Search KoopaTV!

Translate

Wednesday, January 11, 2017

We Received a DMCA Takedown Notice From “Nate Bihldorff”

By LUDWIG VON KOOPA - It's really a “fakedown” notice. How we know it's fake, and how to protect yourself.

Once upon a time, it was a Sunday night. I was responding to your delightful KoopaTV comments, when I saw my e-mail account had a new e-mail. Hm, I wonder what it could be...

And then I was like, “WHAT?! NO!” when I saw the subject line: Takedown Notice Pursuant to the Digital Millennium Copyright Act of 1998. That's something that no webmaster wants to see.

Well, who the hell sent this? Apparently, it came from Nate Bihldorff representing Nintendo. Here's the full message:

To Whom It May Concern,
This is a notice in accordance with the Digital Millennium Copyright Act of 1998 (DMCA) requesting that you immediately cease to provide access to copyrighted material. I wish to report an instance of Copyright Infringement, whereby the infringing material appears on a website for which you are the host.

The infringing material, which I contend belongs to me, is the following:

Mario
The original material is located on my website at the following URLs:
Nintendo.com

The infringing material is located at the following URLs:

http://www.koopatv.org/
My contact information is:

Name: Nate Bihldorff Mailing address: 4600 150th Ave NE, Redmond, WA 98052 Telephone number: (425) 882-2040 E-mail address: dmca@nintendo.com
I have a good faith belief that the use of the described material in the manner complained of is not authorized by the copyright owner, its agent, or by operation of law.

The information in this notice is accurate, and I am either the copyright owner or I am authorized to act on behalf of the copyright owner.

I declare under the perjury laws of the United States of America that this notification is true and correct.

Please notice that if you do not reply to this email within the given amount of 30 days we will be forced to take legal action.

We request you: Take down the website with the associated content that we own.

Signed: Nate Bihldorff Date: 2017-01-08

Obviously, this is terrifying. However, I'm ever-the-skeptic. If I can identify if something is “fake news” (and tell everyone else how they can identify it, too), I can identify problems with DMCA takedown requests. Like “fake news”, fake DMCA requests are also becoming rampant. This is something I'm already sensitive to because I just wrote an article about a group of fan games being taken down by Nintendo! That, and KoopaTV Feedback Form Part VIII (the latest one just made for January 2017) actually asks this question of our readers: “What do you think the chances of KoopaTV being DMCA'd or C&D'd are?” So it's definitely on our minds.

Here are surface-level issues:
  • The takedown request was sent by “Nate Bihldorff”. Nate Bihldorff is a real Nintendo employee, but he works in Nintendo's Treehouse, Nintendo of America's localisation group that we've been watching for the past several E3 events. Localisation is a form of marketing, not the legal department.
  • Who sends a DMCA request on a Sunday night? People don't work on Sunday nights.
  • Nate Bihldorff himself does not own Nintendo intellectual property, and the e-mail made no claim that he represents Nintendo. He switches between first-person singular (“I”, “me”) at the beginning of the e-mail to first-person collective (“we”) by the end, which is not how a lawyer would write a message.
  • A real DMCA request gives specific urls on the infringing site. The way the author put it, they're basically saying that KoopaTV took the whole front page of Nintendo's site and made it KoopaTV's.
  • A real DMCA request would not just say “Mario” but would give copyright/trademark registration numbers, or at least be more specific than that.
So, I dug deeper into how the e-mail was sent. After all, dmca@nintendo.com looks pretty official to me. (I would note that according to Nintendo, their DMCA e-mail is dmca@noa.nintendo.com, but dmca@nintendo.com has the same mail server anyway.) If the e-mail is fake, then the header will contain some kind of irregularity. It's up to me to find it!

Show original fake DMCA takedown notice Nintendo Nate Bihldorff Google Mail
Use the “Show original” feature to open a pop-up with the e-mail's header, aka some technical stuff.
Yahoo Mail calls it ”Show Raw Message”.

