Wednesday, February 21, 2024

TorrentFreak's Latest News

 

100s of Pirate Sites Go Dark as .TV Domains Placed on ServerHold
Andy Maxwell, 21 Feb 03:45 AM

stupidtv-lA few hours ago a TorrentFreak reader linked us to a list of almost 200 domains with several things in common.

The vast majority have naming conventions that almost certainly point to some type of piracy activity. No shortage of the word 'streams' for example, along with other familiar pirate terms such as HD, cine, film, movie, plus the likes of buff, cric and crack.

Sites with 'anime' in their domain names also stand out; they include the popular Animebytes, a platform that above most seemed to be generating significant panic. A gloomy discussion on Reddit spoke of the site having just hours to live, a fate that may have since been suspended but with a root cause that remains unresolved.

The Sun Doesn't Shine on .TV

The sites on the list have other things in common too. All operate from .TV domains that were registered at Finnish registrar Sarek Oy. As things stand, none have any functioning DNS and that means all are completely inaccessible, at least as far as site users are concerned.

The list can be viewed here and given its size and the platforms on it, it feels safe to conclude that this blackout is currently affecting millions of pirates. It's probably fraying the nerves of many site operators too, albeit some more than others.

As far as we know, information and explanations for the unprecedented failure are in short supply, at least those announced directly from Sarek Oy. It's the middle of the night in Finland, so it may be a few hours before any official announcement arrives.

Domain Status: serverHold

After checking a few dozen WHOIS records for domains on the list, all display a domain status of 'serverHold'. ICANN's official description notes that the status is set by domain registries to indicate that a domain is not activated in the Domain Name System (DNS).

serverHold

Given the way the current problem manifests itself, the explanation is accurate but not especially helpful.

The bigger question is why hundreds of domains were suddenly placed on serverHold and why did that have to be done so urgently that there was no time to inform the domain owners? That will likely become evident during the next few hours, but we can confirm that sites operating .TV domains with other registrars remain functional.

whois-buffstreams

That may suggest an issue specific to the registrar. Some type of issue between the registry and registrar seems most likely, but it's hard to imagine either party simply deciding to render so many domains inoperable, seemingly all at once, without any kind of warning.

So at least for now, beads of perspiration will have to persist while soaking up the irony. Perhaps more than any other registrar in operation right now, Sarek Oy's reputation for keeping sites online is extremely well known. That it's currently at the center of one of the largest blackouts in recent history is unexpected, to say the least.

From: TF, for the latest news on copyright battles, piracy and more.

Racing Driver Arrested as Police Target Thailand's Largest & Oldest Torrent Site
Andy Maxwell, 20 Feb 10:14 PM

hacker-coderPress releases announcing the shutdown of yet another pirate site, more arrests, and what that means for the entertainment industry, are nothing out of the ordinary. In particularly busy periods, simply determining where one batch ends and another begins can present challenges.

Yet in many cases, even the most straightforward reports have much more going on just below the surface. An announcement published Monday by the Alliance for Creativity and Entertainment is clear, quite detailed, but also conservative in respect of reporting events behind the scenes.

The matter involves the oldest and most likely the largest torrent site in Thailand, a platform described by the most powerful rightsholders in the United States as a priority enforcement target for at least seven years. Yet only now, 18 years after the site first launched, have local authorities taken any visible action.

If policy recently changed in Thailand, there's no obvious indication of when that took place or what it might be. The official page to provide tips about illegal services on the police website still doesn't work and known complications simmering in this particular case haven't been mentioned either.

ACE Outlines The Main Facts

The key details, as reported by ACE on Monday, read as follows:

The Royal Thai Police's Economic Crimes Department (ECD), with support from the Alliance for Creativity and Entertainment (ACE), has raided four locations in Bangkok, Surin Province and Surat Thani. Four Thai nationals have been taken into custody and are expected to be formally charged with copyright offenses in the coming days.

Siambit.me was the largest torrent tracker site in Thailand with average monthly visits of 5.5 million, and which provided access to a huge range of Hollywood, international and Thai content.

The site had been in operation since 2005 and is known to regularly change its domain to avoid detection. According to statements by the Royal Thai Police, Siambit.me had over 100,000 VIP members and the operators were making an estimated 1.5 million baht (USD $41,000) on a monthly basis.

