Thread: Internet download copyright threat

Originally Posted by Distortion

An IP address can't be hacked it's just that, an address.

but it can be masqueraded and spoofed.

i once got one of the letters for supposedly downloading a harry potter movie...

i cant stand harry potter and knew i or anyone here wouldn't have bothered

so i asked for and got their so called evidence

it was ip based and easily spoofed, as i showed them

i got a nice thank you letter and an apology.

it has been my experience that a lot of these letters result because the package people download includes a trojanised component that sends back the ip address of the machine it has been utilised on.

the payload can be in anything from a jpg to a html file to an avi

peerguardian and the like only stop known lists of "bad" ip addresses monitoring the trackers during the download process..

firewalls usually don't help either as the trojans use the same ports that are open for normal internet traffic.

these mobs usually only go after you if you are sharing what you have downloaded, don't share and your normally safe unless you use a package that is being monitored such as a recent very popular movie.

Interesting incisor,

Most of these that I see go by are cases where they have used a honey pot and have both sent and received a chunk of the file from the address. Spoofing an IP address means the honey pot doesn't get the correct responses when it sends a chunk of the file.

I'm not sure on the details of the letter they sent you but I'm guessing it was some time ago as these days they come through with the amount of data transmitted/received and multiple time stamps of these.

My comment regarding peer guardian was more to do with how easy it is for them to setup the honey pots I referred to above on standard generic ISPs so they are using a random ISP IP Address not on any of peer guardians block lists.

Originally Posted by Distortion

Spoofing an IP address means the honey pot doesn't get the correct responses when it sends a chunk of the file.

that depends on who is controlling dns

but much of it would have changed since my days on os2warez

This is one of my emails in full showing the details you have mentioned Rob.
Dear Customer (***********),

Attached is an email that TPG has received complaining about certain
conduct. The IP address and timestamps provided by the complainant
indicate that the conduct occurred over your TPG Service.

Infringement IP address: 27.32.49.xxx
Infringement timestamp (SYD): 2013-08-08 14:22:45

TPG does not condone the use of TPG Services for activities which are
offensive, illegal, or infringe on the legal rights of other persons.
Such activities are expressly stated in your agreement with us as being
a basis on which TPG may suspend or terminate the supply of services to
you.

It is alleged in the attached complaint that you, or someone authorised
by you, have engaged in such an activity. If you agree that you did
engage in the activity, please cease it immediately. If you do not
believe that you have engaged in the activity complained about or you
believe that the activity is not illegal, offensive or an infringement
of another person's rights, please contact the complainant as soon as
possible and explain your position to them.

If you have any questions about this email or our Terms and Conditions,
please contact Customer Service on customer_service@xxx.com.au or
13 14 23.

Thank you.


Kind Regards,

Internet Abuse Team
xxx Internet

E-mail: ssss@xxx.com.au
Phone: 13 14 23
Fax: 02 9850 0813



From: "starz_media@copyright-compliance.com" <starz_media@copyright-compliance.com>
Subject: 314-95671620 Notice of Unauthorized Use of Starz, LLC ("Starz") Property
Date: 8 August 2013 2:30:58 PM AEST


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Notice of Unauthorized Use of Starz, LLC ("Starz") Property
Notice ID: 314-95671620
Notice Date: 08 Aug 2013 04:30:57 GMT

TPG Internet Pty Ltd.

Dear Sir or Madam:

Irdeto USA, Inc. (hereinafter referred to as "Irdeto") swears under penalty of perjury that Starz has authorized Irdeto to act as its non-exclusive agent for copyright infringement notification. Irdeto's search of the protocol listed below has detected infringements of Starz copyright interests on your IP addresses as detailed in the below report. Irdeto has reasonable good faith belief that use of the material in the manner complained of in the below report is not authorized by Starz, its agents, or the law.

Irdeto has reasonable good faith belief that Starz its agents, or the law does not authorize use of the material in the manner complained of in the below report. The information provided herein is accurate to the best of our knowledge. Therefore, this letter is an official notification to effect removal of the detected infringement listed in the below report.

The Berne Convention for the Protection of Literary and Artistic Works, the Universal Copyright Convention, as well as bilateral treaties with other countries allow for protection of client's copyrighted work even beyond U.S. borders. The below documentation specifies the exact location of the infringement.

We hereby request that you immediately remove or block access to the infringing material, as specified in the copyright laws, and insure the user refrains from using or sharing with others Starz materials in the future.

Further, we believe that the entire Internet community benefits when these matters are resolved cooperatively. We urge you to take immediate action to stop this infringing activity. We appreciate your efforts toward this common goal.

Please send us a prompt response indicating the actions you have taken to resolve this matter, making sure to reference the Notice ID number above in your response.

