Uploading fakes to a BitTorrent network is relatively easy, but keeping the torrents active is a much more difficult task. The moderation teams on private trackers remove fakes as soon as they appear – if people are stupid enough to even try to upload them. Other directories such as The Pirate Bay and Mininova, however, are more difficult to police due to their open nature but these sites continually battle fakes too.

There are several forces driving this phenomenon. Of course, the likes of the MPAA and their partners like to upload fakes in order to waste downloader’s time and to monitor their activities. That said, there are others who are uploading fakes in order to make themselves money, with many of the fakes simply encouraging the use of malware such as Domplayer, or sending the user ostensibly to get passwords to view the video, but in reality directing them to spammy sites.

Unless you’ve been on Mars for a few years, you will be aware that aXXo is one of the strongest BitTorrent-related brands and as such, the aXXo name is ripe to be exploited with fake torrents and the schemes behind them. This morning, Mininova was bombarded with hundreds of fake aXXo torrents linking to various malware and spam schemes. Luckily the moderation staff at Mininova are very much on the ball, and their skills and experience allowed them to remove them very quickly. Indeed, the thousands of users at Mininova also help by informing the site that a torrent is not what it should be, but it’s an on-going battle.

When a fake is removed from the site, the IP address of the uploader is also banned, meaning that unless the uploader gets himself a new IP, he won’t be able to upload any more. However, the problem is a lot deeper than just the odd person here and there uploading a fake. Just recently malware and spam peddlers have been advertising online for people to work for them on a freelance basis, uploading fakes to torrent sites and getting paid for each one. Hundreds, maybe thousands of people have taken them up on their offers, getting paid around 20 cents for each successful upload. The scammers mitigate the effects of their worker’s IPs being banned by torrent sites by advertising for people with dynamically assigned IP addresses, while encouraging them to use proxies.

We spoke with Moe1210 at Mininova who told us that for them, although time consuming, the aXXo fakes are easiest to spot, and they are often removed from the site in a matter of minutes. However, due to these teams of hired individuals doing the uploading, the sheer number of fake torrents is significant. Even though the mod team are checking the site every 5 minutes, sometimes in that period 50 fakes could’ve been uploaded. On a regular day, the amount of fakes uploaded can reach 2,500.

In the ongoing battle the scammers are getting a little smarter, adjusting the way they operate as the challenge is met by Mininova. They became aware that at certain times of the day the fakes stayed on Mininova for longer periods before being removed, which was down to fluctuating staffing levels due to people having to sleep, rest and venture back into real-life every now and again. To counter this, Mininova now have a worldwide team which cover the major time zones.

Speaking of fake aXXo torrents, Moe1210 told TorrentFreak, “It’s a pretty pointless task uploading a torrent with aXXo in the title trying to trick people [on Mininova]. I’d say that 75% – 80% of our members know that if the torrent is not from aXXo’s account, its fake – meaning, if they check the ‘general’ tab and aXXo’s name is not in red letters, it’s fake! They [the scammers] have no way of spoofing this.”

Many fake torrents are using a tracker located at http://bt9.c7q.fast1010.info, which is hosted with Ecatel in The Netherlands. In order to trick users into believing the torrents it tracks are real, the tracker is faking the download statistics, as can be seen with this fake on TorrentPortal, which at the time of writing is reporting 76278 seeders and 82380 leechers.

The torrent contains an unusable video and a password.html file which claims to reveal a password to play the file, but instead leads the user into a quagmire of spammy sites.

Users looking to avoid these fakes should read our previous article entitled Stop Downloading Fakes and Junk From BitTorrent. In the meantime be aware that the same people behind the aXXo fakes are behind file names such as ‘Race to Witch Mountain 2009 DVDRIP XviD BangeR’, and ‘Watchmen 2009 DVDRIP SeedeRz’.

