Many from the scene, especially from Germany, know the Kinox.to group and the old Kino.to. Kinox and Movie4k all originate from Kino.to and Movie2k. There have been rumours and speculations about who the operators might be. Since the foundation of the portals, the German authority has been working to remove them from the net. It is assumed that the largest Warez and Stream portals in Germany belong to the same operators. These sites are Kinox.to, Movie4k.to, Boerse.to and Mygully.com. They have the same Cloudflare connections and even before they knew that many of the sites are on the same servers. Among other things it was also said that they belonged to ddl-warez.to and also these web pages are operated by the same persons. For years Kino.to was the most famous stream portal in Germany and left the biggest headlines behind. The revenues were in millions in one month. Everything about Kinox, Kino.to and its history can be read on Tarnkappe (German), or Torrentfreak (English).
My blog post is not about the Warez portals themselves. It’s about the phenomenon of their hosting providers that were used in the past. There used to be very large stream and file hosting sites. These called themselves as follows: Bitshare.com, Duckload.com, Freakshare.com, Archiv.to, Freeload.to and others. The business model of Kino.to at that time was not only to run a stream portal, but to run several portals. It even went so far that own hosting and stream hosters were founded to earn money through premium. It was a real business where you could earn a lot of money. That’s exactly what happened. They had reached their goal and thus also the great attention.
Many still have a big question mark. How could a new portal like Kinox.to be created after Kino.to was taken off the net and the companies were arrested after about two days? It went relatively fast and the copy of Kino.to appeared after two days out of nowhere and was able to get the throne. It is speculated that Kinox.to belongs to the same operators and until today it was suspected that the real operators were caught although they were not caught or only a part of it?
Even later, after Kinox.to went online, the same DDoS protection from Akrino Inc was used as it was for Kino.to. Akrino Inc was a private and expensive DDoS protection in the form of a reverse proxy that could only be obtained through Russian Business Network contact. Through an inquiry at RIPE you got the mail from Akrino, but you didn’t always get an answer from them.
Then there’s another question I’m asking myself today. Why are Bitshare.com and Freakshare.com still online today? The subpages are no longer available but you can still see the start page today. Both portals have been inactive for more than 5 years but are still online. Such portals were a part of the old Kino.to team and were still online after the bust of Kino.to. The German authorities used to think that after the arrest of Kino.to several portals would go offline which didn’t happen. Some hosting operators were arrested who cooperated with Kino.to and also later cooperated with the German GVU. Kino.to was in its time a real company with many employees and partners. There were even some Hetzner employees who cooperated with Kino.to to earn some money. Archiv.to had all its storage servers at Hetzner. An employee of Hetzner who also knew what was distributed on Archiv.to cooperated. Russian Business Network cooperated with various hosting services that were used. Ecatel, Dragonara and Akrino were all involved.
The Kreshnik and Kastriot Selimi brothers from Kosovo are suspected of having run the Kinox.to group. But I still suspect that both brothers are innocent and not the right operators. The German police accuse the brothers of violence, weapons, coercion, arson and threats. But if you look at the pictures of the two brothers, this can hardly be possible. They simply look like two innocent nerds. The German police themselves do not know who the operators are. They speculate and wait until the operators make a mistake, which they didn’t make after Kino.to went offline. They search for the Selimi brothers and the Warez pages are still online today. Many things don’t make sense and it is questionable how Germany operates against them. Much is veiled and lied. Therefore these Warez pages are a phenomenon today. Many suspect honeypots behind the portals and don’t even want to work with them anymore.
If you scan the Cloudflare name servers or the SSL, you will see how many domains are actually involved with Kinox. Of course this does not mean that all domains are involved. It only means that on the same name there are also domains that others use. But certain domains stand out and one can only think that they must have almost a connection. Like on the photo with crypt.to.
What my thoughts on the whole Kinox Group are, I’ll keep my hands off it. A whole group of operators cooperating with RBN. Have fingers on almost all Warez pages. In principle they control the whole German Warez scene. Be it a hosting operator, proxy provider, stream hoster or just a DDL site. It could also be that a Hetzner employee runs the whole site if they were already involved before? They always say your friend is the biggest enemy and I think it is the same with all these Warez pages. I guess Kinox is run by someone the police would never think. What is your opinion about these portals?