sonnydeejay
01-11-2007, 09:28 PM
t is no secret that the MPAA and other anti-piracy organizations track down alleged pirates by uploading fake torrents. Up until now it was always unclear where those files came from, and how to identify them. http://torrentfreak.com//images/mpaa-block.gifThe MPAA and other anti-piracy watchdogs try to trap people into downloading fake torrents, so they can collect IP adresses, and send copyright infringement letters to ISPs. They hire a company to put up fake copies of popular movies, music albums, and TV series. They even use pirate like filenames such as “Battlestar Galactica S03E07 REPACK DSR XviD-ORENJi (http://fenopy.com/torrent/Battlestar_Galactica_S03E07_REPACK_DSR_XviD_ORENJi/Mzc5OTIz/index.html)” and “Miami Vice[2006]DvDrip[Eng]-aXXo (http://fenopy.com/torrent/Miami_Vice_2006_DvDrip_Eng__aXXo/Mzg2MjQ0/index.html)“.
One of the btjunkie (http://btjunkie.org/) admins has found a unique way to identify trackers that host these fake files, which makes it easy to efficiently remove them.
Virtually all the servers that spread these fake files are located in Southern California and Las Vegas. The administrators of these servers follow patterns that make it easy to identify them. The content of the trackers and seed amounts make them stand out. There are more unique characteristics, but we wont reveal all the tricks because they could take counter measures. Here are some examples of servers that host and track fake torrents:
Tracker 1 (http://fenopy.com/tracker/view_2400.html), Tracker 2 (http://fenopy.com/tracker/view_4080.html), Tracker 3 (http://fenopy.com/tracker/view_2749.html) & Tracker 4 (http://fenopy.com/tracker/view_4081.html). (Screenshots: One (http://torrentfreak.com//images/tracker1.jpg) & Two (http://torrentfreak.com//images/tracker2.jpg))
All the information was provided to me by one of the admins of btjunkie (http://btjunkie.org/), who works together on this with other torrent site admins. He says that the MPAA and friends use a variety of tactics. The tracker will either stall everyone at around 90% or the content will just be a blank monochrome screen.
“I really think this is being done by professionals with a budget, that’s a lot of servers to setup and it takes some expertise to setup in the manner that they did it,” says the btjunkie (http://btjunkie.org/) admin. “I don’t think I really need to say who would spend money on something like this.”
Here are some (http://www.torrentportal.com/torrents-search.php?search=battlestar+galactica&sort=seeders&d=desc&type=and&sizel=&sizeh=&cat=0&exclude=) good (http://www.torrentportal.com/torrents-search.php?search=children+of+men&sort=seeders&d=desc&type=and&sizel=&sizeh=&cat=0&exclude=) examples (http://www.torrentportal.com/torrents-search.php?search=prison+break&sort=seeders&d=desc&type=and&sizel=&sizeh=&cat=0&exclude=) of how these fake torrents clutter up the search results. Virtually all of those X marked torrents are coming from the ip-ranges we mentioned, and are fake files. The good thing is that Torrentportal’s report system is well used by their users.
The server boxes that host these torrents fall in serveral ip-ranges, and are not yet blocked by blocklist software like peerguardian (http://phoenixlabs.org/pg2/). Here are a few of the ranges that were discovered recently. You can easily add these to the blocklist of your torrent client (if it supports one), filewall, or blocklist manager.
The anti-piracy servers use hostnames like 101tracker.dhcp.biz, aplustorrents.qhigh.com, bitnova.squirly.info, bittorment.ocry.com, and pirate-trakkrz.leet.la. All these hostnames can be traced back to the same IP Ranges, these ranges contain possibly hundreds of fake trackers, so feel free to block them:
66.172.60.XXX, 66.177.58.XXX, 66.180.205.XXX, 209.204.61.XXX, 216.151.155.XXX
Note that it’s not only MPAA material that is hosted on these fake trackers. It is more likely that the servers are owned and operated by an organization that logs IP addresses for several copyright owners and or anti-piracy organizations. However, I think it is likely that the MPAA is one of them.
One of the btjunkie (http://btjunkie.org/) admins has found a unique way to identify trackers that host these fake files, which makes it easy to efficiently remove them.
Virtually all the servers that spread these fake files are located in Southern California and Las Vegas. The administrators of these servers follow patterns that make it easy to identify them. The content of the trackers and seed amounts make them stand out. There are more unique characteristics, but we wont reveal all the tricks because they could take counter measures. Here are some examples of servers that host and track fake torrents:
Tracker 1 (http://fenopy.com/tracker/view_2400.html), Tracker 2 (http://fenopy.com/tracker/view_4080.html), Tracker 3 (http://fenopy.com/tracker/view_2749.html) & Tracker 4 (http://fenopy.com/tracker/view_4081.html). (Screenshots: One (http://torrentfreak.com//images/tracker1.jpg) & Two (http://torrentfreak.com//images/tracker2.jpg))
All the information was provided to me by one of the admins of btjunkie (http://btjunkie.org/), who works together on this with other torrent site admins. He says that the MPAA and friends use a variety of tactics. The tracker will either stall everyone at around 90% or the content will just be a blank monochrome screen.
“I really think this is being done by professionals with a budget, that’s a lot of servers to setup and it takes some expertise to setup in the manner that they did it,” says the btjunkie (http://btjunkie.org/) admin. “I don’t think I really need to say who would spend money on something like this.”
Here are some (http://www.torrentportal.com/torrents-search.php?search=battlestar+galactica&sort=seeders&d=desc&type=and&sizel=&sizeh=&cat=0&exclude=) good (http://www.torrentportal.com/torrents-search.php?search=children+of+men&sort=seeders&d=desc&type=and&sizel=&sizeh=&cat=0&exclude=) examples (http://www.torrentportal.com/torrents-search.php?search=prison+break&sort=seeders&d=desc&type=and&sizel=&sizeh=&cat=0&exclude=) of how these fake torrents clutter up the search results. Virtually all of those X marked torrents are coming from the ip-ranges we mentioned, and are fake files. The good thing is that Torrentportal’s report system is well used by their users.
The server boxes that host these torrents fall in serveral ip-ranges, and are not yet blocked by blocklist software like peerguardian (http://phoenixlabs.org/pg2/). Here are a few of the ranges that were discovered recently. You can easily add these to the blocklist of your torrent client (if it supports one), filewall, or blocklist manager.
The anti-piracy servers use hostnames like 101tracker.dhcp.biz, aplustorrents.qhigh.com, bitnova.squirly.info, bittorment.ocry.com, and pirate-trakkrz.leet.la. All these hostnames can be traced back to the same IP Ranges, these ranges contain possibly hundreds of fake trackers, so feel free to block them:
66.172.60.XXX, 66.177.58.XXX, 66.180.205.XXX, 209.204.61.XXX, 216.151.155.XXX
Note that it’s not only MPAA material that is hosted on these fake trackers. It is more likely that the servers are owned and operated by an organization that logs IP addresses for several copyright owners and or anti-piracy organizations. However, I think it is likely that the MPAA is one of them.