MPA/ACE Attempt to Hunt Down Pirate Site Operators via US Court

When launching an investigation into a pirate site there are many publicly available sources that can be trawled for information.

No matter how detailed the findings, however, nothing beats knowing the name and address of a pirate site operator. With this information to hand a number of options become available, from straightforward legal threats to full-blown lawsuits. As a result, most site operators closely guard their identities but others can make crucial mistakes or leave useful crumbs behind.

These trails can sometimes be found at third-party service providers. Domain registries can be useful since domain owners are required to give up their real names, at least in theory anyway. Platforms such as Cloudflare may also carry useful intelligence and a recent case involving pirate index Mangabank shows that the company does indeed hold a lot of information about its customers.

MPA/ACE Seeks Info From TONIC

The Motion Picture Association and anti-piracy partner Alliance for Creativity and Entertainment are no strangers to gathering information in this manner. After many similar requests in recent years, this week they were back in a California court seeking to compel domain registry TONIC to give up the identities of many of its customers.

One of the most visible targets in the first request is long-standing torrent giant rarbg.to, one of the most resilient (and reliable) pirate sites online today. According to SimilarWeb stats the site enjoys more than 60 million visits per month and as a result the MPA wants the TONIC registry to hand over the details of its owner.

Another big target is moviesjoy.to, a streaming site with around 20 million visits per month. Next in popularity (in traffic terms) is freefilm.to, an 8.5 million visitor film streaming platform that is very popular in the Czech Republic. The same can be said for TV streaming platform freeserial.to, where Czech visitors make up the majority of its 3 million visits every month.

Showing the global reach of the MPA/ACE, they are also seeking the identity of the owner of kisstvshow.to, a 6.3 million visit per month TV show site that is popular in Indonesia and the Philippines. The list is completed with requests to unmask those behind several other streaming sites including yesmovies.to, nox.to and kinomax.to (both popular in Germany) and ymovies.to, which is popular in the US, UK and Canada.

The second DMCA subpoena targeting TONIC references a single domain – watchhd.to. This IPTV supplier has been in operation for a number of years with many using its dedicated Kodi addon to access the service. It carries a wide variety of content with a focus on sport but also has a VOD service that reportedly carries more than 4,000 movies and TV shows.

The final subpoena again lists just one domain – oha.to – which isn’t a pirate site, at least in the traditional sense.

To appreciate the importance of this domain one has to look towards the popular ‘Watched’ streaming app that at one point entered the top 30 most popular entertainment apps on Apple’s App Store. Watched is also available on various other operating systems but needs a ‘bundle’ to be installed to make it a functional pirate tool, which is where Oha! (available at oha.to) comes in.

Earlier this year, MPA/ACE went to court in the United States to have Cloudflare hand over information about the owner of oha.to. Whether that was useful or not is unknown but they are now pressing TONIC for information about the domain owner. Hollywood clearly wants this operation shut down.

Whether this trio of subpoenas will bear any fruit will remain to be seen but TONIC is already under scrutiny in the US after being called out by the MPA as a “notorious market” in a submission to the USTR. It’s a characterization the registry fiercely rejects but the diplomatic pressure may yet prove to be a factor.

MPA/ACE Seeks Info From Cloudflare

The final pair of DMCA subpoenas target Cloudflare and more than two dozen of its customers. Several of these (freefilm.to, freeserial.to, nox.to, kisstvshow.to) appear in the subpoenas to TONIC but there are many others too.

They include major streaming site primewire.ag (20 million visits), Chinese streaming site ifsp.tv (15.7m), and Italy-focused supervideo.tv (3.6m).

Also included is egy.best. In 2019 the site announced its shutdown but it is now back up and pulling in more than 15 million visits per month, mostly from Saudi Arabia, Egypt and Morocco. The site was also called out recently by the MPA in its ‘notorious markets’ submission to the USTR.

The rest of the domains in the third MPA/ACE subpoena against Cloudflare are as follows: obniv.com, hd-world.cc, pelis-online.net, 7movierulz.vc, extramovies.camp, sendfox.org, ogladaj.to, 94itv.app, imybinoo.net, extrabb.com, wavob.com, vagdi.com, bovmi.com, kissasian.sh, phimmoizz.net, unblockit.app and vod.phimmoicdn.net

The final application against Cloudflare targets a pair of pirate IPTV sellers/suppliers. They are named as iptvsubscription.tv and webestreams.com. The documentation lists ‘backend’ URLs which suggests the MPA/ACE is interested in their VOD offerings.

Copies of all five DMCA subpoena applications can be found here (1,2,3,4,5 pdf)