If you do not wish to reply by email, please use our Web Interface by clicking on the following link: Ixxxxo Web Infriddddment Response System

Note: If your email program has inserted line breaks into either the email or web links above, you can copy and paste the entire link into your email program, or favorite web browser, respectively.

Nothing in this letter shall serve as a waiver of any rights or remedies of Starz with respect to the alleged infringement, all of which are expressly reserved. Should you need to contact me, I may be reached at the below address.

Regards,

Andrew Beck
Irdeto USA, Inc.
3255-3 Scott Blvd. Suite 101 Santa Clara, CA 95054
Phone: 408-492-8500 fax: 408-727-6743

*pgp public key is available on the key server at MIT PGP Key Serxxx

Note: The information transmitted in this Notice is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, reproduction, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from all computers.

This infringement notice contains an XML tag that can be used to automate the processing of this data. If you would like more information on how to use this tag please contact Irdeto.

Evidentiary Information:
Notice ID: 314-95671620
Initial Infringement Timestamp: 08 Aug 2013 04:22:45 GMT
Recent Infringement Timestamp: 08 Aug 2013 04:22:45 GMT
Infringers IP Address: 27.32.49.117
Protocol: BitTorrent
Infringed Work: Da Vinci's Demons
Infringing File Name: Da.Vinci's.Demons.S01E07.The.Hierophant.720p.WEB-DL.AAC2.0.H.264-BS [PublicHD]
Infringing File Size: 1886484358
Bay ID: 1438dc7953386c852a6022ddb3e852b6d96140af|188648435 8
Port ID: 26085
URL: http://www.h33t.com:3310xxx/announce
Infringer's User Name:
- - ---Start ACNS XML
<?xml version="1.0" encoding="UTF-8"?>
<Infringement xmlns="http://www.acns.net/ACNS" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.acns.net/ACNS http://www.acns.net/v1.2/ACNS2v1_2.xsd">
<Case>
<ID>314-95671620</ID>
<Status>Open</Status>
</Case>
<Complainant>
<Entity>Irdeto USA, Inc</Entity>
<Contact>Andrew Beck</Contact>
<Address>3255-3 Scott Blvd. Suite 101, Santa Clara, California 95054 United States of America</Address>
<Phone>408-492-8500,408-727-6743</Phone>
<Email>starz_media@copyrigh\\\\xxxt-compliance.com</Email>
</Complainant>
<Service_Provider>
<Entity>TPG Internet Pty Ltd.</Entity>
<Email>abusexxxx.com.au</Email>
</Service_Provider>
<Source>
<TimeStamp>2013-08-08T04:22:45.000Z</TimeStamp>
<IP_Address>27.32.49.117</IP_Address>
<Port>26085</Port>
<Type>BitTorrent</Type>
<UserName></UserName>
<Number_Files>1</Number_Files>
<Deja_Vu>No</Deja_Vu>
</Source>
<Content>
<Item>
<TimeStamp>2013-08-08T04:22:45.000Z</TimeStamp>
<Title>Da Vinci's Demons</Title>
<FileName>Da.Vinci's.Demons.S01E07.The.Hierophant. 720p.WEB-DL.AAC2.0.H.264-BS [PublicHD]</FileName>
<FileSize>1886484358</FileSize>
<URL>http://www.h33t.com:3310/xxnounce</URL>
</Item>
</Content>
</Infringement>
- - ---End ACNS XML
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.17 (MingW32)

iQEcBAEBAgAGBQJSAx8BAAoJEIAWnCdHKKNDuboH/A2u/eXNswQhs2cDMKr8tFW6
Muf5NSgkwhnt9EbRlPIR9QfNv8DPhY0B1+XSLk7v+1z7QOW4rO dS44RXjNG9AFl7
UMWpgx67+PL91eHiF+7UvdNFXrNuB7xPcTxQ1ycunNTUQh9o0l kpXURhpYdf75HK
kXIbTtdI3+SPGgrQAYk1iG+GqOKe5MvzfEdDLqEmdSJ59gYosq D/O6UxGWgja1SP
LLjea94sOa3m5ULXF1j65m2/ocD3r3jXOuZXJMs9M8+LVHO6NErzZmAbo8vlGfZS
shYbG4ll3w/4F8oNZlawYxc7B6pDULJri79v+r62pzx/FxK3icf8XEoQXCYy9LQ=
=8vW9
-----END PGP SIGNATURE-----

This will likely interest you

http://forums.whirlpool.net.au/forum...&#39;t=1399900

I'd also suggest not including your email address at the top of that post =)

Hi Rob, thanks - interesting article; thanks. Did you delete my email? if so, how? thanks again.
cheers gerald

no worries

I assume a mod spotted it a silently removed it

If suggest editing the link in the post too.

I clicked it and got to the link the individual is to use to respond.

Could do some mischief with that