TorrentFreak

AI-Built Torrent Site Looks Inside Downloads to Catch Fakes and Malware

Sun, 11 Oct 2026 20:00:53 +0000

In recent years, AI has made it much easier to create new websites and tools. That also applies to pirate sites, including TorrentClaw, a torrent search engine that’s largely built with AI. The site's TrueSpec feature, for example, checks what’s inside torrents. The results reveal a recurring malware trick, where a genuine VLC player is used as a decoy to load a malicious file.

TorrentClaw is a relatively new torrent search engine that launched in February.

The site is built on links from its own DHT crawler and dozens of external torrent sites and aggregators. In just a few months, the site has grown into an index of more than six million torrents, including the latest Hollywood blockbusters and hit series.

The homepage looks more modern than traditional torrent sites and has some clear AI-design tells. That’s not a secret. On the contrary, AI plays a central role in the site’s development and marketing.

TorrentClaw.com

According to TorrentClaw’s developers, who all use the name Deivid Soto, the platform is largely built and run with the help of AI.

“Basically, the core framework is Claude Code combined with local LLMs for specific execution and ingestion tasks,” Soto tells us.

For example, AI is used to match torrents to film and TV titles, so these can be neatly organized. The AI-driven categorization process takes over tasks that would otherwise be manual work, and AI helped to build novel tools as well.

One of the features built this way is TrueSpec, which checks whether torrents actually contain what their names suggest. That helps to spot fake torrents and malware.

TrueSpec: Download and Verify

On most torrent sites, release names are the main source of information for torrent users. They list the resolution, codec, audio and release group, but there’s no guarantee that any of it is accurate.

Mislabeled torrents are often handled by moderators on well-run torrent sites, but most automated indexes have no active moderation. That’s where TrueSpec comes in.

TrueSpec joins the torrent swarm, reads the file listing, and downloads enough pieces to check the video with the analysis tool ffprobe. According to the site and its developers, that’s between 10 and 20 MB per torrent.

TrueSpec

In addition to verifying the names, TrueSpec also checks suspicious files. It looks up their hashes on VirusTotal and, if the files are small enough, uploads these for a scan. TorrentClaw doesn’t run its own virus scanner, the malware verdicts come from VirusTotal.

When TrueSpec finds malware, the torrent remains listed on the site, but with a “Malware detected” label and the download button disabled. At the time of writing, one fake Jujutsu Kaisen episode with this label still had 34 seeders while it remained available on some external sites.

‘Malware detected’

Not Perfect

The TrueSpec system isn’t perfect. In July, an earlier dataset counted 6,450 malware cases, but many were false positives. These included the harmless RARBG_DO_NOT_MIRROR.exe file, fansub scripts that switch audio languages, and scripts that simply open a website.

The TrueSpec data from late September paints a different picture. TorrentClaw now only counts malware when VirusTotal confirms it, which leaves 34 torrents. We checked some of these against the evidence in the data, which links to a VirusTotal report for every confirmed case.

Detected malware is rare, but the count is likely too low. TrueSpec doesn’t download large executables, it prioritizes well-seeded torrents, and dead swarms can’t be checked at all. TorrentClaw also focuses on films and TV shows, so pirated software and games are largely left out.

Malware is only part of what TrueSpec flags. In total, 1,265 of the 687,057 probed torrents were flagged as deceptive, including programs disguised as videos and fake resolutions. That’s less than 0.2% of all checked torrents.

The most common type of ‘mislabeling’ is actually quite harmless. More than half of all probed torrents, 55%, include subtitle tracks that their release names don’t mention. TorrentClaw flags this as a missing label, but subtitles are typically not added to titles unless they are hardcoded. Scene rules don’t require this either.

VLC Player Malware

Most of the confirmed malware torrents follow the same pattern. In 31 of the 34 cases, the torrent includes an executable named after a new episode or film, a file called libvlc.dll, and a playable video in a subfolder.

The application is a renamed copy of the genuine VLC media player. According to TorrentClaw, it’s identical to VideoLAN’s official release and carries its code signature. The malicious part is the DLL, which VLC loads when it starts, and which VirusTotal engines flag as a trojan.

The torrents are named after popular new releases, including episodes of The Boys, Jujutsu Kaisen and Frieren, and films such as Dune: Part Three and Zootopia 2. Many also carry the names of known release or distribution groups, including SubsPlease, ETHEL and YTS.

This type of malware vector is not new. Earlier this year, a security researcher documented a campaign that used fake SubsPlease releases on Nyaa to spread the Vidar infostealer. These were reportedly uploaded from a stolen account.

TorrentClaw sourced its 31 torrents between February and August. Most of them, 22, came in through its own DHT crawler, while the rest were found via Nyaa, The Pirate Bay and TorrentDownload. All had seeders when indexed, and 15 were still active in early October, according to Soto.

Built For AI, By AI

TrueSpec isn’t the only thing that sets TorrentClaw apart. The torrent site also offers an MCP server, which allows AI assistants such as Claude and Cursor to search the index and fetch .torrent files directly.

MCP server

Technically, this means that users can ask an AI assistant to find a release and load the torrent file, without ever visiting the site. According to Soto, some accounts make around 10,000 API requests a day, which might be external sites or services that use it.

Running TrueSpec doesn’t cost much either. In July, Soto said the system ran on three nodes costing well under $50 a month combined.

“The implicit point: if verification is this cheap, any indexer could be doing it, and none are,” Soto explained.

That said, partially downloading content from hundreds of thousands of torrents can also come with a legal cost. TorrentClaw’s DMCA page states that the site doesn’t host, store, upload or distribute files, but rightsholders may see things differently.

When asked about this, Soto describes TrueSpec as a read-only client that doesn’t upload or seed. It only fetches the first part of a video file, enough to read the container headers.

“[It] deletes everything once the analysis is done. We don’t store or serve any content, and we process every valid takedown notice we receive,” Soto says.

TorrentClaw also uses AI to handle these notices. It introduced an AI-managed system in late September that has handled 23 takedowns so far. Before that, the site received just over 300 notices, mostly duplicates.

TorrentClaw also charges for its premium features. PRO costs $3.99 a month, while PRO+ adds a VPN for $6.99. Whether that business model will hold up has yet to be seen, but commercial torrent services typically draw more attention from rightsholders than free ones.

Game Industry Asks U.S. to Flag Denuvo Cracker ‘voices38’ as Notorious Piracy Threat

Mon, 12 Oct 2026 08:06:26 +0000

Home > Law and Politics >

The Entertainment Software Association has asked the U.S. Government to label the Denuvo cracker ‘voices38’ as a notorious piracy market. The game industry group argues that the cracker is an essential source in the game piracy ecosystem, feeding repackers and torrent sites. A notorious market flag is no guarantee of success, however, as FitGirl's previous listings show.

Every year, the Office of the United States Trade Representative (USTR) asks rightsholders to nominate the foreign piracy sites and services they see as the biggest threats.

The resulting list of ‘notorious markets‘ traditionally features torrent sites, cyberlockers and streaming portals. In recent years, hosting companies and other intermediaries were added as well.

Last week, the Entertainment Software Association (ESA), which represents many of the major video game companies, submitted its latest recommendations. These include the usual suspects, but also a target that doesn’t have a website of its own.

A Game Cracker as a Piracy ‘Market’

ESA’s submission lists ‘voices38’ as one of its new threats. The game industry group describes the anonymous cracker as a persistent operation that specializes in beating Denuvo Anti-Tamper, the popular technical protection measure that’s used by at least nine of its members.

Voices38

According to ESA, Reddit’s r/CrackWatch index attributes roughly two dozen cracked or bypassed games to ‘voices38’. The gaming group stresses that the cracker plays a key role in the piracy ecosystem as its releases are picked up by repackers, torrent sites, cyberlockers and piracy forums.

“Each crack therefore unlocks an entire downstream market for an unauthorized copy of that title. For a title that no other actor has made usable, but for Voices38’s crack there would be no functioning pirated copy for those markets to offer,” the submission notes.

“Treating only those downstream services as markets would overlook the upstream operation that determines whether protected games can be offered by them at all.”

The fact that the cracker has no public identity or “traditional homepage” shouldn’t stand in the way of a Notorious Markets listing either, ESA notes. In fact, it argues that a listing could help rightsholders crack down on the cracking operation.

“Designation would focus attention on identifying the operator, preserving evidence, disrupting distribution accounts and donation channels, and coordinating action across the forums, repositories, hosting services, peer-to-peer infrastructure, and other intermediaries used to seed each release,” ESA writes.

ESA’s recommendation

Ideally, ESA would like to identify the person or people behind the popular cracker handle and it’s not alone in this. Identifying the operator is also what Denuvo is trying to do through a U.S. federal court.

Lawsuit Doesn’t Stop the Cracks

Last month, Denuvo sued ‘voices38’ at a California federal court and it recently asked for permission to subpoena Discord, Valve and Reddit. ESA’s submission doesn’t mention this lawsuit.

So far, this hasn’t stopped the cracks from coming out. After a few quiet weeks, ‘voices38’ released cracks for Atomfall and The Adventures of Elliot: The Millennium Tales last week, as well as a crackfix for Dead Space Remake.

Atomfall-voices38

These releases swiftly spread over torrent sites and cyberlockers. Popular repacker FitGirl has already picked them up too, which brings us to ESA’s next target.

Billion Dollar FitGirl

After already being included in USTR’s 2024 and 2025 notorious markets lists, FitGirl gets a recommendation from ESA for the next installment.

FitGirl’s site is currently blocked in Germany, Italy, Spain and elsewhere, but ESA notes that these measures didn’t change much. The repack site received 41.77 million visits in August and continues to offer games published by ESA members.

“FitGirl’s scale and persistence demonstrate that prior blocking and designation have not induced meaningful remediation by its operator. ESA’s takedown notices to the site are ignored, with zero links removed between August 2025 and August 2026,” ESA writes.

The game companies also put a billion-dollar price tag on the losses, which they report down to the last cent.

“Between March and August 2026 alone, ESA detected 15,484,145 users in peer-to-peer swarms for games repacked by FitGirl, with an estimated lost value of $1,083,735,308.55,” the submission notes.

A footnote explains that this figure is based on a retail price of $69.99 for every user ESA spotted in a swarm.

Hypothetical Losses

Other targets are not very responsive either. DODI-Repacks removed 22% of the reported links and RuTracker, the Russian torrent site, complied with just 3% of ESA’s notices over the past year.

While these sites are not responding, ESA highlights that tracking their finances, including crypto transactions that go to KYC-vetted platforms such as Binance, could help to identify these targets.

Handheld Consoles as ‘Superfakes’

This year, the USTR’s review has a special focus on high-quality counterfeit goods, known as superfakes. ESA uses this opportunity to highlight handheld consoles that come preloaded with pirated games, which it sees as the video game equivalent of superfakes.

The group nominates Anbernic.com, the official store for a widely sold line of handheld emulation devices. ESA says these are routinely offered or shipped with memory cards that hold hundreds or thousands of unauthorized games, and notes that they are sold through Amazon and eBay as well.

The submission further lists G2A, FunPay and Eldorado.gg, where game accounts and in-game items are traded, as well as cheat sellers including Cronus Zen. ESA argues that cheats belong on a piracy list because they circumvent the technological protection measures of games.

It’s now up to the USTR to decide which of these recommendations make the final list. The previous edition was published in March, so we might have to wait a while before the final Notorious Markets list arrives.

—

A copy of ESA’s submission for the 2026 Notorious Markets review is available here (pdf).

MPA Takes Credit for Shutting Down Piracy Giants AnimeFLV and Cineby

Tue, 13 Oct 2026 07:34:34 +0000

Home > Piracy >

When pirate streaming giant Cineby shut down at the end of August, its operators blamed the loss of their main video providers. Now, the MPA informs the U.S. Trade Representative that the site stopped operating following "MPA and ACE actions," adding that the same applies to anime piracy portal AnimeFLV. At the same time, the MPA flags several persistent piracy threats, including Telegram, Kisskh, and MagisTV.

