Brazil’s Special Task Force to Combat Organized Crime (Gaeco), part of the Public Prosecutor’s Office of Ceará (MPCE), carried out a large operation on Tuesday targeting individuals and companies believed to be behind several pirate streaming platforms.
With assistance from the Civil Police of Ceará (PCCE), Operation Endpoint saw the execution of 19 search and seizure warrants and five arrest warrants in Alagoas (AL), Ceará (CE) and Santa Catarina. Three people were arrested. Two individuals with outstanding warrants are reportedly still at large.
Investigation
Based on a combination of reports from the Ministry of Justice and Public Security, the Prosecutor’s Office, law enforcement bodies, and local TV news, the investigation began following claims made against the operators of popular pirate streaming services.
Sold under brands including DezPila, Tyflex, and Onlyflix, it was alleged that the operators of the IPTV services were not only committing large scale copyright infringement, but are also involved in wider criminality, including money laundering as part of an organized criminal group.
The authorities claim that the pirate services presented as legitimate subscription TV providers, offering live TV, movies, and TV shows to customers. While they may have appeared legitimate, countless videos posted to YouTube suggest that many customers were aware that authorization from rightsholders was unlikely to be part of the equation.
Asset Seizures, Blocked Sites, Search Engine Delisting
The Prosecutor’s Office says that those higher up in the group used “front men” to facilitate the movement of funds generated by the services, in an effort to conceal the true owners of various assets. To counter the group’s obfuscation efforts, investigators were authorized to obtain information normally protected under Brazil’s banking, tax, and digital secrecy laws.
Social media platforms including WhatsApp and Telegram were reportedly used to attract customers to the streaming services, and via websites hosted by companies including Wix and Hostinger, new customers were signed up.
Online payments were reportedly processed through specialist checkout services, with payments received by various means but predominantly via Pix, an instant payment platform operated by the Central Bank of Brazil.
“As the investigations progressed, it became necessary to request the seizure of assets and valuables from the Judiciary, totaling R$ 12 million (US$2.25m),” the Ministry of Justice reports.
“Simultaneously, 118 websites and social media profiles were blocked, search engines results were de-indexed, and cryptocurrencies were seized.”
Domains Down
TorrentFreak has been unable to find any sites displaying an official seizure banner. However, by matching registered domains to the three brands, and then using alleged use of Wix and Hostinger as a crude filter, hundreds of domains were reduced to a few registered in Brazil.
None are currently functional and some appear to have ‘clientHold’ status, a sign that things aren’t going according to plan. Surprisingly, WHOIS records don’t appear to be consistently redacted, leading to ostensibly real names making repeat appearances.
Maybe they’re bogus, maybe they’re not, but at least one matches a person that has attracted significant interest from the authorities in the past.
Keeping Things Cool
Items of equipment seized by the authorities include what appear to be high-powered fans/blowers or at least according to some searches, vacuum-type devices or even air conditioners. Whether they blow or suck, they presumably exist to prevent electronic equipment from overheating.
In the event that the equipment gets warm enough to catch fire, the spherical object in the image below (top right) will come in handy. Suspended above most fans, it’s actually a self-contained fire extinguisher. In the image top center, a car engine appears to be generating electricity. Bottom left features some quartz watches and a presentation box containing prop money.
Further Investigations, Unanswered Questions
The Ministry of Justice says that investigators identified a number of legal entities linked to the group, used for the ‘transit and distribution’ of illicit funds.
“The investigation also identified partnerships between members of the scheme, who shared shell companies and irregularly traded machinery used for cryptocurrency mining.”
Whether that explains the images above is up for debate, but it’s certainly plausible.
Brazil’s Ciberlab also receives a mention for its technical and scientific support to track and dismantle digital infrastructures “that transcend geographical boundaries.”
The name ‘Operation Endpoint’ was apparently a strategic choice; instead of focusing on arresting individuals, the reported goal was to “target the access points — such as servers, domains, and monetization channels.”
Yet while domains and monetization channels can’t be photographed, the same can’t be said about servers. At least thus far, no images of servers have been released.
Whether the theory holds any weight is unclear, but some IPTV resellers in Brazil appear to be linking recent events in Argentina with the disappearance of DezPila, Tyflex, and Onlyflix, apparently thanks to their “reliance on a central server.”
That was eventually shut down but in line with tradition, others have already taken its place.
From: TF, for the latest news on copyright battles, piracy and more.
Powered by WPeMatico
