▄▄▄▄▄▄▄▄▄
░▄▄███ ▀▀▀▀▀▀██████████▄▄▄
░██▀ ███▌ ███▄ ██▌ ███ ▄▄▄ ▀▀▀▀▄▄▄██▄▄ ▄▄▄▄██▄▄
░▓█ ▄███▌▐██▌█▄ ▐██▌ ██▌ ▀▀▀ █████▀▀▀███ █████▀▀▀███
░██▀▀ ███▐██ ▀█▄▐██ ▐██▌ ███▄ ███ ▄██▀ ███ ▄██▀
███▄ ██▀███ ▀███▌ ███ ███ ▐██▌███▀▀█████ ▐██▌███▀▀
█▀▀ ▀▀ ▀▀▀ ▀▀██ ▐██▌ ██ ██▐██▌
███ ▄▄█▀ ▄ ██
██▀▀▀▀▀
The last few days we've been following leads to a couple of dc hubs that were being fed by 1 specific site by lineowners. One of the hubs is the one in one of our previous notices that contained BRiO members including trasher (which btw, used to literally fill the dumps on there we were told).
When we found out that a specific site may be involved because of the 2nd hub we looked at where the owner was literally bragging he is aldn #1 on the "DVDR-NORDIC site" of that site with 2x more downloaded than #2.
Immediatly, we selected a representative and got into contact with a siteop of this site where we also verified they have someone called Haz3, the owner of the 1st hub, Piratbyrσn -- which has bragged that he cannot be scenebanned.. this guy convinced all his scene contacts he is clean and they think he is telling the truth -- newsflash: they ALL denied it when they were found).
The siteop has pretty much proven useless, as all he managed to do is alert Haz3, and also leak to him the nickname of our representative leading to a pm of this kind:
<Haz3> gonna watch alias now, ok with u? Leeched it from CTU pre site if u wonder :p
The night our representative talked to the siteop, that DC Hub went down and changed bnc -- where Haz3 is no longer seen (but probably still there with another nickname).
We have been told that the siteops of the site do not support p2p at all and have no tolerance for people involved, however the shit they pulled with this gives you the thought they may be involved with this shit also (we doubt it actually... they just made some bad decisions). But we do know they are supporting Haz3 because they honestly believe he's innocent (but he isnt).
Just to remind some people... when f3arelit3 asked the smurf siteops what the hell was going on when we informed him, they denied all knowladge of it -- have yet to see anybody admit it.
To sum it up, the site Haz3 is on as linkowner has 2 linkowners that share to 2 different hubs, Haz3 is one of the two owners of the "Piratbyrσn" hub (the same hub BRiO and metalman are on.. remember the screenshot BRiO.jpg?) and the aldn #1 on their "DVDR-NORDIC site" of that ring is the owner of the 2nd hub.
Piratbyrσn Hub:
Kittym0n is ma@c-d847e455.04-59-73746f34.cust.bredbandsbolaget.se * maria hult [85.228.71.216]
Haz3 is 1005@heroin.campus.luth.se * anal? yes, please!
Was being hosted on 85.228.71.85 before talking to the site's siteop which then obviously talked to Haz3 (which now also has our representative's nickname). Has changed ip and Haz3 seems to have changed nick there.
This is the same hub people from BRiO are on... and are still on it.
source2: Hubben som var nere Σr under rekonstruktion och uppsΣkrad
source1: o va betyder det ?
source2: ny bnc och svinlσnga skumma l÷sen, de ska nog f÷rs÷ka se vad som hΣnt, en massa dumpar Σr *gone* och op'arna mkt spaka
source2 translations:
the hub that was down is under construction and more secure
new bnc and very looooong wierd passwords, they will try to see what happend, a lot of dumps are *gone* and OPs confused
^^ This is stuff that happened AFTER our representative talked to a siteop of a site which Haz3 is linkowner at, which then the siteop went and told Haz3 everything.. INCLUDING our representative's nickname... VERY suspicious for the siteop even if you ask us. What will determine the siteop's true side is what they will do about this when they read this. If they chose to put it under the carpet they will be next. You are lucky we are not childish, after telling Haz3 our rep's nickname you pissed off a few people, was it worth it? Now go ask the person that set up the meeting between you and the rep if the people you messed with were worth messing with.
Peddahubben Hub [ dragonslayer-gbg.no-ip.org:2222 ]:
The siteops of the site seem to be able to find out but all we have seen is them just trying to cover everything up, even helping Haz3 to our representative's nickname. The owner of this hub is a linkowner on the same site, and is aldn #1 on the "DVDR NORDIC site" of it, the siteop has said that the DVDR NORDIC site was down at that moment.. a little too convinient maybe.. ?
BTW this one is run by complete retards, even got a webpage.. haha: http://hem.passagen.se/dragonslayer.no-ip/
Our representative said he promised to the siteop that the site's information will stay secret, however with them leaking the representative's name to a p2p idiot that thinks he's immune just because he's some sort of god (dunno where he got that idea from, maybe because he has a swedish 10mbit/100mbit?), AntiP2P has decided to say enough info about the site just so people involved know that's the site we're talking about.. the shortned version of it is 2 letters, first one being E, and has quite a few DVDR affils (thank you siteop for helping the p2p moron who you think isn't involved with p2p just because he says so).
What the siteops of that site have to ask themselvies is.. how the fuck did we stumble upon their site? We dont just pick random sites and random people, we follow leads.. even showed the siteop what their topic looks like in the channel, courtesy of the 2nd dc hub.
