Topsite (warez)

Topsite is a term used by the warez scene to refer to underground, highly secretive, high-speed FTP servers used by release groups and couriers for distribution, storage and archiving of warez releases.
Topsites have very high-bandwidth Internet connections, commonly supporting transfer speeds of hundreds to thousands of megabits per second; enough to transfer a full Blu-ray in seconds. Topsites also have very high storage capacity; a total of many terabytes is typical.
/ref> Early on these warez sites were mainly distributing software such as games and applications after the release groups removed any protections. Now they are also a source of other copyright protected works such as movies and music. It is strictly prohibited for sites to charge for access to the content, due to decreased security, and sites found doing so are shunned by the topsite community.

Overview

Security

Unlike their predecessors in the Bulletin board system, Bulletin board system (BBS) scene, topsites aren't advertised broadly. With the increased threat of police raids, topsites have been forced to employ elaborate security precautions in order to stay hidden from authorities.

A typical topsite configuration will only allow users to log in from a certain ident and host (or IP range for users with dynamic IPs), with SSL encapsulation on all FTP sessions. FTP bouncers are commonly used to hide the topsite's real IP address, and to share network load.

Along with an "official name", most topsites are also known in the warez scene by an abbreviation that is two or three letters long. Knowledge of the abbreviation as well as the official name is not shared, even between different scene members. For example, a topsite with the hypothetical name "Blackbox" could be abbreviated as "BBX" and subsequently referred to as "B**" during an IRC conversation between those with knowledge of the site.

Site channels

Activity on the FTP server is announced by a ''Sitebot'' in a private IRC channel which is usually invite-only. To receive an invite, users need to issue a command to the FTP server after logging in the site. This ensures that only those with accounts on the FTP have access to the channel. Sitebots typically run Eggdrop IRC bot software.

Dupe (duplicate) check

Release databases record release names and their release date & time, although fields vary from database to database. Examples of other common fields include ID3 musical genre names (for MP3 releases), sections, and nuke (release rejection) details.

Release databases are maintained to provide release groups with a service for checking existing release titles (i.e., to avoid duping another group). Some databases contain historical release records dating back to the BBS era. Note that such databases are uncommon, due to a completely different release naming method (based on the ZIP file descriptor FILE_ID.DIZ, as opposed to a directory name), and lack of information from this period.

Release databases are usually updated by automatic processes that either recurse selected topsites searching for new releases (spidering), or catch pre-release announcements from site channels.

Release databases used by topsites are private, but a number of public websites exist with similar information.

Credit system

Credit system controls the amount of data that users can download. Most sites operate by using an automated credit system. When a user uploads a file, their account is credited for an amount based on the uploaded file size, commonly multiplied three times. For example, when a user uploads a 15MB file, they may receive 45MB credits in return. Credits can be later used to download files from the site. Credits can be lost by uploading a bad release that gets Nuke (warez), nuked. Nuke multiplier affects the amount of lost credits. Nukes can be either site nukes (local) or scene nukes (global). Site nukes are issued when a release that is uploaded to the topsite violates site rules, such as 'No VLS' for the MP3 section. Another common site nuke is for backfilling, which is uploading something after a specific amount of time has elapsed from the time of release, usually 5 to 15 minutes. Typically the nuke multiplier for a site nuke is at least 3x, where all couriers responsible for racing the bad release will lose 3x the credits they gained uploading. These nukes will not be echoed out to pre channels, as they only affect the local site. Scene nukes are nukes which are echoed out to pre channels. Scene nukes usually occur when a release violates scene rules, such as wrong encoder, or when the release is outright bad, such as out of sync. The nuke multiplier for scene nuke on topsites is usually 1x; all the couriers lose all credits gained uploading the release and break even.

