

Dossiernummer: 34186891      Blad 00001

Uittreksel uit het handelsregister van de Kamer van Koophandel en  Fabrieken
voor Amsterdam

Deze gegevens zijn bijgewerkt tot 16-06-2003 16:31:19
________________________________________________________________________

Rechtspersoon:
Rechtsvorm                  :Besloten vennootschap
Naam                        :Maps Holding B.V.
Statutaire zetel            :Amsterdam
Eerste inschrijving in het
handelsregister            :10-06-2003
Akte van oprichting         :30-05-2003
Maatschappelijk kapitaal    :EUR 250.000,00
Geplaatst kapitaal          :EUR 60.000,00
Gestort kapitaal            :EUR 60.000,00
------------------------------------------------------------------------
Onderneming:
Handelsna(a)m(en)           :Maps Holding B.V.
Adres                       :Gyroscoopweg 2f, 1042AB Amsterdam
Correspondentieadres        :Postbus 3385, 2001DJ Haarlem
Telefoonnummer              :020-4117130
Faxnummer                   :020-4115066
Domeinnaam                  :www.mapsholding.nl
E-mailadres                 :info@mapsholding.nl
Datum vestiging             :20-02-2003
De besloten vennootschap
drijft de onderneming sinds:30-05-2003
Bedrijfsomschrijving        :Beheeractiviteiten
Werkzame personen           :0
------------------------------------------------------------------------
Enig aandeelhouder:
Naam                        :2 Face Holding B.V.
Adres                       :Pascalstraat 17, 2014KZ Haarlem
Inschrijving handelsregister
onder nummer               :34112884
Enig aandeelhouder sedert   :30-05-2003
------------------------------------------------------------------------
Bestuurder(s):
Naam                        :2 Face Holding B.V.
Adres                       :Pascalstraat 17, 2014KZ Haarlem
onder nummer               :34112884
Infunctietreding            :30-05-2003
Titel                       :Algemeen Directeur
Bevoegdheid                 :Alleen/zelfstandig bevoegd

This tells us that the company Maps is ran by another company, 2 Face Holding B.V.. The address of Maps is that of Redbus Interhousing. Maps has rented rackspace there officially.

The fax number was involved in a spamrun by SuperZonda on June 3rd 2003. There is one hole in this connection: Maps Holding B.V. has been founded June 10th. The predecessor of this company, Maps Holding I.O., has been terminated at May 30th 2003. There is no record in the registry of the Chamber of Commerce for the period of May 30th to June 10th and neither can they tell if the number was in use by Maps Holding I.O.

>> 2 Face Holding B.V.

This is another company of Bevelander, run by him as well, according to the registry of the Dutch Chamber of Commerce:

Enig aandeelhouder:

Naam                        :Bevelander, Martijn Pieter
Geboortedatum en -plaats    :31-01-1980, Haarlem
Adres                       :Rollandslaan 86, 2015GG Haarlem
Enig aandeelhouder sedert   :21-04-1999
----------------------------------------------------------------------------
Bestuurder(s):

Naam                        :Bevelander, Martijn Pieter
Geboortedatum en -plaats    :31-01-1980, Haarlem

The Chamber of Commerce also reveals the tree of companies involved:

-=> 2 Face Holding B.V. (Haarlem) (34112884)
|
+ Tijncom B.V. (Haarlem) (34099859) (*bestuurder*) (*enig aandeelhouder*)
|
+ Mega Provider B.V. (Haarlem) (34126027) (*bestuurder*)
|
+ Chat Plaza (Haarlem) (34126053) (*bestuurder*) (*enig aandeelhouder*)
|
+ Domain for Web B.V. (Haarlem) (34126054) (*bestuurder*) (*enig aandeelhouder*)
|
+ Maps Holding B.V. (Amsterdam) (34186891) (*bestuurder*) (*enig aandeelhouder*)

>> Domain for Web B.V.

