Pirate CDNs Fueling 1,400 Russian Sites “Use EU & US CDN Infrastructure”

A new report offers a rare glimpse into the world of pirate CDNs. The report suggests that the largest players in Russia together service around 1,400 third party pirate sites, whose operators draw on massive libraries of pirated content offered by the CDNs. A single CDN reportedly controls around 60% of the Russian market, using CDN infrastructure in the Netherlands, the United States, Ukraine, Germany, and France.

f6-s Back in 2019, Dutch anti-piracy group BREIN, alongside the Alliance for Creativity and Entertainment and Hollywood’s MPA, had reason to celebrate following a successful enforcement operation.

Their target was a CDN (Content Delivery Network) known as Moonwalk, which offered vast quantities of movies and TV shows for pirate site operators to embed in their own sites.

Services like these aren’t necessarily the cheapest option, but if time is money, having a one-stop-shop video supplier take care of pretty much everything, ads included, could certainly lighten the load for those short on time.

Moonwalk allegedly supplied content to 80% of known Russian streaming portals before it was shut down. A knock-on effect quickly claimed the scalps of other big players including HDGO and Kodik, at least for a while.

Pirate CDNs Play an Important Role Worldwide

Most visitors to popular pirate streaming sites will have watched embedded movies or TV shows that are hosted somewhere else entirely. This can be obvious when the viewer is presented with a choice of hosts, but that’s not always the case. Most streaming sites simply act as shop windows, which certainly helps with mobility when it’s time to rebrand while circumventing another round of blocking.

A new report from Russian cybersecurity firm F6 (previously Group-IB) provides an overview of the local pirate CDN market and presents some interesting findings.

One Player Dominates the Market

F6 analysts say they investigated 1,400 pirate sites to determine which CDNs are most popular in Russia. At the top of the list by some distance is the Alloha network. F6 estimates that 61% of local illegal streaming sites rely on Alloha for video content.

alloha.tv application In our tests Alloha wasn’t readily findable in Google’s search results, despite being absent from the company’s takedown transparency report. Only when queries contained the platform’s full URL did it surface as expected; searches using Yandex, meanwhile, were much more straightforward.

Access to Alloha is granted on application, and subject to various terms and conditions.

The service states that applicants must operate their own site and must’ve had a minimum of 300 visitors per day during the previous week.

That appears to rule out brand-new sites seeking content to grow from an absolute standing start, but finding 300 visitors shouldn’t be too difficult.

Operating from an Indian domain, the Rewall service takes second place in the F6 list with 42%. In third place is Lumex with 11%, followed by the resurrected Kodik (9%), and HDVB with a modest 7% share. Since the total is over 100%, some pirates seem to be edging their bets with two or three suppliers, just in case.

Databases, Customers, Ads, Hosting

The authors of the report claim that these services usually offer massive libraries of pirated content. One unnamed service reportedly has more than 550,000 items of video listed in its database.

Overall, F6 notes that these services allow pirates to more effectively grow their sites. Advertising delivered along with video streams through the embedded player reportedly accounts for 36% of all advertising on pirate streaming sites.

Alloha player implemented on two different sites
alloha-players
That leaves the claim that around 1,400 streaming sites rely on these types of services for content. That sounds entirely plausible.

Finding sites behind Cloudflare can be a challenge, but at least one of these platforms prefers not to use it, which helped us to quickly identify around 600 domains linked to the service. How many are unique is another question, but the end result probably wouldn’t undermine the headline figure.

The West Should Take Piracy More Seriously, Apparently

Finally, it seems somewhat ironic that the West describes piracy in Russia as a very serious problem, yet in Russia, criticism in this case appears to run in the opposite direction. The mobility of indexing sites means that blocking in Russia descends into a game of cat and mouse, but the CDNs themselves are also considered problematic.

Instead of the CDNs being hosted in Russia, F6 notes that overseas hosting is preferred. The Netherlands, United States, Ukraine, Germany, and France are highlighted as the locations of choice, all of them more difficult for Russian authorities to block than servers hosted on home soil.