Kickass Torrents: How did the US Government Bring Down the File-sharing Site?

By Soko Directory Team / July 21, 2016 | 11:42 am




Until today, Kickass Torrents (KAT) was one of the most visited websites on the internet and brought in tens of millions of dollars a year in advertising.

Now, the website is no more.

It has disappeared from the internet and its 30-year-old alleged founder and operator, Ukranian Artem Vaulin, has been arrested and is facing extradition to the United States.

The domain names KAT used — and there are several — are in the process of being seized by the US Government.

It was the result of years of investigation by Jared Der-Yeghiayan, a special agent with the US Department of Homeland Security.

While he is not exactly a household name, he is the same investigator who brought down Ross Ulbricht, the person behind the infamous online drug marketplace, Silk Road.

The investigation was done both online and in meat space (the real world), and was a mixture of old-school police work and top-of-the-line digital forensics.

Mr Der-Yeghiayan laid out his evidence in the criminal complaint, filed to the US District Court of Illinois.

Here is how he tied Artem Vaulin to KAT:

Follow the (advertising) money

KAT sold adverts around its pirated content, and it is estimated the revenue brought in around $17 million a year.

It was that need to make money that opened KAT up for infiltration.

In late 2015, an uncover agent — known as UC-1 — who worked for the US Internal Revenue Service (IRS) emailed KAT to enquire about advertising on the site.

The undercover agent said the advert was for a US study program and they were after an ad run of five days.

KAT said it would cost $300 a day to run the advert, with a total cost of $1,500.

Nearly a month after the initial enquiry, a KAT representative provided the agent with banking information to transfer the money for the advertising deal.

The bank account was in Latvia, in the name of “GA Star Trading”.

A few months later, the IRS transferred the money and the ad went live.

The IRS tried to organise a few more ad campaigns, and was given bank accounts in Estonia, as well as a Russian payment system, but the Latvian account had already given the US Government a way in.

With that information, agents requested the account holder information under the Mutual Legal Assistance Treaty (MLAT).

It is a set of agreements between countries to share and swap information with the aim of enforcing various laws.

The agents discovered the account had received 28,411,357 euros in deposits from August 2015 and March 2016.

Watch those server logs

Following the money revealed the scale of the operation, but Mr Der-Yeghiayan needed more.

He had been keeping an eye on KAT for years and at some point managed to identify two IP addresses of servers in Chicago.

The Chicago hosting company provided evidence that the servers had previously been tied to a known KAT domain name (kat.ph), and the IP addresses had been held by the person owning the servers for years.

In January 2016, investigators went in and took a forensic copy of the server for analysis, which revealed domain names again pointing to known KAT addresses.

The servers also contained files and access logs, and had user accounts called “Nike” — a username that Mr Vaulin had previously been known to use when instant messaging.

The US Feds connect the dots

With records from some of the world’s largest tech firms like Apple, Facebook and Google, it does not appear to have been particularly difficult to connect the dots.

At a point in the investigation, Mr Der-Yeghiayan worked out the Apple-run email address tirm@me.com belonged to Artem Vaulin.

That email address was the linchpin in the case:

  • The username “tirm” was known as the administrator of KAT
  • Investigators discovered the email had made a purchase on iTunes using the IP address 109.86.226.203
  • They cross referenced the IP address with the social media site Facebook and found that someone had logged into KAT’s account with the same IP address that day
  • They found emails from known KAT domains in the email inbox
  • They found bug reports referencing the KAT website and feature requests, which were tasked to “Artem Vaulin”
  • The investigators found emails from KAT employees asking what to do about a copyright takedown request, with the subject line being: Ignore? The reply from Mr Vaulin was “of course”
  • They also found a series of test emails from admin@kat.ph and admin@kickasstorrents.com to the tirm@me.com account

Financially linking Vaulin to Kickass Torrents

The first clue was via an email in 2010, which predated the 2012 switch to using an internal KAT email system.

A second clue came via KAT’s donation system, which allowed users to donate Bitcoin to an address maintained by a company called Coinbase.

And who did that Coinbase account belonged to? An “Artem Vaulin” of Ukraine. The backup email was tirm@me.com.

Finally, there was the job of linking the GA Star Trading account — which had received more than 28 million euros in seven months — to Mr Vaulin’s Apple account.