With more than 160 million visits in July, Cineby was one of the most popular pirate streaming sites on the Internet.

That changed in August, when the operators announced a surprise shutdown. The site was taken offline in stages over more than a week, with the last domains going dark in early September.

At first, the operators did not explain why they threw in the towel. In a final statement, however, they said that their two main video providers, which they named as the “Sflix group” and “1Movies group,” went down about three months earlier, and that the service never fully recovered.

No anti-piracy operation was mentioned and the usual enforcement groups, including the Alliance for Creativity and Entertainment (ACE), did not claim it either, until now.

The MPA Takes Credit

Last week, the Motion Picture Association (MPA) sent its annual overview of notorious foreign piracy markets to the U.S. Trade Representative (USTR). Before listing the threats that remain, the Hollywood group highlights what it sees as positive developments since its previous submission.

The demise of Cineby is one of them, together with the linked embed service Videasy.

“On another positive note, 2025 submissions Cineby[.]app and Videasy[.]net have ceased operations following MPA and ACE actions,” the MPA writes.

MPA and ACE actions

Earlier in the new filing, the MPA links the takedown of Cineby-associated domains to an “extensive investigation and multi-region enforcement effort.”

Following this effort, the main cineby.at domain is “nonfunctional” and Videasy is offline, the MPA notes. Vidking, which is mentioned alongside them, is still accessible but “has no connected source servers.”

The submission doesn’t mention a court or a police force, so it appears to be a private enforcement effort. Further details are not shared.

The same filing does credit Vietnamese law enforcement with dismantling the HiAnime piracy network, which according to the MPA also included Sflix/MyFlixer and Megacloud/Vidcloud. Seven suspected operators were charged in July.

This is likely the same “Sflix group” Cineby referred to, suggesting that Cineby used services from the Vietnamese group that was shut down.

While the MPA lists Cineby as “no longer active,” the brand hasn’t disappeared entirely. There are several copycats that popped up, including cineby.vg, which the MPA mentions in its report.

AnimeFLV Too

Cineby isn’t the only unexplained shutdown that the MPA now counts as a victory. The submission also lists the Spanish-language anime portal AnimeFLV, which previously received more than a billion annual visits, according to the MPA.

“Additionally, the AnimeFLV family of sites included in last year’s submission has shut down following MPA and ACE actions. This shutdown represents a significant enforcement success,” the MPA writes.

AnimeFLV

In July, we reported that AnimeFLV had stopped serving video in mid-June. The operators stayed silent and no anti-piracy group took credit, until now.

Today, the AnimeFLV domain no longer loads anything. Instead, it returns an HTTP 502 error. Of course, this brand has also been taken over by copycats since.

The Hydra Keeps Growing

Aside from the successes, the MPA’s submission lists dozens of sites and services that remain a problem. The group stresses that its overview is not intended to be comprehensive, but it highlights several key threats.

Last year, Myflixerz/Sflix, Cuevana, and HiAnime were listed as priority linking and streaming sites. This year, Kisskh is the only priority entry, while Cuevana moved to the regular list.

Kisskh, which specializes in Asian dramas and Hollywood content, received more than 70 million visits on its kisskh.is domain in August, mostly from India.

The “hydra sites” category that the MPA introduced last year remains a key concern. These pirate portals often rely on third-party Piracy-as-a-Service (PaaS) platforms for their videos. This includes the live sports PaaS service Streamed.

According to the MPA, the roughly 30 sites that use the live sports PaaS Streamed had 463 million visits in July, up from 134 million a year earlier.

New hydra threats include 1Shows/1Flex, CineHD/VidBox, and StreamEX. On the PaaS side, Videasy and MegaCloud are shut down and no longer listed, but there are newcomers. VidFast, for example, is reportedly used by at least 158 pirate sites with roughly 629 million monthly visits combined.

In the cyberlockers and video hosting category, Telegram now tops the priority list, while DoodStream moved to the regular list. Among other things, the MPA notes that Telegram’s response to takedown notices ranges from swift processing to weeks of inaction.

“Telegram is a platform of immediate concern,” the MPA writes.

Immediate concern

In the hosting category, the MPA shares new details on Netulu, which was already mentioned last year. The company was incorporated in Delaware in April and MPA says that, at that time, all piracy sites hosted by Private Layer were transferred to it. According to the MPA, U.S.-based investigators are “following leads.”

Following leads

Pirate app MovieBox is back on the list as well. The MPA cites more than 243 million downloads from Palm Store alone, but as we reported last week, the store’s counter has already passed 300 million.

The USTR will review the MPA’s submission, together with input from other stakeholders, in the coming months. Its own notorious markets list is expected early next year.

—

A list of all sites and services highlighted and categorized in the MPA’s 2026 notorious markets submission (pdf) can be found below. For additional context, we highlight the new entries, while also indicating those from the 2025 report that have since been removed.

Linking and Streaming Websites

Priority sites

– Kisskh.is / Kisskh.do / Kisskh.co (previously additional)
– Myflixerz / Sflix
– Hianime.to, hianime.nz, etc

Additional sites

– 1Shows / 1Flex (new)
– 1tamilmv
~~– Animeflv.net~~
– Anime-Sama.to
– Animepahe.ru (new)
– Aniwaves.ru (new)
– Buffstream.io
– Burningseries.ac (bs.to)
– Cda.pl
~~– Cineby.app~~
– CineHD / VidBox (new)
– Cuevana3i.bio (previously priority)
– Dytt8899.com, dytt8.net, dytt89.com, etc.
– Gimy.ai
– Goojara.to / levidia.ch / supernova.to
– HydraHD.ru / HydraHD.ws
~~– Librefutboltv.su~~
– LiveTV.sx
– Netmirror
~~– Nunflix.org~~
– Redecanais / Redecanaistv / Futemax
– Rezka.ag
– RiveStream (new)
– Serienstream.to (s.to)
– Soap2day.day
– StreamEX (new)
– Streamingcommunity
– Vegamovies
– Veronline[.]in
– Xalaflix.gg / xalaflix.art
Piracy-as-a-Service (PaaS)

– Belintersat (new)
– Fire Video Player
~~– MegaCloud / VidCloud / RapidCloud (formerly 2embed.to)~~
– Njalla
– Streamed.pk (previously Streamed.su)
~~– Videasy[.]net~~
– VidFast[.]vc (new)
– Vidlink[.]pro
– Vidsrc[.]me
– WHMCS Smarters
– XPass[.]top (new)
Direct Download Cyberlockers and Streaming Video Hosting Services

Priority sites

– Telegram
– Streamtape.com
– Voe.sx

Additional sites

– Baidu Wangpan
– Chomikuj.pl (previously listed as a linking site)
– DoodStream (previously priority)
– Mixdrop.co (returns)
– Rapidgator
– VK.ru / VK.com
Illegal IPTV Services

Priority services

– MagisTV / FlujoTV
– Gogo IPTV

Additional services

– Apollo Group TV
– Atlas Pro
– GenIPTV
– Spider Receiver
~~– TVExpress~~
Piracy Devices and Apps

– EVPAD
– LokLok, RookTV, LokTV, LokiOK
– MovieBox (returns)
– PikaShow
– SVICloud (returns)
– Unblock Tech (unblocktech.com & ub1818.com)
Peer-to-Peer Networks & BitTorrent Portals

– 1337x.to
– Rutracker.org
– ThePirateBay.org
– Yggtorrent.top
– Yts.mx
Hosting Providers

~~– Crypto Servers Ltd~~
– Ddos-Guard.net
– Netulu, Private Layer, Swiss Global, and affiliated companies
– Squitter, ABC Consultancy, Peenq, ESTOXY, BestDC, SERDECH
~~– Veesp~~
– Virtual Systems, V-Sys
Registries

– .CC Registry
– .IO Registry
– .RU Registry
– .SX Registry
– .TO Registry
– .TV Registry
~~– .SU Registry~~

Publishers Seek $19.5m From Pirate Library WeLib, Recycle Anna’s Archive Claims

Wed, 14 Oct 2026 12:05:31 +0000

Home > Law and Politics >

A group of major publishers has asked a New York federal court to issue a $19.5 million default judgment against pirate library WeLib. The site allegedly copied its code and most of its collection from Anna's Archive, which lost a nearly identical case in May. Ironically, the publishers' brief appears to 'copy' from Anna's Archive as well, or at least from their own lawsuit against the shadow library.

Last year, Anna’s Archive warned its users about WeLib, a “new entrant” in the shadow library ecosystem.

The site appeared to have mirrored most of Anna’s collection and used a fork of its codebase. Since WeLib wasn’t sharing new collections or code improvements in return, Anna’s Archive cautioned prospective users.

“We recommend not using them,” the team wrote at the time.

In June, major book publishers came to a similar conclusion, but for different reasons. They filed a lawsuit against WeLib in New York federal court, alleging that the site “was created after its operators copied the source code and most of the contents of” Anna’s Archive.

WeLib

Despite these and other copyright infringement allegations, WeLib’s anonymous operators never responded to the lawsuit. This prompted the publishers to move forward and the court clerk entered a default in August, opening the door to a final judgment request.

$19.5 Million, Again

On Monday, the publishers, including Penguin Random House, Elsevier, and HarperCollins, asked U.S. District Judge Victor Marrero to issue a default judgment against WeLib and its unnamed operators.

“Defendant WeLib is a pirate site whose sole business is the distribution of protected content in violation of the rights of Plaintiffs and other copyright owners,” their brief reads.

The publishers request the maximum statutory damages of $150,000 for each of the 130 works listed in the complaint, ten per publisher. That adds up to $19.5 million, the same amount Judge Jed Rakoff awarded in the Anna’s Archive case.

Damages calculation

Plaintiff	Amount
Apress Media, LLC	$1,500,000
Cengage Learning, Inc.	$1,500,000
Elsevier Inc.	$1,500,000
Hachette Book Group, Inc.	$1,500,000
HarperCollins Publishers LLC	$1,500,000
John Wiley & Sons, Inc.	$1,500,000
Macmillan Learning	$1,500,000
Macmillan Publishing Group, LLC	$1,500,000
McGraw Hill LLC	$1,500,000
Pearson Education, Inc.	$1,500,000
Penguin Random House LLC	$1,500,000
Simon and Schuster, LLC	$1,500,000
Taylor & Francis Group LLC	$1,500,000
Total:	$19,500,000

The brief also puts a spotlight on WeLib’s revenue model. The site can be used for free, but it asks users for “donations” of up to $90 a month. According to the publishers, these are simply payments for faster downloads.

In addition to the damages, the publishers want a permanent injunction. This would require domain registries and registrars to disable welib.org, welib.st, and welib-public.org, and to block their transfer to anyone other than the publishers. Hosting providers would have to stop serving the sites.

Named intermediaries

The injunction would apply to all applicable intermediaries, but the proposed order names five specifically: Public Interest Registry, Cloudflare, Tucows, and two Njalla entities. That’s a much shorter list than the Anna’s Archive judgment, which named more than twenty.

Borrowed From Anna’s Archive

It is not unusual that arguments from a similar case are reused and that also applies here. Large parts of the WeLib brief mirror the one that law firm Oppenheim + Zebrak filed against Anna’s Archive in May, on behalf of the same publishers.

However, not everything fits. According to the brief, WeLib diverts revenue from the publishers “at a scale made worse by their use of the viral BitTorrent protocol.”

We haven’t seen any evidence that WeLib uses BitTorrent, and the WeLib complaint doesn’t mention it either. Instead, the cited paragraphs discuss various harms including lost sales and harm to the market for AI training data.

The same sentence appears, word for word, in the brief against Anna’s Archive. There, it was backed up by the complaint, which described how Anna’s Archive offers torrent files for bulk downloads on a dedicated “Torrents” page.

