{"id":84133,"date":"2025-07-17T09:00:43","date_gmt":"2025-07-17T09:00:43","guid":{"rendered":"https:\/\/www.cryptocabaret.com\/?p=84133"},"modified":"2025-07-17T09:00:43","modified_gmt":"2025-07-17T09:00:43","slug":"fbis-video-game-piracy-crackdown-leads-to-domain-confusion","status":"publish","type":"post","link":"https:\/\/www.cryptocabaret.com\/?p=84133","title":{"rendered":"FBI\u2019s Video Game Piracy Crackdown Leads to Domain Confusion"},"content":{"rendered":"

\"nsw2u\"Originally known as Switch-xci<\/a>, NSW2U has been a thorn in the side of Nintendo for over half a decade. <\/p>\n

The site was initially active on several platforms, including YouTube. Later on, its primary focus was providing a linking portal for pirated games.<\/p>\n

The main NSW2U domain had more than two million monthly visits, according to Similarweb, which was enough to warrant a mention on the USTR\u2019s latest list of notorious pirate sites. Following a presumed referral from rightsholders, it also attracted the attention of the FBI.<\/p>\n

Last Thursday, we reported that the FBI had seized the NSW2U.com domain<\/a> plus several others linked to gaming piracy sites. This action was confirmed in a press release<\/a> issued by the FBI\u2019s Atlanta Field Office, which said that it dismantled the infrastructure of these websites.<\/p>\n

The FBI further stated that unspecified records indicate that the most popular domain is linked to 3.2 million illegal downloads, resulting in a loss of $170 million.<\/p>\n

FBI Domain Error<\/h2>\n

The press release lists seven domain names in total: nsw2u.com, nswdl.com, game-2u.com, bigngame.com, ps4pkg.com, ps4pkg.net, and mgnetu.com. While most of these were indeed linked to pirated games, ps4pkg.net stands out as a currently unregistered domain that wasn\u2019t active earlier in the year either.<\/p>\n<\/p>\n

Domain available<\/em><\/center>
\"\"<\/center><\/p>\n

When we asked the FBI about this peculiarity, a spokesperson informed us that the domain name was listed in error in the June 10th press release, which is still online today. Instead of ps4pkg.net, the target domain should have been ps5pkg.net.<\/p>\n<\/p>\n

FBI Atlanta press release<\/em><\/center>
\"fbipress\"<\/center><\/p>\n

This confusion went unnoticed by most news publications that picked up the press release but was spotted elsewhere, including by popular YouTuber SomeOrdinaryGamers<\/a>.<\/p>\n

Broader Infrastructure<\/h2>\n

Unfortunately, the FBI was not at liberty to share further details on the follow-up plans for the case, as it\u2019s part of an ongoing investigation. However, the official communication suggests that the enforcement action might not be limited to domain names, but also the broader \u201cinfrastructure\u201d.<\/p>\n

Servers may have been targeted as well, for example. That could explain the involvement of the Dutch fiscal police, FIOD, as the Netherlands is a popular hosting location for many pirate sites and services. Public information shows that NSW2U used Dutch servers in the past.<\/p>\n

FIOD informed us that it took action in response to a request for mutual legal assistance. No further details could be shared, but FIOD is known to investigate and take action at local hosting providers in criminal cases.<\/p>\n

There is currently no information indicating any arrests and to our knowledge, there hasn\u2019t been a publicly announced indictment either.<\/p>\n

New NSW2U Domains<\/h2>\n

The erroneous domain listed in the FBI press release is not the only source of confusion in the wake of events last week. As is often the case when pirate sites are shut down, opportunists have stepped in to take advantage.<\/p>\n

There are several NSW2U-branded domains still online today that claim to be alternatives or mirrors of the original. This includes NSW2U[.]games (caution!) which was registered a few hours after the FBI seized the original domains. <\/p>\n<\/p>\n

Registered after<\/a> the domain seizures<\/em><\/center>
\"whois\"<\/center><\/p>\n

This domain redirects to a NSW2U-branded site that doesn\u2019t look like the original, but it is clearly targeted at disoriented users. The .games domain redirects to another unofficial NSW2U-branded domain, which then links users to yet another domain displaying a third-party download site within an iframe.<\/p>\n

Some of these domains are listed by security vendors as malicious. The iframe in question loads external and unknown JavaScript files from a recently registered domain, presumably to display \u2018advertisements.\u2019 However, we can\u2019t rule out other risks. <\/p>\n

In fact, the site itself admits potential trouble. It explicitly recommends an ad blocker and antivirus to avoid malicious ads or redirects. Of course, staying away from these sites completely, for various reasons, is the safest choice.<\/p>\n<\/p>\n

Safe?<\/em><\/center>
\"\"<\/center><\/p>\n

For now, all signs suggest that the FBI action effectively took the real NSW2U operation offline and, absent the copycats, there is no indication that it will make a comeback anytime soon. <\/p>\n

From: TF<\/a>, for the latest news on copyright battles, piracy and more.<\/p>\n

Powered by WPeMatico<\/a><\/small><\/p>\n","protected":false},"excerpt":{"rendered":"

Originally known as Switch-xci, NSW2U has been a thorn in the side of Nintendo for over half a decade. The site was initially active on several platforms, including YouTube. Later on, its primary focus was providing a linking portal for pirated games. The main NSW2U domain had more than two million monthly visits, according to […]<\/p>\n","protected":false},"author":2,"featured_media":84134,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[308],"tags":[],"class_list":["post-84133","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-torrent"],"_links":{"self":[{"href":"https:\/\/www.cryptocabaret.com\/index.php?rest_route=\/wp\/v2\/posts\/84133","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.cryptocabaret.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.cryptocabaret.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.cryptocabaret.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.cryptocabaret.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=84133"}],"version-history":[{"count":0,"href":"https:\/\/www.cryptocabaret.com\/index.php?rest_route=\/wp\/v2\/posts\/84133\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.cryptocabaret.com\/index.php?rest_route=\/wp\/v2\/media\/84134"}],"wp:attachment":[{"href":"https:\/\/www.cryptocabaret.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=84133"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.cryptocabaret.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=84133"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.cryptocabaret.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=84133"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}