Mutarrif Defacer [upd] -

The final act was theatrical. Mutarrif typically struck at 03:00 AM local time of the target. The defacement page would load a custom script that logged the IP addresses of anyone visiting the hacked site—a "trophy log" of investigators trying to scrub the damage.

Mutarrif Defacer, web defacement history, hacktivism, SQL injection attacks, website security CMS. mutarrif defacer

Mutarrif’s index pages were often minimalist. They featured high-contrast Arabic calligraphy interwoven with ASCII art. Instead of deleting the original site, Mutarrif frequently utilized iframe injections, overlaying their message on top of the legitimate site. This demonstrated a technical arrogance: "I could delete you, but I choose to overshadow you." The final act was theatrical

Replaced homepage content but claimed they would not leak citizen data because it "belongs to the people". Instead of deleting the original site, Mutarrif frequently

Encouraged mass harassment and SMS flooding campaigns against officials. Tactics and Motivation A Deep Dive into Defacement - Trend Micro