Author: tio

  • ProtonVPN Fights French Pirate Site Blockades, But Court Rejects Overblocking Fears

    ProtonVPN Fights French Pirate Site Blockades, But Court Rejects Overblocking Fears

    Earlier this week, a Spanish court ordered ProtonVPN and NordVPN to block pirate LaLiga streams on their networks.

    The VPN providers were not involved in the legal proceedings, and the orders were granted without a defense. In fact, ProtonVPN learned about it from news reports and questioned its legal validity.

    While the Spanish order made headlines due to its novelty, France has seen several of these orders already. This includes two new decisions issued in late January, where ProtonVPN fought back tooth and nail but still lost.

    ProtonVPN Faces Two New Blocking Orders in France

    The Paris Judicial Court issued two separate orders on January 28 and 29, both targeting Proton AG individually as the sole defendant. Both cases involved various rightsholders, including Canal+ companies, who sought to protect their interest in sports broadcasts.

    In one case, they want ProtonVPN to block 16 pirate sites (full list here) that streamed Premier League matches, and the other case targets the same number of domain names, focusing on sites that stream the Top 14 Rugby competition.

    From the Rugby case

    proton order

    The Paris Judicial Court ultimately granted both orders, which is in line with previous blocking injunctions. In the Rugby case, one domain was excluded from the blocklist due to an oversight; the court noted that the URL tested during the investigation didn’t match the domain name Canal+ actually requested to be blocked.

    Feature Premier League Case Top 14 Rugby Case
    Case Number RG nº 25/12499 RG nº 25/10983
    Plaintiffs Canal+ entities Canal+ entities and the Ligue Nationale de Rugby (LNR) as intervener
    Targeted Content Premier League (2025/2026 season) Top 14 Rugby (2025/2026 season)
    Domains Targeted 16 pirate domains 16 domains initially listed (one rejected)
    Duration of Block Until May 24, 2026 (end of season) Until June 27, 2026 (end of season)

    ProtonVPN Fought Back Hard

    While Proton was excluded from the legal process in Spain, the Swiss company was allowed to defend itself before the Paris court. This is precisely what it did, with the VPN provider raising a wide variety of defenses.

    The VPN provider raised jurisdictional questions and also requested to see evidence that Canal+ owned all the rights at play. However, these concerns didn’t convince the court.

    The same applies to Proton’s net neutrality defense, which argued that Article 333-10 of the French sports code, which is at the basis of all blocking orders, violates EU Open Internet Regulation. This defense was too vague, the court concluded, noting that Proton cited the regulation without specifying which provisions were actually breached.

    “Under these circumstances, the argument is unfounded. There is no basis for granting Proton’s subsidiary claim of non-compliance with European law,” the court concluded.

    Additionally, Proton argued that forcing a Swiss company to block content for French users restricts cross-border trade in services under the WTO’s General Agreement on Trade in Services. The court dismissed this argument, as the proposed blocking measures are limited in scope and duration, which should be allowed under the WTO agreement.

    Overblocking Concerns Dismissed

    Proton’s defense didn’t stop there; the company also argued that the blocking measures are technically unrealizable, costly, and unnecessarily complex.

    Crucially, the VPN provider argued that a block cannot be technically restricted to France. Therefore, forcing the company to block these domains in France would effectively force an international, global blockade, which is highly disproportionate to the localized rights Canal+ holds.

    The Paris Court was not swayed by these technical and cost-related concerns, including the fears of a global blockade.

    “It must be noted that no quantifiable and verifiable technical evidence corroborates the technical difficulties of implementation cited by the defense,” the court concluded.

    The Battle Continues

    While ProtonVPN was allowed to defend itself, unlike in Spain, the end result is similar. The VPN provider has to block access to the 31 domain names.

    That said, the court didn’t grant Canal+ everything it asked for. The broadcaster wanted ProtonVPN to publish the ruling on its website for three months, but the court concluded that this would unfairly put the VPN provider in a bad light, disproportionately associating it with the pirate sites. Canal+’s €30,000 cost claim didn’t survive either.

