Last month copyright troll law firm Prenda suffered losses on several fronts, including a $81,319.72 court sanction. However, Prenda’s troubles are far from over.
A new filing submitted by defense lawyer Graham Syfert opens up a new can of worms, accusing the copyright trolls of seeding the very files they claim to protect.
In the filing Prenda and its boss John Steele are accused of running a “honeypot” based on an expert report authored by Delvan Neville, whose company specializes in monitoring BitTorrent users.
Neville gave Prenda a taste of their own medicine by conducting a thorough analysis of the IP-addresses sharing the files the copyright trolls are suing for.
Many of the torrents detailed in Prenda lawsuits originate from a user on The Pirate Bay called ‘Sharkmp4’. Could it be that this user is somehow linked to Prenda and distributing the files to increase their list of potential targets?
The expert report found that some interesting patterns emerge from the list of IP-addresses observed sharing these files. Several IP-addresses were present in the majority of the swarms, all using a rather rare version of the BitTorrent client Vuze which is often used for BitTorrent tracking.
The IP-addresses in question resolve to the VPN provider Mullvad, and Neville suggests in his report that these IPs were used by Prenda’s BitTorrent tracking company 6881 Forensics. The same addresses were also found commenting on Prenda topics published on the anti-copyright troll blogs FightCopyrightTrolls and DieTrollDie.
The report goes on to describe many connections between Sharkmp4, the tracking company, and Prenda. Among other things it ties the Comcast IP-address 75.72.88.156 to John Steele’s GoDaddy account. The same IP-address is also associated with porn studio Ingenuity 13 whose work was shared by Sharkmp4 before it was commercially available.
Steele’s GoDaddy account
“It appears from all the evidence that John Steele (or someone under his control or with access to his GoDaddy account records with authorization to make changes to domain names) is the most probable candidate for the identity of Pirate Bay user sharkmp4. Sharkmp4 was the originator of the only found public releases of Ingenuity 13 works prior to the creation of naughtyhotties.com,” Neville writes.
“Some works were shared by sharkmp4 prior to the registered copyright date with indications of access to a higher resolution copy more related to the direct source,” he adds.
While the above makes it likely that Prenda were indeed sharing the files they were supposed to protect, there is one final piece of evidence to conclusively link “Sharkmp4” to the copyright trolls.
It’s no secret that The Pirate Bay stores users’ IP-addresses, so after hearing about the new filing they handed TorrentFreak the log files for Sharkmp4. They link the user to John Steele and Prenda Law.
Below is an overview of some of the uploaded files which are all still online.
Sharkmp4 IP-addresses
The Pirate Bay logs not only link Prenda to the sharing of their own files on BitTorrent, but also tie them directly to the Sharkmp4 user and the uploads of the actual torrent files.
The IP-address 75.72.88.156 was previously used by someone with access to John Steele’s GoDaddy account and was also used by Sharkmp4 to upload various torrents. Several of the other IP-addresses in the log resolve to the Mullvad VPN and are associated with Prenda-related comments on the previously mentioned anti-copyright troll blogs.
The logs provided by The Pirate Bay can be seen as the missing link in the evidence chain, undoubtedly linking Sharkmp4 to Prenda and John Steele. Needless to say, considering the stack of evidence above it’s not outrageous to conclude that the honeypot theory is viable.
While this is certainly not the first time that a copyright troll has been accused of operating a honeypot, the evidence compiled against Prenda and Steel is some of the most damning we’ve seen thus far.
It’s now up to the judge to decide what to do with it.
Update: The logs caused some confusion among TPB users but Pirate Bay’s Winston ensures TorrentFreak that IPs in the database are wiped after 48-hours.
“the IPs I dug up are from the daily database backups. I had to decrypt the backups one by one after checking the upload times and fetching the correct backup file for that day,” Winston tells us.
“The backups are stored on a separate cloud provider, pgp encrypted so the decryption key is not the same as the encryption key, and the decryption key is safely stored offline and is itself encrypted with a passphrase. So there’s no risk of users IPs getting compromised in a raid!”
“As for us sharing the IPs, we would obvious only do this to out the bad guys, after we linked them to the addresses.”