We have seen some notices that try to make up excuses how p2p is good and stuff, the people behind those notices are exactly the kind of people we don't want around. And just a nice warning, almost all swedish sites are a security risk for you.. we are aware of quite a lot of p2p activity on some gbit sites also, so don't think these are isolated incidents on small sites.. a good example is swecheck.net, which a very trustworthy source says.. the people behind it are in groups such as DiTS and MG (and people from swecheck are involved in dc hubs). The MG relation is 100% sure, but DiTS is a VERY VERY good posibility, the source seemed positive about it. One of the sources isnt sure that sigge is involved in DiTS anymore though, so we urge siteops to have a look at the DiTS users if they match sigge/soze's range. Some nice information included unedited from one of the sources:
---
And now that we're already cleaning other assholes from the scene, why not just clean another one, or the whole group(s)
Yes some say both MG and DiTS are aware Soze is running http://swecheck.net
But who knows..
Lets start by logging in to EFnet and join #swecheck.
/dns soze
[22:40] ╖╖ Looking up c-34d172d5.018-3-73746f28.cust.bredbandsbolaget.se
[22:40] ╖╖ Resolved c-34d172d5.018-3-73746f28.cust.bredbandsbolaget.se to 213.114.209.52 press F2 to copy to clipboard
/whois soze
[22:41] ╖╖ soze is soze@c-34d172d5.018-3-73746f28.cust.bredbandsbolaget.se * soze
[22:41] ╖╖ soze on @#swecheck @#project-sl @#
[22:41] ╖╖ soze using irc.inet.tele.dk, Better than WoW
/dns soze (LinkNet)
[22:42] ╖╖ Looking up Soze
[22:42] ╖╖ Unable to resolve LinkNet-282e0d3b4a.cust.bredbandsbolaget.se
/whois soze(LinkNet)
[22:42] ╖╖ soze is soze@LinkNet-282e0d3b4a.cust.bredbandsbolaget.se * soze
[22:42] ╖╖ soze using link-net.org, LinkNet IRC Network
http://213.114.209.52
http://sigge.swecheck.net/
resolves same website .. Soze's website.
http://project-sl.swecheck.net/ (Something they do..)
http://213.114.209.110/project%2Dsl/ (Ofcourse on the swecheck-site)
So... lets carry on..
http://www.swecheck.net/default.asp
http://213.114.209.110/swecheck/
http://213.114.209.110/swecheck2/ (old interface or new one?)
Is the same site too,..
maby its just a coincidence that Soze (Sigge) has OP status in #swecheck?
maby its just a coincidence that Soze (Sigge) has a dns called swecheck for his site?
maby its just a coincidence that a neighbour to Soze host swecheck website?
/dns 213.114.209.52
[23:00] ╖╖ Looking up 213.114.209.52
[23:00] ╖╖ Resolved 213.114.209.52 to c-34d172d5.018-3-73746f28.cust.bredbandsbolaget.se press F2 to copy to clipboard
/dns 213.114.209.110
[23:00] ╖╖ Looking up 213.114.209.110
[23:00] ╖╖ Resolved 213.114.209.110 to c-6ed172d5.018-3-73746f28.cust.bredbandsbolaget.se press F2 to copy to clipboard
maby its just a coincidence http://213.114.209.110 says "trust noone" "deny everything"
Cause theese guys doesnt have to deny anything right...
Theese guys are so big they can do whatever they feel aight?
---
The only way to find out if the DiTS relation is 100% sure is if a siteop of one of the sites DiTS affils on checks it out.
Other people involved with swecheck are:
Deaaaaaas is xXx@BAD.M0THERFUCKER.ORG * Deaaaaaas
FR2k is fr2k@213-67-215-192-o982.telia.com * FR2k [213.67.215.192]
sLy^ is bahaa@81-233-232-244-no19.tbcn.telia.com * bahaa [81.233.232.244]
Cofi is cofi@LinkNet-95aa9f8f7d.burken.nu * Cofi2 [irc.burken.nu]
soemoe is soemoe@LinkNet-ad1caf8d50.tbcn.telia.com * krakow [81-233-219-198-no25.tbcn.telia.com / 81.233.219.198]
Svesse is benne@c-daa1e255.014-39-73766c1.cust.bredbandsbolaget.se * Wodkaz [85.226.161.218]
BTW, check out the included swecheck.jpg to see what morons we are dealing with.
On another note, we would like to report that DEVASTATiON's name is now cleared, and rumor has it they will be asking for permission from the main source groups (such as Replica) via an nfo. We would like to take this chance to ask the original source groups to give them permission by including in their next nfo that DEVASTATiON is allowed to use their releases as source for their custom swesub, in order to create the first "official" custom swesub group. A nice idea also would be that DFG starts doing swedish, norwegian and finnish subtitles and become the first Custom Nordic group (makes sense if you think about it, have 1 release instead of 4). BTW DEVASTATiON, you can thank V.. for this.
We have provided only the information we feel is needed at this point to take care of the situation. The siteop has seen some of the information but chose to believe Haz3's lies, and even.. for the 100th time, leak information to him, thank you for taking your site's security so seriously you fucking moron, the amount of help the siteop offered was 0! Wouldn't be suprised to find his name on some hub soon either, or any more of his line owners. His reaction to this will surely show what side he is on.. if he doesn't take care of his 2 line owners it can only mean he is involved somewhere, which would be quite sad as we were originally told good stuff about the siteops there, and chose to trust them where they betrayed our trust and sided with their p2per.
Take care, still gathering information on scenetorrents and very close to finding their source(s).
Greets to those worth greeting.