    Both orders are dynamic in nature, meaning that rightsholders can report new pirate domains or mirror sites directly to ARCOM, the French media regulator. After ARCOM verifies these new domains, ProtonVPN has to add them to their blocklist.

    The legal battle over VPN blocking is far from over yet. Proton previously said it would take VPN blocking to Europe’s highest court.

    Meanwhile, however, French rightsholders show no sign of slowing down. These two Proton orders came alongside a parallel Google DNS blocking order for the same Premier League domains, as well a massive ISP blocking order covering 150+ IPTV domains.

    At this point, the question isn’t whether French courts will keep ordering VPN blocks. They will. The question is whether Europe’s highest court will eventually set any limits or not.

    Copies of the court orders (in French) are linked below, alongside all targeted domain names.

    Premier League Case (16 Domains):

    – abbasport.online
    – antenaplanet.store
    – antenawest.store
    – daddylive.dad
    – foot22.ru
    – miztv.top
    – tous-sports.ru
    – andrenalynrushplay.cfd
    – vidembed.re
    – bleedfilter.net
    – alldownplay.xyz
    – catchthrust.net
    – 4kultramedia.fr
    – smart.stella.cx
    – franceiptvabonnement.fr
    – slayvision.xyz

    Top 14 Rugby Case (15 Domains):

    – abbasport.online
    – antenashop.site
    – antenawest.store
    – canalsport.ru
    – daddylive2.top
    – sporttuna.click
    – antenaplanet.store
    – veplay.top
    – catchthrust.net
    – lefttoplay.xyz
    – home.sporttuna.vip
    – sporttuna.website
    – zukiplay.cfd
    – iptv-pro.co
    – atlaspro.tv

    (Additionally, here is the simultaneous Google DNS order that targets the same 16 Premier League domains, and the massive ISP order targets roughly 150+ domains tied to seven major IPTV operations).

    From: TF, for the latest news on copyright battles, piracy and more.

  • Snopestionary: 8 tips to vet fundraisers and protect your donations

    Here is how to make sure your money is going to a legitimate cause.
  • Slovakia Marks 8 Years Since the Murder of Journalist Ján Kuciak and his Fiancée

    Hundreds of people gathered in Bratislava and other cities across Slovakia on Saturday to mark the eighth anniversary of the killings of investigative reporter Ján Kuciak and his fiancée, Martina Kušnírová, in a case that shook the country but still lacks a final answer about who ordered their deaths.

    The murders on Feb. 21, 2018, were carried out by gunman Miroslav Marček, who shot Kuciak twice in the chest and Kušnírová once in the head, while an accomplice, Tomáš Szabó, waited nearby, prosecutors said. 

    Both men are serving 25-year prison sentences. Authorities say they acted on instructions relayed by intermediary Zoltán Andruskó, who confessed and received a 15-year term.

    Yet the central question — who commissioned the assassination — remains unresolved, leaving one of Europe’s most consequential journalist murder cases without closure.

    Prosecutors allege that businessman Marian Kočner ordered the killing through an associate, Alena Zsuzsová, who then tasked Andruskó. Courts have twice acquitted Kočner and once convicted Zsuzsová, but each verdict has been overturned on appeal, effectively resetting the case.

    The retrial, now underway at the Specialized Criminal Court in Pezinok, follows a ruling last May by the Supreme Court of Slovakia that cited serious flaws in how earlier judges evaluated evidence. The high court said the panel had failed to address key facts and had not followed prior judicial instructions.

    The new proceedings, which opened in January and are scheduled to run through December, also include charges tied to alleged plots against prosecutors. Two additional defendants — Dušan Kračina and Darko Dragić — are accused in those cases.

    The killings prompted mass demonstrations in 2018 that helped topple a government and reshaped the country’s political landscape. Eight years on, the case remains a symbol of unresolved justice and the risks faced by investigative journalists.

    At a commemorative gathering at Freedom Square, Kuciak’s father, Jozef Kuciak, told attendees, according to The Slovak Spectator: “Every day we live with pain; every day we go to the cemetery to light candles instead of raising our grandchildren.”

    In a statement, Pavol Szalai of Reporters Without Borders urged judges to “duly examine” all evidence and rule independently, adding, “Europe’s eyes are on Slovakia.”

