AI-Built Torrent Web site Seems to be Inaspect Downloads to Catch Fakes and Malware * TorrentFreak
TorrentClaw is a comparatively new torrent search engine that launched in February.
The web site is constructed on hyperlinks from its personal DHT crawler and dozens of exterior torrent websites and aggregators. In only a few months, the positioning has grown into an index of greater than six million torrents, together with the most recent Hollywood blockbusters and hit sequence.
The homepage seems to be extra trendy than conventional torrent websites and has some clear AI-design tells. That’s not a secret. On the opposite, AI performs a central position within the web site’s improvement and advertising.
According to TorrentClaw’s builders, who all use the title Deivid Soto, the platform is basically constructed and run with the assistance of AI.
“Basically, the core framework is Claude Code mixed with native LLMs for particular execution and ingestion duties,” Soto tells us.
For instance, AI is used to match torrents to movie and TV titles, so these might be neatly organized. The AI-driven categorization course of takes over duties that will in any other case be guide work, and AI helped to construct novel instruments as effectively.
One of the options constructed this fashion is TrueSpec, which checks whether or not torrents truly comprise what their names recommend. That helps to identify faux torrents and malware.
TrueSpec: Download and Verify
On most torrent websites, launch names are the primary supply of data for torrent customers. They listing the decision, codec, audio and launch group, however there’s no assure that any of it’s correct.
Mislabeled torrents are sometimes dealt with by moderators on well-run torrent websites, however most automated indexes haven’t any energetic moderation. That’s the place TrueSpec is available in.
TrueSpec joins the torrent swarm, reads the file itemizing, and downloads sufficient items to test the video with the evaluation instrument ffprobe. According to the positioning and its builders, that’s between 10 and 20 MB per torrent.
In addition to verifying the names, TrueSpec additionally checks suspicious information. It seems to be up their hashes on VirusTotal and, if the information are sufficiently small, uploads these for a scan. TorrentClaw doesn’t run its personal virus scanner, the malware verdicts come from VirusTotal.
When TrueSpec finds malware, the torrent stays listed on the positioning, however with a “Malware detected” label and the obtain button disabled. At the time of writing, one faux Jujutsu Kaisen episode with this label nonetheless had 34 seeders whereas it remained accessible on some exterior websites.
Not Perfect
The TrueSpec system isn’t good. In July, an earlier dataset counted 6,450 malware instances, however many have been false positives. These included the innocent RARBG_DO_NOT_MIRROR.exe file, fansub scripts that change audio languages, and scripts that merely open an internet site.
The TrueSpec information from late September paints a special image. TorrentClaw now solely counts malware when VirusTotal confirms it, which leaves 34 torrents. We checked a few of these towards the proof within the information, which hyperlinks to a VirusTotal report for each confirmed case.
Detected malware is uncommon, however the rely is probably going too low. TrueSpec doesn’t obtain massive executables, it prioritizes well-seeded torrents, and lifeless swarms can’t be checked in any respect. TorrentClaw additionally focuses on movies and TV reveals, so pirated software program and video games are largely not noted.
Malware is simply a part of what TrueSpec flags. In complete, 1,265 of the 687,057 probed torrents have been flagged as misleading, together with applications disguised as movies and faux resolutions. That’s lower than 0.2% of all checked torrents.
The commonest sort of ‘mislabeling’ is definitely fairly innocent. More than half of all probed torrents, 55%, embody subtitle tracks that their launch names don’t point out. TorrentClaw flags this as a lacking label, however subtitles are usually not added to titles except they’re hardcoded. Scene guidelines don’t require this both.
VLC Player Malware
Most of the confirmed malware torrents observe the identical sample. In 31 of the 34 instances, the torrent consists of an executable named after a brand new episode or movie, a file referred to as libvlc.dll, and a playable video in a subfolder.
The utility is a renamed copy of the real VLC media participant. According to TorrentClaw, it’s similar to VideoLAN’s official launch and carries its code signature. The malicious half is the DLL, which VLC hundreds when it begins, and which VirusTotal engines flag as a trojan.
The torrents are named after widespread new releases, together with episodes of The Boys, Jujutsu Kaisen and Frieren, and movies reminiscent of Dune: Part Three and Zootopia 2. Many additionally carry the names of recognized launch or distribution teams, together with SubsPlease, ETHEL and YTS.
This sort of malware vector shouldn’t be new. Earlier this 12 months, a security researcher documented a marketing campaign that used faux SubsPlease releases on Nyaa to unfold the Vidar infostealer. These have been reportedly uploaded from a stolen account.
TorrentClaw sourced its 31 torrents between February and August. Most of them, 22, got here in by way of its personal DHT crawler, whereas the remainder have been discovered through Nyaa, The Pirate Bay and TorrentDownload. All had seeders when listed, and 15 have been nonetheless energetic in early October, based on Soto.
Built For AI, By AI
TrueSpec isn’t the one factor that units TorrentClaw aside. The torrent web site additionally presents an MCP server, which permits AI assistants reminiscent of Claude and Cursor to look the index and fetch .torrent information immediately.
Technically, which means customers can ask an AI assistant to discover a launch and cargo the torrent file, with out ever visiting the positioning. According to Soto, some accounts make round 10,000 API requests a day, which is likely to be exterior websites or companies that use it.
Running TrueSpec doesn’t price a lot both. In July, Soto mentioned the system ran on three nodes costing effectively below $50 a month mixed.
“The implicit level: if verification is that this low-cost, any indexer could possibly be doing it, and none are,” Soto defined.
That mentioned, partially downloading content material from lots of of hundreds of torrents can even include a authorized price. TorrentClaw’s DMCA web page states that the positioning doesn’t host, retailer, add or distribute information, however rightsholders may even see issues otherwise.
When requested about this, Soto describes TrueSpec as a read-only consumer that doesn’t add or seed. It solely fetches the primary a part of a video file, sufficient to learn the container headers.
“[It] deletes every little thing as soon as the evaluation is finished. We don’t retailer or serve any content material, and we course of each legitimate takedown discover we obtain,” Soto says.
TorrentClaw additionally makes use of AI to deal with these notices. It launched an AI-managed system in late September that has dealt with 23 takedowns to date. Before that, the positioning acquired simply over 300 notices, principally duplicates.
TorrentClaw additionally costs for its premium options. PRO prices $3.99 a month, whereas PRO+ provides a VPN for $6.99. Whether that enterprise mannequin will maintain up has but to be seen, however business torrent companies usually draw extra consideration from rightsholders than free ones.
