Game of Streams A Comprehensive Study of Streaming Cyberlockers Benjamin Braun Rizwan Ahmad Department of Computer Science and Department of Computer Science and Engineering Engineering University of California, San Diego University of California, San Diego [email protected] [email protected] ABSTRACT this website by authorities showed a complex, intricate re- Streaming cyberlockers, third-party video streaming plat- lationship between the streaming portal, indexing sites, and forms which primarily consist of pirated content, have seen even advertising networks. However, since this raid, there incredible growth in recent years, but seem to avoid much have been very few studies into streaming cyberlockers, and scrutiny and thus have stayed outside the scope of most consequently very little new information about their opera- cyberlocker-centric studies. This project attempts to close tions. this gap in the literature by identifying central characteris- As such, given the growing popularity of these websites tics of streaming cyberlockers such as their traffic and rev- and the absence of studies that look into them, we sought to enue generation models, the physical location of the web- characterize and identify a few key parts of their infrastruc- sites, relationships between websites, and whether there are ture. Specifically, we wanted to understand the following: any feasible forms of external intervention capable of ex- • How they attract and maintain viewers and uploaders. ploiting faults in their operational model. We found that sites did tend to locate themselves in similar locations, and • What their main source of revenue is. that their revenue is generated primarily through advertis- ing, while an affiliate model drives traffic to the website by • Whether there are any prominent similarities or rela- attracting content uploaders, who in turn attract viewers. tionships between websites We were unable, however, to identify any feasible methods of interfering with this model, and determined that current • If there are any readily identifiable means of interven- anti-piracy efforts such as DMCA takedowns are largely un- ing and halting the explosive growth they are currently successful although further studies which take into account experiencing. indexing sites and advertising networks could potentially de- termine some form of intervention. This was accomplished by performing a study on 131 dif- ferent streaming cyberlockers, in which advertising networks Keywords and video content hosters were identified, and other perti- nent information was collected and analyzed. Additionally, Abuse, streaming cyberlockers, copyright infringement we were able to gain some insight regarding the ecosystem of streaming cyberlockers, which is discussed in the next 1. INTRODUCTION section. Streaming cyberlockers are third-party, web-based plat- forms which allow viewers to stream videos hosted on their 1.1 How Streaming Cyberlockers Operate platform. While some video streaming platforms are legiti- There are a number of actors involved in the successful mate sites, such as youtube.com, many of them are used pri- operation of a streaming cyberlocker. A general overview of marily to host and stream copyright protected or otherwise the ecosystem is shown in Figure 1. The three most impor- illegal content. In recent years, such streaming cyberlockers tant actors that can be seen in the diagram are the streaming have become particularly popular, with one such website, sites, indexing sites, and content uploaders. streamcloud.eu cracking the top 25 most visited sites in Streaming Sites: The streaming site itself usually has Germany by Alexa ranking, and maintaining a global rank- a relatively simple interface. We found that most sites us a ing of 611. This popularity has caused an uproar amongst third party video player such as the JWPlayer. Most sites organizations such as the MPAA and other content creators, do not provide a browsable or searchable index on the site who have notoriously worked to shut down these websites. itself. Instead the viewer needs to have a URL to a video Despite their increasing prominence in contemporary so- when coming to the site. While some streaming sites ac- ciopolitical issues, most studies overlook streaming cyber- tually employ web developers to create the sites, there are lockers in particular, and focus instead on a larger class of also a number of website templates available for purchase. A cyberlockers - one-click hosters. As such, streaming cyber- popular example is the XFileSharing template [4], which is lockers have, for the most part, avoided widespread public used by realvid.net and www.thevideo.me as well as oth- scrutiny, to the point that a great deal of the insight we have ers, and can be purchased for $99. Commonly, the streaming about streaming cyberlockers comes from a singular point of sites are hosted on either standard public hosting providers data - a raid on the streaming site kino.to. The analysis of or hosting providers that provide further privacy guarantees, 1 Premium/Affiliate Models $$ Uploaders