As a final thought, TorrentFreak asked Ecatel if they intend to do anything about the fakes tracker. They told us, “Ecatel does not allow any spam and malware in its network.” And then it became clear. The tracker hosted at Ecatel doesn’t host the content, the users do – like all trackers. Sometimes the law’s such an ass.

Article from: TorrentFreak, check out our new blog at FreakBits.

Although most scams can be avoided easily when a few simple rules are followed, they still manage to trick thousands of novices every day – and this is not going to end anytime soon. Since BitTorrent has become more or less mainstream, with millions of users worldwide, it also proves an interesting target for email spammers.

The latest scam, unlike the others we have reported on before, is one that is sent by email. The email is disguised as a message from the anti-piracy company MediaDefender (using their logo etc.), and warns the recipient that his or her download behavior has been logged. The email has a report attached with more details about the infringed material, which turns out to be a virus (A Mytob worm which installs a trojan, and allows outsiders to gain access to your computer).

Dear User!

Your recent internet activity was logged on the following sites:

* Btjunkie
* SumoTorrent
* isoHunt
* Btscene
* Mininova
* Fenopy
* Monova
* Yotoshi
* GetInvites
* Btmon

We have attached a report about the copyrighted movies, music, softwares you
downloaded or searched on these webpages. We strongly advise you to stop any
future activities regarding the downloading of illegal content or you can
expect prosecution by 17 U.S.C. §§ 512, 1201?1205, 1301?1332; 28 U.S.C. §
4001 laws.

Sincerely,

MediaDefender Inc.

To the more experienced and BitTorrent savvy users it is clear that the email is a scam. First of all, MediaDefender has never been involved in anti-piracy enforcement. The only thing they do is spoofing, flood BitTorrent sites with fake files, and the occasional DDoS attack on Revision3.

In addition, the email claims to have data on what the user searched for on the sites, which is irrelevant and practically impossible. It seems that the spammers should have done some more research on the topic. A good spammer would have included The Pirate Bay in the list of sites instead of Getinvites, which is a BitTorrent invite trading site, and not a search engine

A related scam email, sent out by the same group of people judging by the style and format, is also targeted at filesharers and threatens to suspend their Internet connection. The email claims to be sent by the Internet service provider consortium, and again includes an infected attachment with a report.

The email is a clever scam that shows how mainstream BitTorrent has become. The emails are sent out randomly, but many recipients, scared by be cut off by their ISP, or sued for downloading copyrighted material, might open the infected attachment without realizing that it is a scam.

Article from: TorrentFreak, check out our new blog at FreakBits.

An administrator on Darkside RG, the official home of aXXo explained at the time: “aXXo told us that he has decided to take a break, so you will not see new aXXo torrents anywhere for a while. Please show your support by keeping his torrents alive until he comes back, as always, he will post here first when he does.”

Now, after nearly four months of absence aXXo has returned, and uploaded his first .torrent on Darkside RG and other torrent sites. It’s the news that many BitTorrent users have been waiting for.

Marking his comeback with the movie “I Am Legend” could be seen as symbolic. Before aXXo decided to take a break, an estimated one million people downloaded his DVDrips every month. The search term aXXo was undoubtedly the most popular at many torrent sites. Although there are conflicting opinions in respect of the quality of his work, there can be no dispute that he was, and still is, very popular indeed.

While some see him in an almost religious light, others have been quick to take advantage of his popularity for nefarious purposes, or have used the aXXo brand to draw attention to their own releases, like KLAXXON did.

Even though some see him as a legend, aXXo certainly isn’t without his critics but whatever the position, his popularity is indisputable…..along with his modesty ;)

Article from: TorrentFreak, check out our new blog at FreakBits.

Today, sadly, we have to report on a new ring of BitTorrent scam sites. This particular brand notifies people who try to play a video file they’ve just downloaded that they need to download a codec if they want to play the file. The site they are redirected to is of course a scam, most of them are filled with annoying ads.