    Roberta Metsola, president of the European Parliament, said the murders had “shaken Europe” and noted they came months after the killing of Daphne Caruana Galizia. “Their courage remains a beacon for journalists across the continent who risk everything to uncover the truth and safeguard our democracies,” she wrote on X.

  • Leftists Can Stack Up Wins in the 2026 Midterms

    Leftists Can Stack Up Wins in the 2026 Midterms

    We’re now two months into 2026, roughly a quarter of the way through Donald Trump’s second presidency, and things have been grim. Overseas, Trump’s government has attacked Venezuela and kidnapped its head of state, killing at least 83 people in the process. Trump is now threatening Colombia, Cuba, Mexico, Iran, Greenland, and Nigeria with the same kind of aggression, and that’s the short list. At home, ICE troops have murdered Renee Good and Alex Pretti in the street, and they’ve killed at least six people in nightmarish detention centers across the country. Measles is spreading everywhere, thanks largely to the anti-vaccine propaganda of people like Robert F. Kennedy, Jr, and the literacy rate continues to slide downward, while the economy and the environment are consumed by AI data centers. The state of the union, frankly, is a train wreck. Or it would be, if we had any decent trains to begin with.

  • People searching NHS advice on high blood pressure skyrocketed last year

    The number of people searching for trusted NHS advice on high blood pressure surged in 2025 with hundreds of thousands of extra visits to online information on risk and how to get checked. The NHS webpage on high blood pressure rocketed from 30th place in 2024, to the second most visited health condition on NHS.uk […]
  • The Crackpots of the ’90s Foreshadowed Our Political Moment

    The Crackpots of the ’90s Foreshadowed Our Political Moment

    Nation columnist John Ganz is the New York Times best-selling author of When the Clock Broke: Con Men, Conspiracists, and How America Cracked Up in the Early 1990s. Jacobin magazine has called him “one of America’s most astute observers of the Right.” Ganz writes the Unpopular Front newsletter on Substack, and his work has appeared in The Washington Post, Harper’s Magazine, Artforum, the New Statesman, and other publications.

  • Corruption Case Sparks Street Clashes and Political Showdown in Albania

    Police in Tirana fired tear gas and water cannons on Friday to disperse protesters who hurled petrol bombs and fireworks toward the office of Prime Minister Edi Rama, as demonstrators demanded the government’s resignation over corruption allegations involving his deputy.

    It’s the fourth time protesters are hitting the streets over what they see as government efforts to shield senior officials from anti-corruption investigations. At the center is a case against Deputy Prime Minister Belinda Balluku who stands accused of interfering in public tenders in favor of certain companies.

    The country’s anti-corruption prosecutor, SPAK, opened a criminal case after indicting Balluku in December on suspicion of “violation of the equality of participants in public tenders or auctions,” tied to a 2021 procurement connected to the Llogara Tunnel project. She has denied wrongdoing, and Mr. Rama has continued to support her.

    Prosecutors have also linked the allegations to a tender for the Tirana Grand Ring Road, saying Balluku, then infrastructure minister, tilted procedures to favor certain companies and “predetermined the winner,” according to details reported by Reuters.

    On Feb. 6, Albania’s Constitutional Court left in place a court-ordered suspension barring Deputy Prime Minister Belinda Balluku from exercising her public functions, after judges split 4–4 on Rama’s request to lift the measure — short of the five votes needed to overturn it. The decision is expected to take effect once published in the Official Gazette.

    Dorian Matlija, a lawyer and head of the rights group Res Publica, told OCCRP the suspension is meant “to protect the integrity of the investigation” and “does not imply guilt,” describing it as a precaution used when prosecutors argue an official could influence evidence or witnesses.

    Parliament is now weighing a separate prosecutorial request to authorize her arrest. A session of the Council of Mandates and Immunities is scheduled for Feb. 23, followed by a full parliamentary vote expected March 5, according to a timeline compiled by local media. 

    Matlija said the debate would hinge on proportionality, noting that if suspension removes the alleged risks, arrest — an “ultima ratio” measure — becomes harder to justify.