Same sentence, different site

WeLib’s own complaint mentions another download mechanism. It describes how the site serves files directly from its servers, through “slow” and paid “fast” downloads.

The brief also mentions that WeLib’s infringement continued “despite this and several other cases against them.” That entire paragraph comes straight from the Anna’s Archive brief. While Anna’s Archive was sued before, we are not aware of any other lawsuits against WeLib’s operators.

Even a typo and a garbled sentence with a double negative were copied. Both briefs mention what happens if the court “is satified” that the default standards are met, and both argue that the defendants “cannot establish that they have not presented any meritorious defenses.”

A Paper Victory?

It’s now up to Judge Marrero to decide on the request. Whatever the outcome, the publishers are unlikely to collect much, if anything, as WeLib’s operators remain anonymous.

Anna’s Archive lost several domains to an earlier injunction obtained by music companies. However, it remains online through .gl, .pk, and .gd domains, which are tied to registries and registrars outside the United States.

If Anna’s Archive is any indication, the injunction may cost WeLib some of its domains. However, that is no guarantee that the site will shut down permanently.

—

A copy of the publishers’ memorandum in support of the motion for default judgment is available here (pdf). The proposed default judgment and the statement of damages can be found here (pdf) and here (pdf). The publishers’ earlier brief against Anna’s Archive is available here (pdf).

We reached out to Oppenheim + Zebrak for comment on the BitTorrent claim, but they did not respond before publication.

RIAA Flags Anna’s Archive and AI Voice Cloner to U.S. Government

Thu, 15 Oct 2026 07:52:44 +0000

Home > Piracy >

The RIAA has submitted its latest overview of "notorious markets" to the U.S. Government. It lists familiar names such as The Pirate Bay and Rapidgator, but the music group also flags shadow library Anna's Archive and AI voice-cloning service Lalals. The RIAA presents both as "additional" areas of concern, not as official watchlist candidates.

Every year, the U.S. Trade Representative (USTR) invites rightsholders and other stakeholders to suggest foreign sites and services for its list of “notorious markets.”

The annual review doesn’t make any legal findings. Instead, it aims to encourage the listed services, and the countries they operate from, to take proper action against piracy and counterfeiting.

Last week, the RIAA responded with a submission that mostly mentions familiar targets. It lists torrent sites, stream-rippers and cyberlockers, many of which were flagged in previous years. There are some notable newcomers too, including Anna’s Archive.

Anna’s Archive and the Spotify Scrape

In December last year, the shadow library announced that it had downloaded 86 million music files from Spotify, plus metadata for 256 million tracks. This prompted an aggressive legal response.

A few days later, the RIAA coordinated an emergency court action on behalf of its members and Spotify, which resulted in a temporary restraining order against the site. Following this order, domain registry PIR suspended the site’s .org domain, and RIAA says Cloudflare also stopped providing services to the shadow library.

Following this crackdown, Anna’s Archive initially reported that its Spotify metadata torrent was “unavailable until further notice.” In February, however, the site quietly released roughly 3 million music files.

While the torrents for those releases were delisted shortly after, the lawsuit continued, with the labels and Spotify on the winning end.

“On April 14, 2026, RIAA and Spotify obtained a $322 million default judgment against the unknown operators of Anna’s Archive,” the RIAA writes in its USTR submission.

From RIAA’s submission

Despite the legal victory, the music group stresses that Anna’s Archive remains available through its .gl, .pk and .gd domains.

The RIAA isn’t the only rightsholder group that flagged the shadow library to the USTR. The Association of American Publishers (AAP) also lists Anna’s Archive as a “notorious” online site (pdf). According to the publishers, traffic to Anna’s Archive’s domains grew 28% despite their enforcement efforts, to an average of 41 million visitors a month.

The AAP also highlights that Anna’s Archive offers AI developers high-speed access to its collection, in exchange for what the site describes as an “enterprise-level donation.”

Voice Clones and Leaks

The AI angle also applies to newcomer Lalals, a service operated by a company based in the United Arab Emirates. This AI platform allows users to change a vocal recording to sound like popular artists such as Taylor Swift and Drake, without their permission.

According to the RIAA, that infringes the artists’ rights of publicity and likely also infringes its members’ rights in the sound recordings that were used to train the voice models.

“The sound recording artists whose voices are being exploited include Taylor Swift, Drake, Ariana Grande, Bruno Mars, Ed Sheeran, Lady Gaga, Chris Martin, and Rihanna, among many others,” RIAA writes.

Lalals

In the cyberlocker category, meanwhile, Mega is a familiar target. The European Commission added the file-hosting service to its own piracy watch list in 2022, and the RIAA now lists it among the notorious markets it wants the USTR to include.

“While Mega removes content that is specifically reported by rights holders, it does not implement effective measures to prevent the re-upload of infringing material or deter repeat infringement,” the RIAA writes.

RIAA stresses that users of the platform continue to share pre-release music and AI-related content, such as vocal models and cloned recordings. On what grounds Mega is required to prevent reuploads is not mentioned by the music group.

Several new cyberlockers are flagged for their role in pre-release piracy as well. These include Gofile, Sendgb and Imgur.gg.

Links to these services are reportedly shared on music leak forums, and the RIAA mentions Leaked.cx by name in the entries for Sendgb, Imgur.gg and Pixeldrain, which was already included in last year’s submission.

This Imgur.gg hosting platform doesn’t appear to be affiliated with the popular image host Imgur. When we checked, the site didn’t list any company details, but it did promote a music streaming app “Built by the imgur.gg team.”

Imgur.gg

RIAA goes on to mention that Telegram and Discord remain the primary mechanisms through which pre-release music is distributed. That accusation isn’t new, as the passage is nearly identical to last year’s submission.

Familiar Names, Familiar Words

Many other entries are familiar as well. The Pirate Bay, 1337x and RuTracker are listed in the torrent category, Rapidgator and Krakenfiles are flagged as cyberlockers, and Y2mate and Savefrom remain in the stream-ripping section.

Krakenfiles is still listed, even though the RIAA notes that it removed its upload functionality this year.

Whether any of the newly nominated sites will make it onto the USTR’s final list has yet to be seen. Last year, the USTR included several of the RIAA’s picks, including Y2mate, Savefrom and Krakenfiles.

Before the USTR makes its decision, the sites and services mentioned in the submissions can respond with rebuttals of their own, which Mega plans to do.

Responding to our request for comment, the company says that it removes reported content and permanently closes the accounts of repeat infringers, as is required under U.S. law.

According to Mega, infringing activity represents a small fraction of the overall use of the service. Last year, it processed close to 3.9 million copyright takedown requests and removed links represented around 0.002% of the more than 208 billion files stored by its 338 million registered users.

In the same period, 5,627 accounts were suspended under its “three strikes in six months” repeat infringer policy.

“Mega respectfully disagrees with the RIAA’s characterization, which fundamentally mischaracterizes the nature of the service, and will be filing its own submission with USTR setting out why its inclusion on the Notorious Markets List would be unwarranted,” Mega’s Legal and Compliance Manager Csaba Szabó informs TorrentFreak.

—

The RIAA’s full 2026 list of “notorious” sites and services can be found below, and the full report is available here (pdf). The cursive listings marked (new) are newcomers and those that were removed are crossed out. The RIAA stresses that this list is a non-exhaustive overview.

Stream-Ripping Sites

– Y2mate.gs (formerly y2mate.nu)
– Savefrom.net
– Ssyoutube.com
– Notube.net
– Y2mate.is (new)
~~– Snaptube app and related domains~~

Music Download/Streaming Sites

– Mp3.pm (new)
– Tubidy.cool (previously listed as a stream-ripper)
– Scnlog.me
~~– newalbumreleases.net~~
~~– waploaded.com~~
~~– hiphopkit.com~~

BitTorrent Indexing Sites

– ThePirateBay.org
– 1337x.to
– Rutracker.org

Cyberlockers

– Rapidgator.net
– Krakenfiles.com
– Chomikuj.pl
– Pixeldrain.com
– Pillows.su
– Mega.nz (new)
– Gofile.io (new)
– Sendgb.com (new)
– Imgur.gg (new)
– Ddownload.com (new)

Additional Issues

– Anna’s Archive (annas-archive.gl, .pk, .gd) (new)
– Lalals.com (new)
– Other intermediaries: Telegram and Discord
~~– Bulletproof ISPs: PRQ, Frantech Solutions/BuyVM/PONYNET, DDoS Guard~~
~~– Domain Name Registrars: NameCheap, Tucows and others~~

Physical Markets

– Counterfeit CDs and vinyl from China and Russia, sold through Amazon, eBay, Vinted, Marktplaats, Leboncoin and Wallapop (new)

VPNs and Cloudflare Escape beIN’s €10,000-a-Day Piracy Blocking Penalties

Fri, 16 Oct 2026 06:29:47 +0000

Home > Piracy >

VPN providers and Cloudflare only have to make a reasonable effort to block pirate sports streams in France. That's the conclusion of two Paris court rulings that refused beIN Sports' request for penalties of €10,000 per day, per domain. Meanwhile, the Paris Court of Appeal put a separate VPN blocking appeal on hold until France's Supreme Court rules on DNS blocking.

In May, the Paris Judicial Court ordered several VPN providers to block ten pirate sites and IPTV services that streamed WTA tennis matches, including thetvapp.to and tennistream.com.

The order followed a familiar pattern. It was requested by beIN Sports, which holds the exclusive French rights to most WTA tour matches. A day later, the broadcaster secured a similar order against Cloudflare.

In its initial request, beIN asked for penalties of €2,000 per day for each domain that two of the VPN providers failed to block. The court refused to grant that, however, as nothing showed that the providers intended not to comply. If problems arose, the parties could return to court. That’s exactly what happened.

beIN Loses Penalty Request

As first reported by L’Informé, the broadcaster went back to the Paris court, complaining that VPN providers and Cloudflare had not fully blocked the sites. This time, it requested a daily penalty of €10,000 for every domain that remained accessible.

Cloudflare, Surfshark and NordVPN, all represented by the same lawyer, cited technical constraints and said they had done their best to comply. Proton was also targeted but did not show up at the hearing.

The blocking efforts were indeed not bulletproof. Cloudflare blocked three of the four sites, but only through its CDN. Surfshark and NordVPN blocked six of eleven, and only through the DNS service on their servers in France.

‘Reasonable Effort’

For the court, those measures were enough. In two rulings issued on October 7, it concluded that the intermediaries must make a reasonable effort to block the sites, but they don’t have to guarantee the outcome, in line with EU Court of Justice case law. The case files also showed that all companies had carried out the orders, at least in part.

“The requested penalty (…) therefore does not appear necessary or proportionate, given the need to strike a fair balance between the protection of the intellectual property rights of copyright and neighboring rights holders, and the freedom to conduct a business enjoyed by economic operators,” the court wrote, as quoted by L’Informé (translated).

The original blocking orders themselves remain in effect until the end of the WTA season, which is currently set for November 14. Meanwhile, beIN can still appeal.

The outcome mirrors the Paris court’s ruling in Canal+’s case against Cloudflare last month. There, Canal+ was refused daily penalties of €50,000 per site, as the court concluded that Cloudflare only had to take reasonable measures, which it did by blocking through its CDN.

DNS resolver Quad9 is next in line. According to the Swiss foundation, beIN wants €10,000 per domain, per day, which adds up to €580,000 a day. Quad9’s position is different, however, as it isn’t blocking any of the domains at all. A decision on that request is expected later this month.

Appeals Court Hits Pause

The penalty rulings are not the only setback for rightsholders. The VPN providers are also fighting the blocking orders directly, and that effort just got room to run.

Last year, NordVPN, Proton and CyberGhost appealed one of the first VPN blocking orders, which French football league LFP obtained in May 2025.

At the request of the VPN providers, the Paris Court of Appeal put that case on hold on September 30. Instead of ruling on the appeal, it will wait for France’s Supreme Court, the Cour de cassation, to decide on appeals against seven earlier rulings.

