Feds Seize KickassTorrents Domains, Arrest Owner

[Carjacker]

They should have arrested most of those wanker shits with titles like 'Super User', instead of the owner...most are just a bunch of useless twats ass kissing higher ups and being little PC cunts. I don't want to see the site go down, but with their history of DMCA 'compliance', bad site security (especially their SSL config, which was half assed), ranking thousands of mostly useless scumbags as Mods, SU's and other feel-good titles being handed out like candy, it's no wonder they lived a fugitive, constantly on-the-run existence which ended this way it has today.

[LZA]

They should have arrested most of those wanker shits with titles like 'Super User', instead of the owner...most are just a bunch of useless twats ass kissing higher ups and being little PC cunts. I don't want to see the site go down, but with their history of DMCA 'compliance', bad site security (especially their SSL config, which was half assed), ranking thousands of mostly useless scumbags as Mods, SU's and other feel-good titles being handed out like candy, it's no wonder they lived a fugitive, constantly on-the-run existence which ended this way it has today.

I've used KAT a a few times, not as much as TPB, and never really got into the forums there. The gist I get is most people agree with your opinion about the posters there and the politics... Not all after this happened, but over time I've read the complaints.

YA, my new computer wasn't letting gme get there because Firefox said the security sucked...

I think KAT will go through what TPB did a few months ago... They'll be back. I'm confident of this. JMHO

[arcvector]

Any backup torrent sites? Or better yet, any torrents sites that's only on TOR or I2P?

[ravarage]

I was well known there even I upload my torrent to here and 1337 but nothing were like kat even with huge DMCA take down I hope they have backup plan like pirate bay and comeback soon

[Ernesto]

Founded in 2009, KickassTorrents (KAT) grew out to become the largest torrent site on the Internet with millions of visitors a day.

As a result, copyright holders and law enforcement have taken aim at the site in recent years. This resulted in several ISP blockades around the world, but yesterday the big hit came when the site’s alleged founder was arrested in Poland.

Soon after the news was made public KAT disappeared, leaving its users without their favorite site. The question that’s on many people’s minds right now is whether the site will make a Pirate Bay-style comeback.

While it’s impossible to answer this question with certainty, the odds can be more carefully weighed by taking a closer look at the events that led up to the bust and what may follow.

First off, KickassTorrents is now down across all the site’s official domain names. This downtime seems to be voluntary in part, as the authorities haven’t seized the servers. Also, several domains are still in the hands of the KAT-team.

That said, the criminal complaint filed in the U.S. District Court in Chicago does reveal that KAT has been heavily compromised (pdf).

According to the feds, Artem Vaulin, a 30-year-old from Ukraine, is the key player behind the site. Over the years, he obfuscated his connections to the site, but several security holes eventually revealed his identity.

With help from several companies in the United States and abroad, Homeland Security Investigations (HSI) agent Jared Der-Yeghiayan identifies the Ukrainian as the driving force behind the site.

The oldest traces to Vaulin are the WHOIS records for various domains, registered in his name early 2009.

“A review of historical Whois information for KAT….identified that it was registered on or about January 19, 2009, to Artem Vaulin with an address located in Kharkiv, Ukraine,” the affidavit reads.

This matches with records obtained from domain registrar GoDaddy, which indicate that Vaulin purchased three KAT-related domain names around the same time.

The agent further uncovered that the alleged KAT founder used an email address with the nickname “tirm.” The same name was listed as KAT’s “owner” on the site’s “People” page in the early days, but was eventually removed in 2011.

Tirm on KAT’s people page

The HSI agent also looked at several messages posted on KAT, which suggest that “tirm” was actively involved in operating the site.

“As part of this investigation, I also reviewed historical messages posted by tirm, KAT’s purported ‘Owner.’ These postings and others indicate that tirm was actively engaged in the early running of KAT in addition to being listed as an administrator and the website’s owner,” the HSI agent writes.

Assisted by Apple and Facebook the feds were then able to strengthen the link between Vaulin, tirm, and his involvement in the site.

Facebook, for example, handed over IP-address logs from the KAT fanpage. With help from Apple, the investigator was then able to cross-reference this with an IP-address Vaulin used for an iTunes transaction.

“Records provided by Apple showed that [email protected] conducted an iTunes transaction using IP Address 109.86.226.203 on or about July 31, 2015. The same IP Address was used on the same day to login into the KAT Facebook Account.”

In addition, Apple appears to have handed over private email conversations which reference KAT, dating back several years. These emails also mention a “kickasstorrent payment,” which is believed to be revenue related.

“I identified a number of emails in the [email protected] account relating to Vaulin’s operation of KAT. In particular, between on or about June 8, 2010, and on or about September 3, 2010,” the HSI agent writes.

More recent records show that an IP-address linked to KAT’s Facebook page was also used to access Vaulin’s Coinbase account, suggesting that the Bitcoin wallet also assisted in the investigation.

“Notably, IP address 78.108.178.77 accessed the KAT Facebook Account about a dozen times in September and October 2015. This same IP Address was used to login to Vaulin’s Coinbase account 47 times between on or about January 28, 2014, through on or about November 13, 2014.”

As for the business side, the complaint mentions a variety of ad payments, suggesting that KAT made over a dozen million dollars in revenue per year.

It also identifies the company Cryptoneat as KAT’s front. The Cryptoneat.com domain was registered by Vaulin and LinkedIn lists several employees of the company who were involved in the early development of the site.

“Many of the employees found on LinkedIn who present themselves as working for Cryptoneat are the same employees who received assignments from Vaulin in the KAT alert emails,” the complaint reads.