    The case has also ignited a dispute over proposed changes to the criminal procedure code that would exempt top officials, including the prime minister and deputy prime minister, from court-ordered suspensions — a move critics say is designed to protect Rama’s allies.

    Afrim Krasniqi, head of the Albanian Institute for Political Studies, said that in a country seeking closer ties with the European Union, senior officials facing charges should step aside, warning that altering rules mid-case would appear to be “a pure abuse of power.”

    Economist Zef Preçi, who leads the Albanian Center for Economic Research, said it is “a proven fact” that large contracts have increasingly gone to businesses widely seen as politically connected, calling major infrastructure procurement one of Albania’s least transparent sectors.

  • ‘Starkiller’ Phishing Service Proxies Real Login Pages, MFA

    ‘Starkiller’ Phishing Service Proxies Real Login Pages, MFA

    Most phishing websites are little more than static copies of login pages for popular online destinations, and they are often quickly taken down by anti-abuse activists and security firms. But a stealthy new phishing-as-a-service offering lets customers sidestep both of these pitfalls: It uses cleverly disguised links to load the target brand’s real website, and then acts as a relay between the target and the legitimate site — forwarding the victim’s username, password and multi-factor authentication (MFA) code to the legitimate site and returning its responses.

    There are countless phishing kits that would-be scammers can use to get started, but successfully wielding them requires some modicum of skill in configuring servers, domain names, certificates, proxy services, and other repetitive tech drudgery. Enter Starkiller, a new phishing service that dynamically loads a live copy of the target login page and records everything the user types, proxying the data to the legitimate site and back to the victim.

    According to an analysis of Starkiller by the security firm Abnormal AI, the service lets customers select a brand to impersonate (e.g., Apple, Facebook, Google, Microsoft et. al.) and generates a deceptive URL that visually mimics the legitimate domain while routing traffic through the attacker’s infrastructure.

    For example, a phishing link targeting Microsoft customers appears as “login.microsoft.com@[malicious/shortened URL here].” The “@” sign in the link trick is an oldie but goodie, because everything before the “@” in a URL is considered username data, and the real landing page is what comes after the “@” sign. Here’s what it looks like in the target’s browser:

    Image: Abnormal AI. The actual malicious landing page is blurred out in this picture, but we can see it ends in .ru. The service also offers the ability to insert links from different URL-shortening services.

    Once Starkiller customers select the URL to be phished, the service spins up a Docker container running a headless Chrome browser instance that loads the real login page, Abnormal found.

    “The container then acts as a man-in-the-middle reverse proxy, forwarding the end user’s inputs to the legitimate site and returning the site’s responses,” Abnormal researchers Callie Baron and Piotr Wojtyla wrote in a blog post on Thursday. “Every keystroke, form submission, and session token passes through attacker-controlled infrastructure and is logged along the way.”

    Starkiller in effect offers cybercriminals real-time session monitoring, allowing them to live-stream the target’s screen as they interact with the phishing page, the researchers said.

    “The platform also includes keylogger capture for every keystroke, cookie and session token theft for direct account takeover, geo-tracking of targets, and automated Telegram alerts when new credentials come in,” they wrote. “Campaign analytics round out the operator experience with visit counts, conversion rates, and performance graphs—the same kind of metrics dashboard a legitimate SaaS [software-as-a-service] platform would offer.”

    Abnormal said the service also deftly intercepts and relays the victim’s MFA credentials, since the recipient who clicks the link is actually authenticating with the real site through a proxy, and any authentication tokens submitted are then forwarded to the legitimate service in real time.

    “The attacker captures the resulting session cookies and tokens, giving them authenticated access to the account,” the researchers wrote. “When attackers relay the entire authentication flow in real time, MFA protections can be effectively neutralized despite functioning exactly as designed.”

    The “URL Masker” feature of the Starkiller phishing service features options for configuring the malicious link. Image: Abnormal.

    Starkiller is just one of several cybercrime services offered by a threat group calling itself Jinkusu, which maintains an active user forum where customers can discuss techniques, request features and troubleshoot deployments. One a-la-carte feature will harvest email addresses and contact information from compromised sessions, and advises the data can be used to build target lists for follow-on phishing campaigns.

