Home > Anti piracy > DMCA >
The company behind the notorious anti-tamper technology Denuvo, filed an interesting DMCA takedown notice on GitHub this week. According to Irdeto, anonymous parties cloned the company's website, registered a lookalike domain, and ran their own mail server behind the scenes. A brief investigation by TF suggests that the culprits could have known that Irdeto would try to locate them and could have left Easter eggs along the way.
Duplicate and clone sites were once implemented to keep popular sites alive as they imploded under the weight of their own popularity and resulting traffic.
The strategy was implemented around Suprnova, one of the original torrent giants. Considering how frequently the entire site went down, unable to cope with unprecedented success, it was given an unintentionally appropriate name in retrospect.
Today, some clone and mirror sites still exist for the same purpose, but most fall off the end of the streaming site conveyor belt, to take advantage of the popularity of sites with well-known brands, create confusion with similar domains, or both.
As a leading cybersecurity and anti-piracy provider, Irdeto will be well aware of the phenomenon of duplicate and cloned sites. Whether you expected your own website to be cloned and put online is up for debate. As the owner of Denuvo, perhaps the most hated anti-piracy technology currently on the market, it probably came as no surprise.
DMCA Takedown Notice for GitHub
Irdeto's DMCA notice was submitted to GitHub in its own name, which probably doesn't happen very often.
โWe write to you from Irdeto BV ('Irdeto'). โWe own the exclusive copyright to Irdeto.com and its related assets,โ the notice begins.
In response to GitHub's request to identify the original copyrighted work that had allegedly been infringed, Irdeto pointed to its own website.
โIrdeto.com and its related assets (such as text, website design and images) is our copyrighted corporate website. The reported repositories have duplicated the code and assets of the Irdeto website. As this repository contains a direct copy of Irdeto.com, please confirm that we own the copyright to all contents in the repository.โ
Cloned sites operating under two domains
Irdeto goes on to claim that the owner of the offending repositories, described simply as "this individual", had attempted to impersonate Irdeto. One of the domains used in connection with the cloned website was Irdeto.fr, but the notice does not reveal whether there was a broader plan. That said, the existence of a mail server rightly raised additional concern.
After identifying the repositories to be removed, Irdeto called for quick removal and action against the alleged culprit.
โWe respectfully request that Github quickly remove the offending content and suspend the user. If something prevents you from removing the reported content, please let us know what additional information is required,โ the company wrote.
Obviously, the first request was granted by GitHub, but it is unknown if it took any action against the user.
Unexpected
Suspended from GitHub or not, taking on a company like Irdeto has the potential to end pretty badly. At the very least, there are much less risky targets, so who would choose to take on a corporation hoping to beat it at its own game?
Unable to resist taking a brief look around us, we start with basic questions; Who owns Irdeto.fr, what other domains does it own, and why are WHOIS records almost always frustrating?
However, surprisingly, today it is not frustrating at all. Without a cloak of newsrooms, without a wall-to-wall privacy service, Irdeto.fr seems like an image of openness.
Registered on January 28, 2024, Irdeto.fr offers something that most domains don't: personal information, or at least that's what the information suggests it could be. I am not willing to fall into traps of shenanigans or possible registration substitutes, details are written up below.
With limited time, the next easy step was to find other domains registered by the same person. Using the email address given for Irdeto.fr, we ran a check and got another suspiciously easy result.
The same email address not only appears on another domain, but also on a .US domain, which is usually not redacted. This was no exception.
At this point completely out of time, we take it as a direct order. Irdeto almost certainly won't do it, even though there are 121,000 domains left to crawl.
Irdeto's DMCA notice is available here
