McAfee SiteAdvisor Blog

File Sharing Software Falls Victim to Clone Wars

eMule is a well regarded open source file sharing client that also happens to be adware and spyware free, and free of charge. At least, it’s free for those who can tell which eMule is the real McCoy.

Take a look at these two images:

Can you tell which one is the real thing? It took us a while, and we do this stuff for a living.

The real eMule is on the bottom, but it suffers from an ungainly URL: emule-project.net (SiteAdvisor Analysis: emule-project.net). The one of the top has a much better domain: eMule.org (SiteAdvisor Analysis: eMule.org). But eMule.org is actually a decoy, a pixel for pixel cut and paste copy of the real thing. Logo, color schemes, fonts -- it’s uncanny. The dot-org is the perfect touch, too. It makes the site feel more like a non-profit, more like an open-source software site. eMule.org even claims to be the "official” eMule site.

No matter where you click on the eMule.org decoy page, you’re sent to into the sales funnel. We decided to take the plunge.

You can imagine what came next. In short: After paying $27.80 for a lifetime subscription, we got a screen with links to popular (and free) file sharing programs like Limewire and iMesh. Click on their links, and get redirected to Download.com. What a business!

The funny thing is, eMule.org doesn’t even offer the real eMule client. We'll cover the site in more detail later, but the most important thing to know is that the decoy eMule’s business model is the same as FreedownloadHQ.com. (Like eMule, FDHQ charged us $37 for a link to download.com to get Firefox.)

68% Infected

11 out of the 19 results are red. 58%. Add in my-free-music.com, a "review” site that’s little more than a link farm to scams like red-rated mymusicinc.com and unlimitedsoftware2download.com (which leads to a high volume e-mailer called SuperbRewards.com), and the first page of results goes up to 68% red.

What this means is that unwitting consumers are playing Russian roulette with more than half of the chambers loaded.

Who Is eMule.org?

Hugo Liu, an advisor to SiteAdvisor and a doctoral candidate at MIT’s Media Lab, helped me trace the origins of eMule.org back to a server that shares its IP address with these other sites:

www.Chena.com
www.Domain-names-webhost.com
www.Filesharingcash.com
www.Legal-mp3-download.com
www.Mesothelioma-websites.com
www.Archivoscompartidos.com
www.Mariasearch.com

WHOIS data show that some of these sites are protected by the same masking service (Whois Privacy Protection Service, Inc.) But Whois history at all of these sites shows that they used to be registered to:

Registrant Name:Mr Christian A. Chena
Registrant Organization:HYPER SRL
Registrant Street1:1 de marzo 368
Registrant City:Lambare
Registrant State/Province:--
Registrant Postal Code:NA
Registrant Country:PY
Registrant Phone:+595.595213332
Registrant Phone Ext.:4

Mr. Chena is 28-year-old Internet entrepreneur from Paraguay and a domain name speculator. According to people who follow this industry, Chena sold a trio of misspelled names in March 2005 for $204,000, a profit of $124,000 over the $80,000 purchase price. The domains?

Downlaod.com, Donwload.com and Dawnload.com.

A little more digging by Hugo revealed that eMule.org is also an affiliate of MarketEngines.com, a Canadian publisher that runs an affiliate management company called CashEngines.com. CashEngines helps populate the Web with gems like freemp3lover.com and other sites that sell users "customer service” and access to free P2P file sharing software.

Is eMule.org still owned by Chena? Follow me (or rather, Hugo, who did the sleuthing) for a second:

eMule’s CashEngines affiliate ID is https://secure3.marketengines.com/04/p2p/join1.aspx?revshare=aff_isidoro

Isidoro Canones is a famous Argentinean cartoon character, the so-called "Play-Boy of Buenos Aires." Now, along with domain speculation, Chena is also the owner of http://www.animacion.com, the "official” portal of Spanish language animation.

We e-mailed Chena’s company asking if they own eMule.org. We’ll let you know if they respond. Otherwise, this is as far as we could get with the coincidences. We invite readers to see if they can push this further.

A Profitable Business Model

As an affiliate of CashEngines, eMule.org earns a bounty every time it sends a customer through CashEngine’s payment system. Payouts for music sites are $20 per customer.

It’s a typical affiliate arrangement. Since CashEngine’s costs to service a customer are near zero, they can afford to pay as much as 75% of their revenue (a $20 bounty on a $27 sale) to the affiliate. And why are the costs near zero? As we previously learned, scam software sites don’t have any significant customer service costs because they provide little, if any, customer service. We will be contacting eMule.org to ask a variety of basic P2P customer service questions. We’ll add a note here if we get anything close to a real response.

eMule Gets Its Ass Kicked

eMule is run as an open-source project. Programmers are volunteers. Hosting costs are shared by mirror sites. They have little time and no money to fight these guys. In fact, they recently added a disclaimer to their site which reads in part:

If you paid for downloading eMule, you have probably been cheated - but not by us. We suggest that you contact the website were you paid for eMule or your credit card company to arrange a refund. However we are unable to assist you in such a case because (again) we are not involved in any way in such payments so please do not mail us about refundings.

They don’t "agree” with eMule.org’s practices, but because they publish under the General Public License which allows others to study, improve, redistribute and charge for GPL software, eMule "can not prohibit such misuse.”

That said, BitTorrent recently began cracking down on sites that misuse the company’s name. And last year, the Center for Democracy and Technology successfully pressured at least one scammy site to remove the "100% legal" claim from its site. The FTC has also begun to act.

But given how easy it is to hot swap domains and press the ‘copy’ button on a site’s HTML, we think government or corporate legal actions are bound to be at least a step behind the scammers. In fact, as long as there is real money to be made by scamming, our bet is that for every site BitTorrent or the CDT is able to close down, two will take its place. That’s why all of us have to step up and do something.

Found more sites like these? Join SiteAdvisor as a reviewer and let us know which ones.