Thousands of downloaders have already fallen for this scam, and new reports keep coming in. The downloaded files are simply huge uncompressed videos, named after a popular release. This is what the message looks like: “Warning: HD Codec not detected. Please get the correct codec from [insert site here].”

The following sites have been related to these scams, but there are probably a few more.

http://www.torrentm8.com/

http://www.rapid-torrent.com/

http://www.torrent-movie-host.com/

http://www.thepiilotbay.org/

http://torrentrnate.com/

http://moviehost.rapid-torrent.com/

http://www.everybodyshappytorrents.com/

http://hdmi2.com

http://codec.uploadvid.net

Although we dispute the claim that your PC will be filled with spyware and viruses when you use BitTorrent, there are some basic steps people should know in order to avoid running into them. Below are two examples, for a detailed overview and more tips and tricks, check our tutorial on how to avoid fake torrents and other scams.

1. Read Comments

This is a simple but effective way to find out if the .torrent is legit or not. It only takes a few seconds but it’s time well spent. Very often there are requests from previous downloaders for a password to access the file or some might be asking where to download a special video player to view it.

2. Verify the Source

A good way to find out if a .torrent is real or not is to find out who uploaded the file. There are several well known users that always release torrents on a regular basis, EZTV is a good example.

Happy torrenting..

Article from: TorrentFreak, check out our new blog at FreakBits.

Other people get other problems such as torrents never finishing or when they watch a downloaded video it turns out to be completely the wrong thing – i.e the file was deliberately mislabeled. Sometimes the video download is of such poor quality it’s simply unwatchable and of course all this adds up to a lot of frustration and wasted time.

There are many techniques employed by experienced file-sharers to ensure that the torrent is what it says it is and of a good enough quality to even bother with. We’ll look at just a few of them here.

Remember that sharing certain types of media via BitTorrent may not be legal in your country.

1. Always read the comments

Before downloading any torrent, it’s always prudent to read the comments on the site. It only takes a few seconds but it’s time well spent. Very often there are requests from previous downloaders for a password to access the file or some might be asking where to download a special video player to view it. Movies should never come as .zip or an .exe file, if they do there is every chance the file comes with some sort of catch. If the movie won’t play with VLC Media Player there’s every chance it’s a fake. Any files needing 3WPlayer, DomPlayer or any that direct to other sites and ask you to fill in forms or install stuff, are also fake.

2. Can the source be trusted?

A good way to find out if a .torrent is real or not is to find out who uploaded the file. There are several well known users that always release new torrents on the same account, aXXo and EZTV are some good examples of such users. If the user is anonymous, you could look at the tracker, and see if it’s widely used. There is no guarantee that files on a well known trackers are safe, but you can almost be certain that files tracked by trackers such as bittorrent.isthebe.st are fake.

3. Is the file actually released already?

Many people use sites such as VCDQuality and Nforce.nl (sites that rates the quality of media releases on the internet) to not only ensure that the video is of a good quality, but also to weed out malfunctioning releases and identify real ones. Recently a movie producer was grateful to the BitTorrent community for spreading his movie ‘The Man From Earth‘, so we can use this movie as an example:

The VCDQ page shows a lot of information but let’s look at the box marked ‘folder’. Here you can see the release name. By copying and pasting this exact filename into Google, a list of almost guaranteed non-fake torrents appear.

4. TorrentSpam?

Another place to check is TorrentSpam. If you already have a torrent file in your possession, you can either paste the full name (or hash value, obtainable from the ‘general’ tab in uTorrent) into their search engine and if someone has reported this as a bad torrent, the results will be shown. Equally, if despite all the measures you still end up downloading a bad torrent, its possible to report this fact for the benefit of other TorrentSpam users in the future.

Do you have any tips or tricks not mentioned here that you would like to share? Feel free to leave a comment!

4. Other suggestions

We asked Matthijs from Mininova for some good tips on how to avoid downloading fake or scammy torrents and he came up with the following suggestions in addition to what we already posted.

