Link Graph Analysis for Piracy Networks

A single pirated film rarely lives at one address. A viewer finds it through a search result or a social post, lands on an index page, clicks through a redirect or an ad page, and ends at a player embedded from a different domain that pulls the video from a file host somewhere else again. Link graph analysis records that chain as a structure rather than a list, so an enforcement team can see which parts hold the content and which parts only point to it.

Nodes and edges in a piracy context

Each node in the graph is something that can be acted on: a page, a domain, an uploader account, a social profile, a Telegram channel, an embed host, a file on a cyberlocker. Edges describe how they relate: a hyperlink, an HTTP redirect, an iframe embed, a media request, a post that shares a URL, a domain that serves the same page as another.

Typing the edges matters. A hyperlink from a forum post to a file is a different relationship from an iframe that loads a player inside an aggregator page, and both differ from a redirect that silently moves users from a blocked domain to its replacement. Each type implies a different enforcement step and a different party able to take it.

Tracing a path end to end

The useful unit of observation is a complete path, captured with timestamps. Take a hypothetical case. A search result points to a "watch online" page on an aggregator domain. The page contains an iframe from a player domain. The player fetches its video from a file host through an obfuscated URL. Wrapped around the visit is an ad redirect chain passing through several intermediary domains.

Recorded as a graph, that path shows distinct roles. The aggregator attracts traffic. The player domain is a delivery wrapper. The file host stores the content. Removing the aggregator page from search reduces discovery. Removing the file at the host stops playback on every page that embeds it. Those are different actions with different effects, a distinction set out in search deindexing vs source removal.

Where pressure works

Once many paths have been captured, the shape of the graph starts to carry information. In most piracy ecosystems a large population of link aggregators depends on a much smaller set of embed and file hosts. Those shared dependencies appear as nodes with high in-degree: many different pages point at them. Acting on one of them can break playback across a whole family of sites at once.

The graph also exposes nodes that sit between otherwise separate clusters. A Telegram channel that posts links to several unconnected sites, or a redirect domain shared by unrelated aggregators, is a bridge. Bridges deserve close watching, because new destinations tend to appear there first.

Prioritisation is not purely mathematical. A heavily linked file host with an unresponsive abuse desk may be a worse first target than a less central host that reliably removes content. Graph position says where an action would have the most effect. The host's track record says whether the action is likely to succeed. Both go into the decision.

Reading the graph over time

A piracy network reacts to enforcement, and the graph shows how. After a file host removes a batch of files, the aggregators that depended on it either break or switch to another host. Comparing snapshots shows the replacement edge appearing, which identifies the fallback host before it becomes the new primary. When a domain is blocked or delisted, a redirect edge from the old name to a new one is often the earliest sign of the move.

This is why every edge needs a first-seen and last-seen time. A link that existed last month is evidence of history, not of current state, and notices should describe what was live when they were filed.

Proximity is not ownership

An edge proves that one thing technically points to or loads another. It does not prove that the same person controls both. Aggregators embed players run by strangers. Ad networks route traffic through domains used by countless unrelated sites. A file host stores files from anyone who signs up. Claims of common ownership need separate evidence, such as shared account identifiers or an operator's own statements, and should be kept apart from the structural picture the graph provides.

Used with that discipline, link graph analysis turns a stream of individual detections into a map of dependencies, and lets a rights holder spend enforcement effort where it removes the most access for the least work.