GROUP−IB # JOLLY ROGER’S PATRONS JULY 2020 ### GROUP−IB EXPOSES FINANCIAL CRIME NETWORK OF ONLINE PIRATES IN DEVELOPING COUNTRIES ----- ## Contents ###### Introduction 3 Objectives 5 Executive Summary 5 Introduction to video piracy 8 Threat of pirate websites 11 Infrastructure of pirate CDNs 13 Collaps 13 HDVB 22 VideoCDN 26 Kodik 29 Videoframe 33 Bazon 35 Ustore 37 Alloha  39 Protonvideo 43 The economics of illegal resources 46 1xBet 49 General information 49 Entry into the markets of developing countries 49 Links with piracy in the post-Soviet region 50 Beginning of interaction with Koshara/Octopus team 52 Piracy connections worldwide 53 Lucky Partners & Welcome Partners 54 General information 54 Business practices 54 Accepting payments 55 Distributing payments 56 Attracting advertising 56 Russian infrastructure of illegal resources 57 ZeroCDN (Mnogobyte) 57 DDOS-GUARD 58 Legal information 64 Online casinos 64 Online pirates 66 ----- Since 2015, Group-IB has been annually estimating the size of the Russian video piracy market. **The figures are as follows:** 2015: $32 million 2016: $62 million 2017: $85 million 2018: $87 million After major pirated content delivery networks (CDNs) Moonwalk and HDGO were shut down in 2019, the market dropped to $63.5 million. It is now rising again, however, due to a second wave of CDNs. ## Introduction ###### The economic crisis caused by the pandemic, for which no country was prepared, has laid bare a number of problems in today’s soci- ety. Both developing and developed countries have suffered and continue to suffer enormous losses. The world’s industries have been desperately trying to survive and are searching for new strategies to ensure global stability. Analysts estimate that, over the next two years, the coronavirus pandemic will strip the world economy of some $5.5 trillion[1]. People are losing their health, their lives, their loved ones, their jobs, their businesses… The situation is becoming a global disaster whose consequences will be felt for decades to come. To make matters worse, this is when cybercrime rears its ugly head. For more than 17 years, Group-IB has been researching the tactics, tools, and monetization schemes used by various cybercriminal groups and individuals whose overall damage to governments worldwide amounts to billions of dollars. We are acutely aware of the cyclic nature of this phenomenon. For cybercriminals, any crisis is a time of prosperity. While for most people financial insta- bility casts aside anything other than survival, criminals raise their profits by taking vast sums of money out of people’s pockets and economies. One shadow economy channel is online piracy. The fight against this disease within the media industry has been ongoing for some 20 years, but it is only recently that the scale of the piracy business has escalated to such a colossal extent. Russian-speaking cybercriminal conglomerates are no longer con- tent with income that comes solely from video content consum- ers in Russia and other post-Soviet countries. They have started branching out into international markets, mainly in developing countries. This gives them opportunities to increase the capitaliza- tion of their shadow businesses manifold. The US media industry — the largest in the world — is also suffer- ing losses because of piracy. The Global Innovation Policy Center of the US Chamber of Commerce estimates that online piracy costs the US economy up to $29.2 billion[2]. It has become obvious that pirate resources[3] have adapted to pressure from copyright holders. Pirate infrastructures are resilient to new technologies and certain legal initiatives. Pirates’ main investors are still illegal bookmakers, casinos, and alcohol suppliers, or in other words: the entire black market, which spon- sors camrip groups[4], translators, and IT infrastructures for pirated content. [1  Bloomberg citing JPMorgan Chase & Co. analysis](https://www.bloomberg.com/news/articles/2020-04-08/world-economy-faces-5-trillion-hit-that-is-like-losing-japan) [2  https://www.theglobalipcenter.com/wp-content/uploads/2019/06/Digital-Video-Piracy.pdf](https://www.theglobalipcenter.com/wp-content/uploads/2019/06/Digital-Video-Piracy.pdf) 3 Hereinafter, in this report the pirate resources are defined as resources that had faced claims of copyright holders over copyright infringements, as well as resources included in the lists of violators of exclusive rights, compiled by competent authorities of different countries. 4  Pirate groups that specialize in recording the on-screen projections of movies (most often fiction film premiers) and their editing for the purposes of publishing them online. ----- ###### The shadow economy is not alone to facilitate piracy, however. The industry has capacities to host and stream videos that are often bought by pirate platforms from legal hosting services with impunity. Pirate websites embed video players belonging to one or several CDNs and monetize the content by showing ads. Users can freely visit pirate websites, mainly through search engines or social media. Meanwhile, pirates have been making themselves increasingly richer by using processing services of banks, which inadvertently act as accomplices. Eliminating a single component of the pirate Hydra will not kill it. It will simply regenerate. The war on it must be waged on all fronts. This is the only way to cure cyberspace, develop immunity to piracy, not just in Russia but in international markets too, and stop its out- breaks as soon as possible. ----- #### 45% of pirate websites, primarily watched by the Russians, use the content provided by Collaps CDN #### $21,000+ made by bookmakers with well‑developed partner programs per month ## Objectives ###### The purpose of this report is to deliver a devastating blow to cyber- crime: to expose the entire structure of online piracy, to uncover the key organizations that sponsor this activity and those behind them. Group-IB’s report contains confidential data, including informa- tion on individuals believed to be behind some of the key piracy industry players. Copies of this report have been provided to the Russian Prosecutor General’s Office, Russian and international law enforcement agencies. As an international company, Group-IB is calling on the media industry, on regulating authorities, and on international organiza- tions interested in fighting cybercrime to work together and help dismantle a business that has been developing for years, draining blood and cancelling the efforts of copyright holders worldwide. ## Executive Summary ###### Shadow investors in online piracy. As part of their anti-piracy and brand protection activities, Group-IB specialists used the follow- the-money approach to identify who profited from unlawful activity. They found that illegal casinos and bookmaker companies were the main beneficiaries and drivers of illicit video streaming ser- vices and pirated sports streaming services. The leaders of the illegal casino market are Welcome Partners and Lucky Partners. Taking advantage of geopolitical tensions. Those behind one of the most popular CDNs, Collaps, which provides content to 45% of pirate websites primarily watched by the Russians, are based in Ukraine which allows them to continue unlawful activity. Use of Russian banks and international payment systems in crim- inal schemes. Despite most of their owners residing in Ukraine, popular online casinos have been using Russian banks to receive payments as part of their monetization schemes. None of the banks classify this type of activity as MCC[5] 7995. Symbiosis of gambling and pirated online traffic. Next to films and TV series, sports streaming is becoming a new source of reve- nue for pirates. The main advertisers in this case are quasi-legal bookmakers: 1xBet, Melbet, Parimatch, Linebet, Orca88, Bwin, and others. A streaming service’s average revenue is between 20% and 40% of the sum lost by the gamblers it attracted (depending on the partner program). Well-developed partner programs help bookmakers make more than $21,000 per month (for a website with an average of 70-80 gamblers attracted daily). 5  Merchant Category Code is a four-digit number used to classify a particular business when a bank card payment is made. ----- #### 500+ total camrip releases made by 1xBet in 2018 #### 270+ Total titles covered by 1xBet in 2018 ###### Russian-speaking cybercrime in international markets. After being blocked in Russia, shadow bookmakers shifted their focus to: • Latin America (mainly Brazil); • India; • Thailand. Having polished their schemes in Russia (which has traditionally been used as a testing ground for cybercrime), they started enter- ing markets with similar characteristics: developing countries, non-English speaking regions, populations with low financial liter- acy, and countries where sports streaming is highly popular. This situation resulted in a symbiosis of gambling companies and pirated content. Since 2015, 1xBet has allegedly sponsored con- tent for 17 TV show voiceover studios (i.e. 80% of major voiceover studios). 1xBet is one of the main sponsors of illegal distribution of TV series in the post-Soviet region. What’s more, in 2018 1xBet started creating content for other countries: Total releases: over 500. Total titles covered: over 270. Distribution by language: • 100%[6] of camrips are in English; • 14% of camrips are in Spanish; • 5% of camrips are in other languages (Tamil (predominantly spoken in India’s South), Portuguese, Thai, Hindi, and others). Evasion of technical blocking and lawful prosecution. Content delivery networks (CDNs) play a key role in online piracy. They are services that aggregate pirated content and optimize its delivery to the customer. They supply up to 80% of illegal video streaming services in Russia and other post-Soviet countries. The characteristics of second-wave CDNs are: • frequent changes of technical domains and IP pools; • use of geographically distributed infrastructures; • duplicate and reserve content delivery channels, which are usually rented from various Internet service providers. These measures have made the currently enforced practices stip- ulated in anti-piracy legislation ineffective. Exploitation of legal hosting services’ capacities. Group-IB stud- ied the activities of several pirate groups. Analyses of their techni- cal infrastructures revealed that they systematically used capaci- ties belonging to Russian companies. 6  One camrip can be in several languages (e.g. in English and dubbed in Spanish). ----- #### 23% of 3,100 pirate resources analyzed during the pandemic posed risks to users #### 76.8 mln is the amount of total visits to dangerous resources in March ###### Having analyzed the number of CDNs utilizing Mnogobyte’s infra- structure, we determined that the company Mnogobyte is likely to be one of the leaders in providing hosting services for pirate CDNs.[7] A copyright holder’s complaint about pirate services being hosted by a hosting service will yield no results because unique links created for each user individually cannot be opened by any- one else. This means that a hosting service whose servers are used by pirate CDNs has all formal grounds to remove themselves from handling the matter, absolve themselves from any responsibil- ity, and continue to make money by providing a platform for pirate businesses. In addition, analyses revealed a number of network addresses that serviced pirate websites and officially belonged to a company called DDOS-GUARD. The company regularly ensures the opera- tion of services that engage in unlawful activity, thereby essentially providing tools for committing offences. Infection of pirated content with malware. The growing number of online users goes hand in hand with increased fraud and more criminal groups that operate online. Because of how popular they are, pirate websites (streaming services, torrent trackers, etc.) act as platforms for distributing malware and stealing users’ money and personal data. During the pandemic, Group-IB checked over 3,100 pirated content websites for viruses, vulnerabilities, and inclusion in blacklists compiled by antivirus providers and search engines. The analysis revealed that up to 23% of pirate resources posed risks to users. In March, the number of total visits to danger- ous resources amounted to 76.8 million. Most of these resources were in the .RU domain. 7  The main outcomes of this analysis are provided in the Infrastructure of pirate CDNs chapter. All the details can be provided at the formal request of competent authorities. ----- #### CDN service Moonwalk was blocked by the anti-piracy groups BREIN, ACE and MPA in October 2019 after Group-IB`s report was released ## Introduction to video piracy ###### The current situation on the online piracy market is developing against the background of the actively enforced anti-piracy law and cooperation between copyright holders and popular search engines. In addition, the closure of major first-wave pirate CDN services had a significant impact on the market. After Group-IB’s report was released, in October 2019 the anti-piracy groups BREIN, ACE, and MPA took down Moonwalk, the most popular CDN service at the time. Acting on behalf of these groups, law enforcement officers disabled the servers — which ensured Moonwalk’s opera- tion — belonging to three Dutch hosting services and two overseas companies whose servers were physically located in the Neth- erlands. The shutdown of Moonwalk led to the closure of a major CDN HDGO, with another provider, Kodik, losing a significant part of its content. Both used the same infrastructure as Moonwalk. Under such conditions, the behavior of pirate website administra- tors is characterized by a desire to eliminate risks by: ###### 1. 2. **Diversifying content sources** Many pirate websites use several CDNs at once in case one of them fails. In addition, CDN aggregators such as Yohoho, Emblix, Uitools, and others are becoming increasingly popular. Aggregators track content on all major CDNs and provide their own video players, which makes it possible to switch CDNs at the user’s discretion. **Optimizing database provisioning** Pirate website administrators who are constantly forced to create new websites due to blocking have a myriad of modules and scripts that help them quickly transfer and recover databases. To sync pirate databases, they use film IDs of major specialized portals such as Kinopoisk and IMDB. ###### 3. 