Author: tio

The data for our weekly download chart is estimated by TorrentFreak, and is for informational and educational reference only.

Downloading content without permission is copyright infringement. These torrent download statistics are only meant to provide further insight into piracy trends. All data are gathered from public resources.

This week we have one newcomer on the list. “28 Years Later: The Bone Temple” is the most shared title.

The most torrented movies for the week ending on February 23 are:

Note: We also publish an updating archive of all the list of weekly most torrented movies lists.

From: TF, for the latest news on copyright battles, piracy and more.

Earlier this week, a Spanish court ordered ProtonVPN and NordVPN to block pirate LaLiga streams on their networks.

The VPN providers were not involved in the legal proceedings, and the orders were granted without a defense. In fact, ProtonVPN learned about it from news reports and questioned its legal validity.

While the Spanish order made headlines due to its novelty, France has seen several of these orders already. This includes two new decisions issued in late January, where ProtonVPN fought back tooth and nail but still lost.

ProtonVPN Faces Two New Blocking Orders in France

The Paris Judicial Court issued two separate orders on January 28 and 29, both targeting Proton AG individually as the sole defendant. Both cases involved various rightsholders, including Canal+ companies, who sought to protect their interest in sports broadcasts.

In one case, they want ProtonVPN to block 16 pirate sites (full list here) that streamed Premier League matches, and the other case targets the same number of domain names, focusing on sites that stream the Top 14 Rugby competition.

The Paris Judicial Court ultimately granted both orders, which is in line with previous blocking injunctions. In the Rugby case, one domain was excluded from the blocklist due to an oversight; the court noted that the URL tested during the investigation didn’t match the domain name Canal+ actually requested to be blocked.

ProtonVPN Fought Back Hard

While Proton was excluded from the legal process in Spain, the Swiss company was allowed to defend itself before the Paris court. This is precisely what it did, with the VPN provider raising a wide variety of defenses.

The VPN provider raised jurisdictional questions and also requested to see evidence that Canal+ owned all the rights at play. However, these concerns didn’t convince the court.

The same applies to Proton’s net neutrality defense, which argued that Article 333-10 of the French sports code, which is at the basis of all blocking orders, violates EU Open Internet Regulation. This defense was too vague, the court concluded, noting that Proton cited the regulation without specifying which provisions were actually breached.

“Under these circumstances, the argument is unfounded. There is no basis for granting Proton’s subsidiary claim of non-compliance with European law,” the court concluded.

Additionally, Proton argued that forcing a Swiss company to block content for French users restricts cross-border trade in services under the WTO’s General Agreement on Trade in Services. The court dismissed this argument, as the proposed blocking measures are limited in scope and duration, which should be allowed under the WTO agreement.

Overblocking Concerns Dismissed

Proton’s defense didn’t stop there; the company also argued that the blocking measures are technically unrealizable, costly, and unnecessarily complex.

Crucially, the VPN provider argued that a block cannot be technically restricted to France. Therefore, forcing the company to block these domains in France would effectively force an international, global blockade, which is highly disproportionate to the localized rights Canal+ holds.

The Paris Court was not swayed by these technical and cost-related concerns, including the fears of a global blockade.

“It must be noted that no quantifiable and verifiable technical evidence corroborates the technical difficulties of implementation cited by the defense,” the court concluded.

The Battle Continues

While ProtonVPN was allowed to defend itself, unlike in Spain, the end result is similar. The VPN provider has to block access to the 31 domain names.

That said, the court didn’t grant Canal+ everything it asked for. The broadcaster wanted ProtonVPN to publish the ruling on its website for three months, but the court concluded that this would unfairly put the VPN provider in a bad light, disproportionately associating it with the pirate sites. Canal+’s €30,000 cost claim didn’t survive either.

Both orders are dynamic in nature, meaning that rightsholders can report new pirate domains or mirror sites directly to ARCOM, the French media regulator. After ARCOM verifies these new domains, ProtonVPN has to add them to their blocklist.

The legal battle over VPN blocking is far from over yet. Proton previously said it would take VPN blocking to Europe’s highest court.

Meanwhile, however, French rightsholders show no sign of slowing down. These two Proton orders came alongside a parallel Google DNS blocking order for the same Premier League domains, as well a massive ISP blocking order covering 150+ IPTV domains.

At this point, the question isn’t whether French courts will keep ordering VPN blocks. They will. The question is whether Europe’s highest court will eventually set any limits or not.

—

Copies of the court orders (in French) are linked below, alongside all targeted domain names.