    This service strikes me as a remarkable evolution in phishing, and its apparent success is likely to be copied by other enterprising cybercriminals (assuming the service performs as well as it claims). After all, phishing users this way avoids the upfront costs and constant hassles associated with juggling multiple phishing domains, and it throws a wrench in traditional phishing detection methods like domain blocklisting and static page analysis.

    It also massively lowers the barrier to entry for novice cybercriminals, Abnormal researchers observed.

    “Starkiller represents a significant escalation in phishing infrastructure, reflecting a broader trend toward commoditized, enterprise-style cybercrime tooling,” their report concludes. “Combined with URL masking, session hijacking, and MFA bypass, it gives low-skill cybercriminals access to attack capabilities that were previously out of reach.”

  • The Nation’s Largest Public Utility Is Going Back to Coal

    This coverage, originally published by Grist, is made possible through a partnership between Grist and BPR, a public radio station serving western North Carolina. Sign up for Grist’s weekly newsletter here.

    The Tennessee Valley Authority’s quarterly board meeting in Hopkinsville, Kentucky, opened with a triumphant video homage to the agency’s work during the winter storm that battered the eastern U.S. in late January. Energy had come through, yet again, to defeat extreme cold. The montage credited this to the utility’s “coal workhorses,” then noted that nuclear plants provided “uninterrupted power” and “hydro responded instantly.” The list ended there, despite years of promises that the agency would bolster renewables and battery storage. The message was clear: Solar had been unceremoniously dropped from the mix, and coal, which the agency had been phasing out, was back. 

    What the video hinted at the board made official. Its seven members voted unanimously to drop renewable energy as a priority, end diversity programs and grant two of the agency’s four remaining coal plants reprieves from planned closure. The decision followed the seating of four members selected by President Donald Trump, breaking months of paralysis that followed the termination of three members appointed by President Joe Biden.

    The changes, made during the Feb. 11 board meeting, signal more than a routine policy reset for the nation’s largest public power provider. They will slow the TVA’s shift away from fossil fuels just as electricity demand is spiking, raising questions about future costs, pollution and the role of federally owned utilities in the country’s energy transition.

    For years, TVA planners had mapped out a future without coal. That is now on hold. The Kingston Fossil Plant in Roane County, Tennessee, was scheduled for retirement in 2027, with all nine of its units slated for demolition and replacement with an “energy complex” of gas generation and battery storage. All of them will remain online alongside the gas plant, but renewables are no longer part of the picture. The board also shelved plans to scuttle the Cumberland Fossil Plant in Stewart County, Tennessee, in 2028. 

    TVA planners had mapped out a future without coal. That is now on hold.

    These moves come despite the agency’s 2025 Integrated Resource Plan, which called for retiring the two facilities because of Kingston’s “high cost and challenged condition” and Cumberland’s “lack of flexibility.” The Kingston plant was also the site of a devastating 2010 coal ash disaster, the largest industrial spill in U.S. history.

    The board defended its decision by citing energy affordability for the Tennessee Valley. 

    “As power demand grows, TVA is looking at every option to bolster our generating fleet to continue providing affordable, reliable electricity to our 10 million customers, create jobs, and help communities thrive,” agency spokesperson Scott Brooks said in a statement.

    Left unsaid was the fact that a coal-fired unit at the Cumberland plant failed during last month’s storm. 

    Much of the TVA’s load growth comes from the rise of artificial intelligence, said CEO Don Moul, and data centers account for 18% of its industrial load. During the same meeting, the board allowed the company xAI, owned by Elon Musk, to double the amount of power it draws from the grid. 

    For former board member Michelle Moore, one of the Biden-era appointees fired by Trump in March, the shift aligns squarely with the administration’s priorities. It also signals, she said, that the utility is no longer fulfilling its mission to provide affordable power, economic development and environmental stewardship across the seven-state Tennessee Valley. “The politics in Washington may change,” she said.  “But the TVA’s mission does not.”

    That independence has at times put the authority at odds with presidents of both parties. The utility previously resisted Trump administration pressure to keep coal plants open, continuing to retire facilities based on economic reasons. But it also fell short of Biden’s decarbonization goals.