Interestingly, none of the other employees are identified or charged.

To gather further information on the money side, the feds also orchestrated an undercover operation where they posed as an advertiser. This revealed details of several bank accounts, with one receiving over $28 million in just eight months.

“Those records reflect that the Subject Account received a total of approximately €28,411,357 in deposits between on or about August 28, 2015, and on or about March 10, 2016.”

Bank account

Finally, and crucially, the investigators issued a warrant directed at the Canadian webhost of KickassTorrents. This was one of the biggest scores as it provided them with full copies of KAT’s hard drives, including the email server.

“I observed […] that they were all running the same Linux Gentoo operating system, and that they contained files with user information, SSH access logs, and other information, including a file titled ‘passwd’ located in the ‘etc’ directory,” the HSI agent writes.

“I also located numerous files associated with KAT, including directories and logs associated to their name servers, emails and other files,” he adds.

Considering all the information U.S. law enforcement has in its possession, it’s doubtful that KAT will resume its old operation anytime soon.

Technically it won’t be hard to orchestrate a Pirate Bay-style comeback, as there are probably some backups available. However, now that the site has been heavily compromised and an ongoing criminal investigation is underway, it would be a risky endeavor.

Similarly, uploaders and users may also worry about what information the authorities have in their possession. The complaint cites private messages that were sent through KAT, suggesting that the authorities have access to a significant amount of data.

While regular users are unlikely to be targeted, the information may provide useful for future investigations into large-scale uploaders. More clarity on this, the site’s future, and what it means for the torrent ecosystem, is expected to become evident when the dust settles.

Source: TF, for the latest info on copyright, file-sharing, torrent sites and ANONYMOUS VPN services.



Originally Published: Thu, 21 Jul 2016 07:19:42 +0000
source

[Ruler_Of_Hell]

Even after they turned You into a spayed or neutered Woosie Cat You kept uploading there Politux ? 

Yes I continued to upload there because they had the most traffic and I wanted my torrents to be shared as widely as possible but I consistently spoke up against the bullshit DMCA regime and blog censorship.  What did you do exactly?

Got "ETERNALLY BANNED" First: I raised so much Hell about the Malertising Not being removed in a reasonable amount of time. Second: I'd bitched even more than You about the stupidity of the takedowns. Third: add the fact that different Users were allowed to play by different rules made Me tell them to shove their Virtual Titles and let Me be a lowly User. That didn't fly well, so finally just told them to shove the entire Site and I self deleted My Accounts pissing em off even more. So my Avyvies all ended up with IP Blocks on them. LOL
.
Still went back to the site under different Tags since there were some decent people there that remained close Mates I'll miss those that don't know how to contact Me on other Sites

[Sid]

Their "DMCA regime" didn't save them but it wasn't bullshit. Unlike you ignorant and ungrateful freeloaders, torrent site owners risk jail time. They're perfectly entitled to do whatever they want to try to reduce that risk.

I'll admit I never expected for a moment that it would work but it's not like they misled anyone about it. Everyone uploading there knew full well that their torrents were subject to deletion without notice. Their forums were full of threads of hash values that uploaders' maintained in parallel with their torrent uploads for precisely that reason.

[jdevil90]

Read this what mainly happen

Der-Yeghiayan also estimated KAT's annual advertising revenue as being more than $16 million per year as of 2016.


In the complaint, the HSI agent also describes how an undercover IRS agent purchased an ad on KAT in March 2016 at the rate of $300 per day. The KAT representative, "Mr. White," provided details for a Latvian bank but warned the American buyer to "make sure that you don’t mention KAT anywhere."


After a successful five-day ad buy, the undercover IRS agent again tried to buy another ad. Mr. White told him that the existing "faster download" ads were all sold out but that he could buy a pricier banner ad at $1,000 to $3,200 per day.
By May, Mr. White informed the undercover agent of new banking details, this time in Estonia. Through the Mutual Legal Assistance Treaty (MLAT) process, US investigators were able to easily obtain those bank records.


HSI and IRS looked into the historical hosting records of KAT and found that for about 3.5 years, ending in January 2016, the operation was hosted out of Chicago, Illinois, which explains why the case is now being prosecuted out of the Northern District of Illinois. The site also used a Canadian hosting service—the two American agencies also used MLAT to get an image of the Canadian server.

Finally, Der-Yeghiayan also described how Apple provided a copy of Vaulin's e-mail account([email protected]), which included other incriminating information that establishes probable cause of a criminal conspiracy. He concluded by noting that the Costa Rican and Filipino authorities have been alerted and that HSI and IRS would be using the MLAT process to try to seize the kat.cr and kat.ph domains, among others.

[Spud17]

There are already sites popping up claiming to be the new kat, and while most of us know better, some will be taken in. Don't trust any site claiming to be the official kat site, and don't submit your kat log in details to anyone.

Personally, I'm confident that kat will return (just on the strength of its community alone), so let's be patient and wait for any official announcements from the kat staff. We've reached out to one or two of them, so hopefully we can keep everyone here informed as and when any new developments take place. Best of luck to the site owners and the staff, hope to see kat up and running again soon.

[jdevil90]

Hope Artem Vaulin evades heavy punishment



He is the man Jared Der-Yeghiayan

he is the same investigator who brought down Ross Ulbricht, the person behind the infamous online drug marketplace, Silk Road.

And now Kickass

[b]The agents discovered the Latvian account had received 28,411,357 euros in deposits from August 2015 and March 2016.

Thanks spud17 for the support.