Torrent Invites! Buy, Trade, Sell Or Find Free Invites, For EVERY Private Tracker!, BTN, PTP, MTV, Empornium, Orpheus, Bibliotik, RED, IPT, TL, PHD etc!

Results 1 to 1 of 1
Like Tree3Likes
  • 3 Post By jimmy7

Thread: Popcorn Time Domain Suspension Was Triggered by Falsified Court Document

  1. #1
    Super Moderator
    jimmy7's Avatar
    Reputation Points
    Reputation Power
    Join Date
    Jan 2016
    Time Online
    478 d 10 h 50 m
    Avg. Time Online
    7 h 31 m
    2603 Post(s)
    776 Post(s)
    31015 times
    111 (100%)

    Popcorn Time Domain Suspension Was Triggered by Falsified Court Document

    This week, one of the most used Popcorn Time forks had its domain name suspended. We later learned that the registrar took this decision based on a US court order. That's nothing out of the ordinary if it wasn't for the fact that the document was clearly falsified. The registrar eventually reversed its decision after questions were asked, but the trouble didn't stop there.

    Earlier this week registrar 101domain suspended the domain name.

    The grounds for the suspension initially remained unclear. However, after asking for clarification, 101domain explained to the site operator that it had received an injunction from a US court.

    The injunction in question appeared to have been sent by the Motion Picture Association (MPA). It was signed by a federal judge at the US District Court for the District of Columbia and indeed targeted

    Since the MPA had gone after various Popcorn Time forks in the past, this sounded somewhat plausible. However, the document clearly isn’t real.

    At TorrentFreak, we received a copy of the same injunction two weeks ago. It was sent in by an anonymous tipster who urged us to report on it. While the story made some sense, on closer inspection we found that the injunction was obviously falsified.

    For example, the court stamp and the signed date are from May 2019 while the document itself was filed in November 2019, according to the header. The case reference number also identifies a completely unrelated lawsuit and the paperwork shows several other signs of tampering.

    Most telling, perhaps, is that the associated injunction is supposed to prevent “the immediate and irreparable harm will result to Microsoft.” Microsoft?

    Some more digging showed that, while there is no such filing from the MPA, there is an almost identical order from last May in a case between Microsoft and several John Does who operated domains such as

    This case has nothing to do with Popcorn Time. Someone simply took the document and changed several details, making it look as if it came from the MPA targeting

    Use slider to compare the original (pdf) and fake (pdf)

    Although this didn’t take much effort for us to uncover, the fabricated document was apparently sufficient to convince 101domain to suspend the domain. Popcorn Time shared a copy of the response it received from the registrar’s abuse team, which attached the falsified document.

    We reached out to the registrar to verify this and also pointed out our suspicions but unfortunately, we didn’t hear back. Interestingly, a few hours later 101domain suddenly realized that the document was fabricated.

    A Popcorn Time representative informs TorrentFreak that the domain suspension was lifted after 101domain confirmed with the US District Court that the injunction wasn’t legitimate.

    While this is good news for Popcorn Time, it may never have happened if people had started asking questions sooner.

    Perhaps surprisingly, 101domain was not the only registrar to fall for the falsified court document either. When Popcorn Time had its .sh domain suspended it switched to, a domain they registered through 1API.

    It didn’t take long before that registrar received a similarly altered ‘injunction’ (pdf). The same Microsoft order was used as the basis again, but this time targeted the new domain

    In an email, which the Popcorn Time representative shared with TorrentFreak, 1API explained that Popcorn Time had 48 hours to respond, adding that the domain name may eventually be put on hold.

    1API also revealed the request from the original complainant, which was sent from a address, supposedly by a member of MPA’s legal team named ‘John Gibetstan’.

    “Hello 1API, I am a representative of the MPA’s Legal Team. We have obtained an injunction to take control of a domain under your system. The domain in question would be You have 5 business days to take action on the injunction,” it reads.

    Aside from the various flaws in the underlying document, this email doesn’t appear to be very professional. The MPA doesn’t use Protonmail addresses either, and there’s not even a John Gibetstan working there.

    For now, the domain remains available but 1API’s 48-hour window hasn’t expired yet. We reached out to 1API requesting additional details and comment on the issue but, at the time of writing, we have yet to hear back.

    All in all the whole episode shows that it’s surprisingly easy for malicious actors to fool some domain registrars, at least initially. Who the fake complainant is and why he or she wants Popcorn Time offline, remains a mystery.


Tags for this Thread


Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts