ZipTorrent Pollutes and Slows Down Popular Torrents
Written by Ernesto on July 16, 2007

BitTorrent users are facing a new enemy. A BitTorrent client named ZipTorrent, allegedly created by our friends from the anti-piracy organization Media Defender, leeches bandwith and spreads useless data chunks.

ziptorrentThe goal of ZipTorrent is to slow down popular downloads as much as possible. They use hundreds of these clients at the same time and this can potentially bring the average download speed down to zero. Even more so, it is not unlikely that it will record your IP-address in the process so they can send you a copyright infringement notice on top of it.

On the Media Defender website we read:

“Decoying and Spoofing are the most commonly known techniques that we employ. We send blank files and data noise that look exactly like a real response to an initiated search requests for a particular title.”

According to ubisuck over at the mininova forums, Media Defender is doing just this with ZipTorrent. Apparently the fake client is a mod of the popular BitTorrent client Azureus which can be configured to send fake data.

Here’s a full screenshot of the ZipTorrent configuration screen. As you will see, there are some dubious settings like “fake upload ratio mode”, “no upload” and “safe fake download”.

It is not hard to check whether you are connected to these fake clients. In the peers list of your BitTorrent client they will show up as “ZipTorrent” and most of the time you will be connected to a bunch of them all originating from similar IP addresses with either 0% or 100% of the file completed.

However, there are blocklists to stop these malicious clients from connecting to your BitTorrent client. Pasted below is a list of the known IP-ranges ZipTorrent is on. The ranges were identified by The Pirate Bay team and are posted in several forums. You might want to add these to the blocklist of your BitTorrent client or PeerGuardian.

There’s one problem though, Media Defender will probably move to new IPs if they read this, a never ending story.

Update: The legitimacy of the screenshot and “ZipTorrent” is doubtful but the IP ranges are correct. Spoofing is not limited to a client like ZipTorrent and I’m told that clients like uTorrent and Azureus are also used to do this job.

ziptorrent:64.62.145.130-64.62.145.165
ziptorrent:65.19.131.0-65.19.131.85
ziptorrent:66.160.133.0-66.160.133.199
ziptorrent:87.117.250.0-87.117.250.150
ziptorrent:216.218.0.100-216.218.184.199
ziptorrent:216.218.190.0-216.218.199.255
ziptorrent:38.99.252.0-38.99.252.255
ziptorrent:38.99.253.1-38.99.253.200
ziptorrent:38.100.24.0-38.100.24.255
ziptorrent:38.100.25.0-38.100.25.255
ziptorrent:38.100.26.0-38.100.26.255
ziptorrent:38.100.134.0-38.100.135.255
ziptorrent:63.216.0.0-63.223.255.255
ziptorrent:64.62.145.0-64.62.145.255
ziptorrent:64.62.214.0-64.62.214.255
ziptorrent:64.93.64.0-64.93.64.255
ziptorrent:65.19.131.0-65.19.131.85
ziptorrent:65.19.143.0-65.19.143.255
ziptorrent:65.120.42.0-65.120.42.255
ziptorrent:66.117.5.0-66.117.5.255
ziptorrent:66.160.133.0-66.160.133.199
ziptorrent:66.160.158.0-66.160.158.255
ziptorrent:66.180.192.0-66.180.207.255
ziptorrent:66.186.192.0-66.186.223.255
ziptorrent:66.198.35.0-66.198.35.255
ziptorrent:81.230.187.01-81.230.187.99
ziptorrent:87.117.250.0-87.117.250.255
ziptorrent:100.0.0.0-115.255.255.255
ziptorrent:129.47.9.0-129.47.9.255
ziptorrent:154.37.0.0-154.37.255.255
ziptorrent:206.80.0.01-206.80.99.99
ziptorrent:207.45.196.0-207.45.196.255
ziptorrent:208.10.23.0-208.10.23.255
ziptorrent:208.10.29.0-208.10.29.255
ziptorrent:209.66.117.0-209.66.117.255
ziptorrent:209.133.121.0-209.151.247.255
ziptorrent:209.133.122.0-209.133.122.255
ziptorrent:209.151.247.0-209.151.247.255
ziptorrent:216.218.0.100-216.218.184.199
ziptorrent:216.218.190.0-216.218.199.255
ziptorrent:224.0.0.0-239.255.255.255
ziptorrent:240.0.0.0-255.255.255.255