Mr Der-Yeghiayan found connections to the Latvian GA Star Trading account in Mr Vaulin’s email account.

GA Star Trading’s bank account had received deposits in the hundreds of thousands of euros from a company called Castleton Trading, which was a shell company holding a 1/4 share in another company called Bitcoin Innovations Ltd.

The criminal complaint alleges that Mr Vaulin himself has the controlling interest in Bitcoin Innovations Ltd.


More info on Kickass Torrents

  • A BitTorrent is a file distribution system used to transfer large files over the internet, such as music and movies
  • KAT distributed films, video games, television programs, music and other electronic media
  • It was estimated to be the 69th most frequently visited website on the internet, according to the US Justice Department
  • The website moved its domains several times after being blocked in Britain, Ireland, Italy, Denmark, Belgium and Malaysia

This article has been reposted from ABC News.





About Soko Directory Team

Soko Directory is a Financial and Markets digital portal that tracks brands, listed firms on the NSE, SMEs and trend setters in the markets eco-system.Find us on Facebook: facebook.com/SokoDirectory and on Twitter: twitter.com/SokoDirectory

View other posts by Soko Directory Team


More Articles From This Author







Trending Stories










Other Related Articles










SOKO DIRECTORY & FINANCIAL GUIDE



ARCHIVES

2020
  • January 2020 (272)
  • February 2020 (310)
  • March 2020 (390)
  • April 2020 (322)
  • May 2020 (336)
  • June 2020 (67)
  • 2019
  • January 2019 (253)
  • February 2019 (216)
  • March 2019 (285)
  • April 2019 (254)
  • May 2019 (272)
  • June 2019 (251)
  • July 2019 (338)
  • August 2019 (293)
  • September 2019 (306)
  • October 2019 (313)
  • November 2019 (362)
  • December 2019 (320)
  • 2018
  • January 2018 (291)
  • February 2018 (219)
  • March 2018 (278)
  • April 2018 (225)
  • May 2018 (238)
  • June 2018 (178)
  • July 2018 (256)
  • August 2018 (249)
  • September 2018 (256)
  • October 2018 (287)
  • November 2018 (284)
  • December 2018 (185)
  • 2017
  • January 2017 (183)
  • February 2017 (194)
  • March 2017 (207)
  • April 2017 (104)
  • May 2017 (169)
  • June 2017 (205)
  • July 2017 (190)
  • August 2017 (195)
  • September 2017 (186)
  • October 2017 (235)
  • November 2017 (253)
  • December 2017 (266)
  • 2016
  • January 2016 (165)
  • February 2016 (165)
  • March 2016 (190)
  • April 2016 (143)
  • May 2016 (245)
  • June 2016 (182)
  • July 2016 (271)
  • August 2016 (248)
  • September 2016 (234)
  • October 2016 (191)
  • November 2016 (243)
  • December 2016 (153)
  • 2015
  • January 2015 (1)
  • February 2015 (4)
  • March 2015 (166)
  • April 2015 (108)
  • May 2015 (116)
  • June 2015 (120)
  • July 2015 (148)
  • August 2015 (157)
  • September 2015 (188)
  • October 2015 (169)
  • November 2015 (173)
  • December 2015 (207)
  • 2014
  • March 2014 (2)
  • 2013
  • March 2013 (10)
  • June 2013 (1)
  • 2012
  • March 2012 (7)
  • April 2012 (15)
  • May 2012 (1)
  • July 2012 (1)
  • August 2012 (4)
  • October 2012 (2)
  • November 2012 (2)
  • December 2012 (1)
  • 2011
    2010
    2009
    2008
    2007
    2006
    2005
    2004
    2003
    2002
    2001
    2000
    1999
    1998
    1997
    1996
    1995
    1994
    1993
    1992
    1991
    1990
    1989
    1988
    1987
    1986
    1985
    1984
    1983
    1982
    1981
    1980
    1979
    1978
    1977
    1976
    1975
    1974
    1973
    1972
    1971
    1970
    1969
    1968
    1967
    1966
    1965
    1964
    1963
    1962
    1961
    1960
    1959
    1958
    1957
    1956
    1955
    1954
    1953
    1952
    1951
    1950