In the end it’s experience alone that helps identify the fakes. Most people who have been file-sharing for a little while can easily spot these bad torrents but it’s clearly not so easy for the novice, judging by the number of emails we get at TorrentFreak each week. Let’s hope that number reduces soon.

Article from: TorrentFreak, check out our new blog at FreakBits.

An estimated one million people download aXXo rips every month, so although there are conflicting opinions in respect of the quality of his work, there can be no dispute that he’s very popular indeed. While some see him in an almost religious light, others have been quick to take advantage of his popularity for nefarious purposes.

Today, aXXo fans visiting his page on The Pirate Bay were in for a shock, summed up this Pirate Bay user:

C01eMaN – 2007-11-07 00:19 CET:
Whats going on with tpb, all of axxo’s vids are disappearing, any1?

One by one, all torrents released after 7th September 2006 were deleted. But why?

A message on the Pirate Bay comment section seems to sum up the situation and this version of events has been confirmed by aXXo himself, in a couple of places.

hunter1980 – 2007-11-07 12:23 CET:
**************************NOTE**************************

Since the Piratebay staff doesn’t care for their VIP uploaders, then aXXo decided not to use TPB and he deleted his own torrents.

aXXo was constantly exposed to assaults and harassments from possible members of MPAA. Their strategy was to harass aXXo by posting absurd and accusing comments on aXXo’s torrents.

The latest assault incident was especially noticed on aXXo’s last torrent ‘The Simpsons’.
Hunter1980 and aXXo were involved in direct argue with possible members from MPAA.

Unfortunately, this strategy was a success. The strategy was based on rumors and the intention was to spread rumors and all this have had a negative side effects on naive people ( downloaders ).

Since PirateBay did not take any action towards ‘Organized attacks’, aXXo decided to delete his torrent on TPB. aXXo is continuing posting his torrents on mininova or other torrent sites since they care for their VIP uploaders.

***************************END*************************

In a show of protest, Hunter1980 says that he has also deleted all of his torrents from Pirate Bay.

The aXXo world isn’t going to end with the deletion of torrents from The Pirate Bay because they can be found on a number of other torrent sites but it’s never nice to see disputes in the torrent community, especially between great ‘brand’ names.

The deletions have sparked quite a lot of debate on various forums. Some people are angry at The Pirate Bay for allegedly not giving enough support to aXXo while some are wondering if deleting lots of torrents is an appropriate response. Others feel that all uploaders should get the same treatment at The Pirate Bay and that aXXo shouldn’t get special attention. Maybe the Pirate Bay crew simply don’t have time to give anyone special treatment?

Interestingly, not many people seem to be pointing the finger at those who may have made the metaphorical bullets for others to fire – the “possible members of the MPAA” deemed to have taken the original actions which ultimately lead to this (hopefully temporary) breakdown in communication.

If the original MPAA plan was to reduce the availability of aXXo torrents by taking direct or indirect action against them at The Pirate Bay, that sadly seems to have worked, albeit via a strange turn of events. Or maybe it’s nothing to do with the MPAA after all and this is just one big misunderstanding?

Either way, hopefully this aXXo head will be re-attached to the Pirate Bay section of the BitTorrent hydra before it becomes completely severed. Undivided, unconquered.

Article from: TorrentFreak, check out our new blog at FreakBits.

All of the malware we’ve reported on comes from the same 2 servers found at 69.72.144.122 and 207.44.244.86 and this new kid on the block is no different.

DomPlayer is the latest malware to get on BitTorrent user’s nerves. In the last article on this issue we already discovered that the DomPlayer domain was sitting dormant but we didn’t know what it would become. It’s live now and here’s the deal:

Someone downloads a TV show (very often an aXXo fake) via BitTorrent. When the file is played, a message appears:

This video can only be played in DomPlayer, Visit Download.Domplayer.Com

On arrival, the user is greeted with a nice shiny site to distract them from the fact this is an elaborate trick based on DRM’ing previously-free media and forcing users to take steps to unlock it.