From the Dutch Chamber of Commerce:

Naam: Domain for Web B.V. 
Vestigingsadres: Pascalstraat 17 
Vestigingsplaats: 2014KZ Haarlem 
Internetadres: http://www.websociates.nl 
KvK-inschrijfnummer: 34126054 0000 
Soort inschrijving: Hoofdvestiging

History Domain for Web B.V.:

Oude statutaire namen zoals vastgelegd sinds 01-10-1993 
*** Geen historie voor dit onderdeel***  
Oude handelsnamen zoals vastgelegd sinds 01-10-1993 

--------------------------------------------------------------------------------
 
Handelsnaam  Domain for Web B.V. i.o.  
Datum ingang  01-01-2000  
Datum einde  28-08-2000  

--------------------------------------------------------------------------------
 
Handelsnaam  Domain for Web  
Datum ingang  28-08-2000  
Datum einde  01-11-2002  

--------------------------------------------------------------------------------
 
Handelsnaam  Domain 4 Web  
Datum ingang  28-08-2000  
Datum einde  01-11-2002  

--------------------------------------------------------------------------------
 
Handelsnaam  CyberAngels
Datum ingang  01-11-2002  
Datum einde  15-04-2003  

--------------------------------------------------------------------------------
 
Handelsnaam  Cyber Angels
Datum ingang  01-11-2002  
Datum einde  15-04-2003  
Oude vestigingsadressen zoals vastgelegd sinds 01-10-1993 
Adres  Entrada 305, 1096ED Amsterdam  
Datum ingang  ***Onbekend***  
Adres  Folkstoneweg 10, 1118LM Luchthaven Schiphol  
Datum ingang  28-09-2000  
Oude rechtsvormen zoals vastgelegd sinds 01-10-1993 
Rechtsvorm  Rechtspersoon in oprichting  
Datum ingang  01-01-2000  
Oude bedrijfsomschrijvingen zoals vastgelegd sinds 01-10-1993 
Datum ingang  01-01-2000  
Bedrijfsomschrijving  Wereldwijde domeinregistratie  
Functionarisgegevens Uitgetreden functionaris(sen) rechtspers. 
Enig aandeelhouder: 

--------------------------------------------------------------------------------
 
Naam  Bevelander.Com Holding B.V. / 3  
Adres  Herengracht 425 - 429, 1017BR Amsterdam  
Inschrijving handelsregister 
onder nummer  34110462  
Enig aandeelhouder sedert  28-08-2000  
Uit functie  29-12-2000  
Functionarisgegevens Uitgetreden functionaris(sen) onderneming 
Bevoegde functionaris(sen): 

--------------------------------------------------------------------------------
 
Naam  Bevelander.Com Holding B.V. / 1  
Adres  Herengracht 425 - 429, 1017BR Amsterdam  
Inschrijving handelsregister 
onder nummer  34110462  
Infunctietreding  01-01-2000  
Uit functie  28-08-2000  
Functionarisgegevens Uitgetreden functionaris(sen) rechtspers. 
Bestuurder(s): 

--------------------------------------------------------------------------------
 
Naam  Bevelander.Com Holding B.V. / 4  
Adres  Herengracht 425 - 429, 1017BR Amsterdam  
Inschrijving handelsregister 
onder nummer  34110462  
Infunctietreding  28-08-2000  
Titel  Algemeen directeur  
Bevoegdheid  Alleen/zelfstandig bevoegd  
Uit functie  29-12-2000  
Overige functionarisgegevens Uitgetreden 
*** Geen historie voor dit onderdeel*** 

>> Telefonica

Telefonica is a Spanish ISP that has been the upstream for Cyberangels for a long time. In other words, they were selling spam supporting services to Bevelander. The day before the BBC article was sent out, they terminated the contract with Cyberangels for breaking their AUP.

That only happened after Steve Linford had been listing the corporate mailservers of Telefonica in his SBL. In news.admin.net-abuse.email, Steve Linford writes:

In fact Spamhaus listed telefonica-data.net's corporate mail relays on 
the SBL last night (we sent them an SBL warning last Tuesday which they 
responded to but only with excuses for why they couldn't terminate 
Cyberangels - actually they referred to Cyberangels as "him" and "him" 
as "Mister Bevelander"). Additionally as of this morning we increased 
the escatation to include a further /24 of telefonica-data.net relays 
we've seen corporate communications from.

195.235.39.0/14 : http://www.spamhaus.org/sbl/sbl.lasso?query=SBL9600
194.224.58.0/24 : http://www.spamhaus.org/sbl/sbl.lasso?query=SBL9608

Those two should now be causing telefonica-data.net to rethink the 
Cyberangels spam hosting situation, although it'll probably take them a 
day or more before their executives realize the extent of the block.

The fact that Telefonica is refering directly to Bevelander when talking about Cyberangels says enough.