4. **Shifting from quality to quantity** Pirates used to put most of their efforts into developing a small number of websites operated simultaneously. Due to search engine results being actively blocked and cleared, however, this tactic is being used less and less often, mainly by blocked major websites whose owners rely on their audiences’ loyalty despite the need to use blocking evasion tools. Other webmasters prefer attracting traffic by creating many identical sites. This way, losing one site will not result in any significant negative consequences. **Increasing the share of new CDNs** **that use Russian infrastructure** The shift in focus to Russian Internet service providers is connected to three factors: (i) the seizure of the Dutch servers that hosted Moonwalk, HDGO, and Kodik; (ii) the availability of Russian services; and (iii) the lack of successful and tangible legal action against Russian Internet service providers that offer their capacities to pirate websites. ----- #### up to 80% of pirate video streaming services in Russia and other post-Soviet countries are provided with content from CDNs ###### The current structure of the pirated video market comprises: 1. Specialized advertising networks (bookmakers, casinos, alcohol, etc.) that sponsor camrip groups, translators, CDNs, and pirate websites. 2. CDNs that offer their capacities for video hosting and streaming. In turn, these capacities are purchased by pirate platforms from legal hosting services. 3. Pirate websites that embed the players belonging to one or more CDNs and monetize content by displaying ads to users. 4. Users who visit pirate websites mainly through search engines and social media. CDNs play a key role in online piracy. These services aggregate pirated content, optimize its delivery to the end user, and help video streaming services make money through partner programs. CDNs provide content to up to 80% of pirate video streaming ser- vices in Russia and other post-Soviet countries. CDNs are not hosting services or communications service provid- ers. Instead, they use server capacities provided by other (legiti- mate) Internet service providers. ----- ###### The main problem that copyright holders face when interacting with CDNs is that their complaints are ignored and their demands are met on paper only. In particular, many CDNs create links for specific users or devices using tokens. Moreover, these links often function for a limited time only. Complaints about such links are ineffective because the links change regularly, while illegal content continues to be distributed. CDNs take no measures against viola- tors, thereby encouraging unlawful activity. Legal hosting services whose servers are used by CDNs usually refuse to handle the issue and evade responsibility by giving formal replies that given links are unavailable. At the moment, the main CDNs are: • Collaps • HDVB • VideoCDN • Kodik • Videoframe • Bazon • Ustore • Alloha • Protonvideo The specific characteristics of second-wave CDNs are: • frequent changes of technical domains and IP pools; • use of geographically distributed infrastructures; • duplicate and reserve content delivery channels, which are usu- ally rented from various providers. A number of the largest streaming services (e.g. Hdrezka) have their own servers designed to store and deliver video content. In most cases, however, these servers are not used by other resources since they do not involve partner programs and there- fore bring no profit. ----- #### Threat of pirate websites 3,100 pirated content websites were screened by Group-IB during the pandemic ###### 1. **Safe websites** Visiting these websites did not entail any risks to users. #### ±23% of 3,100 pirate resources analyzed during the pandemic posed risks to users #### 76.8 mln is the amount of total visits to dangerous resources in March ###### Analysis revealed that up to 23% of pirate resources posed risks to users. Moreover, total visits to dangerous resources in March amounted to 76.8 million. Distribution by category: **6%** Safe **23%** Dangerous ###### Threat of pirate websites **71%** Relatively safe 8  Content Management System ###### As they are highly popular, pirate sites (streaming services, tor- rent trackers, etc.) are convenient platforms for distributing mal- ware and stealing users’ money and personal data. These sites can be both sources of threats (if their administrators are threat actors) and targets for other threat actors. During the pandemic, Group-IB screened over 3,100 pirated con- tent websites for viruses, vulnerabilities, and inclusion in blacklists compiled by antivirus software providers and search engines. The resources were divided into three risk categories: ###### 2. **Relatively safe websites** No threats were detected on these websites. However, analysis revealed various vulnerabilities that could potentially be used for unlawful activities. Such vulnerabilities are most often the result of outdated or hacked software (e.g. CMS[8]). ###### 3. **Dangerous websites** These are websites where various threats (including malware) were detected or websites that have been included in blacklists compiled by antivirus software providers and search engines. ----- .RU 24% .NET 11.1% .ONLINE 7.2% .COM 6.7% .ORG 5.7% .SITE 4.2% .XYZ 4.0% .TOP 3.1% .CLUB 3.1% .INFO 3.1% .ME 2.6% .CC 2.6% .FUN 1.8% .SU 1.6% .PW 1.5% .BIZ 1.5% .PRO 1.3% .TV 1.1% .CO 0.9% .ML 0.8% OTHERS 12.1% ###### Most pirate resources use outdated or hacked software as well as custom-made parts of code, all of which can contain vulnera- bilities. The two main reasons for this are a desire to save on the costs of creating and operating a website and the fact that some administrators have poor technical skills. The fact that most dangerous resources are in the .RU domain also supports this claim. Experienced webmasters tend to use overseas domains, including offshore ones, to host their resources. Registering a pirate resource in the .RU domain is easier for beginners, although it does involve legal risks. At the same time, these webmasters do not always have the necessary technical knowledge and tools to ensure that their resources are safe. Distribution of dangerous resources by type: **2%** Other **30%** Torrent **68%** Streaming ----- #### Infrastructure Collaps of pirate CDNs Collaps is one of the most popular CDNs. We believe that its orga ###### nizers are from Ukraine. They are also the creators of two large pirate streaming services, Baskino and Hdrezka. As at late 2019, 45% of pirate streaming services used this CDN.[9] The main domain is collaps.org. Video players are placed on third- level technical domains, with formats including *.delivembed. cc, *.multikland.net, *.ellinagraypel.com, *. iframecdn.club, and *.apicollaps. At the moment, access to many of them is restricted. To bypass blocking, the service promptly generates new technical domains and regularly changes its IP pool. New domains are created according to the template api*.(multikland.net|delivembed.cc|elli- nagraypel.com) and using the function JavaScript Date.Now(). The content is distributed using technical domains with the for- mats *.s2w3.space, *.pixars.org, and *.embedcdn.cc. The links were found between the CDN Collaps and the pirate streaming services Baskino and Hdrezka. This assumption is based on the following facts: 1. The domains collaps.org and baskino.club used to have the same Google Analytics ID (UA-131285663). At the moment, this ID is used by more than 50 pirate websites, including bzserial. online, hd-kino.info, kino-tyr.ru, kinogram.life, and anilive.su. 2. The current domain http://baskino.me has only Collaps and Hdrezka video players embedded. 3. A person, whose personal details match those of the official representative of the Baskino website on VKontakte, a social networking site (https://vk.com/baskino), is mentioned as the registrar for numerous Hdrezka mirror websites (e.g. hdrez- ka-ag.com, mrhdrezka.com, betahdrezka.com, myhdrezka.com, newhdrezka.com, aghdrezka.com, wehdrezka.com, nuhdrezka. com, instahdrezka.com). 9  Hereinafter, the share of pirate websites using a particular CDN is shown in relation to the total number of pirate websites analyzed. One site can use multiple CDNs at once. ----- **IP address** **Domain** **ISP** **ASN** **Location** 104.27.150.223 collaps.org CloudFlare Inc. 13335 United States 104.27.151.223 190.2.139.42 c1.pixars.org WorldStream B.V. 49981 Netherlands 179.43.176.156 m1.rumer.club Private Layer INC 51852 Switzerland 5.61.58.226 zombie-film.com ISPIRIA Networks Ltd 50673 58061 5.61.58.226 zombie-film.club ISPIRIA Networks Ltd 50673 58061 5.61.59.104 kinogram.life ISPIRIA Networks Ltd 50673 58061 5.61.58.226 apicollaps.cc ISPIRIA Networks Ltd 50673 58061 37.1.201.235 baskino.club ISPIRIA Networks Ltd 50673 58061 37.1.201.235 baskino.me ISPIRIA Networks Ltd 50673 58061 37.1.205.8 baskino.com ISPIRIA Networks Ltd 50673 58061 Netherlands Netherlands Netherlands Netherlands Netherlands Netherlands Netherlands 179.43.176.226 api.delivembed.cc Private Layer INC 51852 Switzerland 179.43.174.130 api1563373691618.delivembed.cc Private Layer INC 51852 Switzerland 179.43.174.130 api1563456141.delivembed.cc Private Layer INC 51852 Switzerland 179.43.174.130 api1563568942.delivembed.cc Private Layer INC 51852 Switzerland 179.43.176.226 api1563598836.delivembed.cc Private Layer INC 51852 Switzerland 179.43.176.226 api1563780792530.delivembed.cc Private Layer INC 51852 Switzerland 179.43.176.226 api1563787265533.delivembed.cc Private Layer INC 51852 Switzerland 179.43.176.226 api1563787299365.delivembed.cc Private Layer INC 51852 Switzerland 179.43.176.226 api1563804355.delivembed.cc Private Layer INC 51852 Switzerland 179.43.176.226 api1563826656.delivembed.cc Private Layer INC 51852 Switzerland 179.43.176.226 api1563950096350.delivembed.cc Private Layer INC 51852 Switzerland 179.43.176.208 api1587992347.multikland.net Private Layer INC 51852 Switzerland 179.43.176.206 api1588070926901.multikland.net Private Layer INC 51852 Switzerland 179.43.176.206 api1588073338008.multikland.net Private Layer INC 51852 Switzerland 179.43.176.206 api1586724976.multikland.net Private Layer INC 51852 Switzerland 179.43.176.208 api1586743390.multikland.net Private Layer INC 51852 Switzerland 93.190.139.139 hls-c1.s2w3.space WorldStream B.V. 49981 Netherlands 178.132.3.36 hls-t001-l001-c002-s001.s2w3.space WorldStream B.V. 49981 Netherlands 51.83.237.65 hls-t001-l001-c003-s001.s2w3.space OVH SAS 16276 France 89.38.98.23 hls-t001-l001-c004-s001.s2w3.space WorldStream B.V. 49981 Netherlands 190.2.130.119 hls-t001-l001-c005-s001.s2w3.space WorldStream B.V. 49981 Netherlands 190.2.133.242 hls-t001-l001-c006-s001.s2w3.space WorldStream B.V. 49981 Netherlands 89.38.98.65 hls-t001-l001-c007-s001.s2w3.space WorldStream B.V. 49981 Netherlands ----- **IP address** **Domain** **ISP** **ASN** **Location** 91.229.23.61 hls-t001-l001-c009-s001.s2w3.space WorldStream B.V. 49981 Netherlands 89.38.99.149 hls-t001-l001-c011-s001.s2w3.space WorldStream B.V. 49981 Netherlands 109.236.93.13 hls-t001-l001-c012-s001.s2w3.space WorldStream B.V. 49981 Netherlands 190.2.133.153 hls-t001-l001-c013-s001.s2w3.space WorldStream B.V. 49981 Netherlands 190.2.136.90 hls-t001-l001-c014-s001.s2w3.space WorldStream B.V. 49981 Netherlands 89.38.97.203 hls-t001-l001-c015-s001.s2w3.space WorldStream B.V. 49981 Netherlands 62.112.10.207 hls-t001-l001-c017-s001.s2w3.space WorldStream B.V. 49981 Netherlands 89.38.99.211 hls-t001-l001-c018-s001.s2w3.space WorldStream B.V. 49981 Netherlands 93.190.142.106 hls-t001-l001-c019-s001.s2w3.space WorldStream B.V. 49981 Netherlands 51.83.238.6 hls-t001-l001-c020-s001.s2w3.space OVH SAS 16276 France 190.2.134.245 hls-t001-l001-c021-s001.s2w3.space WorldStream B.V. 49981 Netherlands 51.83.238.2 hls-t001-l001-c022-s001.s2w3.space OVH SAS 16276 France 190.2.133.153 hls-t001-l001-c024-s001.s2w3.space WorldStream B.V. 49981 Netherlands 89.38.99.211 hls-t001-l001-c025-s001.s2w3.space WorldStream B.V. 49981 Netherlands 190.2.133.239 hls-t001-l001-c026-s001.s2w3.space WorldStream B.V. 49981 Netherlands 190.2.130.119 hls-t001-l001-c029-s001.s2w3.space WorldStream B.V. 49981 Netherlands 190.2.133.50 hls-t001-l001-c030-s001.s2w3.space WorldStream B.V. 49981 Netherlands 89.38.98.65 hls-t001-l001-c031-s001.s2w3.space WorldStream B.V. 49981 Netherlands 89.39.104.57 hls-t001-l001-c032-s001.s2w3.space WorldStream B.V. 49981 Netherlands 51.91.62.202 hls-t001-l001-c036-s001.s2w3.space OVH SAS 16276 France 62.112.10.207 hls-t001-l001-c037-s001.s2w3.space WorldStream B.V. 49981 Netherlands 190.2.136.90 hls-t001-l001-c038-s001.s2w3.space WorldStream B.V. 49981 Netherlands 190.2.134.211 hls-t001-l001-c039-s001.s2w3.space WorldStream B.V. 49981 Netherlands 93.190.139.139 dash-t001-l001-c001-s001.pixars.org WorldStream B.V. 49981 Netherlands 91.229.23.61 dash-t001-l001-c002-s001.pixars.org WorldStream B.V. 49981 Netherlands 51.83.237.65 dash-t001-l001-c003-s001.pixars.org OVH SAS 16276 France 89.38.98.23 dash-t001-l001-c004-s001.pixars.org WorldStream B.V. 49981 Netherlands 190.2.130.119 dash-t001-l001-c005-s001.pixars.org WorldStream B.V. 49981 Netherlands 190.2.133.242 dash-t001-l001-c006-s001.pixars.org WorldStream B.V. 49981 Netherlands 89.38.98.23 dash-t001-l001-c007-s001.pixars.org WorldStream B.V. 49981 Netherlands 93.190.142.106 dash-t001-l001-c008-s001.pixars.org WorldStream B.V. 49981 Netherlands 91.229.23.61 dash-t001-l001-c009-s001.pixars.org WorldStream B.V. 49981 Netherlands 51.83.237.114 dash-t001-l001-c010-s001.pixars.org OVH SAS 16276 France 89.38.99.149 dash-t001-l001-c011-s001.pixars.org WorldStream B.V. 49981 Netherlands 109.236.93.13 dash-t001-l001-c012-s001.pixars.org WorldStream B.V. 49981 Netherlands 190.2.133.153 dash-t001-l001-c013-s001.pixars.org WorldStream B.V. 49981 Netherlands 190.2.136.90 dash-t001-l001-c014-s001.pixars.org WorldStream B.V. 49981 Netherlands 89.38.97.203 dash-t001-l001-c015-s001.pixars.org WorldStream B.V. 49981 Netherlands 190.2.134.245 dash-t001-l001-c016-s001.pixars.org WorldStream B.V. 49981 Netherlands ----- **IP address** **Domain** **ISP** **ASN** **Location** 62.112.10.207 dash-t001-l001-c017-s001.pixars.org WorldStream B.V. 49981 Netherlands 89.38.99.211 dash-t001-l001-c018-s001.pixars.org WorldStream B.V. 49981 Netherlands 93.190.142.106 dash-t001-l001-c019-s001.pixars.org WorldStream B.V. 49981 Netherlands 51.83.238.6 dash-t001-l001-c020-s001.pixars.org OVH SAS 16276 France 190.2.134.245 dash-t001-l001-c021-s001.pixars.org WorldStream B.V. 49981 Netherlands 51.83.238.2 dash-t001-l001-c022-s001.pixars.org OVH SAS 16276 France 89.38.99.149 dash-t001-l001-c023-s001.pixars.org WorldStream B.V. 49981 Netherlands 190.2.133.153 dash-t001-l001-c024-s001.pixars.org WorldStream B.V. 49981 Netherlands 89.38.99.211 dash-t001-l001-c025-s001.pixars.org WorldStream B.V. 49981 Netherlands 190.2.133.239 dash-t001-l001-c026-s001.pixars.org WorldStream B.V. 49981 Netherlands 51.83.237.65 dash-t001-l001-c027-s001.pixars.org OVH SAS 16276 France 190.2.133.50 dash-t001-l001-c028-s001.pixars.org WorldStream B.V. 49981 Netherlands 190.2.130.119 dash-t001-l001-c029-s001.pixars.org WorldStream B.V. 49981 Netherlands 109.236.93.14 dash-t001-l001-c030-s001.pixars.org WorldStream B.V. 49981 Netherlands 89.38.98.65 dash-t001-l001-c031-s001.pixars.org WorldStream B.V. 49981 Netherlands 89.39.104.57 dash-t001-l001-c032-s001.pixars.org WorldStream B.V. 49981 Netherlands 109.236.93.7 dash-t001-l001-c033-s001.pixars.org WorldStream B.V. 49981 Netherlands 51.83.237.114 dash-t001-l001-c034-s001.pixars.org OVH SAS 16276 France 62.112.9.14 dash-t001-l001-c035-s001.pixars.org WorldStream B.V. 49981 Netherlands 51.91.62.202 dash-t001-l001-c036-s001.pixars.org OVH SAS 16276 France 190.2.136.90 dash-t001-l001-c038-s001.pixars.org WorldStream B.V. 49981 Netherlands 190.2.134.211 dash-t001-l001-c039-s001.pixars.org WorldStream B.V. 49981 Netherlands 109.236.93.14 dash-t001-l001-c040-s001.pixars.org WorldStream B.V. 49981 Netherlands 89.38.97.203 dash-t001-l001-c041-s001.pixars.org WorldStream B.V. 49981 Netherlands 93.190.141.236 dash-t001-l001-c042-s001.pixars.org WorldStream B.V. 49981 Netherlands 51.91.62.202 dash-t001-l001-c043-s001.pixars.org OVH SAS 16276 France 51.83.238.6 dash-t001-l001-c044-s001.pixars.org OVH SAS 16276 France 190.2.130.121 dash-t001-l001-c045-s001.pixars.org WorldStream B.V. 49981 Netherlands 51.83.238.2 dash-t001-l001-c046-s001.pixars.org OVH SAS 16276 France 190.2.134.204 dash-t001-l001-c047-s001.pixars.org WorldStream B.V. 49981 Netherlands 109.236.87.98 dash-t001-l001-c048-s001.pixars.org WorldStream B.V. 49981 Netherlands 198.54.117.197 api1571765124.iframecdn.club Namecheap, Inc. 22612 United States 198.54.117.197 api1571781804.iframecdn.club Namecheap, Inc. 22612 United States 198.54.117.197 api1571781809.iframecdn.club Namecheap, Inc. 22612 United States 198.54.117.197 api1571781818.iframecdn.club Namecheap, Inc. 22612 United States 5.61.59.104 api1574435926.apicollaps.cc ISPIRIA Networks Ltd 50673 58061 5.61.58.226 api1574611456.apicollaps.cc ISPIRIA Networks Ltd 50673 58061 5.61.59.104 api1574695620.apicollaps.cc ISPIRIA Networks Ltd 50673 58061 Netherlands Netherlands Netherlands ----- **IP address** **Domain** **ISP** **ASN** **Location** 5.61.59.104 api1574752795.apicollaps.cc ISPIRIA Networks Ltd 50673 58061 5.61.59.104 api1576394528.apicollaps.cc ISPIRIA Networks Ltd 50673 58061 5.61.58.226 api1577286844.apicollaps.cc ISPIRIA Networks Ltd 50673 58061 5.61.58.226 api1577529908.apicollaps.cc ISPIRIA Networks Ltd 50673 58061 Netherlands Netherlands Netherlands Netherlands 46.105.102.26 api1577647047966.ellinagraypel.com OVH SAS 16276 France 46.105.102.26 api1577647366849.ellinagraypel.com OVH SAS 16276 France 46.105.102.26 api1577648051743.ellinagraypel.com OVH SAS 16276 France 46.105.102.26 api1577648121668.ellinagraypel.com OVH SAS 16276 France 5.61.58.226 api1579820407.apicollaps.cc ISPIRIA Networks Ltd 50673 58061 5.61.59.104 api1579820409.apicollaps.cc ISPIRIA Networks Ltd 50673 58061 5.61.58.226 api1579820412.apicollaps.cc ISPIRIA Networks Ltd 50673 58061 5.61.58.226 api1579820413.apicollaps.cc ISPIRIA Networks Ltd 50673 58061 5.61.59.104 api1579824909.apicollaps.cc ISPIRIA Networks Ltd 50673 58061 5.61.58.226 api1579841105.apicollaps.cc ISPIRIA Networks Ltd 50673 58061 5.61.58.226 api2.apicollaps.cc ISPIRIA Networks Ltd 50673 58061 5.61.58.226 api3.apicollaps.cc ISPIRIA Networks Ltd 50673 58061 Netherlands Netherlands Netherlands Netherlands Netherlands Netherlands Netherlands Netherlands 88.198.45.139 hls-t001-l001-c001-s001.embedcdn.cc Hetzner Online GmbH 24940 Germany 46.4.69.12 hls-t001-l001-c002-s001.embedcdn.cc Hetzner Online GmbH 24940 Germany 116.202.232.122 hls-t001-l001-c003-s001.embedcdn.cc Hetzner Online GmbH 24940 Germany 136.243.134.172 hls-t001-l001-c004-s001.embedcdn.cc Hetzner Online GmbH 24940 Germany 116.202.161.39 hls-t001-l001-c005-s001.embedcdn.cc Hetzner Online GmbH 24940 Germany 78.46.95.85 hls-t001-l001-c006-s001.embedcdn.cc Hetzner Online GmbH 24940 Germany 176.9.10.214 hls-t001-l001-c007-s001.embedcdn.cc Hetzner Online GmbH 24940 Germany 116.202.213.45 hls-t001-l001-c008-s001.embedcdn.cc Hetzner Online GmbH 24940 Germany 116.202.209.217 hls-t001-l001-c009-s001.embedcdn.cc Hetzner Online GmbH 24940 Germany 88.99.63.252 hls-t001-l001-c010-s001.embedcdn.cc Hetzner Online GmbH 24940 Germany 178.63.23.47 hls-t001-l001-c011-s001.embedcdn.cc Hetzner Online GmbH 24940 Germany 148.251.136.4 hls-t001-l001-c012-s001.embedcdn.cc Hetzner Online GmbH 24940 Germany 116.202.209.95 hls-t001-l001-c013-s001.embedcdn.cc Hetzner Online GmbH 24940 Germany 116.202.209.94 hls-t001-l001-c014-s001.embedcdn.cc Hetzner Online GmbH 24940 Germany 88.198.49.115 hls-t001-l001-c015-s001.embedcdn.cc Hetzner Online GmbH 24940 Germany 178.63.23.162 hls-t001-l001-c016-s001.embedcdn.cc Hetzner Online GmbH 24940 Germany ----- **IP address** **Domain** **ISP** **ASN** **Location** 178.63.23.162 hls-t001-l001-c017-s001.embedcdn.cc Hetzner Online GmbH 24940 Germany 88.99.26.222 hls-t001-l001-c018-s001.embedcdn.cc Hetzner Online GmbH 24940 Germany 116.202.208.241 hls-t001-l001-c019-s001.embedcdn.cc Hetzner Online GmbH 24940 Germany 116.202.208.238 hls-t001-l001-c020-s001.embedcdn.cc Hetzner Online GmbH 24940 Germany 176.9.4.121 hls-t001-l001-c021-s001.embedcdn.cc Hetzner Online GmbH 24940 Germany 176.9.5.49 hls-t001-l001-c022-s001.embedcdn.cc Hetzner Online GmbH 24940 Germany 116.202.192.118 hls-t001-l001-c023-s001.embedcdn.cc Hetzner Online GmbH 24940 Germany 178.63.71.62 hls-t001-l001-c024-s001.embedcdn.cc Hetzner Online GmbH 24940 Germany 195.201.181.174 hls-t001-l001-c025-s001.embedcdn.cc Hetzner Online GmbH 24940 Germany 176.9.7.51 hls-t001-l001-c026-s001.embedcdn.cc Hetzner Online GmbH 24940 Germany 195.201.246.84 hls-t001-l001-c027-s001.embedcdn.cc Hetzner Online GmbH 24940 Germany 116.202.192.58 hls-t001-l001-c028-s001.embedcdn.cc Hetzner Online GmbH 24940 Germany 176.9.5.54 hls-t001-l001-c029-s001.embedcdn.cc Hetzner Online GmbH 24940 Germany 178.63.18.158 hls-t001-l001-c030-s001.embedcdn.cc Hetzner Online GmbH 24940 Germany 116.202.209.94 hls-t001-l001-c031-s001.embedcdn.cc Hetzner Online GmbH 24940 Germany 116.202.213.44 hls-t001-l001-c032-s001.embedcdn.cc Hetzner Online GmbH 24940 Germany 116.202.209.250 hls-t001-l001-c033-s001.embedcdn.cc Hetzner Online GmbH 24940 Germany 136.243.134.172 hls-t001-l001-c034-s001.embedcdn.cc Hetzner Online GmbH 24940 Germany 116.202.192.121 hls-t001-l001-c035-s001.embedcdn.cc Hetzner Online GmbH 24940 Germany 116.202.245.248 hls-t001-l001-c036-s001.embedcdn.cc Hetzner Online GmbH 24940 Germany 46.4.17.184 hls-t001-l001-c037-s001.embedcdn.cc Hetzner Online GmbH 24940 Germany 116.202.192.98 hls-t001-l001-c038-s001.embedcdn.cc Hetzner Online GmbH 24940 Germany 116.202.232.123 hls-t001-l001-c039-s001.embedcdn.cc Hetzner Online GmbH 24940 Germany 159.69.79.238 hls-t001-l001-c040-s001.embedcdn.cc Hetzner Online GmbH 24940 Germany 144.76.139.202 hls-t001-l001-c041-s001.embedcdn.cc Hetzner Online GmbH 24940 Germany 78.46.86.183 hls-t001-l001-c042-s001.embedcdn.cc Hetzner Online GmbH 24940 Germany 116.202.209.216 hls-t001-l001-c043-s001.embedcdn.cc Hetzner Online GmbH 24940 Germany 116.202.192.119 hls-t001-l001-c044-s001.embedcdn.cc Hetzner Online GmbH 24940 Germany 116.202.192.120 hls-t001-l001-c045-s001.embedcdn.cc Hetzner Online GmbH 24940 Germany 176.9.4.183 hls-t001-l001-c046-s001.embedcdn.cc Hetzner Online GmbH 24940 Germany 116.202.209.211 hls-t001-l001-c047-s001.embedcdn.cc Hetzner Online GmbH 24940 Germany 195.201.240.69 hls-t001-l001-c048-s001.embedcdn.cc Hetzner Online GmbH 24940 Germany ----- ###### Hdrezka infrastructure **IP address** **Domain** **ISP** **ASN** **Location** 37.1.207.224 hdrezka.club ISPIRIA Networks Ltd 50673 58061 Netherlands 104.24.120.192 hdrezka.co CloudFlare Inc. 13335 United States 104.24.121.192 5.45.87.238 hdrezka.me ISPIRIA Networks Ltd 50673 58061 Netherlands 82.221.104.145 rezka.ag Advania Island ehf 50613 Iceland 37.1.206.186 hdrezka.name ISPIRIA Networks Ltd 50673 58061 Netherlands 104.27.170.245 hdrezka.tv CloudFlare Inc. 13335 United States 104.27.171.245 82.221.128.101 voidboost.net Advania Island ehf 50613 Iceland 104.28.24.91 hdrezka-ag.com CloudFlare Inc. 13335 United States 104.28.25.91 5.45.87.204 mrhdrezka.com ISPIRIA Networks Ltd 50673 58061 5.45.87.204 betahdrezka.com ISPIRIA Networks Ltd 50673 58061 Netherlands Netherlands 104.24.98.117 myhdrezka.com CloudFlare Inc. 13335 United States 104.24.99.117 104.28.4.72 aghdrezka.com CloudFlare Inc. 13335 United States 104.28.5.72 104.28.0.73 nuhdrezka.com CloudFlare Inc. 13335 United States 104.28.1.73 5.45.64.213 instahdrezka.com ISPIRIA Networks Ltd 50673 58061 5.45.77.201 hdrezka-ag.net ISPIRIA Networks Ltd 50673 58061 Netherlands Netherlands 185.190.189.217 actinium.load.hdrezka-ag.net LLC Mnogobyte 47328 Russia 185.190.189.229 aluminum.load.hdrezka-ag.net LLC Mnogobyte 47328 Russia 176.58.54.75 argon.load.hdrezka-ag.net LLC Mnogobyte 199251 Russia 77.220.172.53 asgard.load.hdrezka-ag.net LLC Mnogobyte 42632 Russia 77.220.172.53 asgard.stream.hdrezka-ag.net LLC Mnogobyte 42632 Russia 146.255.198.37 astatium.load.hdrezka-ag.net LLC Mnogobyte 42632 Russia 146.255.199.13 aura.load.hdrezka-ag.net LLC Mnogobyte 42632 Russia 146.255.198.21 aurum.load.hdrezka-ag.net LLC Mnogobyte 42632 Russia 77.220.172.131 bbs.load.hdrezka-ag.net LLC Mnogobyte 42632 Russia 77.220.172.139 beryllium.load.hdrezka-ag.net LLC Mnogobyte 42632 Russia 77.220.172.139 beryllium.stream.hdrezka-ag.net LLC Mnogobyte 42632 Russia 185.190.189.213 bohrium.load.hdrezka-ag.net LLC Mnogobyte 47328 Russia 146.255.197.155 boron.load.hdrezka-ag.net LLC Mnogobyte 42632 Russia 176.58.51.197 buttercup.load.hdrezka-ag.net LLC Mnogobyte 199251 Russia 146.255.198.213 cadmium.load.hdrezka-ag.net LLC Mnogobyte 42632 Russia ----- **IP address** **Domain** **ISP** **ASN** **Location** 77.220.172.147 calcium.load.hdrezka-ag.net LLC Mnogobyte 42632 Russia 146.255.197.59 carbon.load.hdrezka-ag.net LLC Mnogobyte 42632 Russia 176.58.54.76 chlorine.load.hdrezka-ag.net LLC Mnogobyte 199251 Russia 77.220.172.155 cobalt.load.hdrezka-ag.net LLC Mnogobyte 42632 Russia 77.220.172.163 cuprum.load.hdrezka-ag.net LLC Mnogobyte 42632 Russia 176.58.54.92 curium.load.hdrezka-ag.net LLC Mnogobyte 199251 Russia 176.58.46.197 dagon.load.hdrezka-ag.net LLC Mnogobyte 199251 Russia 146.255.198.221 dysprosium.load.hdrezka-ag.net LLC Mnogobyte 42632 Russia 146.255.198.221 dysprosium.stream.hdrezka-ag.net LLC Mnogobyte 42632 Russia 176.58.54.77 einsteinium.load.hdrezka-ag.net LLC Mnogobyte 199251 Russia 146.255.199.37 elvis.load.hdrezka-ag.net LLC Mnogobyte 42632 Russia 146.255.199.37 elvis.stream.hdrezka-ag.net LLC Mnogobyte 42632 Russia 176.58.46.209 ember.load.hdrezka-ag.net LLC Mnogobyte 199251 Russia 146.255.198.173 erbium.load.hdrezka-ag.net LLC Mnogobyte 42632 Russia 185.190.189.197 europium.load.hdrezka-ag.net LLC Mnogobyte 47328 Russia 176.58.54.205 fermium.load.hdrezka-ag.net LLC Mnogobyte 199251 Russia 77.220.172.77 fingerium.load.hdrezka-ag.net LLC Mnogobyte 42632 Russia 77.220.172.77 fingerium.stream.hdrezka-ag.net LLC Mnogobyte 42632 Russia 77.220.172.93 flerovium.load.hdrezka-ag.net LLC Mnogobyte 42632 Russia 77.220.172.93 flerovium.stream.hdrezka-ag.net LLC Mnogobyte 42632 Russia 146.255.199.61 flora.load.hdrezka-ag.net LLC Mnogobyte 42632 Russia 146.255.198.45 francium.load.hdrezka-ag.net LLC Mnogobyte 42632 Russia 146.255.198.61 gadolinium.load.hdrezka-ag.net LLC Mnogobyte 42632 Russia 77.220.172.101 gallium.load.hdrezka-ag.net LLC Mnogobyte 42632 Russia 77.220.172.101 gallium.stream.hdrezka-ag.net LLC Mnogobyte 42632 Russia 77.220.172.171 giza.load.hdrezka-ag.net LLC Mnogobyte 42632 Russia 77.220.172.171 giza.stream.hdrezka-ag.net LLC Mnogobyte 42632 Russia 176.58.46.205 grendel.load.hdrezka-ag.net LLC Mnogobyte 199251 Russia 185.190.189.221 hassium.load.hdrezka-ag.net LLC Mnogobyte 47328 Russia 77.220.172.116 holmium.load.hdrezka-ag.net LLC Mnogobyte 42632 Russia 176.58.53.74 indium.load.hdrezka-ag.net LLC Mnogobyte 199251 Russia 146.255.198.13 iridium.load.hdrezka-ag.net LLC Mnogobyte 42632 Russia 146.255.198.13 iridium.stream.hdrezka-ag.net LLC Mnogobyte 42632 Russia 77.220.172.85 jointinum.load.hdrezka-ag.net LLC Mnogobyte 42632 Russia 77.220.172.85 jointinum.stream.hdrezka-ag.net LLC Mnogobyte 42632 Russia 176.58.53.80 kalium.load.hdrezka-ag.net LLC Mnogobyte 199251 Russia 77.220.173.5 kurt.load.hdrezka-ag.net LLC Mnogobyte 42632 Russia 176.58.54.217 lawrencium.load.hdrezka-ag.net LLC Mnogobyte 199251 Russia 176.58.54.209 livermorium.load.hdrezka-ag.net LLC Mnogobyte 199251 Russia 176.58.48.48 load.hdrezka-ag.net LLC Mnogobyte 199251 Russia ----- **IP address** **Domain** **ISP** **ASN** **Location** 146.255.198.253 loki.load.hdrezka-ag.net LLC Mnogobyte 42632 Russia 77.220.172.179 louvre.load.hdrezka-ag.net LLC Mnogobyte 42632 Russia 146.255.198.149 lutetium.load.hdrezka-ag.net LLC Mnogobyte 42632 Russia 146.255.198.149 lutetium.stream.hdrezka-ag.net LLC Mnogobyte 42632 Russia 146.255.198.245 magic.load.hdrezka-ag.net LLC Mnogobyte 42632 Russia 212.188.6.14 magnesium.load.hdrezka-ag.net MTS PJSC 8359 Russia 176.58.46.201 midgard.load.hdrezka-ag.net LLC Mnogobyte 199251 Russia 176.58.46.213 mimin.load.hdrezka-ag.net LLC Mnogobyte 199251 Russia 146.255.199.45 mortis.load.hdrezka-ag.net LLC Mnogobyte 42632 Russia 185.190.189.249 moscovium.load.hdrezka-ag.net LLC Mnogobyte 47328 Russia 146.255.198.229 nailium.load.hdrezka-ag.net LLC Mnogobyte 42632 Russia 146.255.198.229 nailium.stream.hdrezka-ag.net LLC Mnogobyte 42632 Russia 185.190.189.253 natrium.load.hdrezka-ag.net LLC Mnogobyte 47328 Russia 146.255.198.165 neon.load.hdrezka-ag.net LLC Mnogobyte 42632 Russia 185.190.189.245 neptunium.load.hdrezka-ag.net LLC Mnogobyte 47328 Russia 146.255.198.237 nickel.load.hdrezka-ag.net LLC Mnogobyte 42632 Russia 146.255.199.53 nika.load.hdrezka-ag.net LLC Mnogobyte 42632 Russia 77.220.172.252 niobium.load.hdrezka-ag.net LLC Mnogobyte 42632 Russia 77.220.172.195 nitrogen.load.hdrezka-ag.net LLC Mnogobyte 42632 Russia 146.255.199.5 osiris.load.hdrezka-ag.net LLC Mnogobyte 42632 Russia 146.255.197.69 osmium.load.hdrezka-ag.net LLC Mnogobyte 42632 Russia 146.255.197.235 oxygen.load.hdrezka-ag.net LLC Mnogobyte 42632 Russia 77.220.173.13 ozzy.load.hdrezka-ag.net LLC Mnogobyte 42632 Russia 77.220.172.21 pe.load.hdrezka-ag.net LLC Mnogobyte 42632 Russia 77.220.172.203 petra.load.hdrezka-ag.net LLC Mnogobyte 42632 Russia 146.255.198.189 phosphorus.load.hdrezka-ag.net LLC Mnogobyte 42632 Russia 146.255.198.189 phosphorus.stream.hdrezka-ag.net LLC Mnogobyte 42632 Russia 146.255.198.5 platinum.load.hdrezka-ag.net LLC Mnogobyte 42632 Russia ----- ###### HDVB HDVB is the second most popular CDN. As at late 2019, 38% of pirate streaming services used this CDN. Video traffic comes from regularly updated domains: *tesswalton. pw, *bernardjordan.pw, *elmerwatson.pw, *alfredcurry.pw, *quinn- nash.pw, *frankfoley.pw, *rexhammond.pw, *janenoble.pw, *nadia- pattel.pw, etc. The domains are generated mainly in the .pw domain zone according to the template vb{some_number}{random_name_ surname}.pw. It also hosts video players. The CDN’s domains are regularly blocked by Roskomnadzor (Russia’s Federal Service for Supervision of Communications, Information Technology and Mass Media) in accordance with the procedure established in Article 15.2 of Russian Federal Law No. 149-FZ of July 27, 2006 “On Information, Information Technologies, and Protection of Information,” which leads to new ones being cre- ated constantly. The domains are changed using a script published on GitHub (https://partnercoll.github.io/actualize.js). ----- **IP address** **Domain** **ISP** **ASN** **Location** 198.16.66.22 cdn-s.vb17110frankfoley.pw FDCservers.net 174 30058 50.7.236.13 cdn062.vb17110frankfoley.pw FDCservers.net 174 30058 5.61.59.245 vid1586770147163.vb17110frankfoley.pw ISPIRIA Networks Ltd 50673 58061 5.61.59.245 vid1587050469061.vb17110frankfoley.pw ISPIRIA Networks Ltd 50673 58061 5.61.59.245 vid1587472644353.vb17110frankfoley.pw ISPIRIA Networks Ltd 50673 58061 5.61.59.245 vid1587475512511.vb17110frankfoley.pw ISPIRIA Networks Ltd 50673 58061 5.61.59.245 vid1587476524362.vb17110frankfoley.pw ISPIRIA Networks Ltd 50673 58061 5.61.59.245 vid1587478250266.vb17110frankfoley.pw ISPIRIA Networks Ltd 50673 58061 5.61.56.147 hdvb.info ISPIRIA Networks Ltd 50673 58061 198.16.67.58 cdn-b.hdvb.info FDCservers.net 174 30058 198.16.67.58 cdn-s.hdvb.info FDCservers.net 174 30058 198.16.67.58 cdn-t.hdvb.info FDCservers.net 174 30058 198.16.67.58 cdn-z.hdvb.info FDCservers.net 174 30058 198.16.67.58 cdn0.hdvb.info FDCservers.net 174 30058 United States United States Netherlands Netherlands Netherlands Netherlands Netherlands Netherlands Netherlands United States United States United States United States United States 194.59.142.130 cdn074.hdvb.info Melbikomas UAB 56630 Netherlands 194.59.142.178 cdn075.hdvb.info Melbikomas UAB 56630 Netherlands 50.7.230.242 cdn3.hdvb.info FDCservers.net 174 30058 50.7.231.242 cdn4.hdvb.info FDCservers.net 174 30058 50.7.236.11 cdn5.hdvb.info FDCservers.net 174 30058 United States United States United States 213.226.69.210 cdn51.hdvb.info Melbikomas UAB 56630 Netherlands 50.7.236.4 cdn7.hdvb.info FDCservers.net 174 30058 United States 37.1.204.81 cdn0.vb17106cecilgregory.pw Serverius Holding B.V. 50673 Netherlands 50.7.236.4 cdn7.vb17106cecilgregory.pw FDCservers.net 174 30058 United States 5.61.56.146 vid1577265532464.vb17106cecilgregory.pw Serverius Holding B.V. 50673 Netherlands 198.16.66.22 cdn0.vb17107rexhammond.pw FDCservers.net 174 30058 United States 93.189.61.202 cdn6.vb17107rexhammond.pw Melbikomas UAB 56630 Netherlands 5.61.57.201 vid1577992399.vb17107rexhammond.pw ISPIRIA Networks Ltd 50673 58061 5.61.57.201 vid1578595030063.vb17107rexhammond.pw ISPIRIA Networks Ltd 50673 58061 Netherlands Netherlands ----- **IP address** **Domain** **ISP** **ASN** **Location** 5.61.57.201 vid1578616870.vb17107rexhammond.pw ISPIRIA Networks Ltd 50673 58061 5.61.57.201 vid1578758734.vb17107rexhammond.pw ISPIRIA Networks Ltd 50673 58061 5.61.57.201 vid1579679408.vb17107rexhammond.pw ISPIRIA Networks Ltd 50673 58061 5.61.57.201 vid1580059869.vb17107rexhammond.pw ISPIRIA Networks Ltd 50673 58061 5.61.57.201 vid1580305928.vb17107rexhammond.pw ISPIRIA Networks Ltd 50673 58061 198.16.66.22 cdn0.vb17108janenoble.pw FDCservers.net 174 30058 Netherlands Netherlands Netherlands Netherlands Netherlands United States 93.189.61.228 cdn072.vb17108janenoble.pw Melbikomas UAB 56630 Netherlands 50.7.230.242 cdn3.vb17108janenoble.pw FDCservers.net 174 30058 United States 213.226.69.210 cdn51.vb17108janenoble.pw Melbikomas UAB 56630 Netherlands 93.189.61.202 cdn6.vb17108janenoble.pw Melbikomas UAB 56630 Netherlands 5.61.58.238 vb17108janenoble.pw ISPIRIA Networks Ltd 50673 58061 5.61.58.238 vid1580540888520.vb17108janenoble.pw ISPIRIA Networks Ltd 50673 58061 5.61.58.238 vid1580540942515.vb17108janenoble.pw ISPIRIA Networks Ltd 50673 58061 5.61.58.238 vid1580683679983.vb17108janenoble.pw ISPIRIA Networks Ltd 50673 58061 5.61.58.238 vid1581008549.vb17108janenoble.pw ISPIRIA Networks Ltd 50673 58061 5.61.58.238 vid1581066611933.vb17108janenoble.pw ISPIRIA Networks Ltd 50673 58061 5.61.58.238 vid1582631670127.vb17108janenoble.pw ISPIRIA Networks Ltd 50673 58061 5.61.58.238 vid1582659968.vb17108janenoble.pw ISPIRIA Networks Ltd 50673 58061 5.61.58.238 vid1582889689.vb17108janenoble.pw ISPIRIA Networks Ltd 50673 58061 5.61.58.238 vid1583155595210.vb17108janenoble.pw ISPIRIA Networks Ltd 50673 58061 50.7.236.13 cdn062.vb17109nadiapattel.pw FDCservers.net 174 30058 Netherlands Netherlands Netherlands Netherlands Netherlands Netherlands Netherlands Netherlands Netherlands Netherlands United States 93.189.61.228 cdn072.vb17109nadiapattel.pw Melbikomas UAB 56630 Netherlands 194.59.142.130 cdn074.vb17109nadiapattel.pw Melbikomas UAB 56630 Netherlands 194.59.142.178 cdn075.vb17109nadiapattel.pw Melbikomas UAB 56630 Netherlands 93.189.61.202 cdn6.vb17109nadiapattel.pw Melbikomas UAB 56630 Netherlands 5.61.58.238 vid1583682315750.vb17109nadiapattel.pw ISPIRIA Networks Ltd 50673 58061 5.61.58.238 vid1584471132619.vb17109nadiapattel.pw ISPIRIA Networks Ltd 50673 58061 5.61.58.238 vid1584537369.vb17109nadiapattel.pw ISPIRIA Networks Ltd 50673 58061 Netherlands Netherlands Netherlands ----- **IP address** **Domain** **ISP** **ASN** **Location** 5.61.58.238 vid1584612206933.vb17109nadiapattel.pw ISPIRIA Networks Ltd 50673 58061 5.61.58.238 vid1584981188.vb17109nadiapattel.pw ISPIRIA Networks Ltd 50673 58061 5.61.58.238 vid1585053700.vb17109nadiapattel.pw ISPIRIA Networks Ltd 50673 58061 5.61.58.238 vid1585133929.vb17109nadiapattel.pw ISPIRIA Networks Ltd 50673 58061 5.61.58.238 vid1585736220.vb17109nadiapattel.pw ISPIRIA Networks Ltd 50673 58061 5.61.58.238 vid1586009177579.vb17109nadiapattel.pw ISPIRIA Networks Ltd 50673 58061 5.61.58.238 vid1586068643.vb17109nadiapattel.pw ISPIRIA Networks Ltd 50673 58061 5.61.58.238 vid1586193986.vb17109nadiapattel.pw ISPIRIA Networks Ltd 50673 58061 5.61.58.238 vid1586204553.vb17109nadiapattel.pw ISPIRIA Networks Ltd 50673 58061 5.61.58.238 vid1586268356456.vb17109nadiapattel.pw ISPIRIA Networks Ltd 50673 58061 5.61.58.238 vid1586268630763.vb17109nadiapattel.pw ISPIRIA Networks Ltd 50673 58061 5.61.58.238 vid1586268825429.vb17109nadiapattel.pw ISPIRIA Networks Ltd 50673 58061 5.61.58.238 vid1586269053884.vb17109nadiapattel.pw ISPIRIA Networks Ltd 50673 58061 5.61.58.238 vid1586269672547.vb17109nadiapattel.pw ISPIRIA Networks Ltd 50673 58061 5.61.58.238 vid1586269715315.vb17109nadiapattel.pw ISPIRIA Networks Ltd 50673 58061 5.61.58.238 vid1586270273297.vb17109nadiapattel.pw ISPIRIA Networks Ltd 50673 58061 5.61.58.238 vid1586276799.vb17109nadiapattel.pw ISPIRIA Networks Ltd 50673 58061 5.61.58.238 vid1586329315202.vb17109nadiapattel.pw ISPIRIA Networks Ltd 50673 58061 5.61.58.238 vid1586336901423.vb17109nadiapattel.pw ISPIRIA Networks Ltd 50673 58061 5.61.58.238 vid1586340985437.vb17109nadiapattel.pw ISPIRIA Networks Ltd 50673 58061 5.61.58.238 vid1586527818006.vb17109nadiapattel.pw ISPIRIA Networks Ltd 50673 58061 5.61.58.238 vid1586528408828.vb17109nadiapattel.pw ISPIRIA Networks Ltd 50673 58061 5.61.58.197 vb10555nyashmyash.pw ISPIRIA Networks Ltd 50673 58061 Netherlands Netherlands Netherlands Netherlands Netherlands Netherlands Netherlands Netherlands Netherlands Netherlands Netherlands Netherlands Netherlands Netherlands Netherlands Netherlands Netherlands Netherlands Netherlands Netherlands Netherlands Netherlands Netherlands 185.199.108.153 185.199.109.153 185.199.111.153 185.199.110.153 partnercoll.github.io GitHub, Inc. 36459 United States ----- ###### VideoCDN VideoCDN is the third most popular CDN. As at late 2019, 33% of pirate streaming services used this CDN. The main domain is videocdn.tv. The content is hosted on technical domains with the format *.cloud.hotlan.by. ----- **IP address** **Domain** **ISP** **ASN** **Location** 77.220.172.51 asgard.cloud.hotlan.by LLC Mnogobyte 42632 Russia 146.255.198.35 astatium.cloud.hotlan.by LLC Mnogobyte 42632 Russia 146.255.198.19 aurum.cloud.hotlan.by LLC Mnogobyte 42632 Russia 146.255.199.11 aura.cloud.hotlan.by LLC Mnogobyte 42632 Russia 77.220.172.140 beryllium.cloud.hotlan.by LLC Mnogobyte 42632 Russia 146.255.198.211 cadmium.cloud.hotlan.by LLC Mnogobyte 42632 Russia 77.220.172.148 calcium.cloud.hotlan.by LLC Mnogobyte 42632 Russia 146.255.197.61 carbon.cloud.hotlan.by LLC Mnogobyte 42632 Russia 176.58.48.48 cloud.hotlan.by LLC Mnogobyte 199251 Russia 146.255.198.219 dysprosium.cloud.hotlan.by LLC Mnogobyte 42632 Russia 146.255.199.35 elvis.cloud.hotlan.by LLC Mnogobyte 42632 Russia 146.255.198.171 erbium.cloud.hotlan.by LLC Mnogobyte 42632 Russia 77.220.172.75 fingerium.cloud.hotlan.by LLC Mnogobyte 42632 Russia 77.220.172.91 flerovium.cloud.hotlan.by LLC Mnogobyte 42632 Russia 146.255.198.43 francium.cloud.hotlan.by LLC Mnogobyte 42632 Russia 146.255.198.59 gadolinium.cloud.hotlan.by LLC Mnogobyte 42632 Russia 77.220.172.99 gallium.cloud.hotlan.by LLC Mnogobyte 42632 Russia 77.220.172.172 giza.cloud.hotlan.by LLC Mnogobyte 42632 Russia 146.255.198.11 iridium.cloud.hotlan.by LLC Mnogobyte 42632 Russia 77.220.172.83 jointinum.cloud.hotlan.by LLC Mnogobyte 42632 Russia 77.220.172.180 louvre.cloud.hotlan.by LLC Mnogobyte 42632 Russia 146.255.198.147 lutetium.cloud.hotlan.by LLC Mnogobyte 42632 Russia 146.255.198.243 magic.cloud.hotlan.by LLC Mnogobyte 42632 Russia 146.255.198.227 nailium.cloud.hotlan.by LLC Mnogobyte 42632 Russia 146.255.198.235 nickel.cloud.hotlan.by LLC Mnogobyte 42632 Russia 77.220.172.250 niobium.cloud.hotlan.by LLC Mnogobyte 42632 Russia 77.220.172.196 nitrogen.cloud.hotlan.by LLC Mnogobyte 42632 Russia 146.255.199.3 osiris.cloud.hotlan.by LLC Mnogobyte 42632 Russia 146.255.197.67 osmium.cloud.hotlan.by LLC Mnogobyte 42632 Russia 77.220.172.19 pe.cloud.hotlan.by LLC Mnogobyte 42632 Russia 77.220.172.204 petra.cloud.hotlan.by LLC Mnogobyte 42632 Russia 104.27.134.40 0537.videocdn.pw CloudFlare Inc. 13335 United States 104.27.135.40 104.24.124.147 10.videocdn.ca CloudFlare Inc. 13335 United States 104.24.125.147 104.27.134.40 10.videocdn.pw CloudFlare Inc. 13335 United States 104.27.135.40 104.27.134.40 101.videocdn.pw CloudFlare Inc. 13335 United States 104.27.135.40 104.27.134.40 107.videocdn.pw CloudFlare Inc. 13335 United States 104.27.135.40 104.24.106.73 11.videocdn.so CloudFlare Inc. 13335 United States 104.24.107.73 ----- **IP address** **Domain** **ISP** **ASN** **Location** 104.27.134.40 12.videocdn.pw CloudFlare Inc. 13335 United States 104.27.135.40 104.24.106.73 13.videocdn.so CloudFlare Inc. 13335 United States 104.24.107.73 104.24.106.73 14.videocdn.so CloudFlare Inc. 13335 United States 104.24.107.73 104.27.134.40 1axammchjvyj.videocdn.pw CloudFlare Inc. 13335 United States 104.27.135.40 104.27.134.40 2.videocdn.pw CloudFlare Inc. 13335 United States 104.27.135.40 104.27.134.40 200.videocdn.pw CloudFlare Inc. 13335 United States 104.27.135.40 104.27.134.40 201.videocdn.pw CloudFlare Inc. 13335 United States 104.27.135.40 104.27.134.40 202.videocdn.pw CloudFlare Inc. 13335 United States 104.27.135.40 104.27.134.40 203.videocdn.pw CloudFlare Inc. 13335 United States 104.27.135.40 104.27.134.40 204.videocdn.pw CloudFlare Inc. 13335 United States 104.27.135.40 104.27.134.40 205.videocdn.pw CloudFlare Inc. 13335 United States 104.27.135.40 104.27.134.40 206.videocdn.pw CloudFlare Inc. 13335 United States 104.27.135.40 104.27.134.40 207.videocdn.pw CloudFlare Inc. 13335 United States 104.27.135.40 104.27.134.40 210.videocdn.pw CloudFlare Inc. 13335 United States 104.27.135.40 104.24.106.73 25.videocdn.so CloudFlare Inc. 13335 United States 104.24.107.73 104.27.134.40 2571112.videocdn.pw CloudFlare Inc. 13335 United States 104.27.135.40 104.24.106.73 28.videocdn.so CloudFlare Inc. 13335 United States 104.24.107.73 104.24.106.73 29.videocdn.so CloudFlare Inc. 13335 United States 104.24.107.73 104.27.134.40 3.videocdn.pw CloudFlare Inc. 13335 United States 104.27.135.40 104.24.106.73 30.videocdn.so CloudFlare Inc. 13335 United States 104.24.107.73 104.27.134.40 301.videocdn.pw CloudFlare Inc. 13335 United States 104.27.135.40 104.27.134.40 302.videocdn.pw CloudFlare Inc. 13335 United States 104.27.135.40 104.27.134.40 303.videocdn.pw CloudFlare Inc. 13335 United States 104.27.135.40 104.27.134.40 7132.videocdn.pw CloudFlare Inc. 13335 United States 104.27.135.40 37.1.223.227 videocdn.tv ISPIRIA Networks Ltd 50673 58061 Netherlands 104.24.106.73 videocdn.so CloudFlare Inc. 13335 United States 104.24.107.73 104.24.124.147 videocdn.ca CloudFlare Inc. 13335 United States 104.24.125.147 ----- ###### Kodik This CDN is mainly used for cartoons and Asian films and TV series. The content is hosted on technical domains with the format *.get. kodik-storage.com. ----- **IP address** **Domain** **ISP** **ASN** **Location** 185.190.189.215 actinium.get.kodik-storage.com LLC Mnogobyte 47328 Netherlands 185.190.189.227 aluminum.get.kodik-storage.com LLC Mnogobyte 47328 Netherlands 176.58.54.194 argon.get.kodik-storage.com LLC Mnogobyte 199251 Russia 77.220.172.51 asgard.get.kodik-storage.com LLC Mnogobyte 42632 Russia 146.255.198.35 astatium.get.kodik-storage.com LLC Mnogobyte 42632 Russia 146.255.198.19 aurum.get.kodik-storage.com LLC Mnogobyte 42632 Russia 77.220.172.132 bbs.get.kodik-storage.com LLC Mnogobyte 42632 Russia 77.220.172.140 beryllium.get.kodik-storage.com LLC Mnogobyte 42632 Russia 185.190.189.211 bohrium.get.kodik-storage.com LLC Mnogobyte 47328 Netherlands 146.255.197.156 boron.get.kodik-storage.com LLC Mnogobyte 42632 Russia 176.58.51.195 buttercup.get.kodik-storage.com LLC Mnogobyte 199251 Russia 146.255.198.211 cadmium.get.kodik-storage.com LLC Mnogobyte 42632 Russia 77.220.172.148 calcium.get.kodik-storage.com LLC Mnogobyte 42632 Russia 146.255.197.61 carbon.get.kodik-storage.com LLC Mnogobyte 42632 Russia 176.58.54.195 chlorine.get.kodik-storage.com LLC Mnogobyte 199251 Russia 77.220.172.156 cobalt.get.kodik-storage.com LLC Mnogobyte 42632 Russia 77.220.172.164 cuprum.get.kodik-storage.com LLC Mnogobyte 42632 Russia 176.58.54.90 curium.get.kodik-storage.com LLC Mnogobyte 199251 Russia 146.255.198.219 dysprosium.get.kodik-storage.com LLC Mnogobyte 42632 Russia 176.58.54.69 einsteinium.get.kodik-storage.com LLC Mnogobyte 199251 Russia 146.255.199.35 elvis.get.kodik-storage.com LLC Mnogobyte 42632 Russia 176.58.46.207 ember.get.kodik-storage.com LLC Mnogobyte 199251 Russia 146.255.198.171 erbium.get.kodik-storage.com LLC Mnogobyte 42632 Russia 185.190.189.195 europium.get.kodik-storage.com LLC Mnogobyte 47328 Netherlands 176.58.54.203 fermium.get.kodik-storage.com LLC Mnogobyte 199251 Russia 77.220.172.75 fingerium.get.kodik-storage.com LLC Mnogobyte 42632 Russia 77.220.172.91 flerovium.get.kodik-storage.com LLC Mnogobyte 42632 Russia 146.255.199.59 flora.get.kodik-storage.com LLC Mnogobyte 42632 Russia 146.255.198.43 francium.get.kodik-storage.com LLC Mnogobyte 42632 Russia 146.255.198.59 gadolinium.get.kodik-storage.com LLC Mnogobyte 42632 