Affiliates

A warez group may gain access to a topsite as an affiliate (or "affil"), thus making the site among the group's primary distribution points. Affiliation benefits the warez group as the site will grant a certain number of leech accounts to the group (the number usually depending on the reputation of the group), and the site benefits by becoming one of a collection of sites that has first access to the releases of the group, thus improving its own reputation. Typically, groups will affiliate with several topsites, in order to maximize efficient distribution by couriers to other (non-affiliated) topsites. A group will choose topsites based on geographical location, mostly by country but sometimes by region, such as Northern Europe or Western US. Barring extraordinary circumstances, a group selects just one site for each location.

Topsites may have any number of affiliates, and commonly advertise them in the welcome message to indicate to its users the quality of the site. The most exclusive topsites will avoid affiliating with an excessive number of groups for security purposes and also to maintain adequate network resources. Topsites may also remove (or "drop") affiliates for a variety of reasons, including the lack of productivity of the release group, conflict between the site operator and the group, and the group's decision to affiliate with another topsite in the same geographical region.

Each affiliate has access to a private, hidden directory on the topsite. This directory is used for uploading new releases before they are made available to other users. When a new release has finished uploading on each of the group's sites, a command is executed to simultaneously copy it into a directory accessible by other users, and trigger an announcement in the topsite IRC channel. This event is known as a pre-release (or "pre"), and must occur at the same time on every affiliated site.

The warez scene relies on strict release standards, or rules, which are written and signed by various warez groups.

Couriers

Couriers are a specific class of topsite users who earn their access by uploading new releases and filling requests. When a courier gains access to a topsite, they are often required to pass a trial test such as uploading a certain amount in a short period of time.

Couriers compete (race) against each other for respect, credits, access to other topsites, and fun. Private couriers often operate as independent (iND) couriers. Some couriers band together to form courier groups which provide support and friendship through camaraderie.

Staff roles

Site operator

A site or system operator (siteop/sysop) is in charge of the day-to-day operation of a topsite. They have full (root) access to the server and are able to manage users, groups, and topsite scripts and daemons installed on server. They decide on site rules, and site sections (e.g. TV Rips, XviD movies, MP3 music, etc.). Site operators are also in charge of managing the site channel, and sitebot.

Group administrator

A group administrator ('gadmin') is a member of an affiliated group or courier group with user management rights over the group. Each group has a pre-negotiated number of leech and ratio users, or slots.

Takedowns

While these sites are protected with technologically advanced schemes, law enforcement operations such as Operation Buccaneer (December 2001) and Operation Fastlink (April 2004) have been able to gain access and shut down sites by infiltrating the copyright infringement groups that operate on them. The group DrinkOrDie was busted during Operation Buccaneer. Tens of thousands of copies of software, games, movies and music were on ''leech'' sites reserved for their members only, having the names Lake of Fire, Packet Storm, Fatal Error and High Octane. One eventually grew to 1 terabyte in size. , Operation Site Down was the latest significant law-enforcement attack on the warez scene. There were also busts in June 2006, with one US.biz site being busted, and several co-located servers being seized.

In November 2006, the Dutch anti-piracy organization BREIN claimed their first shutdown of a topsite, MadBiker (MB), after infiltrating the closed user community. The site allegedly had 5.6 terabytes of content and used the super fast Onsnet fiber network in Nuenen. In name of the international interest organizations MPAA, IFPI, RIAA, ESA and BSA, Brein explained the situation to the network administrator Edutel, who closed the site down at their request. Brein estimates there are dozens of similar sites in the Netherlands.

Two years later, on November 26, 2008, Brein got the ftp servers of the 'topsite' TV Land (TVL) seized. The 3 gigabit drFTPd site without affils offered 45TB of content, making it one of the largest topsites ever. Brein director Tim Kuik claims it was one of the sites at the top of the piracy pyramid. The files would leak to the torrent site Scenetorrents.org and other large torrent portals. The servers were hosted at different providers of which some were located at Leaseweb. The owner, 'Smokin1', is located outside the Netherlands and no raids or arrests were made. Brein suggests there are hundreds of topsites worldwide, of which two thirds are located in the Netherlands. The administrator of the site would also sell download accounts with a limit of 400GB for 40 euro a month. This made Tweakers question whether Brein really infiltrated the site or they got the information for free. A week earlier a scene notice attacked the collaboration between TV Land and SceneTorrents. The NFO file showed ''smokin1 (admin of TV Land), I recommend you to close your insecure p2l/p2p site within 24 hours, or I will provide all Dutch anti-piracy organizations all information about the site, including complete releases list and sufficient proof to get the site busted, you have been warned!''. Tim Kuik, the managing director of Brein, told Slyck.com that TV Land was penetrated before the release of the notice.

