Ramblings of a Tampa engineer
two men operating smartphones
Photo by rawpixel / Unsplash

Watching an illegally obtained film is probably something everyone has done accidentally or intentionally once in their lifetime. The battle of streaming services attempted to solve this problem by giving an avenue for users to legally obtain media. However, even today illegal downloads of media continue to be a populated source of the Internet Ecosystem.

While I could talk about the absolute mess of legal avenues, today I want to focus on the people/companies behind the illegal portion of the media industry, but how do you find these people?

Well the easy part is - these uploaders "brand" their content so users know where it came from. For example, I googled "The Hills Have Eyes" and wanted to download it illegally. In under 30 seconds I found this download:

  • The.Hills.Have.Eyes.2006.UNRATED.BrRip.600MB.YIFY.mkv

So there is a lot to break down here. Basically we were giving the following information:

  • Title - (The Hills Have Eyes)
  • Year of release - (2006)
  • Rating - (Unrated)
  • Source - (Blu-ray)
  • Filesize - (600MB)
  • Uploader - (YIFY)

I was available to download it without any payment or account. Now I know from simple technical knowledge that Blu-ray is not that small. The discs for Blu-ray range from single-layer to quadruple-layer with each layer containing a possible 25GB. So while the movie may have started from a Blu-ray, the quality took a dive into order to release it to the world.

Like most of this ecosystem, discussing the format/source and encoding of films could be a blog post about itself. This time we are focusing on the uploader.

So who is YIFY? Are they a person or a corporation?

It doesn't take long to find a small snippet on Wikipedia.

YIFY is a peer-to-peer release group known for distributing large numbers of movies as free downloads. YIFY releases were characterised through their HD video quality in a small file size, which attracted many downloaders. The official YIFY/YTS website was shut down by the MPAA in 2015, although one website imitating the YIFY/YTS brand still gains a significant amount of traffic. The name 'YIFY' is derived from the name of the website's founder, Yiftach Swery.
Source - Wikipedia (US) - February 12, 2019

Reading up on this Yiftach Swery guy shows he is very technically inclined, as he learned tricks with the x264 video encoding codec to take HD movies into very small (400-800MB) file sizes. Unfortunately for him, his trade was infringing massively on copyright of big corporations across the world. This lead to his ultimate end, with a multi-million lawsuit against him.

How did he get his films? There was many more questions I had, so armed with YIFY. I went to the Internet to research as many uploaders as I could find. I quickly realized this search would take me months and hundreds of paragraphs to complete. There are popular uploaders everywhere so I set my eyes on the following:

  • aXXo
  • Ganool
  • HRA v3
  • YIFY

I started with a Google trend report over the past decade with the above uploaders.

Google Trend (Ganool, aXXo, YIFY & HRA) - 2004 - 2019

So it became apparent that "aXXo" was maybe a name of the past so I started there. This was an interesting uploader who popularized quick releases of DVDs into AVI files, including the same style of NFO files.

An NFO file from an "aXXo" download
A download-tracking firm BigChampagne found — in a sampling period in late 2008 — that almost 33.5% of all movie downloads were aXXo torrents.
Source - Wikipedia (US) - February 14, 2019

As the "whack a mole" continued with torrent sites, eyes would point towards "aXXo" who was an unknown individual holding 33% of the illegal download space. From what we do know, "aXXo" retired in a final statement to his followers.

I can only say a big thank you for your appreciation mates, hope you all enjoy the darkside as much as you can My home is my beloved Darkside and as I've said so many times before on each of my torrents.... Be aware of bogus sites and lamers See ya
Source - DarkSideRG Forums

So we encountered YIFY who got caught, aXXo who retired (allegedly), but the first thing in common with those two was torrents.

Torrents (without VPN or proxies) expose your IP address as it connects to computers around the world to upload/download content. This allowed ISPs to simply sit and wait and issue letters/warnings to customers. However, early 2000s torrents were the only effective method to exchange large content. Finding a place to "host" a 700MB file without chopping it up into 90 parts was difficult.

This led to file-sharing sites that skirted the rules and normally was hosted outside of the United States. This led to sites like RapidShare and MegaUpload that would also, like uploaders face the repercussions of legal entities.

Ganool unlike the previous uploaders seemed to be a group of people who hosted file upload links on a regular free Blogger website. The accessibility and ease of use for these links shot Ganool into the light, with the primary target looking to be India. This was of course until Blogger shut down the site and Mediafire deleted their account removing 2 years of illegal content with it.

"For those who are waiting..."

The battle of uploaders, upload sites, torrent takedowns and more continues forever. So we enter our final uploader known as "HRA v3" who is remains popular in 2019.

How does he evade the constant detection and takedown of law enforcement? He has his own site hosted on Cloudflare and hides behind an alias. Based on his comments, the individual looks to be quite young. With the following post about why an uploading site deleted his account.

[redacted] permanently suspended my account. I sent an email to find out the reason. Even if I open a new account, this could happen all over again.
Source - Redacted.

I'm not sure if the charade is for his followers, but I'm sure he knows why his accounts get deleted. His followers however, sometimes suffer from lack of common sense. I found the following post from a follower in response to his announcement.

I purchased [redacted] services in ordered to download and watch programs I can't get on my Television. I use [redacted.com] to get the shows to download. Now you have suspended [redacted.com] from your site and I would like to get my money back and go another way to download programs. Unless you are going to reintall [redacted.com] as a host for downloads.

So this user basically sent a support request to the hosting service saying he is downloading content from a site.

HRA v3 themselves seems to spend time on uploading TV shows with nearly 800 different uploads. The equipment and storage to upload this content must be large for what seems to be one individual. HRA v3 doesn't miss a beat, which keeps his community growing and illegal money flowing. He apologies when he has delays, because he is just human.

HRA v3 site announcement of delay


This ecosystem of uploaders seems to get more vast the longer I spent time researching it. I could blog about this for months without running out of content, since there are uploaders everywhere. Along with science to all the different encodings and we haven't even begun to discuss the sources of this media. So next week we might take a look into the sources of illegal media and trying to make sense of all the encodings.

You’ve successfully subscribed to Connor Tumbleson
Welcome back! You’ve successfully signed in.
Great! You’ve successfully signed up.
Success! Your email is updated.
Your link has expired
Success! Check your email for magic link to sign-in.