Once inside the Show original, I noticed some interesting things, including the SPF (Sender Policy Framework) being a SOFTFAIL. I don't know what an SPF even is, so I kept looking.

Eventually, I found this interesting block of information (my e-mail address edited slightly):
Received: from emkei.cz (emkei.cz. [46.167.245.116])
by gmr-mx.google.com with ESMTPS id o77si772240wme.0.2017.01.08.18.18.57
for <ludwigvkoopa(at)gmail(dot)com>
(version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
Sun, 08 Jan 2017 18:18:57 -0800 (PST)
Received-SPF: softfail (google.com: domain of transitioning dmca@nintendo.com does not designate 46.167.245.116 as permitted sender) client-ip=46.167.245.116;
Received: by emkei.cz (Postfix, from userid 33) id C4DA3D635E; Mon, 9 Jan 2017 03:18:55 +0100 (CET)
To: dmca@koopatv.org
Subject: Takedown Notice Pursuant to the Digital Millennium Copyright Act of 1998
From: Nate Bihldorff <dmca@nintendo.com>
X-Priority: 3 (Normal)
Importance: Normal
Errors-To: dmca@nintendo.com
Reply-To: dmca@nintendo.com
Content-Type: text/plain; charset=utf-8
Message-Id: <20170109021855.C4DA3D635E@emkei.cz>
Date: Mon,
9 Jan 2017 03:18:55 +0100 (CET)
Note that something called emkei.cz shows up multiple times. What is emkei.cz? I looked up the site, and...

Emkei's Mailer emkei.cz free online fake mailer spoofer
Free online fake mailer, huh?

Apparently, emkei.cz is a popular (especially from Nigeria?) fake e-mail creator where you can send people things from whatever name and e-mail address you would like. This lets any troll or person who wants to steal from you while disguising themselves as someone else try to take advantage of you.

If “Nate Bihldorff” was sending their messages through emkei.cz, then it's obvious that it's not a genuine DMCA takedown request, because Nintendo's legal team obviously wouldn't use a fake mailer.

What purpose would this nasty person who sent this e-mail have? I'm not sure if this is something done just to troll KoopaTV, or try to exploit us for money (we don't have any), or if this is an activity done to many, many other Nintendo-based websites to try to shut them down. Perhaps it was sent by a KoopaTV competitor to try to get rid of their competition?

We would love to hear from other people, if they received this same message, and what kind of sites they have. We really don't want these scamsters to win, and I can absolutely imagine scenarios where less fraud-literate people fall for this kind of crap. For whatever reason, this didn't get caught into a spam folder, so others presumably are at risk!

A question that came up within KoopaTV's own staff was, “Why not contact Nintendo directly and ask them if they sent a DMCA takedown request?” Well, you see, I'm a bit afraid of the answer being, “No, we didn't send it to you, but upon inspection of your site, we're now going to send a real one over. Have a nice day!”

Bizarrely, “Nate Bihldorff” sent us a follow-up message hours later that consisted of just an attachment (which I wouldn't recommend downloading) of a .jpg of his picture:

Nate Bihldorff picture photo fake DMCA request jpg Nintendo of America Treehouse N-Sider
It's a real picture coming from N-Sider.com. (Not to be confused with the Nintendo NSider Forums.)

I'm not sure why he'd just dump a picture of “himself” with no context, other than trying to give us malware or something. If he's still trying to pretend he's really Nate Bihldorff, I would think the real Nate Bihldorff would have a better picture than one taken twelve years ago by a third-party website. It's not even a good picture.