The 5.5 million visits reported here align exactly with data reported by SimilarWeb, so we'll put that aside for now. The reference to 100,000 VIP members indicates those paying a fee each month. The lowest monthly fee reported recently was just 99 baht with the highest at 499 baht, so roughly $2.70 to almost $14.00 per month.

The higher monthly rate of $14.00 makes little to no sense in any context while the claim that 1.5 million baht was generated each month could in theory suggest around 15,000 members paying 99 baht each. If 100,000 members paid even the minimum rate each month, no figures from any source combine to produce a sensible total, so perhaps more information will emerge to clarify the situation.

Images of Police Action Emerge

Images that began circulating late last week seem to confirm that the authorities had good intelligence. Photographs such as the one featuring a server room below appear to have been taken at the home of the main suspect.

siambit_servers1

When trying to establish a timeline for the events reported a few days ago a confusing picture emerged. In fact, to make any sense of these events we needed to go back, not just days, but several weeks.

Thai Police & ACE Took Sites Down in January

On January 19, 2024, we provided background on an ACE announcement detailing the shutdown of 27 Thai-focused sites, each reliant on a common infrastructure provided as a service by the website IAMTHEME.com.

Around January 17, officers from the Central Investigation Bureau were preparing an operation to enforce the country's strict pornography laws; in Thailand it's illegal to distribute porn, possess it, or produce it.

The bureau's target was the suspected operator of numerous sites including xxxporn678.com, 037movie-hd.com, dooball678.com, movie678.com, and 678-hd.com. The first domain seems to have majored on illegal adult content while the rest appeared to focus on pirated movies and pirated live football streams.

678-trash

The common denominator for all sites was a) a reliance on services offered by IAMTHEME.com and b) offering porn illegally and/or generating revenue illegally from online gambling advertising.

Combinations like these are an effective way to attract Thai authorities, who will shut sites down and arrest their operators. And that's exactly what happened here. Items seized included four computers, eight mobile phones, and more than a dozen bank accounts.

Dominoes Start to Fall

Not long after the operator of xxxporn678 and the other sites was arrested, police began investigating the operator of IAMTHEME. On or around February 2, he too was placed under arrest, most likely for similar reasons.

At some point, police determined that their latest suspect was either sourcing his porn and pirated movies from SiamBit or was otherwise connected to the site and/or its operator. That triggered a series of events that led to Thailand's largest torrent site becoming the focus of the ACE announcement published on Monday.

A source who asked not to be identified said that police initially expanded their investigation to identify the person in charge at SiamBit. Armed with a search warrant dated February 7 issued by a local court, on February 9 they targeted the home of a man in his late thirties* suspected of running the group that controls the site.
*the suspect is believed to be either 38 or 40

SiamBit2

According to the authorities, SiamBit had 10,000 VIP members, together paying around 1.5 million baht to its operators every month. For balance, we have also seen references to '100,000 members' but without any mention of money. SiamBits' tracker data obtained by TF shows a peak of almost a million peers while reporting over 200,000 members.

It's possible that the focus will end up being a monetary value, but whether that will be linked to porn and gambling, copyright infringement, or both, is still unclear.

At least initially, police focused on suspected crimes under Section 287 of the Thai Penal Code. Section 287 makes it beyond clear that any kind of dealing in pornographic content is a criminal offense, punishable by a fine, a prison sentence, or both.

Section 287 Thai Penal Code

While we were able to positively identify all four main suspects by name and home address, details here are limited to their initials, arrest location, alleged role, and reported age.

CW: Sai Mai District. SiamBit operator and famous professional racing driver (38/40)
PB: Chatuchak District. Financial controller (54)
WNK: Surin Province. Website/systems administrator (42)
NSWW: Surat Thani Province. Administrator, community manager (53)

Several images made available by the authorities allegedly feature the suspected operator of SiamBits but whether all show the same person isn't entirely clear.

On the top row, images one and two show the same person at the same location, dressed in a light blue t-shirt, face blurred. However, the person with his face obscured in image three at the bottom seems to more closely match press images of the racing driver named as the main suspect.

