Once the malware had found .torrent files, it used their filenames to generate a fake ‘copyright infringement’ report warning the user that their ‘offenses’ could result in 5 years in prison and a $250,000 fine.

Of course, in the true spirit of all pay-up-or-else schemes, they were also given the option to make the whole thing go away by paying a ‘fine’ of around $400, as can be seen from the screenshot below

The whole scam was run by an outfit calling themselves the ICCP Foundation and now, thanks to a report from security expert Brian Krebs, we can see what kind of money was involved in this scam.

Last year, thousands of documents were leaked from Chronopay, Russia’s largest processor of online payments, and Krebs managed to get his hands on them. They revealed that Chronopay is up to its neck in the operations of “high-risk” industries – ones with the greatest chance of credit-card chargebacks and the companies involved doing high-speed disappearing acts.

Krebs notes that Chronopay “handsomely profited from the market for scareware, programs that infiltrate victim PCs to display fake security alerts in a bid to frighten users into paying for worthless security software,” so it comes as no surprise that ICCP Foundation – or ICCP-Online as they are referred to in Chronopay’s documents – are partners of the payment processor.

As can seen from the cropped screenshot below, hundreds of people fell for the scam, with 451 people using Visa to pay nearly $220,000 and 129 using Mastercard to hand over just under $63,000.

With 580 people paying $283,000, each payment works out to around $483, which sounds roughly right given the sample screenshots given to TorrentFreak when we first reported the scam. Krebs points out that the message in Russian at the top of the email says that the calculation formula may have been producing errors, but this appears to be a reference to the fraud counts as highlighted in yellow on the full screenshot which can be found here.

Its worth mentioning that these figures only show 2 active months for the scam, so the true amounts could actually be higher.

If anything, the above shows how easy it is to extract money from BitTorrent users, whether one is a legitimate lawyer, a scam artist, or one of the copyright trolls that fall in between.

Source: TorrentFreak, for the latest info on copyright, file-sharing and anonymous VPN services.

There is a lot of variance in the reported effectiveness between BitTorrent sites and the different decoy projects. We scanned through most of the reports and it seems that The Pirate Bay and Mininova were best protected against fake files whereas MediaDefender was more effective on sites like BiteNova and TorrentPortal.

Niek from Mininova, the toughest site to get onto according to MediaDefender, wrote a blog post in response to the leaked MediaDefender emails. He sums up some of the quotes that show how well protected Mininova is. Niek adds, “We can only be grateful for the many nice words from our friends at MediaDefender. All thanks go to our great moderating team, who did (and do) great work.”

The Pirate Bay has always been one of MediaDefender’s main targets because this site is often mentioned in the press. Unfortunately for MediaDefender The Pirate Bay is also one of the sites that is well protected against fake files.

In July, Brokep from The Pirate Bay already told us that they were doing all they can to block Media Defender from accessing their trackers. “We block them and some other torrent sites do as well.” he said.

This apparently annoyed MediaDefender, as we can see from one of their emails regarding the effectiveness of their decoys for Micheal Moore’s Sicko: “we still have no presence on Pirate bay which is a site they [Weinstein?] are likely watching as it was mentioned in the AdAge article they referenced.”

Here is an example of an effectiveness report for “Fantastic 4: Rise of the Silver Surfer” based on the top search results. Note that an effectiveness of 100% means that all the torrents that showed up in the search results (top 6/10/15) were fake.

BiteNova: 100%
Bittorrent.am 27%
Btjunkie 20%
Btmon 15%
BushTorrent 100%
ExtraTorrent 47%
Fenopy 100%
FlixFlux 23%
FullDLS 32%
IsoHunt 100%
Meganova 100%
Mininova 0%
Monova 35%
MyBittorrent 91%
NewTorrents 0%
Novatina 98%
PirateBay 0%
Snarf-it 74%
TorrentBox 32%
TorrentLocomotive 47%
TorrentPortal 100%
TorrentReactor 0%
TorrentSpy 4%
TorrentValley 77%
TorrentView 27%
Torrentz 22%
Underground 0%
WorldNova 97%
Yotoshi 92%

Source: TorrentFreak, for the latest info on copyright, file-sharing and anonymous VPN services.