How Facebook and Apple helped reveal the identity of the owner of KickassTorrents

One of these days on Geektimes news about arrest in Poland of the Ukrainian Artem Vaulin was published . He was arrested on suspicion of illegal distribution of copyrighted content. US authorities believe that Vaulin is the owner of the largest torrent tracker in the world. The amount of damage for owners of content distributed by the resource is estimated at $ 1 billion.

Also in the previous material it was told about how the owner was calculated. The main reason is the carelessness of Vaulin, who conducted transactions in iTunes, using his real data. Apple c Facebook also helped to reveal his personality. Now there is more data on this case.

KickassTorrents began working in 2008, and over the course of several years it became one of the largest torrent trackers in the world, and a few years later it became the largest. The popularity of the resource was positively influenced by the prosecution by law enforcement officers from different countries of The Pirate Bay team. Domains at this torrent tracker are constantly changing, the site is sometimes just "lying", and part of the audience of the "Bay" switched to KickassTorrents. Now attendance KickassTorrents is 50 million unique visitors per month. According to this parameter, the resource takes 68 place in the world.
')
Torrent trackers have long been the target of copyright advocates from around the world. And the owners and operators of such resources are illegal in many countries. Militiamen usually do not stint on punishment for such “criminals”: ​​for illegal distribution of copyrighted content content can be more severe than murder. For this reason, the owners of torrent trackers carefully hide their real identity. Well, if you are the owner of the largest torrent tracker in the world, you need to use all possible precautions.

But the US authorities still managed to reveal the identity of the owner of Kickasstorrents. In the 48-page document presented in the Chicago District Court, the prosecution described in detail the process of tracking and identifying this person. The main role in this matter was played by the special agent of the Department of Homeland Security Jared Der-Yeghiayan (Jared Der-Yeghiayan). He claims that there is no doubt that the 30-year-old native of Kharkov is the founder and owner of KickassTorrents.

Fake advertising

In November 2015, the agent conducted negotiations with the administration of the KickassTorrents (KAT) regarding advertising on the resource’s website. The parties agreed and the advertisement was posted. Cost of accommodation - $ 300 per day. The campaign was paid for five days, advertising was placed in March 2016. Subject of advertising - training in the United States. The money was transferred by the customer to the CAT account in Latvia. The US authorities have requested the account data from the bank, and it turned out that from August 2015 to March 2016 about $ 31 million was transferred to this account.



The agent found out the address of one of the representatives of the administration of the resource. It was an e-mail pr@kat.cr. The email address was the main one for communicating with the “advertising department” and was used to promote the resource on Facebook. After the appeal of the law enforcement agencies, the social network transmitted all the requested data.

Apple participation

Using publicly available tools, Jared Der-Yegiyan obtained the IP of a number of resource mirrors: kickasstorrents.com, kat.cr, kickass.to, kat.ph, kastatic.com, thekat.tv and kickass.cr. After a short search, it turned out that the two IPs were Chicago, KAT had been using them for four years. Agents received a copy of the server logs for several years (by the way, the geo-referencing of the case to Chicago is explained by the fact that previously there were located the resource server).

Agents also viewed the WHOIS of all known domain mirrors. The contact of one of the domains, kickasstorrents.biz, was specified by Artem Vaulin, Kharkov, Ukraine. The same method was received and mail Artem, tied to Whois.

As it turned out, the Ukrainian used this mail several times to conduct transactions in iTunes. One of the transactions was conducted July 31, 2015. Agents received from Apple IP, which lit up during the transaction.

And the same IP address was used to log in to the Facebook account associated with the KAT page on this social network. Another detail was discovered - after KAT started accepting donations to Bitcoin, $ 72,767 was transferred to a Coinbase account owned by Vaulin. Bitcoin wallet has been registered to the same email address.

Now what?

The prosecution demands to split all domains that are in any way connected with the case of Artem Vaulin. Appeals have already been sent to the .com and .tv administrators. Requests are planned to be sent to the administrators of the domain zones of Costa Rica, Tonga and the Philippines.

Torrent tracker while working. Probably, after the domain names are separated, the resource will go to other domains, so access to it will be maintained. But the alleged owner is already awaiting extradition to the United States. If he is unable to maintain the work of the resource at the proper level (and here the law enforcement officers have a number of tools - blocking accounts, arrests of representatives of the administration of the resource, etc.), KickassTorrents will have problems. True, the site administration also began to act - for example, one of the mirrors appeared on the KAT.am domain. This mirror is placed on several "cloud" servers at once, and hosting information is hidden using Cloudflare. A mobile version of the site has also appeared, and a KAT clone is already on IsoHunt .



Ironically, in this case, the legal purchase of a song led to the arrest of a person who stands behind the world's largest torrent tracker, violating the copyright of owners of illegally distributed content.