Proginter and the booter.xyz saga

Proginter and the booter.xyz saga

אף אחד לא אמר של ddos זה לא חוקי. – Nobody says that ddos is illegal (Eden Hen, CEO Proginter.com)

After our articles, the founder of Proginter.com has reached out to clarify his role in the stress testing service booter.xyz.
According to him, booter.xyz was operated by XYZ networks in his servers and payments took place by fake Paypal accounts associated with thefreakcrack@gmail.com aka Lidor Nagan aka Spaien.

He also told us that booter.xyz was hosted without any contract as payment was received by the automated system WHMCS. The site was hosted in Proginter for at least nine months hidden by Cloudflare.

When asked why Poni Walker aka Naftali is openly advertising Stress Testing Services using Proginter’s name in Hack Forums, the director of Proginter claims that Naftali is not his employee and is just trying to gain community respect.

We asked the director of Proginter for proof that he was not Naftali, he sent us a picture of a credit card with the name Eden Hen, the same name that we found in the RIPE records associated to Proginter. (Does anyone know which bank issues this credit card?)

Eden Hen Card
Eden Hen Card

During a series of mails we asked if Proginter had a VAT number to verify that he was the real owner.

He claimed that Proginter did not have such number and that there was no service in Israel to check the validity of a company. That only “Limited” companies have a VAT number.

FBI was here

When asked about law enforcements and the VDOS case, Eden Hen claimed that FBI visited him in Israel to request information about booter.xyz and they took all the files and information with them.

Does Eden Hen run Proginter?

Eden Hen claims to be the director of Proginter and not to be directly connected to booter.xyz. He also claims that his company has no VAT number. What Eden Hen might not know is that we already found his missing VAT number and the person that registered his company.

A search in the Israel Tax Authority reveals that Proginter seems to have a VAT number 203312434 and that the owner of the company is Mor Cohen.

 

VAT# of Proginter
VAT# of Proginter

After exchanging dozens of emails with the director of Proginter, we noticed that “Poni Walker” removed his connection with www.proginter.com in Hack Forums.

So is “Poni Walker”, Mor Cohen director of Proginter?

 

The poni evolution
The “Poni Walker” evolution. While we kept asking questions, he was changing his image in Hack Forums…

All this information is available from public sources

From the Israeli Tax Authorities

203312434
שם העוסק:
כהן מור <Cohen Moore>
כנוי עסק:
פרוגינטר
מען:
אנילביץ 38 חולון  <Anielewicz 38 Holon>
ממונה אזורי:
מע"מ ת"א 2
סוג תיק:
עוסק מורשה


From the .co.il registry

person:       eden hen
address:      Anielewicz 38
address:      holon
address:      58514
address:      Israel
phone:        +972 50 8851200
e-mail:       gusuigusui12 AT gmail.com
nic-hdl:      GI-EH5746-IL
changed:      domain-registrar AT isoc.org.il 20150412

==
query:        proginter.co.il
reg-name:     proginter
domain:       proginter.co.il
descr:        eden hen
descr:        Anielewicz 38
descr:        holon
descr:        58514
descr:        Israel
phone:        +972 50 8851200
e-mail:       gusuigusui12 AT gmail.com
admin-c:      GI-EH5746-IL
tech-c:       GI-EH5746-IL
zone-c:       GI-EH5746-IL
nserver:      ns1.uk.proginter.com
nserver:      ns2.uk.proginter.com
validity:     12-04-2017
status:       Transfer Locked
changed:      domain-registrar AT isoc.org.il 20150412 (Assigned)
changed:      domain-registrar AT isoc.org.il 20150930 (Changed)
changed:      domain-registrar AT isoc.org.il 20151112 (Changed)
changed:      domain-registrar AT isoc.org.il 20151112 (Changed)
changed:      domain-registrar AT isoc.org.il 20151120 (Changed)
changed:      domain-registrar AT isoc.org.il 20151215 (Changed)
changed:      domain-registrar AT isoc.org.il 20151215 (Changed)
changed:      domain-registrar AT isoc.org.il 20151216 (Changed)
person:       eden hen
address:      Anielewicz 38
address:      holon
address:      58514
address:      Israel
phone:        +972 50 8851200
e-mail:       gusuigusui12 AT gmail.com
nic-hdl:      GI-EH5746-IL
changed:      domain-registrar AT isoc.org.il 20150412
registrar name: Gorni Interactive Ltd
registrar info: http://www.box.co.il/

The VAT registration for self-employed shows that the company name and address are the same by owner in RIPE does not match.

 

Update 22th October

An archived version of the WHOIS data of the domain uph.co.il shows that the owner was “Mor Cohen” and later on was changed to “Eden Hen”. A copy is available here

Update 1st November
Proginter owner has recently changed the EH3415-RIPE objects from Eden Hen to Mor Cohen. We wonder… why?

org-name:       Mor Cohen
org-type:       OTHER
address:        Israel Afula Borchov 30
abuse-c:        ACRO1306-RIPE
mnt-ref:        PROGINTER-MNT
mnt-by:         PROGINTER-MNT
mnt-by:         HYDRA-MNT
tech-c:         EH3415-RIPE
abuse-mailbox:  abuse@proginter.com
created:        2015-10-06T15:05:31Z
last-modified:  2016-10-21T03:26:03Z
source:         RIPE # Filtered