When you are whoever owns the world's biggest torrent-sharing site, the last thing you'd expect to land you in trouble would be a totally legitimate (and legal) purchase via iTunes. He's been accused of reproducing and distributing hundreds of countless copies of music records, video games, TV shows and movies totaling more than $1 billion. The US is now waiting to extradite him.
Founded in 2008, the site has slowly grown to become the largest torrent-sharing web site in the world. It finally got the mantle in 2015 after The Pirate Bay experienced multiple raids, combated with lengthy bouts of downtime and its three creators were detained. More than 50 million unique monthly visitors are counted by KAT and is estimated to be the 68th most often visited the website on the web -- according to Alexa.
In a 48-page criminal complaint (PDF) filed with the U.S. District Court in Chicago, the U.S. Attorney's Office discloses how it was able to monitor Vaulin. That is how it played out.
The fake advertisement
An undercover IRS Special Agent talked with a KAT representative about hosting an ad that would direct visitors to an undercover website. An arrangement was made and the ad, which advertised a system to study in the USA, would be set on individual torrent listings for $300 per day. A link seemed underneath the torrent download buttons for five days when it eventually went live on March 14th, 2016.
This back-and-forth additionally enabled investigators to identify an important point of contact: the email address [email protected] Not only was it linked to web site inquiries, but it was also the email related to KAT's social media presences including Facebook. Representatives could obtain records from Facebook that showed the "official.KAT.fanclub." page was almost definitely associated with KAT.
The engagement of Apple
Using fundamental site-tracking services, Der Yeghiayan could uncover (via a reverse DNS search) the hosts of seven apparent KAT website domains: kickasstorrents.com, kat.cr, kickass.to, kat.ph, kastatic.com, thekat.tv and kickass.cr. This dug up two Chicago IP addresses, which were used as KAT name servers for more than four years. Representatives were then able to obtain legally a copy of the server's access logs (describing why it was federal authorities in Chicago that eventually charged Vaulin with his alleged crimes).
Using similar tools, Homeland Security investigators also performed something called a WHOIS lookup on a domain name that redirected people to the principal KAT website. A WHOIS search provides the address, name, email and phone number of a site registrant.
Der-Yeghiayan was not unable to link the email address present in the WHOIS lookup to an Apple email address that Vaulin used to manage KAT. It's this Apple account that seems to tie all of the bits of Vaulin's alleged participation collectively.
On July 31st, 2015, records provided by Apple show that the me.com account was used to purchase something on iTunes. The logs reveal that the same IP address was used on the same day to obtain the KAT Facebook page. After KAT started accepting Bitcoin contributions in 2012, $72,767 was moved into a Coinbase account in Vaulin's name. That Bitcoin wallet was registered with the same me.com email address.
Homeland Security has already requested that the seven KAT domain names identified in the grievance are forfeited for his or her part in facilitating piracy. Homeland Security subsequently anticipates those websites to be redirected to a server of its picking.
Now, KickassTorrents seems to be up still, at least. Nonetheless, it's likely only a matter of time until it becomes a lot harder to locate. The sarcasm meter is broken by the notion a legal media purchase could function as the undoing of a piracy king kinda while investigators had a lot of signs before they added the mixture and the iTunes transaction.