These rulings, issued in March and May this year, upheld blocking orders that Canal+ obtained against DNS providers. In the March cases, Google, Cloudflare and Cisco lost their appeals. Several DNS providers then took the matter to the Supreme Court.

The appeals court acknowledged that these cases are not identical to the VPN dispute. However, it sees enough overlap to pause the case and wait for the Supreme Court outcome.

“Despite the differences, namely that the seven decisions under appeal concern DNS providers rather than VPNs, and that they were issued at the request of the Canal Plus companies rather than LFP and LFP1, the present case has many legal questions in common with the rulings under appeal before the [Supreme Court],” the court writes (translated).

From the freeze order

These overlapping questions include who can be ordered to help stop piracy, whether the French blocking law complies with EU law, how infringements must be proven, and when blocking measures are proportionate.

When the Supreme Court will rule on the matter is unknown, but the appeals court believes the outcome could affect the VPN case as well.

—

A copy of the Paris Court of Appeal’s ruling (RG 25/09229) is available here (pdf).

Chinese Court Jails Aiyifan Operator, U.S. Judge Won’t Transfer Pirate Site’s Domains

Sun, 18 Oct 2026 10:41:19 +0000

Home > Lawsuits > Apps and Sites >

A Shanghai court confirmed the criminal conviction of Wang Jianyang, one of the operators of pirate streaming platform Aiyifan. In a parallel case, a Florida federal judge awarded Chinese streaming service iQIYI $1.96 million in damages, roughly 1% of what it initially requested. The court also refused to transfer Aiyifan’s domains, noting that the sites carry content from other rightsholders too.

Last month, Chinese streaming giant Tencent won the first round of its legal battle against the pirate site Olevod, when a Florida judge ruled that the case can proceed in the United States.

Tencent is not the only Chinese platform to try its luck there. Last year, rival streaming service iQIYI used the same court and the same legal team to sue Aiyifan, a pirate streaming service for Chinese speakers outside China.

Aiyifan also operates under the names YFSP and IYF, with domains including aiyifan.tv, yfsp.tv and iyf.tv. According to Similarweb, yfsp.tv alone drew roughly 14 million visits last month.

Unlike Olevod, Aiyifan never appeared in court, and none of its operators were named as defendants. However, the U.S. case isn’t the only legal trouble the pirate site is up against. In China, one of the site’s operators has been sentenced to prison recently.

Operator Jailed in China

In August, iQIYI informed the Florida court that the Shanghai Third Intermediate People’s Court had upheld the criminal conviction of Wang Jianyang, describing him as one of Aiyifan’s principals.

According to the ruling, Wang ran a company in Chongqing that provided the technical support for Aiyifan’s website and app. He also handled advertising and promotion, working on the pirate platform since 2022.

The Chinese police detained Wang in March 2024, which was more than a year before iQIYI filed its lawsuit in Florida.

Wang had been convicted before. In 2021, a court in Jiangsu gave him a suspended prison sentence of three years and a 6 million yuan fine for setting up another pirate site.

Aiyifan launched while he was still on probation. In March of this year, a Shanghai district court revoked the suspension and added a new sentence of three and a half years, plus a 1 million yuan fine. Combined, Wang faces four and a half years in prison and a 7 million yuan fine.

From the translated Shanghai ruling

Wang appealed the verdict, arguing that the evidence was insufficient and that, at most, he merely provided technical support. The appeals court disagreed, however, concluding that he played a major role in the operation. That ruling is final.

Florida: $1.96 Million Instead of $196 Million

In Florida, iQIYI’s civil case was launched in hopes to shut down the site. Aiyifan didn’t respond to the complaint in the U.S. federal court, after which a default was entered in July 2025.

iQIYI asked for a massive $196.55 million in damages. Most of that came from applying the $150,000 statutory maximum to 776 registered works, while thousands of unregistered works added another $78.55 million in proposed damages.

In January, Judge Melissa Damian ruled that Aiyifan is indeed liable. However, she rejected the damages award because it lacked support. iQIYI responded with a revised request for $54.4 million, but that was still too much for the court.

In an order issued last week, Judge Damian awarded $1,000 per registered work, doubled for willfulness, for a total of $1.8 million. The award covers a total of 901 works as more copyright registrations had been processed as the case moved on.

The trademark claims added $160,000, but there were no damages awarded for the roughly 5,000 unregistered works. This brings the total to $1.96 million, about 1% of the original request.

From the final default judgment

The reduces damages is not the only setback for the Chinese streaming company either, as its requested injunction is also limited.

Judge Won’t Transfer Domains

iQIYI specifically targeted the pirate site’s domain names, asking the court to hand them over and redirect them to iQIYI’s own site. It also wanted ISPs, hosting companies, CDNs, payment processors and WeChat to stop serving Aiyifan.

The amended motion for a default judgment dropped most of these third parties, but it still requested the domain takeovers, to effectively take these offline.

Judge Damian was not convinced that this would be appropriate. iQIYI admitted that it couldn’t say how much of the content on the sites was infringing, or whether any of the other content is licensed.

Aiyifan streams plenty of content that is not owned by iQIYI. Taking over the domains entirely would therefore go too far, the judge concluded.

The order acknowledges that “some other judges in this District have a more liberal approach to the dispensation of injunctive relief.” However, Judge Damian sided with the Eleventh Circuit’s requirement that injunctions must be narrowly tailored.

yfsp.tv’s homepage this week, with Toy Story 5 in the top slot

Partial Domain Registrar Suspensions?

Instead of transferring the domains, the judgment orders domain registrars to cancel the pages and subdomains that feature iQIYI’s shows or trademarks, once iQIYI provides a list.

If a registrar fails to comply, the registry must move the domain to a registrar of iQIYI’s choosing. That changes the registrar but would not transfer the ownership.

The registrar provisions in the judgment

Whether registrars can comply is questionable. A registrar controls the domain registration, not the pages on a website, so the only tools at its disposal are suspending or redirecting a domain as a whole.

That is exactly the broad outcome the court is trying to avoid.

Even the subdomains are a stretch. Two of the listed sites, m.yfsp.tv and www.yfsp.tv, share a single domain, and a registrar can only switch one of them off if it also runs the domain’s DNS.

For now, the Aiyifan sites remain online. Without a response from the operators, it’s also unclear whether iQIYI will be able to collect any of the damages.

—

A copy of the final default judgment, issued at the U.S. District Court for the Southern District of Florida, is available here (pdf). The accompanying order can be found here (pdf), and the translated Shanghai ruling, as filed by iQIYI, here (pdf).

The seven (sub)domains listed in the judgment: m.yfsp.tv, www.yfsp.tv, www.yfsp.lv, www.iyf.tv, www.iyf.lv, www.aiyifan.tv and www.ayysp.com.

Court Approves ‘voices38’ Subpoenas After Denuvo Drops Payment and Login Data Requests

Mon, 19 Oct 2026 08:09:47 +0000

Home > Lawsuits >

Denuvo can subpoena Discord, Valve and Reddit to identify the anonymous game cracker ‘voices38’. After a California federal judge raised privacy concerns, the DRM company dropped its demands for payment data, comments and other data, reducing 46 requests to nine. What remains are identity and contact details, including IP addresses, which Denuvo says may be the only reliable path to identify the defendant.

Earlier this month, Denuvo asked a California federal court for help to unmask the person or group behind the popular game cracking handle ‘voices38’.

The request is part of the DMCA anti-circumvention lawsuit that the Irdeto-owned company filed in September. That complaint identified the cracker only by a Discord user ID, a Reddit account and seven Steam profiles.

Denuvo wanted to subpoena Discord, Valve and Reddit, and its request wasn’t limited to just names and email addresses. The proposed subpoenas also requested payment details, login logs and post/comment histories, which turned out to be a step too far for the court.

‘Voluminous Data’

On October 8, Judge Haywood S. Gilliam Jr. ordered Denuvo to explain why it needs “the voluminous data contained in its requests for production” to identify and serve the defendant.

“Plaintiff’s requests for production go well beyond what is needed for the limited purpose of identifying the defendant and could pose substantial privacy concerns,” Judge Gilliam wrote.

Privacy concerns

The proposed subpoena to Valve was the broadest with 35 requests for the seven Steam profiles. These covered payment methods and transaction histories, IP addresses with timestamps, device identifiers, and any linked accounts.

Discord was asked to list the account’s server memberships and role assignments. Reddit, meanwhile, was asked for the posts and comments by ‘voices38’, as well as the account’s subreddit memberships.

From 46 Requests to Nine

The judge gave Denuvo the option to revise the subpoenas, using a narrow subpoena model from another case, or justify each data request in detail.

Denuvo chose the revise option. A few days ago, it filed new subpoenas that ask the platforms for targeted information.

Each request now covers documents relating to the identity or contact information of the account holder. That includes names, identification documents, email addresses, IP addresses, phone numbers, and business or residential addresses. Instead of the 46 original requests, there are now nine.

Info requested from Reddit

The new requests no longer list payment data, transaction histories, login logs, comments or posts. They do ask for IP addresses and phone numbers, which go beyond the model subpoena the judge pointed to. Denuvo argues that the platforms collect little information at sign up, and that what they collect is self reported.

The IP addresses may therefore be the only reliable path to the defendant, Denuvo writes. It also wants any name or identification document these companies have on file.

“Denuvo has only a pseudonym,” the company notes.

The nine requests

#	Platform	Target Account / Identifier	Information Demanded
1	Discord	User ‘voices38’ (ID: 1427416652684984397)	Names, ID documents, email addresses, IP addresses, phone numbers, and physical addresses
2	Reddit	User ‘voices38’	Names, ID documents, email addresses, IP addresses, phone numbers, and physical addresses
3	Valve (Steam)	Profile 76561199431115733	Names, ID documents, email addresses, IP addresses, phone numbers, and physical addresses
4	Valve (Steam)	Profile 76561198779407957	Names, ID documents, email addresses, IP addresses, phone numbers, and physical addresses
5	Valve (Steam)	Profile 76561199886659362	Names, ID documents, email addresses, IP addresses, phone numbers, and physical addresses
6	Valve (Steam)	Profile 76561199875355070	Names, ID documents, email addresses, IP addresses, phone numbers, and physical addresses
7	Valve (Steam)	Profile 76561199872834766	Names, ID documents, email addresses, IP addresses, phone numbers, and physical addresses
8	Valve (Steam)	Profile 76561198730942620	Names, ID documents, email addresses, IP addresses, phone numbers, and physical addresses
9	Valve (Steam)	Profile 76561198735927271	Names, ID documents, email addresses, IP addresses, phone numbers, and physical addresses

The crypto platform FixedFloat isn’t on the list of subpoena targets. Denuvo previously said that it found cryptocurrency transactions by the cracker on the crypto exchange, but it hasn’t asked the court for permission to subpoena the platform.

Subpoenas Granted

After reviewing the new request, Judge Gilliam granted the motion. This means that Denuvo can now serve Discord, Valve and Reddit with the revised subpoenas, to identify the defendant and serve the lawsuit.

The subpoenas set November 3 as the deadline for the platforms to produce the requested information. Whether that will be enough to put a name to ‘voices38’ has yet to be seen.

—

A copy of Judge Gilliam’s order to show cause is available here (pdf). Denuvo’s response, with the revised subpoenas, can be found here (pdf), and the order granting the motion is available here (pdf).

Judge Orders Meta to Name Employees Who Approved Torrenting Anna’s Archive and LibGen

Tue, 20 Oct 2026 09:20:22 +0000

Home > Lawsuits >

Meta will have to name the people who greenlit its torrenting of pirated books. A federal magistrate judge has ordered the company to identify everyone who approved sourcing books from LibGen and Anna’s Archive. This goes beyond the employees who ran the downloads and includes whoever decided whether to seed the books to others.

Last month, Magistrate Judge Thomas Hixson ordered Meta to hand over the command histories of the servers it used to torrent pirated books.