Russia 77.220.172.99 gallium.get.kodik-storage.com LLC Mnogobyte 42632 Russia 176.58.48.48 get.kodik-cdn.com LLC Mnogobyte 199251 Russia 176.58.48.48 get.kodik-storage.com LLC Mnogobyte 199251 Russia 77.220.172.172 giza.get.kodik-storage.com LLC Mnogobyte 42632 Russia 176.58.46.203 grendel.get.kodik-storage.com LLC Mnogobyte 199251 Russia 185.190.189.219 hassium.get.kodik-storage.com LLC Mnogobyte 47328 Netherlands 77.220.172.117 holmium.get.kodik-storage.com LLC Mnogobyte 42632 Russia 146.255.198.11 iridium.get.kodik-storage.com LLC Mnogobyte 42632 Russia 77.220.172.83 jointinum.get.kodik-storage.com LLC Mnogobyte 42632 Russia 176.58.53.82 kalium.get.kodik-storage.com LLC Mnogobyte 199251 Russia ----- **IP address** **Domain** **ISP** **ASN** **Location** 77.220.173.3 kurt.get.kodik-storage.com LLC Mnogobyte 42632 Russia 176.58.54.207 livermorium.get.kodik-storage.com LLC Mnogobyte 199251 Russia 77.220.172.180 louvre.get.kodik-storage.com LLC Mnogobyte 42632 Russia 146.255.198.147 lutetium.get.kodik-storage.com LLC Mnogobyte 42632 Russia 146.255.198.243 magic.get.kodik-storage.com LLC Mnogobyte 42632 Russia 212.188.6.12 magnesium.get.kodik-storage.com PJSC MTS 8359 Russia 176.58.46.199 midgard.get.kodik-storage.com LLC Mnogobyte 199251 Russia 176.58.46.211 mimin.get.kodik-storage.com LLC Mnogobyte 199251 Russia 146.255.198.227 nailium.get.kodik-storage.com LLC Mnogobyte 42632 Russia 185.190.189.251 natrium.get.kodik-storage.com LLC Mnogobyte 47328 Netherlands 146.255.198.163 neon.get.kodik-storage.com LLC Mnogobyte 42632 Russia 185.190.189.243 neptunium.get.kodik-storage.com LLC Mnogobyte 47328 Netherlands 146.255.199.51 nika.get.kodik-storage.com LLC Mnogobyte 42632 Russia 77.220.172.250 niobium.get.kodik-storage.com LLC Mnogobyte 42632 Russia 77.220.172.196 nitrogen.get.kodik-storage.com LLC Mnogobyte 42632 Russia 146.255.197.67 osmium.get.kodik-storage.com LLC Mnogobyte 42632 Russia 146.255.197.236 oxygen.get.kodik-storage.com LLC Mnogobyte 42632 Russia 77.220.173.11 ozzy.get.kodik-storage.com LLC Mnogobyte 42632 Russia 77.220.172.19 pe.get.kodik-storage.com LLC Mnogobyte 42632 Russia 77.220.172.204 petra.get.kodik-storage.com LLC Mnogobyte 42632 Russia 146.255.198.189 phosphorus.get.kodik-storage.com LLC Mnogobyte 42632 Russia 146.255.198.3 platinum.get.kodik-storage.com LLC Mnogobyte 42632 Russia 77.220.172.227 plumbum.get.kodik-storage.com LLC Mnogobyte 42632 Russia 176.58.53.68 plutonium.get.kodik-storage.com LLC Mnogobyte 199251 Russia 146.255.198.27 polonium.get.kodik-storage.com LLC Mnogobyte 42632 Russia 77.220.172.212 potassium.get.kodik-storage.com LLC Mnogobyte 42632 Russia 185.190.189.203 promethium.get.kodik-storage.com LLC Mnogobyte 47328 Netherlands 185.190.189.239 protactinium.get.kodik-storage.com LLC Mnogobyte 47328 Netherlands 146.255.198.51 radium.get.kodik-storage.com LLC Mnogobyte 42632 Russia 176.58.46.215 rock.get.kodik-storage.com LLC Mnogobyte 199251 Russia 146.255.199.19 rocker.get.kodik-storage.com LLC Mnogobyte 42632 Russia 176.58.53.86 ruthenium.get.kodik-storage.com LLC Mnogobyte 199251 Russia 77.220.172.43 rutherfordium.get.kodik-storage.com LLC Mnogobyte 42632 Russia 185.190.189.199 samarium.get.kodik-storage.com LLC Mnogobyte 47328 Netherlands 176.58.54.199 scandium.get.kodik-storage.com LLC Mnogobyte 199251 Russia 185.190.189.223 seaborgium.get.kodik-storage.com LLC Mnogobyte 47328 Netherlands 176.58.53.76 silicium.get.kodik-storage.com LLC Mnogobyte 199251 Russia 77.220.172.67 skinium.get.kodik-storage.com LLC Mnogobyte 42632 Russia 146.255.198.179 sodium.get.kodik-storage.com LLC Mnogobyte 42632 Russia 185.190.189.207 stannum.get.kodik-storage.com LLC Mnogobyte 47328 Netherlands ----- **IP address** **Domain** **ISP** **ASN** **Location** 77.220.172.125 stibium.get.kodik-storage.com LLC Mnogobyte 42632 Russia 77.220.172.236 stonehenge.get.kodik-storage.com LLC Mnogobyte 42632 Russia 146.255.198.195 strontium.get.kodik-storage.com LLC Mnogobyte 42632 Russia 185.190.189.235 technetium.get.kodik-storage.com LLC Mnogobyte 47328 Netherlands 176.58.52.69 tellurium.get.kodik-storage.com LLC Mnogobyte 199251 Russia 146.255.198.139 terbium.get.kodik-storage.com LLC Mnogobyte 42632 Russia 77.220.172.187 thallium.get.kodik-storage.com LLC Mnogobyte 42632 Russia 185.190.189.231 thorium.get.kodik-storage.com LLC Mnogobyte 47328 Netherlands 77.220.172.59 tiberium.get.kodik-storage.com LLC Mnogobyte 42632 Russia 176.58.53.90 titanium.get.kodik-storage.com LLC Mnogobyte 199251 Russia 146.255.198.131 ununbium.get.kodik-storage.com LLC Mnogobyte 42632 Russia 146.255.198.155 uranium.get.kodik-storage.com LLC Mnogobyte 42632 Russia 77.220.172.244 vegas.get.kodik-storage.com LLC Mnogobyte 42632 Russia 77.220.172.27 vespene.get.kodik-storage.com LLC Mnogobyte 42632 Russia 146.255.198.203 yttrium.get.kodik-storage.com LLC Mnogobyte 42632 Russia 185.129.100.109 kodik.cc DDOS-GUARD LTD 57724 Russia 185.129.100.109 kodik.online DDOS-GUARD LTD 57724 Russia 185.129.100.109 hdrise.com DDOS-GUARD LTD 57724 Russia 185.129.100.109 kodik.biz DDOS-GUARD LTD 57724 Russia 185.129.100.109 kodikdb.com DDOS-GUARD LTD 57724 Russia ----- ###### Videoframe The main domain is iframe.video. The content is delivered through technical domains with the for- mat *.cdn.videoframe.space. The CDN also has its own video streaming service, rknfilms.com (formerly smotrihd.com). ----- **IP address** **Domain** **ISP** **ASN** **Location** 83.222.106.83 iframe.video LLC Mnogobyte 42632 Russia 212.76.137.114 videoframe.space LLC Mnogobyte 42632 Russia 176.58.48.48 cdn.videoframe.space LLC Mnogobyte 199251 Russia 176.58.54.194 argon.cdn.videoframe.space LLC Mnogobyte 199251 Russia 146.255.198.35 astatium.cdn.videoframe.space LLC Mnogobyte 42632 Russia 77.220.172.140 beryllium.cdn.videoframe.space LLC Mnogobyte 42632 Russia 146.255.197.156 boron.cdn.videoframe.space LLC Mnogobyte 42632 Russia 77.220.172.148 calcium.cdn.videoframe.space LLC Mnogobyte 42632 Russia 146.255.197.61 carbon.cdn.videoframe.space LLC Mnogobyte 42632 Russia 77.220.172.99 gallium.cdn.videoframe.space LLC Mnogobyte 42632 Russia 77.220.172.172 giza.cdn.videoframe.space LLC Mnogobyte 42632 Russia 176.58.54.200 krypton.cdn.videoframe.space LLC Mnogobyte 199251 Russia 77.220.172.180 louvre.cdn.videoframe.space LLC Mnogobyte 42632 Russia 212.188.6.12 magnesium.cdn.videoframe.space PJSC MTS 8359 Russia 146.255.198.163 neon.cdn.videoframe.space LLC Mnogobyte 42632 Russia 77.220.172.196 nitrogen.cdn.videoframe.space LLC Mnogobyte 42632 Russia 146.255.197.236 oxygen.cdn.videoframe.space LLC Mnogobyte 42632 Russia 77.220.172.204 petra.cdn.videoframe.space LLC Mnogobyte 42632 Russia 146.255.198.189 phosphorus.cdn.videoframe.space LLC Mnogobyte 42632 Russia 77.220.172.227 plumbum.cdn.videoframe.space LLC Mnogobyte 42632 Russia 77.220.172.212 potassium.cdn.videoframe.space LLC Mnogobyte 42632 Russia 146.255.199.75 rubidium.cdn.videoframe.space LLC Mnogobyte 42632 Russia 146.255.198.179 sodium.cdn.videoframe.space LLC Mnogobyte 42632 Russia 77.220.172.236 stonehenge.cdn.videoframe.space LLC Mnogobyte 42632 Russia 146.255.198.195 strontium.cdn.videoframe.space LLC Mnogobyte 42632 Russia 77.220.172.187 thallium.cdn.videoframe.space LLC Mnogobyte 42632 Russia 146.255.198.131 ununbium.cdn.videoframe.space LLC Mnogobyte 42632 Russia 77.220.172.244 vegas.cdn.videoframe.space LLC Mnogobyte 42632 Russia 83.222.96.28 rknfilms.com LLC Mnogobyte 42632 Russia 212.76.138.158 frameloader.xyz LLC Mnogobyte 42632 Russia 212.76.138.154 smotrihd.com LLC Mnogobyte 42632 Russia ----- ###### Bazon The main domain is bazon.to. Videos are streamed using technical domains with the format *.bazonserver.site, *.bazon.site and *.bazon.to. ----- **IP address** **Domain** **ISP** **ASN** **Location** 95.215.205.213 yohoho.bazon.site FAFBO Private Enterprise 204601 Netherlands 50.7.184.42 atom.bazonserver.site FDCservers.net 174 30058 50.7.222.114 alpha.bazonserver.site FDCservers.net 174 30058 50.7.115.3 beta.bazonserver.site FDCservers.net 174 30058 50.7.222.114 higgs.bazonserver.site FDCservers.net 174 30058 50.7.173.90 red.bazonserver.site FDCservers.net 174 30058 United States United States United States United States United States 95.215.205.213 bazon.cc FAFBO Private Enterprise 204601 Netherlands 95.215.205.213 bazon.to FAFBO Private Enterprise 204601 Netherlands 104.24.108.197 videobase.ml CloudFlare Inc. 13335 United States 104.24.109.197 95.215.205.213 czx.bazon.site FAFBO Private Enterprise 204601 Netherlands 95.215.205.213 v1576210739.bazon.to FAFBO Private Enterprise 204601 Netherlands 95.215.205.213 v1576240051.bazon.to FAFBO Private Enterprise 204601 Netherlands 95.215.205.213 v1577426573.bazon.to FAFBO Private Enterprise 204601 Netherlands 95.215.205.213 v1578068587.bazon.site FAFBO Private Enterprise 204601 Netherlands 95.215.205.213 v1578668593.bazon.site FAFBO Private Enterprise 204601 Netherlands 95.215.205.213 v1581401604.bazon.site FAFBO Private Enterprise 204601 Netherlands 95.215.205.213 v1581404376.bazon.site FAFBO Private Enterprise 204601 Netherlands 95.215.205.213 v1584421543.bazon.site FAFBO Private Enterprise 204601 Netherlands 95.215.205.213 v1585317741.bazon.site FAFBO Private Enterprise 204601 Netherlands 95.215.205.213 v1585659568.bazon.site FAFBO Private Enterprise 204601 Netherlands 95.215.205.213 v1586362728.bazon.site FAFBO Private Enterprise 204601 Netherlands 95.215.205.213 v1586712062.bazon.site FAFBO Private Enterprise 204601 Netherlands 95.215.205.213 v1587343332.bazon.site FAFBO Private Enterprise 204601 Netherlands 95.215.205.213 v1587472635.bazon.site FAFBO Private Enterprise 204601 Netherlands 95.215.205.213 higgs.bazon.to FAFBO Private Enterprise 204601 Netherlands ----- ###### Ustore The main domain is ustore.bz. Videos are streamed using technical domains with the format *.u-cdn.org and *. u-stream.in. ----- **IP address** **Domain** **ISP** **ASN** **Location** 185.128.41.59 start.u-play.pro Grupo Panaglobal 15 S.A 39782 Switzerland 185.128.41.58 ustore.bz Grupo Panaglobal 15 S.A 39782 Switzerland 109.236.84.105 ct1.u-cdn.org WorldStream B.V. 49981 Netherlands 185.132.133.99 ct2.u-cdn.org WorldStream B.V. 49981 Netherlands 185.132.179.144 ct3.u-cdn.org WorldStream B.V. 49981 Netherlands 185.180.221.167 ct4.u-cdn.org WorldStream B.V. 49981 Netherlands 190.2.153.136 ct5.u-cdn.org WorldStream B.V. 49981 Netherlands 212.8.248.100 ct6.u-cdn.org WorldStream B.V. 49981 Netherlands 185.21.60.72 ct7.u-cdn.org WorldStream B.V. 49981 Netherlands 217.23.8.221 ct8.u-cdn.org WorldStream B.V. 49981 Netherlands 89.38.99.46 ct9.u-cdn.org WorldStream B.V. 49981 Netherlands 149.202.203.79 s1.u-cdn.org OVH SAS 16276 France 193.70.13.83 s2.u-cdn.org OVH SAS 16276 France 193.70.13.83 s3.u-cdn.org OVH SAS 16276 France 193.70.13.83 s4.u-cdn.org OVH SAS 16276 France 149.202.203.79 s5.u-cdn.org OVH SAS 16276 France 193.70.13.83 s6.u-cdn.org OVH SAS 16276 France 193.70.13.76 s7.u-cdn.org OVH SAS 16276 France 190.2.143.109 download1.u-cdn.xyz WorldStream B.V. 49981 Netherlands 50.7.172.138 s1.u-cdn.xyz FDCservers.net 174 30058 United States 109.236.84.105 ct1.u-cdn.xyz WorldStream B.V. 49981 Netherlands 185.132.133.99 ct2.u-cdn.xyz WorldStream B.V. 49981 Netherlands 185.132.179.144 ct3.u-cdn.xyz WorldStream B.V. 49981 Netherlands 176.58.48.48 u-stream.in MnogoByte LLC 199251 Russia 77.220.172.83 jointinum.u-stream.in MnogoByte LLC 42632 Russia ----- ###### Alloha The main domain is alloha.tv. Videos are streamed using technical domains with the format *.streamalloha.live. ----- **IP address** **Domain** **ISP** **ASN** **Location** 94.130.136.80 sbl-99-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 138.201.130.77 sbl-98-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 46.4.69.7 sbl-97-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 148.251.123.13 sbl-96-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 148.251.188.234 sbl-95-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 138.201.130.75 sbl-94-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 176.9.30.234 sbl-93-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 195.201.161.122 sbl-92-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 178.63.44.171 sbl-91-v3.streamalloha.live Hetzner Online GmbH 24940 Germany 138.201.202.23 sbl-90-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 116.202.223.19 sbl-89-v3.streamalloha.live Hetzner Online GmbH 24940 Germany 138.201.59.92 sbl-88-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 78.46.22.15 sbl-87-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 138.201.82.100 sbl-86-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 138.201.205.160 sbl-85-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 94.130.10.154 sbl-84-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 88.99.147.100 sbl-83-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 138.201.66.2 sbl-82-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 88.99.70.178 sbl-81-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 88.99.69.7 sbl-80-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 116.202.208.147 sbl-79-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 178.63.84.248 sbl-78-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 176.9.114.66 sbl-77-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 176.9.84.74 sbl-76-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 51.83.238.224 sbl-75-v2.streamalloha.live OVH Sp. z o. o. 16276 France 50.7.144.2 sbl-74-v2.streamalloha.live FDCservers.net 174 30058 50.7.231.114 sbl-73-v2.streamalloha.live FDCservers.net 174 30058 United States United States 5.9.137.44 sbl-72-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 5.9.123.119 sbl-71-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 5.9.65.179 sbl-70-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 46.4.95.146 sbl-69-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 144.76.139.3 sbl-68-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 144.76.138.243 sbl-67-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 144.76.30.215 sbl-66-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 78.46.174.189 sbl-65-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 5.9.137.30 sbl-64-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 144.76.32.230 sbl-63-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 144.76.71.134 sbl-62-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 144.76.75.239 sbl-61-v2.streamalloha.live Hetzner Online GmbH 24940 Germany ----- **IP address** **Domain** **ISP** **ASN** **Location** 144.76.42.209 sbl-60-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 144.76.163.81 sbl-59-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 46.4.123.45 sbl-58-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 51.89.227.119 sbl-57-v2.streamalloha.live OVH Ltd 16276 France 51.178.63.160 sbl-56-v2.streamalloha.live OVH SAS 16276 France 95.216.12.121 sbl-55-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 