That raises the question of why the person in image three is wearing completely different clothes than those worn by the suspect in one and two.

suspects

Other apparent anomalies include the Alliance for Creativity and Entertainment referencing the domain Siambit.me, which as far as we can establish is indeed the site's main domain.

Locally there appears to be greater interest in Siambit.io, which at the time of writing redirects to Google. Meanwhile, the .me variant currently redirects to a Telegram channel with over 18,700 members.

Thai authorities confirm that their interest in SiamBit was raised due to complaints from companies in the movie industry. In its statement published yesterday, the anti-piracy group said that copyright infringement charges are expected in the next few days.

From: TF, for the latest news on copyright battles, piracy and more.

Film Companies Seek 'Torrenting History' Related to Redditor
Ernesto Van der Sar, 20 Feb 11:33 AM

reddit-logoEarly last year, a group of filmmakers obtained a subpoena which required Reddit to reveal the identities of users who commented on piracy-related topics.

The movie companies said they were not planning to go after these people in court but wanted to use their comments as evidence in an ongoing piracy lawsuit against Internet provider RCN.

Reddit wasn't willing to go along with the request, at least not in full. The company objected, arguing that handing over the requested information would violate its users' right to anonymous speech. Reddit later responded similarly to a second and third subpoena request.

Reddit Shared IP Address

Recent legal activity shows that Reddit doesn't intend to automatically comply with all user information requests. Early last year, it did share some information (including IP address logs) related to user 'ben125125'. Since the comment mentioned RCN, Reddit felt that was the appropriate response.

ben reddit

After this initial disclosure in March last year, no new information surfaced in 2023. However, a recent court filing shows that the movie companies, including Voltage Holdings and Millennium Media, actively tried to track down the commenter.

The IP address handed over by Reddit was linked to a T-Mobile account. Responding to a subpoena, the provider shared information related to subscriber 'Mr. S'. According to the filmmakers, the Redditor used this connection to post on the platform.

When Mr. S failed to respond to their letter, the filmmakers obtained a subpoena from the District of New Jersey to compel a response last December. The filmmakers were contacted by phone in early January, supposedly by Mr. S' family attorney, who promised to send information over email. According to the film companies, a response never arrived.

Movie Companies Seek 'Torrenting History'

To move the case forward, a few days ago the filmmakers asked the Illinois federal court to compel Mr. S to comply with the subpoena. The request reveals what type of information these companies are looking for.

The plaintiffs have always maintained that they don't intend to pursue legal action against the targeted Redditors. Instead, they're seeking information to support their lawsuits against RCN and other Internet providers.

The motion to compel shows that the movie companies are seeking the following information from Mr. S, who is not necessarily the Redditor:

1. All written communications with RCN concerning piracy from Oct. 1, 2017 to the present.

2. Payment records to RCN from Oct. 1, 2017 to present.

3. All personal computing records pertaining to usage of BitTorrent from Oct. 1, 2017 to the present.

4. All social media account usernames used including for Reddit, Twitter and Facebook January 1, 2016 to present.

5. All Reddit posts and messages from Jan. 1, 2016 to the present

6. Records of all movie piracy websites (including but not limited to YTS, 1337x, RARBG, Torrent Galaxy, The PirateBay) that were used at your Internet service.

The above shows that the movie companies would like to see comprehensive details of the subscriber's torrenting history, including records of visits to The Pirate Bay. In addition, it seeks information on other social media profiles, where more relevant information might be found.

Direct Infringement

The movie companies argue that the requested information is relevant and proportional to the needs of the case. For example, Bittorrent activity will help to show direct copyright infringement by an RCN subscriber.

"[The responses] will prove direct infringement and thus Plaintiffs' allegation that Defendant's subscribers directly infringe Plaintiffs' exclusive rights (and that Defendant is liable for its subscribers' piracy)," they argue.

At the time of writing, the court has yet to respond to the motion and no objections have been received. The filing is very insightful, though, as it sheds some extra light on what type of information the movie companies are after.

A copy of the movie companies' motion to compel, submitted at the U.S. District Court for the Northern District of Illinois, is available here (pdf)

From: TF, for the latest news on copyright battles, piracy and more.

270x90-blue

Are you looking for a VPN service? TorrentFreak sponsor NordVPN has some excellent offers.

 
 
Powered by Mad Mimi®A GoDaddy® company

No comments: