AI 建構的 TorrentClaw 站點透過下載內容檢測假檔與惡意程式

TorrentClaw is a relatively new torrent search engine that launched in February.

The site is built on links from its own DHT crawler and dozens of external torrent sites and aggregators. In just a few months, the site has grown into an index of more than six million torrents, including the latest Hollywood blockbusters and hit series.

The homepage looks more modern than traditional torrent sites and has some clear AI-design tells. That’s not a secret. On the contrary, AI plays a central role in the site’s development and marketing.

TorrentClaw.com

According to TorrentClaw’s developers, who all use the name Deivid Soto, the platform is largely built and run with the help of AI.

“Basically, the core framework is Claude Code combined with local LLMs for specific execution and ingestion tasks,” Soto tells us.

For example, AI is used to match torrents to film and TV titles, so these can be neatly organized. The AI-driven categorization process takes over tasks that would otherwise be manual work, and AI helped to build novel tools as well.

One of the features built this way is TrueSpec, which checks whether torrents actually contain what their names suggest. That helps to spot fake torrents and malware.

TrueSpec: Download and Verify

On most torrent sites, release names are the main source of information for torrent users. They list the resolution, codec, audio and release group, but there’s no guarantee that any of it is accurate.

Mislabeled torrents are often handled by moderators on well-run torrent sites, but most automated indexes have no active moderation. That’s where TrueSpec comes in.

TrueSpec joins the torrent swarm, reads the file listing, and downloads enough pieces to check the video with the analysis tool ffprobe. According to the site and its developers, that’s between 10 and 20 MB per torrent.

TrueSpec

In addition to verifying the names, TrueSpec also checks suspicious files. It looks up their hashes on VirusTotal and, if the files are small enough, uploads these for a scan. TorrentClaw doesn’t run its own virus scanner, the malware verdicts come from VirusTotal.

When TrueSpec finds malware, the torrent remains listed on the site, but with a “Malware detected” label and the download button disabled. At the time of writing, one fake Jujutsu Kaisen episode with this label still had 34 seeders while it remained available on some external sites.

‘Malware detected’

Not Perfect

The TrueSpec system isn’t perfect. In July, an earlier dataset counted 6,450 malware cases, but many were false positives. These included the harmless RARBG_DO_NOT_MIRROR.exe file, fansub scripts that switch audio languages, and scripts that simply open a website.

The TrueSpec data from late September paints a different picture. TorrentClaw now only counts malware when VirusTotal confirms it, which leaves 34 torrents. We checked some of these against the evidence in the data, which links to a VirusTotal report for every confirmed case.

Detected malware is rare, but the count is likely too low. TrueSpec doesn’t download large executables, it prioritizes well-seeded torrents, and dead swarms can’t be checked at all. TorrentClaw also focuses on films and TV shows, so pirated software and games are largely left out.

Malware is only part of what TrueSpec flags. In total, 1,265 of the 687,057 probed torrents were flagged as deceptive, including programs disguised as videos and fake resolutions. That’s less than 0.2% of all checked torrents.

The most common type of ‘mislabeling’ is actually quite harmless. More than half of all probed torrents, 55%, include subtitle tracks that their release names don’t mention. TorrentClaw flags this as a missing label, but subtitles are typically not added to titles unless they are hardcoded. Scene rules don’t require this either.

VLC Player Malware

Most of the confirmed malware torrents follow the same pattern. In 31 of the 34 cases, the torrent includes an executable named after a new episode or film, a file called libvlc.dll, and a playable video in a subfolder.

The application is a renamed copy of the genuine VLC media player. According to TorrentClaw, it’s identical to VideoLAN’s official release and carries its code signature. The malicious part is the DLL, which VLC loads when it starts, and which VirusTotal engines flag as a trojan.

The torrents are named after popular new releases, including episodes of The Boys, Jujutsu Kaisen and Frieren, and films such as Dune: Part Three and Zootopia 2. Many also carry the names of known release or distribution groups, including SubsPlease, ETHEL and YTS.

This type of malware vector is not new. Earlier this year, a security researcher documented a campaign that used fake SubsPlease releases on Nyaa to spread the Vidar infostealer. These were reportedly uploaded from a stolen account.

TorrentClaw sourced its 31 torrents between February and August. Most of them, 22, came in through its own DHT crawler, while the rest were found via Nyaa, The Pirate Bay and TorrentDownload. All had seeders when indexed, and 15 were still active in early October, according to Soto.

Built For AI, By AI

TrueSpec isn’t the only thing that sets TorrentClaw apart. The torrent site also offers an MCP server, which allows AI assistants such as Claude and Cursor to search the index and fetch .torrent files directly.

MCP server

Technically, this means that users can ask an AI assistant to find a release and load the torrent file, without ever visiting the site. According to Soto, some accounts make around 10,000 API requests a day, which might be external sites or services that use it.

Running TrueSpec doesn’t cost much either. In July, Soto said the system ran on three nodes costing well under $50 a month combined.

“The implicit point: if verification is this cheap, any indexer could be doing it, and none are,” Soto explained.

That said, partially downloading content from hundreds of thousands of torrents can also come with a legal cost. TorrentClaw’s DMCA page states that the site doesn’t host, store, upload or distribute files, but rightsholders may see things differently.

When asked about this, Soto describes TrueSpec as a read-only client that doesn’t upload or seed. It only fetches the first part of a video file, enough to read the container headers.

“[It] deletes everything once the analysis is done. We don’t store or serve any content, and we process every valid takedown notice we receive,” Soto says.

TorrentClaw also uses AI to handle these notices. It introduced an AI-managed system in late September that has handled 23 takedowns so far. Before that, the site received just over 300 notices, mostly duplicates.

TorrentClaw also charges for its premium features. PRO costs $3.99 a month, while PRO+ adds a VPN for $6.99. Whether that business model will hold up has yet to be seen, but commercial torrent services typically draw more attention from rightsholders than free ones.