95.216.13.96 sbl-54-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 176.9.73.215 sbl-53-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 5.9.121.34 sbl-52-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 176.9.85.43 sbl-51-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 176.9.111.47 sbl-50-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 176.9.48.147 sbl-49-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 176.9.45.67 sbl-48-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 144.76.91.102 sbl-47-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 5.9.19.55 sbl-46-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 144.76.0.240 sbl-45-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 148.251.187.43 sbl-44-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 144.76.173.217 sbl-43-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 144.76.157.166 sbl-42-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 144.76.85.148 sbl-41-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 144.76.94.123 sbl-40-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 88.198.35.164 sbl-39-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 176.9.83.226 sbl-38-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 144.76.16.227 sbl-37-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 5.9.136.122 sbl-36-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 5.9.62.125 sbl-35-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 176.9.70.182 sbl-33-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 88.198.0.41 sbl-32-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 176.9.101.16 sbl-31-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 5.9.148.80 sbl-30-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 88.198.67.51 sbl-29-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 5.9.151.114 sbl-28-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 144.76.39.139 sbl-27-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 176.9.114.144 sbl-26-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 176.9.146.211 sbl-25-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 176.9.85.201 sbl-24-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 144.76.172.52 sbl-23-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 144.76.61.208 sbl-22-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 5.9.139.244 sbl-21-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 176.9.125.81 sbl-20-v2.streamalloha.live Hetzner Online GmbH 24940 Germany ----- **IP address** **Domain** **ISP** **ASN** **Location** 176.9.104.237 sbl-19-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 176.9.114.210 sbl-18-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 213.239.209.172 sbl-17-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 78.46.72.109 sbl-121-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 176.9.149.239 sbl-120-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 176.9.107.138 sbl-119-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 51.178.179.38 sbl-118-v2.streamalloha.live OVH SAS 16276 France 176.9.19.73 sbl-117-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 138.201.81.133 sbl-116-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 138.201.85.31 sbl-115-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 88.99.216.190 sbl-114-v3.streamalloha.live Hetzner Online GmbH 24940 Germany 138.201.137.219 sbl-113-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 116.202.228.188 sbl-112-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 88.99.102.142 sbl-111-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 88.99.147.168 sbl-110-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 176.9.85.56 sbl-109-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 176.9.99.220 sbl-108-v2.streamalloha.live Hetzner Online GmbH 24940 Germany 149.202.26.226 alienist.allohalive.com Malets Alexei Alexeevich 16276 France (OVH network is used) 149.202.26.226 bayas.allohalive.com Malets Alexei Alexeevich 16276 France (OVH network is used) 149.202.26.226 best.allohalive.com Malets Alexei Alexeevich 16276 France (OVH network is used) 149.202.26.226 bob.allohalive.com Malets Alexei Alexeevich 16276 France (OVH network is used) 149.202.26.226 klipzona.allohalive.com Malets Alexei Alexeevich 16276 France (OVH network is used) 149.202.26.226 pope.allohalive.com Malets Alexei Alexeevich 16276 France (OVH network is used) 194.88.104.22 sbl.streamalloha.live WorldStream B.V. 49981 Netherlands ----- ###### Protonvideo The main domain is protonvideo.to. Videos are streamed using technical domains with the format *.cdn.protonvideo.to. ----- **IP address** **Domain** **ISP** **ASN** **Location** 146.255.198.35 astatium.cdn.protonvideo.to LLC Mnogobyte 42632 Russia 146.255.198.19 aurum.cdn.protonvideo.to LLC Mnogobyte 42632 Russia 77.220.172.132 bbs.cdn.protonvideo.to LLC Mnogobyte 42632 Russia 77.220.172.140 beryllium.cdn.protonvideo.to LLC Mnogobyte 42632 Russia 146.255.198.211 cadmium.cdn.protonvideo.to LLC Mnogobyte 42632 Russia 77.220.172.148 calcium.cdn.protonvideo.to LLC Mnogobyte 42632 Russia 176.58.48.48 cdn.protonvideo.to LLC Mnogobyte 199251 Russia 77.220.172.156 cobalt.cdn.protonvideo.to LLC Mnogobyte 42632 Russia 146.255.199.35 elvis.cdn.protonvideo.to LLC Mnogobyte 42632 Russia 146.255.198.171 erbium.cdn.protonvideo.to LLC Mnogobyte 42632 Russia 77.220.172.75 fingerium.cdn.protonvideo.to LLC Mnogobyte 42632 Russia 77.220.172.91 flerovium.cdn.protonvideo.to LLC Mnogobyte 42632 Russia 54.36.106.81 flerovium.protonvideo.to OVH SAS 16276 France 146.255.199.59 flora.cdn.protonvideo.to LLC Mnogobyte 42632 Russia 146.255.198.43 francium.cdn.protonvideo.to LLC Mnogobyte 42632 Russia 146.255.198.59 gadolinium.cdn.protonvideo.to LLC Mnogobyte 42632 Russia 77.220.172.99 gallium.cdn.protonvideo.to LLC Mnogobyte 42632 Russia 77.220.172.172 giza.cdn.protonvideo.to LLC Mnogobyte 42632 Russia 77.220.172.117 holmium.cdn.protonvideo.to LLC Mnogobyte 42632 Russia 146.255.198.11 iridium.cdn.protonvideo.to LLC Mnogobyte 42632 Russia 77.220.172.83 jointinum.cdn.protonvideo.to LLC Mnogobyte 42632 Russia 77.220.172.180 louvre.cdn.protonvideo.to LLC Mnogobyte 42632 Russia 146.255.198.147 lutetium.cdn.protonvideo.to LLC Mnogobyte 42632 Russia 146.255.198.243 magic.cdn.protonvideo.to LLC Mnogobyte 42632 Russia 146.255.199.43 mortis.cdn.protonvideo.to LLC Mnogobyte 42632 Russia 146.255.198.227 nailium.cdn.protonvideo.to LLC Mnogobyte 42632 Russia 146.255.198.235 nickel.cdn.protonvideo.to LLC Mnogobyte 42632 Russia 146.255.199.51 nika.cdn.protonvideo.to LLC Mnogobyte 42632 Russia 77.220.172.250 niobium.cdn.protonvideo.to LLC Mnogobyte 42632 Russia 77.220.172.196 nitrogen.cdn.protonvideo.to LLC Mnogobyte 42632 Russia 146.255.197.67 osmium.cdn.protonvideo.to LLC Mnogobyte 42632 Russia 146.255.197.236 oxygen.cdn.protonvideo.to LLC Mnogobyte 42632 Russia 77.220.173.11 ozzy.cdn.protonvideo.to LLC Mnogobyte 42632 Russia 77.220.172.204 petra.cdn.protonvideo.to LLC Mnogobyte 42632 Russia 146.255.198.189 phosphorus.cdn.protonvideo.to LLC Mnogobyte 42632 Russia 77.220.172.227 plumbum.cdn.protonvideo.to LLC Mnogobyte 42632 Russia 146.255.198.27 polonium.cdn.protonvideo.to LLC Mnogobyte 42632 Russia 77.220.172.212 potassium.cdn.protonvideo.to LLC Mnogobyte 42632 Russia 31.220.40.67 protonvideo.to Amarutu Technology Ltd 206264 Netherlands 146.255.198.51 radium.cdn.protonvideo.to LLC Mnogobyte 42632 Russia ----- **IP address** **Domain** **ISP** **ASN** **Location** 146.255.199.19 rocker.cdn.protonvideo.to LLC Mnogobyte 42632 Russia 146.255.199.27 rockstar.cdn.protonvideo.to LLC Mnogobyte 42632 Russia 77.220.172.43 rutherfordium.cdn.protonvideo.to LLC Mnogobyte 42632 Russia 146.255.199.67 selenium.cdn.protonvideo.to LLC Mnogobyte 42632 Russia 77.220.172.220 silicon.cdn.protonvideo.to LLC Mnogobyte 42632 Russia 77.220.172.67 skinium.cdn.protonvideo.to LLC Mnogobyte 42632 Russia 77.220.172.236 stonehenge.cdn.protonvideo.to LLC Mnogobyte 42632 Russia 146.255.198.195 strontium.cdn.protonvideo.to LLC Mnogobyte 42632 Russia 146.255.198.139 terbium.cdn.protonvideo.to LLC Mnogobyte 42632 Russia 77.220.172.187 thallium.cdn.protonvideo.to LLC Mnogobyte 42632 Russia 77.220.172.59 tiberium.cdn.protonvideo.to LLC Mnogobyte 42632 Russia 185.132.179.155 u1.protonvideo.to WorldStream B.V. 49981 Netherlands 178.132.0.30 u2.protonvideo.to WorldStream B.V. 49981 Netherlands 62.112.8.18 u3.protonvideo.to WorldStream B.V. 49981 Netherlands 190.2.153.12 u4.protonvideo.to WorldStream B.V. 49981 Netherlands 185.180.223.78 u5.protonvideo.to WorldStream B.V. 49981 Netherlands 185.177.124.26 u6.protonvideo.to WorldStream B.V. 49981 Netherlands 190.2.140.12 u7.protonvideo.to WorldStream B.V. 49981 Netherlands 146.255.198.131 ununbium.cdn.protonvideo.to LLC Mnogobyte 42632 Russia 77.220.172.244 vegas.cdn.protonvideo.to LLC Mnogobyte 42632 Russia 77.220.172.27 vespene.cdn.protonvideo.to LLC Mnogobyte 42632 Russia 146.255.198.203 yttrium.cdn.protonvideo.to LLC Mnogobyte 42632 Russia ----- #### $140 the profit of the beginners as part of the Melbet partner program in the first month #### $21,000+ made by bookmakers with well‑developed partner programs per month ## The economics of illegal resources ###### As part of their anti-piracy and brand protection activities, Group-IB specialists used the follow-the-money approach to identify who profited from unlawful activities. It was found that illegal casinos and bookmakers were the main beneficiaries and drivers of illicit video streaming services and pirated sports video streaming services. Although other monetization methods exist, online casino and book- maker partner programs are still the main way to generate income in the piracy business. Pirate websites act as advertising platforms designed to attract new users. In most gambling partner programs, compensation is a per- centage of the sum lost by online players. For the largest partners, other terms can be established accord- ing to the CPA (cost per action) model. In this case, compensation is paid for an agreed list of player actions and does not depend on the sum lost. There are usually three kinds of advertising materials: • partner links; • promo codes; • banners. Partner links and banners are most often used on websites, while broadcasts and videos contain promo codes and ads of their own domains. To keep statistics and track visits, links and banners have unique IDs (referral codes) that help identify what website a user has come from. If advertising is embedded into streamed video content, promo codes are used for the same purpose. To ensure that promo codes are used during registration, players are offered a small bonus, often paid by the organizer of the pirate video broadcast (the bonus is later subtracted from the final compensation for the online player the orga- nizer attracted). The bonuses mean that it is more profitable for players to register using referral links or promo codes. Active players, let alone those addicted to gambling, can have multiple accounts to diversify risks related to money withdrawal and account blocking. The main advertisers in sports streaming are 1xBet, Melbet, Parimatch, Linebet, Orca88, Bwin, and others. A streaming service’s average revenue is between 20% and 40% of the sum lost by the players it attracted (depending on the partner program). As compensation is dependent on how lucky the online players are, it is impossible to forecast the revenue for each project. Moreover, passive income from previously attracted players grows over time. As part of the Melbet partner program, beginners make $140 in their first month on average (for resources with over 7,000 subscribers and more than 14,000 views per day). Customers who take part in the Melbet program for a long time can reach revenues of up to $21,000 per month (for resources with an average of 70-80 players attracted daily). ----- ###### Statistics:[10] Example of revenue from the partner program forum* ###### Although some partner program participants have high profits, it should be noted that online casinos and bookmakers often use schemes to reduce commission sums. For example, regular pay- ments may be delayed or cancelled altogether under various pre- texts. Traffic and the number of players attracted may be underre- ported, as may sums lost by the players. Statistics may be mixed with fake data simulating frequently winning players. What’s more, nearly all bookmakers cut the account balances for players who have considerable profits in the long run. As a result, accounts belonging to partner program participants may even fall below zero. 10 The statistics were provided by participants of the Melbet partner program. This may have been done for advertising purposes and the information might not be factual or accurate. - Hereinafter screenshots in Russian will be provided together with a translation into English ----- Reviews by scammed webmasters ----- #### 1xBet **Founded:** 2007 **Website:** 1xBet.com ###### General information A perfect example of actively promoting a gambling brand online is the history of 1xBet. 1xBet is a betting company founded in 2006. Mediascope, spe- cialized in media research, estimates that in Q1 2019 1xBet came third in the top 10 list of advertisers in the online videos segment, with 2.4% (by comparison, Google topped the list and had 3.3%). According to the year-end results of 2019, however, the company did not make it to the list due to active measures against online gambling. At the moment, various experts estimate that the com- pany is not even on the list of the top 30 advertisers in Russia. The bookmaker’s primary audience includes residents of develop- ing countries (India, Brazil, Thailand, and post-Soviet countries). In 2009, Russia passed a law that banned non-certified gambling organizations. Two years later, the Russian government had claims against 1xBet for the first time. In 2016, access to the main domain 1xBet.com was restricted in Russia. To prevent losses, 1xBet took two steps: 1. It expanded its development beyond the post-Soviet region. 2. It took measures to bypass blocking: numerous mirror sites (over 800) were created and an ad system involving pirate traffic (voiceover studios, camrip groups) was developed. Entry into the markets of developing countries After being blocked in Russia, 1xBet owners shifted their focus to: • Latin America (primarily Brazil); • India; • Thailand. Like Russia, these regions and countries have the following characteristics: 1. They are developing countries. 2. Their inhabitants are mainly non-English speakers. 3. Their populations have a low financial literacy. 