Introducing Nulledflix – Nulled forum’s own streaming service

 

Lockdowns implemented during the COVID-19 (aka coronavirus) pandemic have forced people around the world to spend a large part of their leisure time indoors and required us all to find ways to fill the time. Some people have taken up baking as a new hobby, others prefer to read or paint, but many settle for a good movie or binge-watch their favorite TV show. The latter option has proven to be particularly popular: There have been multiple reports of streaming services’ membership and revenue increasing following the implementation of lockdown. 

However, it seems like it’s not just your regular Joe who enjoys the occasional movie and TV stints. Watching movies, TV shows, and other live-streams appears to be a popular way for cybercriminal netizens to spend their spare time too. Accounts for various streaming services are being shared for free in abundance on cybercriminal forums and a user on the English-language cybercriminal platform Nulled recently introduced a brand new live-streaming service on the forum that enables members to watch live streams together. This is the first time Digital Shadows (now ReliaQuest) has identified a streaming service created exclusively for a cybercriminal forum. This blog will provide an overview of the Nulledflix streaming service and why movies, TV shows, music, gaming, and other leisure topics appear to be prevalent in cybercriminal forums.

Introducing Nulledflix

On 03 Jun 2020, Nulled forum’s May 2020 “Member of the Month” announced the launch of their cleverly titled, self-developed streaming service Nulledflix. According to the user, Nulledflix is an Ultra High-Quality streaming service that allows forum users to “watch live streams of movies, TV shows, memes, and NSFW for free.” The announcement stated that Nulledflix would have a “chatbox” function via which users could engage in live chat during streams. 

According to the post, at first live streams would “only be made by staff,” but the number of members able to make their streams would be increased in the foreseeable future. Nulledflix purportedly “does not have any advertising or way of making money”; there was no indication as to whether the service would receive any support from Nulled staff or other forum members to develop and maintain the streaming system. If the service proves popular and is opened up to more users, some form of support will likely become necessary to maintain the service around the clock, with more live-streams scheduled for a consistently growing audience.

The issue of developing and maintaining Nulledflix appears to be already causing some downtime for the service: Nulledflix’s creator has taken the service down temporarily until they have “enough time” to work on unspecified issues. Nulledflix is expected to reopen “in a month or less” -an extended outage for a new service trying to bump up the number of users.

First live streams and initial reviews of Nulledflix

Before this outage, Nulledflix’s creator had created at least five threads with updates on changes to Nulledflix’s design and provided links to scheduled live streams so users who were online at the time could join. Recent live streams have included various blockbuster movies and streams of “memes.” 

Thus far, the threads announcing live stream schedules have been created just one minute before the live stream started. This strategy would not appear to lend itself to gaining a large viewership: Cybercriminals, believe it or not, have lives outside of the underground scene. Cybercriminals are unlikely to sit in front of their computers all day long and may subsequently miss live stream updates. However, it is possible that Nulledflix’s creators chose to announce the live streams with such short notice to exploit the likely increased screen time cybercriminals have had during COVID-19. This would let the service prove reliable before potentially announcing the live-streams further ahead of time. Though, if this was the intention, it is now somewhat void considering Nulledflix’s current downtime.

It is also plausible that Nulledflix’s creators have announced the live streams with such short notice for security purposes. The tight time frame would make it more difficult for both law enforcement and competitor threat actors alike to detect the server’s location, for instance: A live stream would likely be long over before it is even identified in the first place.

The reactions from the Nulled community to Nulledflix’s launch have been positive, with the initial announcement quickly receiving well over 20 comments from forum members congratulating its creator and thanking them for taking the initiative to create the streaming service. One user, for instance, commented, “DAMN THATS amazing great job,” while another user appeared to confirm the quality of the live streams, merely stating “HQQQQQ++++++.” Nulledflix’s creator has also created threads asking for opinions on the site’s design, which was also positively received by the community. The latest design update revealed that Nulledflix’s aesthetics might mimic those of the popular streaming service from which it took its name.

Despite the user engagement on Nulledflix’s announcement and update threads, the posts notifying users of upcoming live streams have barely garnered any comments. This may be because these posts serve the practical purpose of informing users that a live stream is about to begin and will become redundant as soon as the live stream is over. It is more likely that users are discussing the live streams using Nulledflix’s chatbox function rather than forum threads. 

Fun and games on forums

Nulledflix can be used free of charge, and the service reportedly does not receive any funding through advertisements or by other means. So it appears that money is not the motivating factor for this service. Cybercriminal forums will always be linked to criminal activity, but as Nulledflix shows, forum users do not exclusively use these platforms to conduct illicit activity. Just like traditional, non-criminal forums, these sites operate as a community for sharing information that has nothing to do with criminal profit. This includes discussions on leisure activities such as movies, music, and gaming. Users often create threads in the “Lounge”, or dedicated Movie and Music sections, asking about other users’ favorite artists, what type of music they are listening to, what movies they like, and opinions on new movie releases. 

Cybercriminals also share an abundance of illicitly obtained accounts for various streaming services free of charge with the forum community, including credentials for movies, music, and gaming services. Such accounts are often stumbled across as byproducts of other illegal activity. Sharing these credentials freely rather than attempting to monetize them could indicate that only low levels of profit can be gained through trying to exploit such accounts or might be a result of cybercriminals’ desire to build a sense of community within forums. 

Allowing space for users to discuss more easy-going topics, organizing gaming competitions “for fun”, and sharing free streaming accounts that  have likely been an essential factor in ensuring forums’ perseverance in an otherwise fluid and ever-changing cybercriminal landscape (We’ve written about this in greater detail in our whitepaper, The Modern Cybercriminal Forum) 

Additionally, English-language cybercriminal forums such as Nulled tend to attract younger, novice users who might be shunned from more high-level forums due to their lack of experience. When forums allow these users to participate in less skill-based activities, they no longer feel inadequate or “low-level” compared to their peers. Instead, they will likely feel more comfortable in being active on the forum and contributing quality content. This increased engagement, in turn, might lead to an increase in forum membership numbers. 

The unprecedented introduction of a streaming service such as Nulledflix is the icing on the cake–or toffee on the popcorn–in a long line of changes and updates taking place on Nulled forum over the past six months. These developments are likely aimed at expanding the forum, ensuring it becomes more widely-known within the English-speaking cybercriminal scene, and developing a loyal, core community. While it remains to be seen how popular Nulledflix will become when it is up and running again, its success would become an essential factor in Nulled’s push for prominence. Nulledflix could also potentially set a precedent for other, similar, English-language cybercriminal forums if the service turns out to be a hit. It’s not that merely organizing a good movie night is what it’s going to take to mark yourself out in the English-language cybercriminal scene, but a sharper focus on the forum community and the development of exclusive services and social activities just might. 

To stay up to date with the latest on dark web and cybercriminal forums, subscribe to our email list below.