These logs would presumably reveal how Meta’s torrent clients were set up, including any changes to their upload settings.

The order is one of many discovery battles in the lawsuits over Meta’s use of shadow libraries. In the class action filed by authors including Richard Kadrey and Sarah Silverman, the court already ruled that training AI models on the books was fair use. That left the BitTorrent claims as the last live part of that case.

The server logs could reveal what happened on Meta’s machines. However, publisher Entrepreneur Media also wants to know who approved the torrenting activity.

‘Technical’ Decisions

Entrepreneur Media, which publishes Entrepreneur magazine, filed one of the related lawsuits where it accuses Meta of contributing to piracy by uploading (seeding) works to third parties, similar to the authors’ contributory infringement claim.

To find out more, the publisher asked Meta to identify everyone who “made, authorized, or approved” the decisions to obtain the shadow library datasets, and to do so via BitTorrent.

Meta’s answers named several people who are believed to have been involved in data-related decisions. However, Meta said it couldn’t identify anyone who “formally” made or approved decisions to acquire or use books for its first two Llama models. Those decisions were often the result of team consensus, Meta argued.

When it came to the torrenting itself, Meta pointed to the employees who ran the downloads, describing their choices as technical decisions.

Decision?

Meta added that the acquisition of data from Anna’s Archive went through an internal legal review in early 2024, which involved its in-house lawyers.

In other words, the company didn’t name anyone higher up who approved the use of BitTorrent.

“On that construction no one at Meta decided to torrent anything, yet Meta torrented shadow libraries repeatedly from 2022-2024,” Entrepreneur Media countered.

‘Legally Not Okay’

The question becomes more concrete when it comes to seeding. One of the engineers who torrented LibGen data previously testified that the issue of seeding was raised and discussed internally, and that steps were taken to limit it.

An internal Meta logbook, which one employee reviewed before starting a download from Anna’s Archive, mentions a decision not to use torrents.

“Decided to go with direct file uploads without using torrents for the following reasons: Using torrents would entail seeding the file such as sharing content outside. This would be legally not okay,” the logbook reads, as quoted in Entrepreneur Media’s filing.

‘Legally not okay’

Meta does not deny that it used BitTorrent to download LibGen’s Scimag collection and data from Anna’s Archive. However, it says it isn’t aware of anyone who “made, authorized, or approved” a decision to upload or distribute the data. Meta’s lawyers also added that measures were implemented to avoid seeding.

How much data Meta shared with others is not clear either. Last year, Meta’s own expert estimated that uploads from its AWS servers didn’t exceed roughly 30% of the data downloaded during torrent downloads between April and July 2024.

Everyone in the Group

Yesterday, Judge Hixson ruled on the dispute. Two weeks earlier, Meta informed the court that it had no additional information to provide on the torrenting decision.

This didn’t convince the judge. He noted that the interrogatory isn’t limited to formal decisions, and that Meta’s answers were mostly about using the data, not obtaining or downloading it.

Meta’s argument that decisions were often collaborative doesn’t change that. The interrogatory asks about all decisionmakers, so if a decision was made by a team, everyone involved has to be named.

Everyone in the group

Meta must also identify the people who took part in the discussion that preceded the 2023 LibGen torrent download. In addition, it has to name the people who approved going ahead with BitTorrent, and whoever greenlit the April 2024 download from Anna’s Archive.

Notably, the order also covers everyone who decided “whether or how to seed, or to mitigate seeding,” when Meta downloaded LibGen’s Scimag collection and Anna’s Archive through BitTorrent.

For Entrepreneur Media, these names are important. The publisher says the answers “bear on” willfulness, as well as on its contributory copyright infringement and distribution claims.

This dispute largely revolved around naming the people involved. Whether Meta’s torrenting was fair use, and whether it actually distributed pirated books to others, has yet to be decided.

—

A copy of Magistrate Judge Hixson’s order is available here (pdf). The joint letter briefs filed by Entrepreneur Media and Meta can be found here (pdf) and here (pdf). Meta’s second supplemental interrogatory responses are available here (pdf).

‘VPNs at Risk’: Tech Coalition Pushes Back on Piracy Blocking Duties for VPNs

Thu, 22 Oct 2026 06:35:05 +0000

Home > Technology > VPN Providers >

A new report published by the Internet Infrastructure Coalition (i2Coalition) warns that poorly targeted VPN regulation can weaken the security infrastructure everyone depends on. The group, whose members include VPN providers, points to piracy blocking orders against VPNs in France, while U.S. lawmakers also consider similar blocking requirements. The report is released on Global Encryption Day.

When Rep. Darrell Issa introduced his site blocking bill last month, VPN providers made the list.

The American Copyright Protection Act (ACPA) would allow courts to order ISPs, DNS resolvers, and VPNs to block foreign pirate sites.

The competing DEFEND IP Act, introduced days later by Rep. Zoe Lofgren and Sen. Thom Tillis, does the opposite. It explicitly excludes services that only offer VPNs.

The VPN industry has a voice in U.S. blocking debates through the Internet Infrastructure Coalition (i2Coalition). In addition to representing companies such as Amazon, Cloudflare, and Google, the group runs a VPN Trust Initiative, with ExpressVPN, NordVPN, and Surfshark as founding members.

The coalition has been relatively quiet in recent site blocking discussions, but today, on Global Encryption Day, i2Coalition published a report titled “VPNs at Risk.”

Like last year’s DNS at Risk report, it warns against turning neutral infrastructure into a copyright enforcement tool.

VPNs at Risk

From Pirate Sites to VPNs

Copyright enforcement is one of the reasons governments consider regulating VPNs, the report notes. VPNs can be used to bypass blocking measures and may make it harder for rightsholders to identify infringers or enforce geographic licensing restrictions.

France has been one of the prime examples of this type of regulation, i2Coalition notes. In May 2025, a Paris court ordered NordVPN, CyberGhost, Surfshark, ExpressVPN, and Proton VPN to block 203 pirate sports streaming domains at the request of Canal+.

More orders followed later.

“These cases, brought by rightsholders before French courts, illustrate how obligations imposed at one layer of the Internet can migrate to another when users find alternative technical paths around court-ordered restrictions,” the report notes.

Migrating obligations

That raises a broader question.

According to the report, the issue is not just which intermediaries can be ordered to block, but whether these measures actually reduce piracy, and what side effects they have for lawful users.

The French legal battle isn’t over either.

The report describes the decisions as “currently pending appeal,” but it doesn’t mention the latest twists. On September 30, the Paris Court of Appeal put an appeal by NordVPN, Proton, and CyberGhost against a similar order, obtained by football league LFP, on hold. It will first wait for a ruling from France’s Supreme Court, the Cour de cassation, in related DNS blocking cases.

A week later, the Paris court refused beIN’s request for daily penalties against VPN providers and Cloudflare, which had not fully blocked the targeted sites.

i2Coalition is aware of these developments but will keep the report text as is.

“We’re following those proceedings, including the pending Cour de cassation outcome. We’re keeping the text for this release, but those developments will inform future updates. They don’t change our broader concern about the implications of extending blocking obligations to VPN providers,” Executive Director Christian Dawson tells us.

Target the Right Layer

The report doesn’t ask for a VPN exemption from any and all regulation. Instead, it urges lawmakers to be precise, and to take measures where they make the most sense.

“Policymakers should consider where meaningful knowledge and control actually reside and whether an obligation can be directed toward the relevant conduct or service before moving deeper into general-purpose Internet infrastructure. The further an intervention moves from the activity being regulated, the greater the need to consider its effects on unrelated users and services,” the report reads.

Target the right layer

Targeting the right layer is particularly important when it comes to VPNs. Consumer VPN services and corporate networks rely on many of the same underlying technologies, including protocols such as OpenVPN and WireGuard.

The report notes that Russia’s reported blocking of these VPN protocols shows how hard it is to tell the different uses apart at the network level.

When it comes to liability, i2Coalition points to the U.S. Supreme Court’s Cox ruling from earlier this year. This ruling confirmed that continuing to provide an Internet service, while knowing that some customers may misuse it, isn’t enough on its own to establish contributory copyright infringement.

The group sees the principles from this ruling as relevant to VPNs as well, but it doesn’t claim the matter is settled.

“If providers face liability merely because general-purpose services can be misused, they may have strong incentives to terminate users, restrict access, or intervene preemptively even when they have limited knowledge of the underlying conduct. Obligations should therefore reflect what an intermediary can reasonably know, control, and address,” the report warns.

Strong incentives

“We see those principles as relevant to the debate around VPNs, but we aren’t suggesting that the ruling automatically determines the outcome of every VPN case. That would depend on the facts and legal issues presented,” Dawson notes.

VPN providers are not completely without responsibilities. According to the report, they can strengthen trust through independent audits and cooperation with legitimate legal processes. Voluntary programs, such as the VPN Trust Initiative’s own Trust Seal, can complement these efforts.

Lawmakers, in turn, should involve VPN providers and other technical experts from the start when they want to tackle a problem.

Silent on U.S. Bills

The report doesn’t apply these recommendations to the pending site blocking bills, as neither ACPA nor DEFEND IP is mentioned.

That’s notable, as ACPA would allow courts to name VPN providers with 100,000 or more monthly U.S. users or subscribers in a blocking order. That’s a position VPN companies would rather not be in.

TorrentFreak asked i2Coalition why the report doesn’t mention the two bills. Dawson says that the group is following both proposals, but that this particular report focuses on other developments.

“For this edition, we’ve focused on the developments covered in the report rather than trying to capture every pending legislative proposal. We expect to revisit US legislation in a future update as the debate develops,” Dawson says.

For now, both bills remain pending. Issa retires at the end of the year and Tillis’s term ends in January, so both bills would have to move ahead before the current session closes.

—

A copy of i2Coalition’s “VPNs at Risk” report is available here (pdf).

DNS Resolver Quad9 Will Leave France After Court Orders Piracy Blocking Penalty

Thu, 22 Oct 2026 16:51:02 +0000

Home > Lawsuits >

Quad9 is leaving France over pirate site blocking orders, which makes it the second DNS resolver to leave the country. Quad9 will stop serving French users on November 24, after a Paris court set a €1,000 daily penalty for not blocking pirate tennis streams. Faced with this order and roughly 20 other pending French cases, Quad9 says that it has no other viable option left.

Earlier this month, DNS resolver Quad9 informed TorrentFreak that it was weighing its future in France, including the option to leave the country altogether.

The Swiss non-profit foundation faced a request from beIN Sports for penalties of up to €580,000 a day, as Quad9 chose not to block pirate tennis streams.

Yesterday the Paris Court ruled on the matter and not in favor of Quad9. As a direct result, the foundation decided that it will no longer offer its services to users in France starting November 24.

Farewell, France

€1,000 a Day

The court ordered Quad9 to implement the May blocking order, which since expanded to 58 domain names, or face a penalty of €1,000 a day, which is a fraction of beIN’s demands.

beIN had asked for €10,000 per day for every domain that remained accessible through Quad9. The court set the penalty at €1,000 per day in total instead. This runs until the blocking measures end on November 14, which Quad9 calculates adds up to €24,000, not counting its own legal costs.

Quad9 told us that it understands it is now subject to the penalty, as it won’t block the domains before the order ends.

In its ruling, the court points to Quad9’s own statements. According to the court, Quad9 has to make reasonable efforts to block the domain names, but it decided to take no action at all, for reasons it previously explained.

Reasonable effort

That’s a different outcome than earlier this month, when the Paris court refused beIN’s penalty requests against Cloudflare and several VPN providers. These companies had blocked at least some of the domains, which the court considered a reasonable effort.

Canal+ also lost a similar penalty request against Cloudflare in September. Quad9, however, hasn’t blocked a single domain, as it also confirmed in a statement submitted to the court.

Leaving France

For Quad9, the case was never just about money. The foundation sees recursive DNS resolution as a neutral service and doesn’t want to tamper with it.