4. Sports streaming is highly popular. ----- ###### Links with piracy in the post-Soviet region Official advertising services rarely work together with pirate por- tals. In their license agreements, major aggregators such as Yan- dex and Google have paragraphs that ban the use of content without the copyright holder’s consent. This resulted in a symbiosis of gambling companies and pirate traffic. In September 2015, 1xBet, together with the voiceover studio Baibako team, published their first ever joint release, with their ads integrated into the video. First time that 1xBet work together with with pirates voiceover studio ----- ###### Based on the analysis of conversations on specialized forums, since 2015, 1xBet is likely to have sponsored content for 17 TV show voiceover studios (i.e. 80% of major voiceover studios). **Voiceover studio** **Collaboration start date** **Content** Baibako September 26, 2015 TV series/movies Gears Media November 29, 2016 TV series Coldfilm January 17, 2017 TV series Green Рай [Green Rai] April 1, 2017 TV series/movies NewStudio March 7, 2017 TV series Idea film May 24, 2017 TV series Omsk Bird May 18, 2017 TV series/movies Hamster studio October 9, 2018 TV series Alexfilm March 5, 2018 TV series/movies Jaskier June 17, 2017 TV series/movies Sunshine Studio November 7, 2017 TV series Good People August 12, 2017 TV series/doramas Kansai Studio August 3, 2017 Animation Gostfilm March 26, 2018 TV series Alternative Production November 28, 2018 TV series Синема УС [Cinema US] February 01, 2019 TV series Музобоз / Колобок February 01, 2019 Movies [Muzoboz / Kolobok] ###### 1xBet has been one of the main sponsors of illegal distribution of TV series in the post-Soviet region since 2017. **Year** **Number of studios working with 1xBet** 2015 1 2016 2 2017 9 2018 14 2019 17 ###### Collaboration with voiceover studios was based on the follow- ing pattern: a voiceover studio would inform an 1xBet advertising manager about a possibility to produce content and 1xBet would pay for it. This meant that 1xBet did not participate in content pro- duction (did not order any specific content) but sponsored it. Its collaboration with camrip groups was similar. Voiceover studies and their representatives searched for digital copies of content released abroad. The more relevant the content, the more 1xBet paid for it. ----- #### $55 is the average cost of voiceover services paid by 1xBet for one episode #### up to 80% of pirate resources in post‑Soviet countries contained 1xBet advertisements #### Koshara × 1xBet Launched together 100 camrips ###### The average cost of voiceover services for one episode amounted to about $55.[11] For a movie already released online, the cost was $65-$70. 1xBet spent between $5,000 and $8,300 on average per month on sponsoring voiceover studios and creating camrips in the post-Soviet region. If we look at the history of camrips, the average cost of produсing one camrip amounted to between $400 and $1,000 (depending on the copy’s quality and the content’s popularity). As for integrating ads into the pre-rolls of pirate CDNs, collabora- tion has been ongoing since 2016. As such, 1xBet ads have been placed on more than 80% of all pirate resources in post-Soviet countries. The total number of content items voiced over with 1xBet’s sup- port in post-Soviet countries amounts to over 900 (movies and TV series). Beginning of interaction with Koshara/Octopus team In February 2019, the group Koshara started acting as an intermediary between 1xBet and voiceover studios. Around the same time, this release-group began creating camrips with hardcoded 1xBet ads for post-Soviet countries. Koshara still makes its own camrips regardless of 1xBet, which is why 1xBet ads often appear several times in different versions of a camrip. The first time is when a voiceover studio edits an overseas camrip; the second time is when a camrip is created locally. In addition to producing content, Koshara commits to distributing content by placing it on more than eight major torrent tracker services (including its own website) and uploading it to two CDNs after the content is released. Since 1xBet started working with Koshara, over 100 camrips have been released, which amounts to an average of three per week. 11 The costs shown are for the post-Soviet region; content production costs for India are unknown. ----- ###### Piracy connections worldwide 1xBet.com traffic map (according to similarweb.com) ###### 1xBet started creating content for overseas countries in 2018. Total camrip releases: over 500. Total titles covered: over 270. Distribution by language: • 100% of camrips are in English; • 14% of camrips are in Spanish; • 5% of camrips are in other languages (Tamil, Portuguese, Thai, Hindi, and others). On average, 1xBet released four camrip versions of films per week. ----- #### Lucky Partners & Welcome Partners **Website:** https://luckypartners.biz/ **Foundation** Lucky Partners founded by Rustam Gilfanov **In 2011,** Lucky Partnerns moved from Moscow to Kiev due to Ukraine’s less strict gambling laws **In 2013,** Lucky Partners started collaborating with a Ukrainian entrepreneur **In 2020,** The conflict between Lucky Partners and Welcome Partners has lasted for over six years ###### General information For a long time, the two partner programs Lucky Partners and Wel- come Partners were the main participants involved in the under- ground online casino market. According to media reports, Lucky Partners was founded by Rus- tam Gilfanov. His partner was Sergey Tokarev.[12] In 2011, Lucky Partnerns moved from Moscow to Kiev due to Ukraine’s less strict gambling laws.[13] Welcome Partners was founded by a Ukrainian entrepreneur, the owner of many Ukrainian online casinos and popular dating websites. Lucky Partners started collaborating with the Welcome Partners leadership in 2013. However, they later had a conflict, which has been ongoing for over six years. Business practices Both partner programs use two types of illegal online casinos: licensed and non-licensed. In several countries, including in Europe, laws generally allow for online casinos to operate. As such, some developers provide software for online casinos that comply with gambling regula- tions. In such casinos, winning is possible and winnings are based on a mathematical algorithm that ensures that the casino always has some profit. These casinos are considered licensed. In the case of non-licensed casinos, similar software is installed, but it is cracked and allows setting arbitrary betting odds, including in a way that makes winning impossible. It is worth mentioning that Lucky Partners try to distance them- selves from the most well-known casinos, particularly Azino777, but media outlets have confirmed that this casino is in fact one of their projects. Along with online casinos, partner programs are involved in other gambling-type projects: small Forex brokers and binary options (a business that deals with bets on currencies and cryptocurren- cies, which in general is banned by international payment systems, Russian law, and the laws of European countries), various lotteries, and other similar products. Lucky Partners and Welcome Partners stay away from Fonbet and 1xBet, the leaders of the bookmaker industry. Nevertheless, both support the gambling industry. 12 [https://www.rbc.ru/magazine/2018/07/5b3f96df9a79475e9f9f5045](https://www.rbc.ru/magazine/2018/07/5b3f96df9a79475e9f9f5045) 13 [https://rb.ru/longread/unlucky-labs/](https://rb.ru/longread/unlucky-labs/) ----- #### $25,000+ is a fine for violating the MCC 7995 requirement ###### Accepting payments International payment systems require that almost all aforementioned types of businesses be registered with a special transaction code, MCC 7995. This is the code that was blocked in the US to stop online casino transactions. Violating the MCC 7995 requirement incurs significant fines starting at $25,000 for each incident. In addition, banks assign MCC codes based on data that companies themselves provide. To be able to operate in Russia, online casinos specify other MCC codes. For example, Azino used the code 6012 (sale of certificates and consulting services as well as loan payments), while the actual recipient was the company Victory 777 N.V, which held a Curaçao license.[14 ]In December 2018, the company was placed on the list of entities for which there is information that they organize and host gambling games in violation of Russian law. This list is kept by the Russian Federal Tax Service and includes 42 companies. It was last updated in August 2019. To verify payment information, Group-IB specialists used the website https://affgambler.ru/blacklisted-casinos, which lists the most popular licensed and non-licensed online casinos. Analysis suggests that all popular online casinos use exclusively Russian banks[15] to accept payments, despite the fact that the owners are based in Ukraine. None of the banks use MCC 7995 for this activity even though there are technical solutions that help automatically check websites connected to the processing system for illegal content (including related to online casinos). Such actions by banks are ignored by the international payment systems Visa and Mastercard and the Russian system Mir, which runs counter to both the rules of the payment systems themselves and the provisions of the Central Bank of Russia. There are almost no international precedents of online casinos or bookmakers violating MCC 7995. Under the rules of international payment systems, this type of violation is one of the most serious ones, second only to payments for child pornography. 14 [https://www.rbc.ru/magazine/2018/07/5b3f96df9a79475e9f9f5045](https://www.rbc.ru/magazine/2018/07/5b3f96df9a79475e9f9f5045) 15 The names of the banks have not been disclosed in the report’s public version for confidentiality reasons. This information has been provided to relevant government agencies. ----- ###### In Russia, Visa and Mastercard parent organizations fail to address the ubiquitous violations. The reason could be their poor understanding of the scale of online piracy in Russia and the monetization of this business through the gaming industry. As such, we have shared this report with the parent organizations of the payment systems. Distributing payments For outgoing financial flows (namely players’ winnings and commission payouts to webmasters for ads), acquiring banks usually act as intermediaries. Payouts to webmasters seem to be carried out through the online bank capitalist.net. Attracting advertising Attracting ad traffic to the aforementioned projects is done in two ways. The first method is advertising in the webmaster community, which centers around the forums gofuckbiz.net, maultalk.com, and armadaboard.com. Community members meet at various offline events, mainly overseas to avoid the attention of law enforcers. According to the information available, these forums also belong to capitalist.net. The second method involves ads through pirate websites using specialized advertising agencies. One of such agencies is Adwise Agency, whose links with Lucky Labs were confirmed by the media.[16 ]Adwise Agency has been suspected of having links with illegal online gambling and pirate websites (e.g. Kinogo, HDRezka, Filmix, Kinoprofi), including by law enforcement agencies. In February 2020, the Cyber Police of Ukraine searched Adwise Agency’s offices in relation to the funding of the pirate websites kinosha.se, kinanema.net, kinoprofi.vip, rezka.ag, and filmix.co.[17] 16 [https://www.rbc.ru/magazine/2018/07/5b3f96df9a79475e9f9f5045](https://www.rbc.ru/magazine/2018/07/5b3f96df9a79475e9f9f5045) 17 [https://ain.ua/2020/02/28/obyski-u-adwise/](https://ain.ua/2020/02/28/obyski-u-adwise/) ----- #### ZeroCDN (Mnogobyte) **The project’s websites:** https://zerocdn.com/ https://mnogobyte.ru/ **INN[18]** 7733572160 **OGRN[19]** 1067746757176 **Legal address:** 12 Tushinskaya St., Moscow, Russia **Office address:** 39 Leningradskaya St., Bld. 6, Fl.14 ## Russian infrastructure of illegal resources ###### ZeroCDN, which belongs to the Russian company Mnogobyte, is one of the most popular services used for placing and distribut- ing video content. As at late 2019, the ZeroCDN project infrastruc- ture was used by 38% to 60% of pirate websites. The following CDNs were found to use ZeroCDN servers: • VideoCDN (the third most popular CDN, used by up to 33% of pirate websites); • Kodik; • Videoframe; • Protonvideo. In addition, ZeroCDN servers are used by some separate projects, in particular Hdrezka (over 52 million visitors per month) and Kinogo (more than 35 million visitors per month). The company’s website mentions that the Mnogobyte network has direct connections to major Russian communications ser- vice providers, including Beeline, MTS, and TransTelecom, as well as Moscow-based and regional operators. Major Ukrainian com- munications service providers (Eurotel, Dataline, Datagroup, and Topnet) and Belarus’ largest telecommunications service pro- vider Beltelecom are also connected to the Mnogobyte network. What’s more, Mnogobyte is part of several Internet Exchange Points (MSK-IX, DATA-IX, W-IX, Global-IX). In 2015, the company launched the ZeroCDN project, the aim of which was to store and transfer large amounts of media content. Since 2017, the company has been officially working with the Swiss solutions provider DigitalOne AG.[20] 18 Taxpayer identification number 19 Principle state registration number 20 [https://hosting.kitchen/mnogobyte/mnogobayt-i-digitalone-ag-podpisali-dogovor.html](https://hosting.kitchen/mnogobyte/mnogobayt-i-digitalone-ag-podpisali-dogovor.html) ----- #### DDOS-GUARD **Address** Suite 11, Floor 5, 276 Maksima Gorkogo St., Rostov Region, Russia **INN** 9204005780 **OGRN** 1149204010988 **KPP[21]** 616701001 **Website** https://ddos-guard.net/en **IP address ranges** 45.155.60.0/24 185.129.100.0/22 185.129.101.0/24 185.129.102.0/24 185.129.103.0/24 185.178.208.0/24 185.178.209.0/24 185.178.210.0/24 186.2.160.0/20 190.115.16.0/20 ###### The Russian company DDOS-GUARD provides anti-DDoS and con- tent delivery services. It is also a hosting service provider.[22] By Order of the Russian Ministry of Digital Development, Com- munications and Mass Media No. 326-FZ of June 26, 2017, the DDoS-Guard Protection software was registered as an information security tool in Russia’s Unified Register of Programs for Electronic Computers and Databases. Yet the company’s services are used by many illegal resources, including pirate and fraudulent ones. DDOS-GUARD does not usu- ally respond to any complaints regarding such resources. The company DDOS-GUARD: • provides fraudulent websites with its computing capacities, which are used to operate the websites in question; • conceals the actual hosting service and obstructs the identifi- cation of website owners. It is of note that the terms and conditions of using DDOS- GUARD’s services stipulate that customers agree to use the specified services for lawful purposes only. Yet organizing gambling games and scams falls under unlawful use.