Streaming Sites Indexing Site Viewers Advertising Networks Website Templates Video Players Video Server Hosts Figure 1: The Ecosystem of Streaming Cyberlockers in order to increase resilience against DMCA takedown re- of this revenue to be translated directly to profit. The report quests. To generate revenue, all observed streaming cyber- is also cited in a letter from the MPAA to the United States lockers serve aggressive ads on their sites. Some sites also Trade Representative [10], which led to a number of stream- offer premium membership for benefits, such as being able ing sites being mentioned on the USTR Notorious Markets to download the videos, faster streaming, or longer file avail- Report. ability. Others offered a more intriguing affiliate member- The other cyberlocker-based studies we identified focused ship, which allowed uploaders to receive money in response primarily on one-click hosters, such as a study performed by to views generated by their videos. Lauinger et al. [6], who conducted a large scale measurement Indexing Sites: Because the streaming sites do not pro- study on the effectiveness and impact of current anti-piracy vide an index themselves, there are a number of indexing efforts against one-click hosters. In their study, they crawled sites available to help viewers locate the videos they want two indexing sites to collect links to pirated files hosted on to watch. The indexing sites aggregate and organize links cyberlockers and observed how their availability. From this, to videos hosted on streaming sites, while not hosting any they investigated the impact of DMCA takedown Notices illegal content on their own site. Indexing sites come in var- and court mandated actions by the OCHs against piracy ious shapes and forms, with some indexing sites focusing and hardware seizures. They concluded that current anti- exclusively on TV shows, while others focus on other types piracy measures are mostly ineffective. of media. In a related study [7], Lauinger et al. also investigated Uploaders: Uploaders collect content distributed through prevalence of copyrighted material on one-click hosters us- other channels, such as torrents and one-click hosters, and ing the available file metadata to heuristically infer whether upload it to the streaming sites. Their main incentive are content is legitimate or infringing, concluding that the vast the affiliate rewards systems of the streaming sites, which majority of content hosted on these sites was indeed infring- pay the uploader anywhere between $10 and $40 per 10,000 ing material. unique video views. To attract more people to view the Liu et al. [9] studied the structure of URL-sharing sites uploaded videos, the uploader will typically distribute the linking to one-click hosters. They collected pages containing unique links to a number of indexing sites and numerous cyberlocker URLs for movies via the use of general search other places, including the information field on YouTube engines and proceeded to analyze characteristics of those videos. indexing sites. In this study, we strive to perform an analysis similar to that of the spam value chain in [8]. Specifically, we aim 2. RELATED WORK to take a closer look a the ecosystem of streaming cyber- The only study we are aware of that looked into stream- lockers to uncover the inner workings of these sites and to ing cyberlockers was one performed by NetNames, a brand identify parts of the ecosystem that are more susceptible to protection agency. This report [11] investigated the cost intervention. and revenue structure of direct download and streaming cy- berlockers. According to their notion, cyberlockers distin- guish themselves from legitimate cloud storage services by 3. DATA COLLECTION METHODOLOGY not limiting access to files, using affiliate programs that re- Given the previously mentioned goals of this project, we ward uploaders when content is accessed, and by dealing chose to collect data regarding the most commonly used ad- with repeat offenders in different manners. Based on their vertising networks found on the websites, the hosting providers estimates, popular streaming cyberlockers make millions of used to serve video content, and the websites' reactions to dollars in revenue annually from ads and, to a lesser extent, DMCA takedown notices. In order to collect this data, sev- premium models. They also maintain an operating cost that eral different streaming websites were identified, and each is a small fraction of their total revenue, leading the majority site was crawled individually while pulling information re- 2 garding advertising networks and video hosters. Videos sub- the page by injecting it into the DOM, and then sending sequently found in Google DMCA notices were identified, the data back to a web server running locally on the same and the status of the video - whether it was live or taken machine, which would store it in a SQL database. down - was noted. After aggregating this information, we The injected code initially attempted to play the video, proceeded to identify trends between different cyberlockers.