“We categorically refuse to alter or lie to you about the DNS responses you receive in a way that opposes your expectations,” Quad9 writes in a statement.

The Swiss foundation also says that it can’t accurately block for French users only. Its free service requires no sign-up and it says that there is no reliable way to tell which users are in France.

Blocking the domains for all users would also satisfy the court, Quad9 confirms. However, the DNS resolver refuses to apply a French court order to Internet users worldwide.

How Quad9 will stop serving French users hasn’t been decided yet. The foundation told us that it’s still evaluating its options, which it believes are all imperfect.

Blocking wouldn’t help much either, Quad9 argues, as there are plenty of workarounds. People who want to access the pirate sites can simply switch to one of the thousands of other open DNS resolvers.

“This is like holding a piece of newspaper in front of a stadium full of people to block the view of a concert,” the foundation says.

More Blocking Cases

The decision to leave isn’t just about this beIN case. Quad9 notes that roughly 20 other blocking cases are pending in France and the foundation expects many of them to ultimately lead to more blocking pressure and potential fines.

“Quad9 cannot survive the accumulation of penalties yet to be assessed in 20 other pending cases, nor those of future cases similar to the one brought by beIN,” it notes.

Cannot survive

Quad9 isn’t the first public DNS resolver to make this move. In 2024, OpenDNS suspended its service in France in response to a Canal+ blocking order.

For Quad9, it’s also a matter of principle. The foundation fears that blocking demands which seem reasonable today will turn into a flood of new ones.

“Once the tools of censorship are built, they are rarely used sparingly or justly,” Quad9 writes.

An appeal is pending and Quad9 says it will continue to fight court-ordered DNS blocking. For now, French users have until November 24 to switch to another DNS resolver.

—

A copy of the Paris Judicial Court’s ruling (RG 26/11882) is available here (pdf).

AI-Assisted Paper on Z-Library Cites a TorrentFreak Article That Doesn’t Exist

Sat, 24 Oct 2026 07:55:15 +0000

Home > Opinion Articles >

A fresh academic paper on Z-Library cites a TorrentFreak article that doesn’t exist, and several other sources in the paper are also unfindable. The authors disclose that they used AI tools, which may explain what is going on. The use of AI in an academic paper on shadow libraries is also somewhat ironic, as rightsholders are suing AI companies for using these sites to train AI models.

Z-Library is one of the largest pirate ebook libraries on the Internet, offering millions of books and papers for free.

For students and researchers who can’t afford expensive textbooks and journal subscriptions, it can be a useful resource. At the same time, publishers have spent years trying to take it down, with takedown notices and blocking orders, while U.S. authorities indicted its alleged operators.

This tension is the subject of a paper published earlier this month in the journal New Review of Academic Librarianship, written by two librarians at Nigerian universities.

The paper

The peer-reviewed academic paper doesn’t pick a side and the lead author kindly shared a copy of their work with TorrentFreak. While the conclusions are not immediately newsworthy, there was one reference that stood out right away.

A TorrentFreak Article That Doesn’t Exist

In a section on enforcement against Z-Library, the authors write that major academic publishers, including Elsevier and Springer Nature, have taken similar legal action. The reference is a 2021 TorrentFreak article, as shown below.

The claim

The problem is that this particular legal action is new to us. The reference section lists the article as “Publishers continue crackdown on shadow libraries” and links to the TorrentFreak homepage. However, we have never published an article with that title.

We did report that Elsevier and Springer Nature obtained a UK blocking order against Sci-Hub, and that several Z-Library domains were temporarily suspended over copyright infringement claims. However, we’re not aware of this particular legal action against Z-Library.

Looking more closely, we see more claims that don’t seem to fit. The paper’s account of the Z-Library criminal case, for example, states that the U.S. Department of Justice “arrested individuals” in 2022.

Some references

The DOJ’s own press release says that the two alleged operators, whose indictment we covered at the time, were arrested in Argentina “at the request of the United States.” The title the paper gives for that press release doesn’t exist either.

Plausible but Inaccurate

These non-existent citations appear plausible, as they cite real publications and organizations in a fitting context. However, that doesn’t mean they are accurate. When we went over the full reference list, we noticed that this applies to more sources.

The paper cites a 2019 Harvard Journal of Law & Technology article by IP law professor Daniel Gervais, titled “The future of intellectual property in the shadow of shadow libraries.” The table of contents of the cited issue doesn’t include it, and the cited pages are taken up by two articles on other topics.

The same applies to a 2019 College & Research Libraries article attributed to Carol Tenopir and colleagues. The cited issue has no article by Tenopir. She did co-author a 2019 article on a similar topic, but it appeared in a different journal, under a different title.

Other references that couldn’t be located include a 2019 article credited to Björn Brembs and articles credited to authors named Smith, Piper, Okike and Aronson, as well as a Kaspersky report on “the hidden dangers of shadow libraries.”

In total, we had trouble finding at least ten of the 44 references in the paper, as well as others that didn’t necessarily back the stated claims.

100% AI?

The obvious question is where these mystery references came from. The paper’s acknowledgements may offer a hint in the right direction, as they mention that AI was used in the research and writing process.

“We confirm that Consensus AI was used in sifting through large volume of literature and extract relevant information,” the authors write. They add that ChatGPT was used to improve the language of parts of the paper.

Acknowledgements

AI chatbots are known to invent references, often with plausible titles credited to real experts in the field. This could explain the findings, although it doesn’t prove that AI wrote these references.

We also ran the paper’s abstract and conclusion through the AI detection tool Pangram. For both sections, the tool reported that “100% of the text is likely AI-generated.” These types of tools are not perfect and can produce false positives, but it would fit the picture.

Pangram’s conclusion

It would be rather ironic if AI caused these errors. It would mean that a paper in a commercial, peer-reviewed journal, published by Taylor & Francis, relied on AI to write about Z-Library. Meanwhile, many rightsholders are suing AI companies for using shadow libraries to train AI models.

Interestingly, the paper explicitly warns that sites such as Z-Library hurt publishers’ revenue, which funds peer review and editing.

“The widespread use of Z-Library poses significant challenges to the sustainability of academic publishing. Publishers rely on subscription fees and paywalls to fund the peer review, editing, and distribution of scholarly works,” it reads, presumably generated by AI as well.

The paper doesn’t mention that peer reviewers generally aren’t paid for their work, an issue that was central to a recent lawsuit against major academic publishers, including Taylor & Francis.

Publisher Investigates

The lead author initially shared a copy of the paper with us, but didn’t answer our follow-up questions about the mysterious references. We also asked Gervais, Brembs and Tenopir whether they wrote the papers that are credited to them, but they didn’t respond either.

Publisher Taylor & Francis did reply and says that it’s looking into the matter.

“I can confirm that this has been referred to our Editorial and Publishing Ethics & Integrity teams, who will investigate the concerns you have raised,” a Taylor & Francis spokesperson informed TorrentFreak.

The publisher will not comment further while the investigation is ongoing. Whether the paper will be corrected or retracted has yet to be seen.

—

The paper “Z-Library and Full-Text Access: Democratizing Knowledge or Undermining Copyright Ethics?” is available here.

Framing the News: Anti-Piracy Press Release Turned a 2016 Raid Into a 2026 Story (2016)

Sun, 25 Oct 2026 08:23:04 +0000

Home > Opinion Articles >

In August, City of London Police and anti-piracy group FACT announced a six and a half year prison sentence for a 68-year-old pirate IPTV operator. Without dates or a service name in the release, some outlets reported it as a recent bust. Records obtained by TorrentFreak show the operation was raided in 2016, the operator pleaded guilty, and the service was called Ex Pat TV.

On August 27, City of London Police published a press release headlined: “Man in his 60s jailed for 6.5 years after making over £980,000 through illegal streaming.”

In the days that followed, this exact framing was repeated throughout many online news articles.

The release came with statements from the Federation Against Copyright Theft (FACT), the Premier League, Sky and BBC Studios. Additionally, FACT published the same release on its own website the next day.

Headlines

City of London Police said that a 68-year-old from Chorley was “found guilty of conspiracy to defraud” at Preston Crown Court. His business ran on 80 servers, sold subscriptions to customers worldwide, particularly British expats, and generated £980,812 “over a three-year period.”

As is often the case with UK enforcement efforts, details are scarce. The official press releases didn’t mention the pirate service at stake, nor did they say anything about when these offenses took place, or what the reasoning of the court was.

Some news reports filled in these blanks themselves. The Mirror, for example, used the following headline: “Massive streaming crackdown blocks more UK homes from watching Sky for free.”

The Mirror reported that a “major closure has taken place after a man behind a popular illegal streaming service was recently arrested.” The server seizure left customers “with nothing more than blank screens,” it added, suggesting that this was a recent action.

The Mirror, September 1

IBC reported that all 80 servers “have now been seized,” and a French site wrote that British justice had “just dismantled” the operation. Meanwhile, BleepingComputer suggested the seized servers “may lead to the identification of users” who could face fines.

After some digging, we can now confirm that this case isn’t recent at all. In fact, the raid on Ibrahim’s operation dates back to 2016, more than a decade ago.

Pleaded Guilty

The release got the three-year period right, but the rest of the picture looks different.

After several emails and a check of our press credentials, Preston Crown Court confirmed that Ibrahim pleaded guilty to two counts. For the indictment, the court referred us to the Crown Prosecution Service (CPS), which also named the service and answered follow-up questions, partly on background.

According to the CPS, Ibrahim pleaded guilty five days into his trial.

A guilty plea sounds different than being “found guilty”. When we asked the City of London Police about the wording in its press release, it said: “The jury did find him guilty but he plead guilty before. The terminology is fine to use for either.”

When a defendant changes his plea after the jury has been sworn in, the jury is typically asked to return a formal guilty verdict. The conviction rests on the plea.

Which Three Years?

The indictment also fills in the dates, revealing that this case is far from new. All three counts run from June 1, 2013 to August 10, 2016.

That end date is the day of a raid. On August 10, 2016, PIPCU searched a business and three homes in Chorley and arrested three men, aged 36, 40 and 58, on suspicion of conspiracy to defraud and money laundering. Ibrahim was 58 at the time. The 2026 release does not mention this raid.

From the indictment

TorrentFreak reported on the raid the next day. At the time, sources already pointed to a Chorley company selling IPTV packages to expats.

The CPS now confirms that the previously unnamed service was “initially known as ‘Ex Pat TV’ and latterly ‘My TV Abroad’.” This rebrand happened before the raid.

With those names, TorrentFreak was able to locate the service’s old website. An archived copy of mytvabroad.com from July 15, 2016, less than four weeks before the raid, carries a banner announcing the switch: “BIG RE-BRAND! Ex-Pat TV is now My TV Abroad.”

My TV Abroad, July 2016

The site promised “live UK channels, anywhere in the world” from £19 per month, with no VPN required. Its footer credits a web designer in Chorley.

That means FACT’s identification of the service, which it highlighted in the release, took place more than a decade ago. That wasn’t mentioned either. There’s more new information too.

From Three Defendants to One

The press release mentions just one defendant, but the indictment names three. In addition to Milan Ibrahim, it lists two other men, who were also charged with conspiracy to defraud copyright holders, through live TV streams, movie streams and satellite decoders supplied to commercial premises.

Milan Ibrahim pleaded guilty to the first two counts but the other two men were not convicted. The Crown did not proceed against either of them. TorrentFreak understands that Milan Ibrahim was seen as the main instigator, and that the case against the other two was resolved as part of his plea. The exact arrangement hasn’t been confirmed.

None of the new information changes the outcome. Ibrahim is serving six and a half years and, according to the police, faces Proceeds of Crime Act proceedings to recover the £980,812. That was all clear from the press release.

For proper news reporting, however, context is key. That the pirate IPTV service, Ex Pat TV or My TV Abroad, was raided a decade ago, and that the sentence followed a guilty plea, are not trivial details. The same is true for the co-defendants, who were part of the same indictment.