Premier League Case (16 Domains):

– abbasport.online
– antenaplanet.store
– antenawest.store
– daddylive.dad
– foot22.ru
– miztv.top
– tous-sports.ru
– andrenalynrushplay.cfd
– vidembed.re
– bleedfilter.net
– alldownplay.xyz
– catchthrust.net
– 4kultramedia.fr
– smart.stella.cx
– franceiptvabonnement.fr
– slayvision.xyz

Top 14 Rugby Case (15 Domains):

– abbasport.online
– antenashop.site
– antenawest.store
– canalsport.ru
– daddylive2.top
– sporttuna.click
– antenaplanet.store
– veplay.top
– catchthrust.net
– lefttoplay.xyz
– home.sporttuna.vip
– sporttuna.website
– zukiplay.cfd
– iptv-pro.co
– atlaspro.tv

(Additionally, here is the simultaneous Google DNS order that targets the same 16 Premier League domains, and the massive ISP order targets roughly 150+ domains tied to seven major IPTV operations).

From: TF, for the latest news on copyright battles, piracy and more.

Most phishing websites are little more than static copies of login pages for popular online destinations, and they are often quickly taken down by anti-abuse activists and security firms. But a stealthy new phishing-as-a-service offering lets customers sidestep both of these pitfalls: It uses cleverly disguised links to load the target brand’s real website, and then acts as a relay between the target and the legitimate site — forwarding the victim’s username, password and multi-factor authentication (MFA) code to the legitimate site and returning its responses.

There are countless phishing kits that would-be scammers can use to get started, but successfully wielding them requires some modicum of skill in configuring servers, domain names, certificates, proxy services, and other repetitive tech drudgery. Enter Starkiller, a new phishing service that dynamically loads a live copy of the target login page and records everything the user types, proxying the data to the legitimate site and back to the victim.

According to an analysis of Starkiller by the security firm Abnormal AI, the service lets customers select a brand to impersonate (e.g., Apple, Facebook, Google, Microsoft et. al.) and generates a deceptive URL that visually mimics the legitimate domain while routing traffic through the attacker’s infrastructure.

For example, a phishing link targeting Microsoft customers appears as “login.microsoft.com@[malicious/shortened URL here].” The “@” sign in the link trick is an oldie but goodie, because everything before the “@” in a URL is considered username data, and the real landing page is what comes after the “@” sign. Here’s what it looks like in the target’s browser:

Once Starkiller customers select the URL to be phished, the service spins up a Docker container running a headless Chrome browser instance that loads the real login page, Abnormal found.

“The container then acts as a man-in-the-middle reverse proxy, forwarding the end user’s inputs to the legitimate site and returning the site’s responses,” Abnormal researchers Callie Baron and Piotr Wojtyla wrote in a blog post on Thursday. “Every keystroke, form submission, and session token passes through attacker-controlled infrastructure and is logged along the way.”

Starkiller in effect offers cybercriminals real-time session monitoring, allowing them to live-stream the target’s screen as they interact with the phishing page, the researchers said.

“The platform also includes keylogger capture for every keystroke, cookie and session token theft for direct account takeover, geo-tracking of targets, and automated Telegram alerts when new credentials come in,” they wrote. “Campaign analytics round out the operator experience with visit counts, conversion rates, and performance graphs—the same kind of metrics dashboard a legitimate SaaS [software-as-a-service] platform would offer.”

Abnormal said the service also deftly intercepts and relays the victim’s MFA credentials, since the recipient who clicks the link is actually authenticating with the real site through a proxy, and any authentication tokens submitted are then forwarded to the legitimate service in real time.

“The attacker captures the resulting session cookies and tokens, giving them authenticated access to the account,” the researchers wrote. “When attackers relay the entire authentication flow in real time, MFA protections can be effectively neutralized despite functioning exactly as designed.”

The “URL Masker” feature of the Starkiller phishing service features options for configuring the malicious link. Image: Abnormal.

Starkiller is just one of several cybercrime services offered by a threat group calling itself Jinkusu, which maintains an active user forum where customers can discuss techniques, request features and troubleshoot deployments. One a-la-carte feature will harvest email addresses and contact information from compromised sessions, and advises the data can be used to build target lists for follow-on phishing campaigns.

This service strikes me as a remarkable evolution in phishing, and its apparent success is likely to be copied by other enterprising cybercriminals (assuming the service performs as well as it claims). After all, phishing users this way avoids the upfront costs and constant hassles associated with juggling multiple phishing domains, and it throws a wrench in traditional phishing detection methods like domain blocklisting and static page analysis.

It also massively lowers the barrier to entry for novice cybercriminals, Abnormal researchers observed.

“Starkiller represents a significant escalation in phishing infrastructure, reflecting a broader trend toward commoditized, enterprise-style cybercrime tooling,” their report concludes. “Combined with URL masking, session hijacking, and MFA bypass, it gives low-skill cybercriminals access to attack capabilities that were previously out of reach.”