Pirate-Powered CDNs Operate Innovative Illicit Streaming Model

While torrent sites are still important sources of unofficial content for hundreds of millions of users worldwide, streaming sites are undoubtedly eating into their market share.

Streaming platforms, easily accessible on the web and often sporting a Netflix-style interface, are enjoyed by expert pirates and the less savvy alike.

With a point-click-watch approach, streaming sites offer simplicity and convenience, features that regular torrent sites do not usually offer. As a result, a report shared with TorrentFreak by Moscow-based cyber-security company Group-IB indicates that 80% of pirated movies in Russia are now streamed, a figure that increases to 90% for TV shows.

Perhaps of more interest, however, is the supply chain and business model in place to get this content to the end-user while making a profit on the way.

In a report published earlier this week, it was revealed that in 87% of cases the first public copies of premiere titles appeared on torrent sites first, before spreading out to other platforms. While this underlines the continuing importance of torrent sites, Group-IB informs TF that “large monopolists” are now supplying content to thousands of websites via dedicated ‘pirate’ Content Delivery Networks (CDN).

“Much of the pirate underground has adopted advanced technologies of content distribution—pirate CDNs (Content Distribution Networks). CDNs store hundreds of thousands of files containing films and TV series,” the company reveals.

Group-IB says it has identified 15 ‘pirate’ CDN providers in this business while describing four as “major undertakings”. One CDN, for example, contains around 300,000 files sitting on more than five petabytes of server space.

While the storing of pirate content on servers is long-established, Group-IB says that these suppliers go an important step further by not only supplying video ‘wholesale’, but also additional services to help people set up their own professional pirate sites.

Running this kind of CDN is an expensive proposition. Group-IB estimates that the 300,000 file CDN mentioned above costs around $100,000 per month to maintain. This, however, is recouped via the content and services offered to pirate streaming site operators.

“Illegal videos are monetized via built-in CDN players. CDN platforms pay the pirate website owners on a CPM (cost per mille or thousand impressions) model. The CDNs are sponsored by bookies and online casinos, whose ads get ‘built-into’ the CDN players,” says Dmitry Tyunkin, Deputy Director Anti-Piracy at Group-IB.

“The CDN operators then become a kind of ‘wholesalers’ of pirated content that gets quickly and easily ‘fed’ to an almost unlimited number of pirate public-facing websites, such as movies and TV shows streaming portals.

“Some of these technical CDN providers also offer web modules that autofill sites with film posters and descriptions, and in some cases even supply unique reviews.”

Group-IB provided TF with details of a CDN named ‘Moonwalk’, which reportedly began operating in 2013. The company says it carries around 33,490 movies and TV shows via a maximum bandwidth of 400 Gb/s, paying out $0.60 per 1,000 views.

Given the size of these kinds of operations, we asked Group-IB whether they are a target for local law enforcement. The company said that while most developers are Russian-speaking, their infrastructure is now hosted outside the country.

“It’s not easy to take any legal actions against CDN providers for copyright owners in Russia, since CDN is a network of servers, which in most cases now are located outside of Russia,” Tyunkin says.

“Most of them in fact are located in Europe, and in the Netherlands in particular, close to so-called Internet backbones, the principal data routes between large computer networks and core routers on the Internet, for faster content distribution.”

Another interesting aspect of these pirate CDNs and the sites they service is that they appear to be undermining site-blocking efforts in the country.

While thousands of pirate domains are blocked in Russia under instruction of the Moscow City Court, the availability of CDNs behind the scenes means that any domain or site targeted for blocking can simply move on, with a minimum of disruption and with its content source intact.

“Nobody considers their domain or platform to be invaluable anymore, and the possibility of them being blocked is no real threat,” the company says.

“Pirates register dozens of domain names, content on these websites is filled automatically, and if the website is blocked, its search ratings are ‘transferred’ to a new website. This allows pirates to retain top positions in search engine results even if the original resource is blocked, which is not prohibited by the law.”

The end result is that while the number of blocked sites is increasing, there is also a trend of users who previously visited larger sites being spread over a larger number of smaller platforms. The anti-piracy memorandum signed last November by content and tech companies is having an effect, Group-IB says, but it’s “too early to talk about a complete victory.”

“Pirates know how to adapt to changing markets and are receiving support in the form of active sponsors among clandestine casinos and bookies. Not to mention creating a pirated website and moving content to it from a CDN provider is becoming increasingly easier and cheaper,” the company concludes.