    Moore worries that ordinary ratepayers are no longer an active part of the TVA’s decision-making. Typically, a shift as monumental as turning away from renewable energy would have been subject to a lengthy review with input from communities throughout the region, something that simply will not occur now. “This is one more indicator that the public power model is being eroded and is at risk,” Moore said.

    Last month, the TVA said it would streamline how it reviews the ecological impacts of its projects, allowing some to move ahead with far less, if any, scrutiny. The move follows a broader rollback of the National Environmental Policy Act under Trump that grants greater discretion over such considerations to entities like the TVA. For nearly 60 years, the law required an assessment of the environmental impacts of federal projects. “Over the past several years, the TVA board has faced pressure to make decisions based on stringent environmental regulations,” said board member Wade White.

    The TVA’s willingness to join the Trump administration’s push to revive the coal industry has rankled locals and environmentalists. In the first year of his second term, Trump lifted Environmental Protection Agency restrictions on the industry, used emergency executive orders to keep aging coal plants open, expanded mining and ordered the Pentagon to buy electricity from power plants that use coal. The president has since received an award from industry executives dubbing him the “Undisputed Champion of Clean, Beautiful Coal.” 

    “This is one more indicator that the public power model is being eroded and is at risk.”

    From a public health standpoint, it’s a nightmare. “Coal is one of the worst things you can imagine for the environment,” said Avner Vengosh, a professor of environmental quality at Duke University who leads a coal and coal ash research group. Mining destroys ecosystems and poisons groundwater, polluting rivers and streams with sulfuric acid. Burning the fossil fuel releases fine particulate matter, impacting the health of nearby residents. A 2023 study in the journal Science found that coal plants caused nearly half a million excess deaths between 1999 and 2020, and a Sierra Club report notes that TVA coal-fired plants were the nation’s deadliest

    “People are upset, they feel like we’re going backwards,” said Amy Kelly, a Sierra Club campaign manager. “The fact that these plants are from the ’50s and ’60s, and we’re just going to prop them up with Band-Aid solutions to appease the current administration is going to cost people.” 

    Even some coal plant operators agree. A Colorado utility is suing to close one facility, calling a federal emergency order to keep it online “unconstitutional.” For those who live near the two plants the TVA just saved, the decision is, in Joe Schiller’s words, “a betrayal.” Schiller, a retired college professor, has lived near the Cumberland plant for 30 years. “It contradicts everything they’ve told us about the plants in the past,” he said. Even so, he added, it’s a beautiful area. Moments before, his wife had called him outside to admire the sandhill cranes flying by.

    “It’s not like you look around every day and say, ‘Yep, that Cumberland plant is slowly killing me,’” Schiller said with a laugh. “Although it probably is.”

    The post The Nation’s Largest Public Utility Is Going Back to Coal appeared first on Truthdig.

  • Newly Released Epstein Records Detail Financial Ties Linking Billionaire, Art Adviser and Epstein

    The latest release of Justice Department records tied to the Jeffrey Epstein investigation provide new details about the finances of a former Ukrainian model and now art adviser and collector who received at least $2.5 million in personal transfers from the American billionaire Leon Black between 2011 and 2015.

    The email correspondence shows Epstein playing a significant role at least until 2018 in coordinating the financial affairs of Anastasiya Siroochenko, including liaising with accountants and auditors, overseeing tax documentation and tracking the movement of funds between her personal accounts and art-related companies. 

    An accountant overseeing her finances has resigned after raising concerns about how a property purchase has been handled, according to the cache of emails reviewed by Toronto Television’s OSINT unit.

    Black, a co-founder of Apollo Global Management Inc, was a longtime Epstein client and paid him roughly $158 million for tax and investment advice, according to reporting by The New York Times.

    The newly released records do not allege criminal wrongdoing by Siroochenko or Black, and they do not show Black directing or participating in the email exchanges. But they offer a detailed view of how Epstein operated as a financial intermediary, inserting himself into complex arrangements involving wealthy clients, younger associates and opaque financial structures, particularly in the art market.