Why the police and FACT left these details out is unknown.

—

A copy of the revised indictment in R v Ibrahim and others (Preston Crown Court, T20237377) is available here (pdf). The names of the two co-defendants, who were not convicted, have been redacted.

Top 10 Most Pirated Movies of The Week – 10/26/(2026)

Sun, 25 Oct 2026 23:09:40 +0000

Home > DVDrip >

Every week we take a close look at the most pirated movies on torrent sites. What are pirates downloading? 'Spider-Man: Brand New Day' tops the chart, followed by 'Hope.' 'Project Hail Mary' completes the top three.

The data for our weekly download chart is estimated by TorrentFreak, and is for informational and educational reference only.

Downloading content without permission is copyright infringement. These torrent download statistics are only meant to provide further insight into piracy trends. All data are gathered from public resources.

This week we have three newcomers on the list.

“Spider-Man: Brand New Day” is the most shared title.

The most torrented movies for the week ending on October 26 are:

Movie Rank	Rank last week	Movie name	IMDb Rating / Trailer
Most downloaded movies via torrent sites
1	(1)	Spider-Man: Brand New Day	7.9 / trailer
2	(2)	Hope	6.6 / trailer
3	(8)	Project Hail Mary	8.2 / trailer
4	(9)	Obsession	7.8 / trailer
5	(5)	Runner	6.2 / trailer
6	(10)	Toy Story 5	7.3 / trailer
7	(3)	The End of Oak Street	6.2 / trailer
8	(…)	By Any Means	6.5 / trailer
9	(…)	Tenzing	7.5 / trailer
10	(6)	Matchbox the Movie	5.7 / trailer

Meta Pitches AI Sports Piracy Detector in Notorious Markets Rebuttal

Mon, 26 Oct 2026 08:06:09 +0000

Home > Law and Politics >

Meta informed the U.S. Trade Representative that it built an AI tool to predict whether a live stream is a pirated sports broadcast. The tool is featured in Meta’s rebuttal to this year’s “notorious markets” submissions, which also lists restrictions on Facebook Live. Cloud storage platform Mega, meanwhile, rejects piracy accusations in its rebuttal but acknowledges that its repeat infringer system didn't work properly for months.

Earlier this month, rightsholders sent their annual overviews of “notorious” piracy markets to the U.S. Trade Representative (USTR).

The MPA, RIAA and other groups listed dozens of pirate sites, but online platforms and infrastructure providers were mentioned too. Several of them have now responded with rebuttals of their own.

This includes Meta, whose rebuttal mostly addresses counterfeiting concerns. However, unlike last year, the company also dedicates a section to piracy, much of it focused on unauthorized live streams.

AI-Predicted Pirate Streams

Meta describes a three-pronged response to piracy. It aims to stop infringing content from being posted, remove what gets through, and make the rest harder to find. According to the company, its recent efforts against live streaming piracy show that this approach works.

The most prominent example is a new AI tool that spots pirated sports broadcasts while they are being streamed.

“[I]n 2026, we built and launched an advanced AI enforcement tool that analyzes video content along with additional signals, to predict whether the content is an unauthorized stream of a professional sports broadcast,” Meta writes.

“Based on the prediction results, we can proactively remove this content in real time, before it gains a significant audience, and without a rights holder ever having to intervene.”

AI enforcement

Meta doesn’t share any figures on the AI tool, such as how many streams it removed or which sports events it was used for.

IPTV and Firestick Warnings

The AI tool works alongside changes to Facebook Live. New accounts are not allowed to use Live at all, and most users can only host a limited number of streams at the same time. Accounts that had a live stream blocked are limited in the features they can use.

Meta also limits the distribution of likely infringing live content and has introduced delays, so its anti-piracy measures can take effect before a stream is visible to the public.

Beyond live streams, Meta says that the vast majority of its removals of content promoting illegal streaming devices and services now happen proactively. It also shows warning pop-ups when users search for terms such as “firestick loaded” or “iptv free.” We spotted similar warnings for IPTV searches in 2023.

Pop-ups

Meta isn’t the only company that used its rebuttal to address piracy claims.

Mega’s Suspension System Went Down

Earlier this month, the RIAA listed Mega as a cyberlocker, claiming that it fails to prevent re-uploads of infringing material or deter repeat infringement. Mega responded with a rebuttal on October 20.

The company argues that it is a cloud storage platform, not a cyberlocker. It also points to its repeat infringer policy, under which accounts that receive three strikes within six months are suspended.

However, the filing also acknowledges that this system didn’t always work.

“Because of a technical error, the suspension system did not operate fully in Q4 2024 or at all in Q1 2025,” Mega writes.

Technical error

This isn’t news to those who read Mega’s transparency report, where the outage is disclosed in two footnotes. According to the report, the issue was resolved in early April 2025.

Mega says that rightsholders who report a file can choose to have every copy removed from all accounts that store it, and it encourages the RIAA and its member labels to use this.

Mega is new on this year’s RIAA list. Cloudflare, on the other hand, has been responding to similar claims for a decade.

Groundhog Day, Again

Rightsholder groups have mentioned Cloudflare in their submissions for years, and the company has filed rebuttals since 2016. Last year, we described this back and forth as an anti-piracy Groundhog Day.

This year, Cloudflare makes its main point with the exact same sentence it used last year.

“We firmly believe that the continued use of the Notorious Markets process to pressure Cloudflare and other Internet infrastructure companies into taking actions neither expected nor required by U.S. law is both misguided and a misuse of this vital trade tool,” Cloudflare writes.

Cloudflare Flags Misuse

Other submissions and rebuttals also include repetitive or identical sections, suggesting that many piracy disputes and complaints remain unresolved.

The USTR will now review the original submissions and these and other rebuttals, to decide what warrants a mention. Its final list of notorious markets is expected to come out early next year.

—

Meta’s rebuttal is available here (pdf), Mega’s rebuttal can be found here (pdf), and Cloudflare’s response is here (pdf).

Judge Allows Google, Yahoo and Microsoft Subpoenas to Identify Gay-Torrents Users

Tue, 27 Oct 2026 07:18:00 +0000

Home > Piracy >

FlavaWorks can subpoena Google, Yahoo, Microsoft and three other companies to identify staff and members of the defunct BitTorrent site Gay-Torrents.org, an Illinois federal court ruled. Instead of starting from IP addresses, the subpoenas target the email accounts that are linked to their tracker profiles. How FlavaWorks obtained those email addresses remains unclear.

Earlier this year, adult entertainment company FlavaWorks sued the operators and hundreds of users of private torrent tracker Gay-Torrents.org.

The lawsuit had an immediate effect, as the tracker went offline shortly after. In an amended complaint, FlavaWorks later narrowed its list of targeted users from 325 to 39.

Several of the site’s administrators and most of the targeted members are still listed as anonymous John Does. To change that, FlavaWorks asked the court for permission to subpoena their email providers. In an October 14 order, U.S. District Judge John Robert Blakey granted this request in part.

Subpoenas Target Google, Yahoo, Microsoft

The order allows FlavaWorks to subpoena Google, Yahoo, Microsoft, AT&T, Cloudflare and Newfold Digital. Each subpoena is limited to the email addresses or domains of defendants linked to that provider.

The targeted services are asked to hand over the subscriber’s name, mailing address and phone number, as well as any secondary, recovery or two-factor authentication email addresses. FlavaWorks can also request the most recent IP address that was used to access each account, covering the period from January 2025 onward.

The order

The judge didn’t give FlavaWorks carte blanche. The company also asked for the billing names and addresses on file with the email providers, and for a subpoena to payment processor Stripe to identify the people behind a Bulgarian company linked to the site. The order includes neither.

An IP Address Is Not a Person

Subpoenas targeting email providers are not common in torrent-related lawsuits. Rightsholders typically collect IP addresses from torrent swarms and ask Internet providers to identify the account holders. FlavaWorks says it has IP address data for the defendants too, but it chose to go after their email accounts instead, bypassing the more common ISP route.

As justification, FlavaWorks mentions an argument that’s usually reserved for defendants, stating that an IP address is not a person.

“But an IP address identifies an Internet subscription, not a person: it resolves to whoever pays the bill for a household, an office, a university network, or a shared carrier-grade address pool, and it can be masked by a VPN,” FlavaWorks writes.

Not a person

An email address, the company argues, is personal to the account holder, which should help to identify the defendants.

According to the exhibit filed with the motion, 22 defendants are linked to Gmail addresses, nine to Yahoo, three to Hotmail and one to an AT&T address. Two others use private domains, registered through Cloudflare and Bluehost, a Newfold Digital company.

Email providers

This list of targets isn’t limited to regular members. Several of the site’s administrators are on it as well, identified by Gmail, Yahoo and Hotmail addresses. One other administrator, who used a ProtonMail address, was left out, as the Swiss company is beyond the reach of a U.S. subpoena.

Tracker Users Can Still Object

The new order doesn’t mean that the data will be handed over right away. It explicitly allows the defendants and the providers to move to quash the subpoenas.

Google, for example, has pushed back before. In February, we reported that the company raised First Amendment concerns over a similar FlavaWorks subpoena targeting users of another private tracker.

However, in a July filing, FlavaWorks said that Google produced subscriber data in that case in April. Whether that covered all the targeted Gmail accounts is not mentioned. FlavaWorks adds that the tech giant handed over the same type of information in an earlier case, without objection.

Insider Knowledge?

For FlavaWorks, the subpoenas are meant to confirm its existing suspicions. The member defendants in this case were selected because the email address on their tracker account matched an account on one of FlavaWorks’ own sites.

In a September status report, the company said that its own records already point to a probable identity for many of them. It doesn’t want to name anyone publicly, however, before the email providers confirm who is behind each account.

How FlavaWorks obtained the email addresses in the first place is still a mystery. On an invite-only tracker, this information is typically only visible to staff. The court filings don’t offer a direct answer but cite the company’s own records and “investigation” without going into detail.

The September status report, which we haven’t seen reported anywhere, shows that FlavaWorks has help, presumably from an insider.

“Plaintiff has also obtained the cooperation of an individual with direct knowledge of the Site’s operation,” it reads.

Direct knowledge

The report doesn’t say when this cooperation started, or whether this person is the source of the email addresses. That said, FlavaWorks expects that this cooperation can help identify the operators, as well as other users who shared its works or funded the site.

Some defendants are already settling. FlavaWorks notes that several members resolved the claims before they were named. Additionally, in its separate RICO lawsuit against 75 members, one John Doe agreed to pay an undisclosed settlement amount in installments.

For now, the account holders and the subpoenaed companies can still ask the court to quash the subpoenas, but the docket shows no movement on that front yet.

—

A copy of Judge Blakey’s order is available here (pdf). FlavaWorks’ renewed motion for expedited discovery, with the defendant-to-provider table, can be found here (pdf), and the September status report is available here (pdf). FlavaWorks’ July discovery motion, which mentions Google’s earlier productions, can be found here (pdf).

Streamed, the Live Sports Engine Behind Many Pirate Sites, Shuts Down

Tue, 27 Oct 2026 11:34:42 +0000

Home > Piracy >

Live sports piracy service Streamed, which offered streams to many pirate sites, has surprisingly shut down. Its operators posted a brief farewell message without further detail, pointing visitors to five alternative sites. Earlier this month, the MPA marked the service as a growing threat in its submission to the U.S. Trade Representative.

Pirate sports streaming sites come and go, but there are a few services that have played a more central and stable role.

These “Piracy-as-a-Service” providers offer ready-made video players that other sites can embed. This allows new pirate sites to launch live sports coverage without hosting any streams themselves.

Streamed was one of these providers. The platform focused on live sports and was used as the backbone by many other sites. However, its homepage now suggests that this has come to an abrupt end.

“We are no longer operating Streamed. Thank you for the support over the years,” the message reads.

Streamed closure

The operators don’t explain why they decided to pull the plug.