This is where DomPlayer differs from the other malware media players we’ve report on. The site claims: “DomPlayer is 100% clean, no bundled software!” At this stage, it doesn’t appear to install any intrusive adware etc on the host PC – there is a different trick up this 945K installer’s sleeve.

When it’s run, it’s believed the software locates the user, directs him to a telephone hotline appropriate to his country and instructs him to call it via cellphone. The call leads to the ‘activation’ of the DomPlayer software but ends up costing the user money.

If the user is in a country ‘unsupported’ by DomPlayer’s payment system, he will be directed to the 3WPlayer site where he can install 3WPlayer and a load of malware onto his PC, completely free of charge.

Although fake aXXo releases are known to be a frequent target of this scam, other media is also affected so many file-sharers find it prudent to check the comments on the site before they download a torrent.

UPDATE: Reports suggest that software is now available to play 3WPlayer (and possibly DomPlayer) files without getting either player. This software is untested by TorrentFreak.

UPDATE 2: Software to crack 3WPlayer, WinZix can also be found here. Click here for the .torrent.

Article from: TorrentFreak, check out our new blog at FreakBits.

However, there are companies out there who give you ‘free’ software (like a torrent client) but at the same time install some of that extra stuff you don’t want too. We have regularly reported on BitTorrent clients which also install this malware such as Torrent101, BitRoll, TorrentQ and GetTorrent. These are just a handful of bad clients currently available online.

It didn’t take much research to discover that a Swedish company called Wakenet is behind the enterprise, a company that made news on lots of spyware sites due to its Anti-Leech plugin.

Wakenet has a new domain called uvTorrent.com (currently diverting to their Cash4Downloads site) – no prizes for guessing the planned confusion with novices and the official ‘uTorrent’ client. They also have a new (fake) ‘compression’ utility called Winzix, obviously named to be confused with Winzip. Unfortunate downloaders will download something from BitTorrent, only to learn that it needs to ‘decompressed’ with Winzix in order to work. Installing Winzix again results in malware getting onto the host PC.

Our investigations revealed two major servers carrying the malware-ridden clients, media players, compression utilities and other sites supporting the enterprise:

IP: 69.72.144.122

1. netpumper.com (there’s even a link to this from Wakenet’s homepage)
2. bitgrabber.com
3. bitroll.com
4. c4dl.com
5. cash4downloads.com
6. download.play3w.com
7. get-torrent.com
8. playon.play3w.com
9. winzix.com (additional information from Symantec)
10. bitdownload.org
11. divoplayer.com
12. plugindl.com
13. torrent101.com
14. torrentq.com
15. torrentsoftware.org

IP: 207.44.244.86

1. bitroll.com
2. c4dl.com
3. cash4downloads.com (Click here for removal instructions)
4. download.netpumper.com
5. Uvtorrent.com
6. playon.play3w.com
7. wakenet.se (WakeNet’s own homepage is on the same server)
8. bitsofporn.com
9. domplayer.com
10. gamingtorrent.com
11. kitplayer.com
12. torrentmusic.org
13. torrentgamers.com
14. Torrentspeeder.com (different server currently)

We suggest that everyone stays well away from every site on the above lists. Use uTorrent or Azureus to download and if you ever download anything that requires anything other than a standard media player or WinRAR in order to play, be a little suspicious. Checking the comments to the torrent you plan to download is always a good idea.

For the little more adventurous reader, it’s possible to use the Windows HOSTS file to block the activity caused not only by the malware listed above but also that from hundreds of other sources. We recommend the excellent guide from MVPS, “Blocking Unwanted Parasites with a Hosts File”

UPDATE: Reports suggest that software is now available to play 3WPlayer (and possibly DomPlayer) files without getting either player. This software is untested by TorrentFreak.

UPDATE 2: Software to crack 3WPlayer, WinZix can also be found here. Click here for the .torrent.

Article from: TorrentFreak, check out our new blog at FreakBits.