[23] Despite that, DDOS-GUARD does not comply with its own terms and conditions of using their services. Under Articles 15.1 to 15.6-1 of Russian Federal Law No. 149-FZ of July 27, 2006 “On Information, Information Technologies, and Protection of Information,” access to many websites that distribute ille- gal information and that are or have been hosted on DDOS- GUARD’s network addresses is restricted by Roskomnadzor (Rus- sia’s Federal Service for Supervision of Communications, Informa- tion Technology and Mass Media). At the same time, the specified procedure before blocking provides for the mandatory notification of violation to the hosting provider, indicating the need to remove unlawful information. Thus, DDOS-GUARD knew about the viola- tions on the blocked websites, but did not take any actions. As at June 24, 2020, a total of 453 such resources (domains or URL addresses) were blocked. These include: • 6 resources with network addresses in the subnetwork 185.129.100.0/24; • 5 resources with network addresses in the subnetwork 185.129.102.0/24; • 442 resources with network addresses in the subnetwork 185.178.208.0/24. 21 Reason for registration code 22 [https://ddos-guard.net/ru/store/hosting](https://ddos-guard.net/ru/store/hosting) 23 [https://ddos-guard.net/file/aup_en.pdf](https://ddos-guard.net/file/aup_en.pdf) ----- ###### The breakdown of violations on these resources is as follows: • copyright infringements: 299; • narcotics: 67; • gambling games: 29; • alcohol trade: 1; • other violations (by court decision): 57. **15%** Narcotics **6%** Gambling games **66%** Copyright infringement **13%** Other violations (court) ###### In addition to pirate resources, the blocking covered socially dan- gerous resources such as Shadowmarket, an online platform for buying and selling illegal products and services, as well as numer- ous narcotics stores: ----- The resource is hosted on the IP address 185.178.208.149 ----- The resource, illegally using TSUM trademark, was hosted on the IP address 185.178.208.174 (at the moment on Cloudflare) ----- The resouce was hosted on the IP address 185.178.208.135 (at the moment on Cloudflare) ----- The resource is hosted on the IP address 185.178.208.183 ----- #### Online casinos ## Legal information ###### The activities of online casinos are regulated by Russian Federal Law No. 244-FZ of December 29, 2006 “On the State Regulation of Activities Involving the Organization and Conduct of Gambling and on the Introduction of Amendments to Certain Legislative Acts of the Russian Federation.” Requirements for gambling game organizers are laid down in Article 6. For instance, only legal entities duly registered according to the established procedure within the territory of the Russian Federa- tion can organize gambling games. In turn, only legal entities that are part of a self-regulatory organization of gambling game orga- nizers at bookmakers or a self-regulatory organization of gambling game organizers at betting houses can organize gambling games at bookmakers or betting houses. Article 5 of this law sets out restrictions on organizing and con- ducting gambling games, including a ban on such activity when it involves information and telecommunications networks, including the Internet, and also when it involves means of communication, including mobile communication (with the exception of instances of accepting interactive bets and payouts on them by organizers of gambling games at bookmakers and (or) betting houses). Failure to comply with the above requirements incurs various types of liability. Article 171.2 of the Russian Criminal Code provides for criminal liability for natural persons who illegally organize and conduct gam- bling games, including by using information and telecommunica- tions networks, including the Internet, or means of communication. Under Article 14.1.1, paragraph 1, the same actions carried out by legal entities incur administrative liability and are punishable by a fine between 800,000 rubles ($11,350) and 1.5 million rubles ($21,300), including confiscation of the gaming equipment. In addition, gambling websites may be subject to restriction of access within the territory of the Russian Federation. According to paragraph 1 of the Regulation No. 228 of the Government of the Russian Federation of March 16, 2009 “On the Federal Service for Supervision of Communications, Information Technology, and Mass Media,” Roskomnadzor is an executive body that supervises the media, mass communication, information technology, and communications. As such, Roskomnadzor takes measures to restrict access to websites that contain information whose distribution in Russia is prohibited according to the procedure established in Article 15.1 of Russian Federal Law No. 149-FZ “On Information, Informa- tion Technologies, and Protection of Information.” In particular, paragraph 5 of this Article allows for non-judicial restriction of access to information that violates Russian Federal Law No. 244-FZ of December 29, 2006 “On the State Regulation of Activities Involving the Organization and Conduct of Gambling ----- ###### Games and on the Introduction of Amendments to Certain Legis- lative Acts of the Russian Federation” and Russian Federal Law No. 138-FZ of November 11, 2003 “On Lotteries,” which bans the organization and conduct of gambling games and lotteries that involve the Internet and other means of communication. Pursuant to subparagraph a) of paragraph 5 of Decision-making rules for federal executive bodies authorized by the Government of the Russian Federation in relation to certain types of informa- tion and materials distributed through the Internet whose distribu- tion in the Russian Federation is prohibited (approved by Russian Government Decree No. 1101 of October 26, 2012 “On the Uniform Automated Information System the Unified Register of Domain Names and Website References on the Internet), the basis for including domain names and website references related to gam- bling in the Unified Register of prohibited information is a decision of the Russian Federal Tax Service. The information and material assessment criteria necessary for making such a decision are approved by Order No. 84/292/351/ MMV-7-2/461S of May 18, 2017 by Roskomnadzor, Russian Ministry of Internal Affairs, the Federal Service for Surveillance on Con- sumer Rights Protection and Human Wellbeing (Rospotrebnadzor), and the Russian Federal Tax Service. These criteria are: 1. The existence of photo, video, audio and/or textual and graphic information encouraging to take part in a gambling game or lot- tery that is conducive to attracting the attention of a poten- tial participant on a website where it is possible to take part in a gambling game or lottery, make bets, and receive payouts for winning. 2. The existence of photo, video, audio and/or textual and graphic information that provides an understanding of a gambling game or lottery; terms and conditions for taking part in a gambling game or lottery, including rules of conducting gambling games and terms and conditions for participating in lotteries; poten- tial prizes; description of ways of transferring money to par- ticipate in a gambling game or lottery; and ways of receiving prizes on a given website where it is possible to take part in a gambling game or lottery, make bets, and receive payouts for winning. 3. The existence of a demonstration of taking part in a gam- bling game or lottery, with descriptions of the process and sequence of actions in a gambling game or lottery involving photo, video, audio, or images on a website where it is pos- sible to take part in a gambling game or lottery, make bets, and receive payouts for winning. 4. The possibility of taking part in a gambling game or lottery on a website. 5. The possibility of transferring money (including electronic money) using electronic means of payment to participate in a gambling game or lottery, as well as a possibility of receiving (providing) a prize on a website. ----- #### Online pirates ###### 6. The existence of a notice or information about the possi- bility of taking part in a gambling game or lottery using other domain names and (or) website references on the Internet on a website. 7. The existence of information and/or) computer programs on a website that make it possible to access a website or web- site page that contains forbidden information that meets the criteria specified in the paragraphs above. 8. The possibility of loading computer programs on a website or website page that make it possible to take part in a gambling game or lottery. Under Russian law, Internet services that provide servers to CDNs are considered information intermediaries. According to Article 1253.1(3) of the Russian Civil Code, an information intermediary that provides an opportunity to place materials on the Internet (e.g. a hosting service) does not bear responsibility for breaches of intellectual rights occurring as a result of materials being placed by a third party or on the instruction thereof. However, the responsibility is abrogated only if the information intermediary meets the following conditions: 1. They neither knew nor should have known that the use of the relevant result of intellectual activity or means of personaliza- tion in such materials was unlawful. 2. After receving a written complaint by the copyright holder about a breach of intellectual rights with reference to the website page and/or to the web address where such material was placed, they took timely measures, which were necessary and sufficient, to end the breach of the intellectual rights. A list of the measures deemed necessary and sufficient, and the procedure for implementing them, may be established by law. This means that, if an Internet service that provides pirate CDNs with their server capacities refuses to cooperate with copyright holders or if the measures taken are insufficient for stopping pirate activities, the following is possible: • Civil liability is imposed on the Internet service provider; • Administrative and criminal liability is imposed on those responsible; • Demands to protect intellectual property rights are set (unrelated to the enforcement of civil liability penalties), including demands to delete information that violates exclusive rights or demands to restrict access to such information. Within the framework of civil law relations, recovery of damages may be claimed from a party that has unlawfully used the result of intellectual activity (Article 1252(1)(3) of the Russian Civil Code). Demands for compensation can also be made (Article 1301 of the Russian Civil Code). ----- ###### In addition, depending on the damages, such a party can incur administrative liability under Article 7.12 of the Russian Code on Administrative Offences or criminal liability under Article 146 of the Russian Criminal Code. These types of liability can be applied against the Chief Executive Officer of a company whose activity has caused damages as a result of the unlawful use of intellectual property. As an example, in April 2018 the CEO of HOME-iPTV, Yuri Moskachev, was sentenced to three years’ suspended imprison- ment for an offence under Article 146(3)(v) and (g) of the Russian Criminal Code. According to the case file, the accused transferred the signal of the TV Channel Nostalgiya, for which the copyright holder was NTV Plus, using the TCP/IP protocol without an agree- ment with the copyright holder. The court later ordered Yuri Moskachev to pay NTV Plus $180,390. ----- ###### 1000+ successful investigations worldwide ###### 60 000++ hours of incident response ###### $300 MLN returned to Group-IB clients thanks to our products and services ## About Group−IB ##### Group-IB is a leading provider of high-fidelity threat intelligence and best-in-class anti-APT and anti-fraud solutions. Group-IB's mission is to protect its clients in cyberspace by creating and using innovative products, solutions, and services. Since 2003, we have been at the forefront of digital forensics, security assessments, and consulting, protecting major companies around the world against financial and reputational losses. ###### IMPACT A partner of International Multilateral Partnership Against Cyber Threats ###### OSCE Recommended by the Organization for Security and Co-operation in Europe ###### WORLD ECONOMIC FORUM Permanent member of the World Economic Forum ###### CIO OUTLOOK Ranked in APAC CIO Outlook's Top 10 Cybersecurity Companies in APAC ###### GARTNER, FORRESTER Group-IB’s Threat Intelligence is among the best in the world according to Forrester and Gartner ###### BUSINESS INSIDER One of the top 7 most influential companies in the cybersecurity industry according to Business Insider ###### C ----- ###### 1. This report aims to provide information 4. This report was drafted with the aim to deliver on the ways to conduct illegal actions information and raise awareness, is limited in order to attract the attention of state in distribution and cannot be used by readers watchdogs, relevant competent authorities in commercial or other purposes that as well as to minimize the risks of such illegal do not relate to education or personal non- actions in the future, to counter them in due commercial use. course and raise legal awareness level among Group-IB provides readers with the right ordinary users. to use the report all over the world by the 2. In order to comply with the law on the means of downloading, reading and quoting protection of personal data and ensure it (in the amount that corresponds to the the safety of natural persons, this report legitimate quotation and provided that the doesn’t include any personal information. All report and the link to the website of the the names or any other information directly copyright holder, on which it was released, are or indirectly referring to a specific natural mentioned as the quote source). person are fictional. 5. This report and all of its parts are subject 3. All the observations made in this report to copyright and are protected by applicable are based on Group-IB experts’ analysis intellectual property law. It is prohibited of information available in open sources and to copy, distribute (including by placing this should not be perceived at any part as the report on other websites or web resources official position of the competent authorities, on the Internet) or use the information including of the law enforcement of any or other contents without a prior written jurisdiction. The information that was public approval by the right owner. In case before the release of this report is mentioned Group-IB copyright for the report is violated, in original and unchanged form. Group-IB has the right to approach a court or other state bodies to protect its rights and interests and seek the punishment provided by law for the perpetrator, including compensation. info@group-ib.com www.group-ib.com -----