Pointing to Rivals

The notice isn’t limited to streamed.pk. The strmd.link domain redirects to the closure page and streamed.st shows the same message.

Instead of simply going dark, the operators offer some advice to former users. They list five alternative sports streaming sites, each with a short description of its niche. This includes ppv.st, pitsport.st and thedaddy.pk. The latter has “lots of ads” according to the recommendation.

The shutdown of Streamed is significant as it affects dozens of sites at once. It was also seen as a notorious piracy threat by the Motion Picture Association.

The MPA previously mentioned Mapple as one of the sites that relied on Streamed. At the time of writing, some of its sports streams return a 404 error.

404

A Growing Threat

Earlier this month, the MPA listed Streamed in its annual overview of notorious piracy markets, which it sent to the U.S. Trade Representative. The movie industry group described it as a “Piracy-as-a-Service” provider that keeps growing.

Citing Similarweb data, the MPA said that around 30 pirate sites used Streamed in July, with a combined 463 million visits. A year earlier, it counted 29 sites with 134 million visits.

According to the MPA, a significant number of the sites relying on Streamed are so-called “hydra sites,” one-stop piracy portals such as HydraHD, Rivestream, StreamEX and Mapple. Cineby is listed as an example too, although it has since shut down.

“None of the sites Streamed services host live content themselves; all traffic flows through Streamed as the PaaS, which relies entirely on its own infrastructure,” the MPA writes.

MPA on Streamed

The MPA’s data covers the sites that used the Streamed embed. The streamed.pk domain itself also received 19.76 million visits in September according to Similarweb, 56% more than the month before. Nearly half of these visits came from the United States, followed by Canada and the UK.

But Why?

Streamed’s farewell message doesn’t mention any enforcement action. There is also no seizure banner and neither the MPA nor the Alliance for Creativity and Entertainment (ACE) thave said anything so far.

That doesn’t rule out any external involvement, however. In its submission, the MPA took credit for the shutdowns of Cineby and AnimeFLV. These sites didn’t mention an anti-piracy action when they went down, and no group claimed it at the time.

That said, since the closure message openly promotes other pirate streaming sites, it seems unlikely that the shutdown was part of a settlement or another agreement with Hollywood.

—

We reached out to the MPA and ACE for a comment on the shutdown, but they did not respond before publication.

Accused Impostor in Private Tracker Lawsuit Faces Contempt for Withholding Passport

Wed, 28 Oct 2026 08:07:36 +0000

Home > Lawsuits >

The alleged impostor behind a lawsuit against several private torrent trackers now faces a request to hold him in civil contempt. According to the defense, he missed a deadline to hand over his passport, driver’s license, and Copyright Office paperwork. Meanwhile, the defense’s proposed discovery has blanks the missing documents were meant to fill, in addition to a subpoena for his PACER IP addresses, and requests for any AI prompts.

Last year, we reported that a filmmaker named Matthew Schneider obtained a DMCA subpoena through a California federal court, seeking information from Cloudflare on several prominent private trackers.

These trackers, including PassThePopcorn, BroadcasTheNet, Karagarga, HDBits, and Beyond-HD, allegedly shared several of his works without permission.

A few months later, the same operators were sued in an Illinois federal court. That case took a turn when defense attorneys presented evidence that the plaintiff may be an impostor, and last month the person litigating as Matthew Schneider dropped the lawsuit.

That isn’t the end of it though, as Judge Andrea R. Wood kept jurisdiction over the pending sanctions request. Before any sanctions can follow, the defense wants the court to verify the identity of the plaintiff.

At a September hearing, the man said that Matthew Schneider is his legal name and that he lives in London. In response, the court requested official paperwork to back that up.

Passport, License, Copyright Application

Judge Wood had ordered the October 2 status hearing to take place by videoconference, but the plaintiff joined by phone, noting that he had technical difficulties.

At the hearing, the judge directed him to email the courtroom deputy copies of his driver’s license, his passport, and documentation of his application to the U.S. Copyright Office by October 9.

The documents would be filed under seal and shared with the parties under a protective order. However, the deadline seemingly passed without a response.

On October 14, the plaintiff asked the court if he could share a single “independently certified and apostilled” UK government photo ID instead, to be examined by the judge alone with no access for the defense.

These privacy restrictions are warranted, he argues, citing UK data protection law. Once his government ID is exposed, he adds, that can’t be undone.

“Once opposing counsel receives Plaintiff’s sensitive government-issued identification and residential information, the resulting loss of confidentiality cannot meaningfully be reversed,” the motion reads.

‘In lieu of producing both a passport and driving licence’

If the court refuses to restrict the disclosure, he asks for a temporary stay so he can seek appellate review. The motion does not mention the Copyright Office records, however, which as far as the defense knows haven’t been shared either.

‘This Is Plaintiff’s Design’

Two days later, Erin Russell, who represents Doe 1, asked Judge Wood to order the plaintiff to explain why he shouldn’t be held in civil contempt. According to the motion, he had agreed on the record to hand over the documents.

Russell isn’t asking for punishment, at least not yet. She wants a sworn statement on what was sent and when, followed by an in-person hearing.

The identity question is more than a formality. As Russell told the court in September, any sanctions award would be uncollectible unless the court first establishes who the plaintiff actually is.

In a filing last week, Doe 1 went a step further. “Plaintiff’s refusal to produce his passport and driving license hinders the discovery plan agreed to by the parties on October 2, 2026. Defendants do not know Plaintiff’s true identity,” it reads.

The plaintiff already made it clear that he will appeal if his motion is denied, which would drag this case further along. According to Doe 1’s filing, this is no accident.

“This interference with the discovery schedule is not incidental. This is Plaintiff’s design.”

Plaintiff’s design

Blanks to Fill

In last week’s filing, Doe 1 shared its proposed discovery requests and subpoenas. Doe #10, identified in its own filing as Usenet indexer omgwtfnzbs.org, submitted a similar filing. Both are incomplete, as the defense doesn’t have the identity documents.

Doe #10 had planned to tailor its requests to the passport, license, and copyright paperwork. Without them, it switched to placeholders such as “Admit that Your legal name is [insert legal name on passport].”

Placeholders

The proposed subpoenas target Google for the plaintiff’s Gmail account, the carrier of his phone number, and the mailbox provider or landlord for his Sanborn, New York address. From the latter, Doe 1 seeks billing records, payment methods, and the addresses to which his mail is “allegedly forwarded.”

Doe 1 also wants the PACER Service Center to hand over the IP addresses the plaintiff used to access the court’s website.

The defendants are also measuring their own exposure. Both Does ask for “all documents, data, and other materials” he received from the companies he subpoenaed since August 2025.

According to the filings, that includes materials Cloudflare produced in response to the California DMCA subpoena. The exhibit they cite, which the plaintiff filed in February, is currently sealed.

Previously, Doe 1’s attorney suggested that the person behind the lawsuit had been banned from the trackers and “bears ill will” over it, hinting at a retaliatory motive.

Was ‘Do Us Part’ Made With AI?

The last set of questions deals with “Do Us Part,” one of three films the plaintiff says he made in the UK. After being ordered by the court, he submitted his version of the film in September. According to his motion, the evidence “directly refuted” the claim that his film is the Canadian production.

His film was allegedly created more than 14 years ago, but the defense appears to doubt this. They ask the plaintiff to admit that the submission “was generated, in whole or in part, using GenAI.”

GenAI

They also want the original file, all raw footage, and “all prompts, outputs, project files, account records, and activity logs” for any use of AI.

All parties can still file objections to the discovery requests and they are scheduled to meet again at a video hearing on November 17. This time, the court has directed the plaintiff to test his video capabilities before it starts.

—

The plaintiff’s motion to modify the ID order is available here (pdf). Doe 1’s contempt motion is here (pdf). The proposed discovery requests from Doe 1 and Doe #10 can be found here (pdf) and here (pdf).

Chile Blocks 1,954 Pirate TV URLs to Protect Citizens’ ‘Privacy and Personal Data’ (1954)

Thu, 29 Oct 2026 07:25:28 +0000

Home > Anti-Piracy > Site Blocking >

Chile's telecoms regulator Subtel reports that local ISPs blocked 1,954 pirate streaming URLs between June and October. The blocks are part of a court order obtained by Warner Bros., but Subtel presents them as a data protection measure. Meanwhile, the piracy problem persists as several of the targeted brands remain just a search away.

Early this year, a Santiago court sided with Warner Bros. in its fight against MagisTV, FlujoTV, and XuperTV, three popular Latin American pirate streaming brands.

The 19th Civil Court of Santiago ordered all variants of these services to be blocked and instructed telecoms regulator Subtel to notify the country’s Internet providers. Subtel sent these blocking orders in January, and Warner later followed up with a criminal complaint against a local IPTV operator.

This week, new info released by Subtel shows that these initial blocking measures were just the beginning, as the blocking campaign continues to expand.

According to the regulator, the ISPs GTD, DirecTV, Entel, WOM, Mundo, ClaroVTR, Netline, and Movistar have now blocked a total of 1,954 URLs linked to illegal IPTV services. These blocklist updates come in batches, which come in regularly.

URLs blocked per month

Month	URLs	Share
June	221
July	180
August	469
September	319
October	765
Total	1,954

The blocked domains are not limited to MagisTV, FlujoTV, and XuperTV. Subtel also lists Cuevana, Oleada TV, Stella TV, TeleLatino, PelisPlus, Cinecalidad, and Fútbol Libre, as well as their variants and mirror sites.

Subtel’s announcement came shortly after Chilean police arrested 16 people linked to the pirate IPTV services UltraIPTV and MegaIPTV, in a separate criminal investigation.

A Matter of Data Protection

Subtel’s announcement doesn’t lead with copyright. Its headline puts digital security and data protection first, and the regulator says the procedure aims to protect citizens’ privacy and personal data.

Digital safety first (translated)

Subtel warns that these unauthorized streaming platforms can collect sensitive data from users, leaving them exposed to cybercrime, data theft, and financial fraud.

“By installing these informal apps, users expose their bank passwords, personal data, and devices to hacks and scams, without any kind of support or protection,” says Undersecretary of Telecommunications Romina Garrido (translated).

“When using a pirate app or site, users hand over the key to their personal data to unknown organizations,” Garrido adds.

The data protection argument isn’t new. Warner’s own legal action argued that the pirate platforms put users’ personal data at risk, local media reported in February.

Garrido also points users to legal alternatives. “With these blocks, we break the chain of cybercrime and promote a legal offering that actually guarantees data protection and support, such as the one offered by Chile’s formal telecommunications industry,” she says.

MagisTV and Beyond

While the court order serves as the legal basis for the blocks, the original ruling only named MagisTV, FlujoTV, and XuperTV, according to reports at the time. Since then, the piracy blocklist has expanded considerably.

According to La Tercera, other pirate TV sites were added based on an interpretation of the ruling. Subtel, the Public Prosecutor’s Office, Warner, and the Alliance Against Digital Piracy then agreed on a protocol to decide which sites should be blocked.

Subtel’s monthly figures start in June, months after the regulator notified ISPs in January. The regulator didn’t explain the gap, but it’s possible that the protocol took some time to put in place.

In practice, the anti-piracy Alliance puts together the lists of URLs, IP addresses, and domains. Subtel then forwards these to the ISPs, which implement the blocks nationwide.

The order itself is quite broad. According to Emol, it covers all variants of the three brands, including any domain, subdomain, IP address, link, redirect, or mirror site that reproduces audiovisual content, wholly or partially, without authorization.

Whac-El-Topo

Despite the growing list, the blocking efforts haven’t stopped piracy. BioBioChile found that several of the targeted sites are still online.

Our own search shows that alternatives and copycats remain easy to find as well, including sites that use the popular Cuevana, Fútbol Libre, and MagisTV brands.

MagisTV search

As shown earlier, October is the busiest month so far, with 765 blocked URLs and several days still to go. That number will likely rise further as the game of whac-a-mole continues.