Let's end this article with some levity with an excerpt between myself and RawkHawk2010 when he signed onto AIM and missed the whole discussion I was having with Kamek about the e-mail:

RawkHawk2010 (10:52:51 PM):    what'd i miss
Nintendork 13 13 (10:52:54 PM):    uh
Nintendork 13 13 (10:52:57 PM):    lots of stuff
Nintendork 13 13 (10:53:00 PM):    Go see your e-mail.
RawkHawk2010 (10:53:13 PM):    uh oh we got shut down didn't we
Nintendork 13 13 (10:53:21 PM):    <_<
RawkHawk2010 (10:53:23 PM):    WHAT THE FUCK
RawkHawk2010 (10:53:26 PM):    I WAS KIDDING
RawkHawk2010 (10:53:35 PM):    LOLOLOLOL
Nintendork 13 13 (10:53:44 PM):    >_>
RawkHawk2010 (10:53:48 PM):    for real
Nintendork 13 13 (10:53:56 PM):    >.<
RawkHawk2010 (10:53:59 PM):    I thought I was joking
RawkHawk2010 (10:54:00 PM):    so uh
Nintendork 13 13 (10:54:13 PM):    Did you say that before you saw your e-mail?
RawkHawk2010 (10:54:22 PM):    yes
RawkHawk2010 (10:54:56 PM):    Fucking Nate Bihldorff?
Nintendork 13 13 (10:54:56 PM):    You know how life imitates art, so stop joking around about that. >_>
RawkHawk2010 (10:55:11 PM):    Fucking Nate Bihldorff sent this personally?


Again, if you've encountered a fake DMCA notice like this, or similar extortionist tactics, KoopaTV would like to know about them. Share this story to spread awareness of this situation and those like it, so the good part of the Internet can be a step ahead of these bad guys! KoopaTV hasn't and won't respond to the fake Nate Bihldorff, by the way. Unfortunately, KoopaTV has no way of tracking down the original sender and having them charged under the perjury laws of the United States of America.


The real Nate Bihldorff voices the Shy Bandit from Paper Mario: Color Splash. That's sort of fitting.
Read cybersecurity tips from an expert who guest-posted at KoopaTV!
KoopaTV didn't respond within 30 days. So... what happened next?

8 comments :

  1. The fake "Nate Bihldorff" could have at least linked to Nintendo's Copyright Policy.
    http://www.nintendo.com/corp/copyright.jsp

    ReplyDelete
    Replies
    1. I don't think they do that on their actual DMCA takedown notices, because that copyright policy applies to just their website.

      Delete
  2. You seem to have navigated this issue pretty well.

    I could imagine it being coincidental with all of your talk about the DCMA stuff recently on your site, or a disgruntled KoopaTV enemy/defector trying to shock you, something like that?

    ReplyDelete
    Replies
    1. ...I'd like to think all of our currently known enemies/defectors have better things to do.

      Right now, my e-mail account (non-KoopaTV one that the KoopaTV e-mail redirects to) is suddenly on a ton of spam e-mail lists and I'm getting flooded with dozens of spam e-mails per hour. Yikes.

      I know we navigated it well, but I'm concerned, if this is widespread, that other folks are not navigating it well. That's why sharing this is important.

      Delete
  3. I really wouldn't be surprised if someone with that last name was driven to cyber shenanigans. It's the kind of name that basically means being picked on in school is automatic. I mean, I know it wasn't ACTUALLY Nate Bihldorff who sent that, but still.

    ReplyDelete
    Replies
    1. Wait, what's wrong with Bihldorff? It's an awesome-sounding last name!

      Delete
    2. It's one syllable away from being "Dorfman."

      Delete
    3. You can do anything with a free syllable!

      Especially since four-letter-words are all one syllable.

      Delete

We embrace your comments.
Expect a reply between 1 minute to 24 hours from your comment. We advise you to receive an e-mail notification for when we do reply.
Also, see our Disclaimers.

Spamming is bad, so don't spam. Spam includes random advertisements and obviously being a robot. Our vendor may subject you to CAPTCHAs.

If you comment on an article that is older than 60 days, you will have to wait for a staffer to approve your comment. It will get approved and replied to, don't worry. Unless you're a spambot.