I Know What You Download on BitTorrent

Just a side-note: the attitude expressed in the Russian version of the website is nowhere that mild and neutral as in the English one. I personally do find it not only alarming, but disgusting to the very least (esp. the "torrent-tracker users deanonymization" part).

https://iknowwhatyoudownload.com/ru/contacts/

Screenshot: http://imgur.com/a/PTiDT (under the title "Сотрудничество", which means "Cooperation").

Here is my crude translation:

...

Cooperation

============

We are ready to share data on an automated basis, in a different cross-sections and formats. Besides we do have the technical means for "catching" users, who do participate in the torrent-file seeding. By means of connecting to the user's device and subsequent downloading of one tiny piece from the torrent-file, it is possible to collect a TCP-dump of the data exchanged for that piece. There is a unique fingerprint associated with both those data exchanged and the torrent-file itself [0]. That allows to prove the fact that torrent distribution had been taken place from the particular IP address [1]. Everything mentioned above will be potentially actual/useful in Russia [2]. If interested in cooperation, you could let us know:

P.S. We also have means/possibilities to build recommendation systems, to de-anonymize torrent-trackers users and much, much more.

...

[0] I guess, they speak about "piece" from the "info" array: https://en.wikipedia.org/wiki/Torrent_file#File_structure

[1] They have downloaded it from you, so the fact of the distribution, am I missing something?

[2] http://hitech.newsru.com/article/03oct2016/piratefine || https://translate.google.com/translate?sl=ru&tl=en&js=y&prev...

This is very strange, as I highly doubt they're crawling the entire DHT space, and even if they did they would be getting only infohashes. These are hashes of (a subset of) the torent metadata (including the chunk hashes), so it won't actually tell you what the content is, unless you also download the torrent metadata from peers using BEP-0009.

I'd bet they're pulling popular torrent files from big sites and then pulling peer lists from the DHT. This will work OK for 'hot' content, but they could probably get much better lists if they actually connected to swarms and did peer exchange (PEX) which clients effectively have no control over - it's up to their peers if they are going to reveal addresses through PEX.

Also note that of course none of this will work for private torrents (which almost all clients respect) as they disable all methods of peer/metadata acquisition other than from the trackers directly.

Most torrent clients do support encryption (opportunistically), although the bittorrent protocol's encryption is relatively weak and uses RC4. It should be considered more obfuscation to avoid DPI and whatnot.

Bittorrent peers are fundamentally public by design, unless the torrent is marked private, so this is just curating and presenting that information.

The results are garbage. Zero correct results and tons of false positives.

Checked the last dozen or so IP addresses I used. I don't see a single valid result. I torrent lots from the most popular torrents on the biggest site. You'd think it could get that right.