    Siroochenko, now 38, has built a public career in the art world, organizing exhibitions and serving on the boards of cultural institutions in New York, including the SculptureCenter and the Watermill Center..In 2015, she helped organize the exhibition Delirious Picasso in London while working through the art advisory firm House of Nobleman.

    Emails indicate that Siroochenko met Epstein in 2010, when she was 22, while working as a model and exploring professional opportunities in New York. That year, she signed with MC2 Model Management — Miami, a modeling agency run by Jean-Luc Brunel, a close Epstein associate who later died in a French prison while awaiting trial for sex crimes and sex-trafficking charges.

    Beginning 2011, Siroochenko’s financial activity started appearing regularly in Epstein’s correspondence. Between 2011 and 2015, Black and entities linked to him transferred at least $2.5 million to her personal accounts. 

    Accountants classified the payments as gifts, according to the emails, which show Epstein coordinating how the transfers were documented and described for tax and audit purposes.

    In 2013, Siroochenko founded Sublime Art LLC, an art dealer and consulting company, and according to records, Black became a client of the firm, with invoices reflecting hundreds of thousands of dollars in art purchases. 

    Separate correspondence from 2017 describes a proposed commission agreement between Sublime Art and Narrows Holding LLC, a company associated with Leon Black. According to the Epstein files, Narrows held art owned by Black as collateral, and accounted for the vast majority of the loans tied to his art portfolio as of 2016, Forbes reported

    Under the 2017 agreement, Siroochenko’s company would receive $1.8 million for arranging the sale of a Paul Klee painting valued at $7.8 million, contingent on the completion of the sale. Epstein appears in the emails approving language and relaying information among parties, though the records do not establish whether the commission was ultimately paid.

    The overlap between Siroochenko’s personal income from Black and her business dealings with him prompted concern among some accountants and auditors involved in her finances. In one email, an accountant warned that the arrangement could present a conflict of interest, noting that the gift deposits clearly identified Black as the source of funds while he was also the firm’s principal client.

    Other correspondence shows disputes over property purchase in Lviv, Ukraine. One accountant later resigned, citing disagreements over the ownership and tax treatment of the Lviv property, according to the emails. Those also indicate that funds used to purchase the property were transferred from Siroochenko’s personal account to an limited liability company and categorized as a loan, and part of those funds was used to buy the property. Public records list her as the owner as of 2026. 

    The emails suggest Epstein took interest in ensuring that documentation related to the property was handled correctly for reporting purposes.

    Some messages also suggest that funds moving through Siroochenko’s companies were, at times, discussed in connection with potential investments involving Black’s interests. The records do not show that such transactions were completed, nor do they establish that he directed these discussions.

    Black stepped down from leadership roles at Apollo Global Management Inc. in 2021 following renewed scrutiny of his relationship with Epstein. He has acknowledged relying on Epstein for financial advice but claimed he was unaware of Epstein’s criminal conduct. In the past, three women had accused Black of sexual assault; he has denied the allegations, and a federal lawsuit brought by a woman identified as Jane Doe remains pending.

    The documents form part of a broader body of material illustrating Epstein’s financial dealings with Black and others. Previous investigations found that Black transferred millions of dollars to multiple women connected to Epstein, some of whom were later identified in court filings as victims or associates of the convicted sex offender.

    In a written response, Siroochenko said that her name “appears in the disclosed correspondence solely in connection with private financial, property, and legal matters from nearly a decade ago and has no connection to any criminal cases. References to me in the correspondence were strictly of a business nature.”

    Siroochenko said she has worked in the international art field for many years and that her “professional activity has always been public and transparent” and that she has never been a subject of any criminal proceedings. 

    While the newly released records do not explain the purpose of the transfers to Siroochenko or establish illegality, they provide a detailed record of how Epstein embedded himself in financial relationships that blended personal payments, business transactions and tax planning — arrangements that, in some cases, unsettled professional advisers but nonetheless continued for years.

    The files leave unresolved why such large sums changed hands and why Epstein played such an important coordinating role. But they add to the public record of how Epstein exercised influence far beyond his own finances, operating in ways that often relied on discretion, complexity and limited transparency.