A year later, SceneTorrents (ScT) announced they are shutting down for good on November 29, 2009. The 20,000 members had to find a new site after 4.5 years on the respected and well-connected private BitTorrent tracker. An invite was hard to find. Rumours said the shutdown was related to the raid on topsite LOOP two days earlier, which was (supposedly) one of SceneTorrent's main content provider according to insiders. Other rumors said it could be a planned operation unrelated to the topsite. Later a staff message on the site said it was due to pending legal issues. Members of their staff were arrested and they declined to comment any further on the situation because of the criminal proceedings. On November 27, Brein got the ranked topsite LOOP taken down. Two servers with a total storage capacity of 40TB spread over 28 hard disks were raided at their hoster in Amsterdam. The site was hard to access because you had to be invited by a staff member. Kuik says there are only a couple of hundred similar sites worldwide.

On December 16, 2008, less than a month after TV Land, Brein took down yet another topsite. Sparta had 65TB of content, so Brein could claim again to have taken down the largest topsite ever.

Hong Kong Customs uncovered a case when "copyright industry representatives" tipped them off in June 2009, resulting in the first case in Asia. Apparently, an international syndicate for unauthorized distribution used a topsite to download and then distribute copyright-infringing items such as movies, music, computer programs and video game software.

In September 2010, after being in the planning for two years, the police executed a file sharing raid in up to 14 countries across Europe. Started by the Belgian authorities, it is suspected that a scene group in Belgium had been infiltrated. Some of the ranked sites affected by the busts are BAR, LOST, DLR and SC.

In December 2010, a site known as ''Devil'' was raided by the Swedish police after receiving information from an anti-piracy group. At least a dozen computers and servers were seized, containing more than 200 terabytes of media.

In January 2011, the Dutch anti-piracy organization BREIN claimed to have taken down their largest topsite ever: ''Swan'' (previously known as ATS). According to BREIN it contained 220 TB of data spread over 12 servers, but the operator of Swan, MrTB in Costa Rica, said it were only 8 servers with 175 TB of data. The site was taken down by hosting provider WorldStream and without judicial process BREIN seized its servers. The owners of the servers retaliated by seizing them back and may sue BREIN for breach of privacy and property rights as BREIN is a private organization and has no special legal or investigative authority.

Not all takedowns are successful. Operation Bahnhof (March 2005) failed when the officials entered an area that their warrant didn't include. Although they found several dedicated servers with terabytes of illegal material, they ended up being sued for illegal trespassing and harassment, and were accused of planting evidence, since one of the Antipiratbyrån (Swedish anti-piracy group) employees was trying to infiltrate the scene to gather evidence, and in doing so violated Swedish laws against entrapment.

Software

Some software that is used to run topsites.

FTP daemons

* glFTPd
* DrFTPD Pre date: 2004-12-02

/ref>
* ioFTPD Archive
of the scene notice contains a ''.raidenftpd.acl'' file. ioFTPD mentioned in the notice. Pre date: 2004-04-24. This notice appeared a couple of days after the Operation Fastlink US DoJ press release. Pre date: 2008-06-14

/ref>
* RaidenFTPD Václav Jirovský, ''Kybernetická kriminalita'', Grada Publishing a.s., 2007, , p. 72

See also

*Warez
*Bulletin board system
* Pubstro

References

External links

* ''Wired magazine'' article about the phenomenon
The shadow internet
* NetMonkey Weekend Report (NWR
article on topsite FTP daemons

The Significance of the Huge European Warez Scene Raids
!-- to use as source/content to explain site ranking (also in book) -->

{{DEFAULTSORT:Topsite (Warez)
Warez