The current cluster is the latest generation of a long-running, Russian-language number-spoofing operation sharing one operator handle — XHO / xhoru.

• Handle XHO / xhoru — the DataLife Engine database name xhoru_caller on caller-id.net (captured live in MySQL error 1146, /engine/modules/cron.php, table xhoru_caller.dle_comments_files), the mirror domain xho.biz (hosting the narayan.im typosquat), and the product name SIP ACCOUNT “XHO PRO” on Shoppy.gg.
• caller-id.net — live Russian caller-ID / voice-spoofing service (“Звонки с подменой номера”), archived since 2010, DataLife Engine with xhoru_ prefix, on cluster IPs 188.114.96.1/97.1. Contacts → t.me/sipsupport (~20) → sip.support; Registration → shoppy.gg/product/9mhrEwO (“XHO PRO”).
• sip-system.com — oldest domain (registered 2011-03-16, paid to 2032; same registrar Internet.bs as the hub magnusbilling.net, Cloudflare NS); simultaneously a live front of the current cluster.
• vk.com/callerid — VK community “SIP-system”: “how to call and send SMS with number spoofing; gateway setup” (#флуд #телефонныйфлуд); officially links sip-system.com and fakenumbers.ru (both operator properties; now defunct).
• gopbx.org — the core brand: “GoPBXbot — SIP, VoIP, SMS, eSIM and API inside Telegram”, hosted directly on the origin 152.228.129.114 (same server as magnusbilling.net). The “Telegram: GoPBX” contact in every panel is this product.
• Co-location proof — reverse-IP on the exposed origin 152.228.129.114 shows one physical server hosting magnusbilling.net, gopbx.org, admin.sip.support and (via passive DNS) the wider cluster. New operator domains surfaced this way: xho.ru, sip-call.com, narayana.cc (another Narayana-impersonation TLD).
• Identity lead — ICQ 222-443 / weblancer @Belok — sip-system.com's 2012-10-26 snapshot (the day after the Weblancer post), titled "Подмена номера телефона" (caller-ID spoofing), lists ICQ 222-443, Skype sip-system.com, email support@sip-system.com, and takes payment via WebMoney (WMID 301635640454, alias "SIP-system", Personal / passport-verified certificate issued 2012-06-06 — a KYC'd identity WebMoney can disclose). The same ICQ 222-443 appears on the 2012-10-25 Weblancer job by "Aleksandr" (username @Belok, Belarus) commissioning a browser SIP phone — the web-phone now inside the panels. (Jabber sip@jabber.ru is listed on later snapshots, e.g. 2017-04-22.) (All verified from primary sources: the archived pages, the WebMoney passport, and the Weblancer posting.)
• Copied Narayana artwork — the same illustration appears on both sip-system.com and narayana.im, differing only in the little house's label: "NRN" (Narayana) vs "sip system" on the sip-system.com copy (compare the two archived snapshots in the source links below). The "NRN" label is Narayana's own branding.

The reseller/agent portal is distributed openly at https://login.narayana.li/mbilling/agent-portal-download.php (agent-portal.zip, PHP MVC app, built 2026-06-01).

// hard-coded central backend for every branded front
		const RESELLER_API_URL = 'https://magnusbilling.net/reseller-api/index.php';

// client login + PLAINTEXT password forwarded to the central API
		$client->postJson('client-auth', [
		    'login'    => $login,
		    'password' => $password,   // plaintext
		]);
		// authenticated with the reseller's X-API-Key (app/Core/ApiClient.php)

Payments: crypto via Plisio (api.plisio.net) and Heleket (api.heleket.com).

Consequence: every front funnels to one operator, which holds its registered clients' passwords centrally in plaintext (a password-reuse risk for its own customers). This is distinct from the impersonation harm — anyone who enters real Narayana / MagnusBilling credentials on any look-alike has them harvested regardless of backend routing.

1. Brand impersonation of MagnusBilling (magnusbilling.net vs. genuine magnusbilling.org) and of Narayana (narayana.li, narayana.boats, narayana.cc).
2. Typosquatting / look-alike impersonation of the genuine narayana.im via narayan.im (dropped letter) and narayana.cc (alternate TLD) — interception of mistyped / look-alike traffic.
3. Unauthorized use of the MagnusBilling name and its “free” license, evidenced by license check-ins to the real vendor as v=magnusbilling.net.
4. Credential harvesting by impersonation across all branded fronts — credentials entered on any front are captured equally (all funnel to the one operator via magnusbilling.net/reseller-api); the only safe domains are the genuine narayana.im / magnusbilling.org.