This was how the founder of Kickass Torrent (KAT) was caught


Earlier on we reported on how 30-year-old Ukrainian Artem Vaulin a.k.a “tirm,” owner and operator of KickassTorrents (KAT), was arrested yesterday and charged in Poland for criminal copyright infringement and money laundering. Here’s how it happened.

In a 48-page criminal complaint filed with the U.S. District Court in Chicago, the U.S. Attorney’s Office reveals how Vaulin was tracked. A special agent with the US Department of Homeland Security, Jared Der-Yeghiayan, was given the task of tracking Vaulin, the man behind KAT, his report proves beyond reasonable doubt that Vaulin needs to be brought to justice.

KAT counts more than 50 million unique monthly visitors and is estimated to be the 68th most frequently visited website on the internet — according to Alexa. The site also earns more than $16m per year in ad revenue from its 50 million monthly users.

From November 2015, an undercover IRS Special Agent discussed with a KAT representative concerning hosting an advertisement that would direct visitors to an undercover site, the ad would be placed on individual torrent listings for $300 per day and will purportedly advertise a program to study in the United States.

After the agreement was made and went live on March 14th 2016, a link appeared underneath the torrent download buttons for 5 days, this was enough to link KAT to a Latvian bank account, this account receives $31 million in deposits from advertising payments within the period of August 2015 and March 2016.

Additionaly, investigators were able to identify the email address Apart from the fact that this email was linked to website enquiries, KAT’s social media presences such as Facebook were also associated to this email. Investigators through the help of Facebook were able to obtain records that showed the “official.KAT.fanclub.” page was certainly associated with KAT.

Through reverse DNS search Der-Yeghiayan was able to uncover the hosts of seven apparent KAT website domains:,,,,, and From this data, two Chicago IP addresses, which were used as KAT name servers for more than four years were gotten. The authorities were then able to legally gain a copy of the server’s access logs, this explains why the federal authorities in Chicago were able to charge the Ukrainian with his alleged crimes.

Homeland Security investigators also played a huge part in this investigation, they performed a “WHOIS” lookup on a domain that redirected people to the main KAT site (WHOIS search provides detailed information such as name, email phone number e.t.c of a website registrant. The url, returned Artem Vaulin from Kharkiv, Ukraine as the registrant.

Der-Yeghiayan linked the email address found in WHOIS lookup to an Apple email address that Vaulin purportedly used to operate KAT. The match confirmed Vaulin’s alleged involvement.

Records provided by Apple on July 31st 2015 show that the account was used to purchase something on iTunes. From the logs it was seen that the same IP address was used on that same day to access the KAT Facebook page. KAT began accepting Bitcoin donations in 2012, during that time, $72,767 was moved into a Coinbase account in Vaulin’s name, that Bitcoin wallet was registered with the same email address.


As of now, Homeland Security has asked that the seven KAT domains named in the complaint are forfeited for their role in facilitating piracy. Verisign would also seize the .com and .tv domains, while Mutual Legal Assistance Treaty (MLAT) requests will be sent to registrars in Tonga, Costa Rica and the Philippines. Those sites will be redirected to a server of its choosing.

For now, KickassTorrents is still up via the numerous proxy services that support it, but that’s just for a short while until it inaccessible.

KickassTorrents (KAT) is a website founded in 2008 that provides torrent files and magnet links to facilitate peer-to-peer file sharing using the BitTorrent protocol. As of November 2014, KAT became the most visited torrent directory in the world according to the site’s Alexa ranking. On 20 July 2016, the domain was seized by the United States government and was subsequently shut down.

There are 2 comments

Add yours

Post a new comment