任何 Tracker 维护者应该都听说过 MarkScan 的臭名：
- https://www.reddit.com/r/COPYRIGHT/comments/1gs3o2p/i_got_a_copyright_strike_from_internet/
- https://www.reddit.com/r/COPYRIGHT/comments/1ief3zf/the_markscan_enforcement_copyright_problem_hasnt/
- https://bbs.itzmx.com/thread-111413-1-1.html
- https://bbs.itzmx.com/thread-102072-1-1.html
简单来说，这是一家位于印度的公司，从大的公司那里接单负责版权投诉，使用自动化工具扫描整个互联网上的 Tracker 并发送 DMCA（美国数字千年版权法案） 投诉。
如果是合法的维护版权，那倒也可以理解。但问题在于——Tracker 服务器本就不提供任何侵权材料和信息，它是一个 K-V（键值对）存储器。K 为 infohash，V 为 IP:端口。任何人都可以声称自己拥有 K 的资源，然后把自己的 IP 和端口放进 V 中。这个过程并不交换任何实际二进制数据。
那么 MarkScan 的扫描器是怎么做的呢？答案是它们的扫描器伪装自己是个 Peer，请求 Tracker 服务器——带着它们“声称收到版权保护的 info_hash”。服务器收到这个请求后，就会把 MarkScan 的 Peer 加入缓存中，等待其它人获取。
只要服务器接收到 MarkScan 的请求，返回的 HTTP 状态码不是错误类型的（包括 2xx，3xx），那么 MarkScan 就认定你的服务器违规。
问题是什么？
问题在于 infohash 是个通过文件内容计算得出的随机的哈希值。在你实际知晓那个资源之前，你对 infohash 实际代表着什么内容完全不知情。它可以是个文本文件、视频文件、甚至只是一个普普通通的随机字符——只要符合格式就行。
MarkScan 的做法十分暴力，只要它的 infohash 请求 Tracker 成功，就给你发送 DMCA 邮件，而且不告诉你 infohash 是哪个。
按照 DMCA（美国数字版权法案）的要求，任何收到 DMCA 的服务商都必须立刻采取措施先行关停服务。不管该 DMCA 请求是否真实。尽管有作伪证等要求，但实际执行过程中，几乎没人检查。如果服务商收到多次 DMCA 邮件，就会很容易永久封禁服务器。
消失的授权函
为了法律合规，MarkScan 发送邮件时会带有一个 URL of Authorization Letter of the Copyright Owner 的授权函，以此证明自己是得到了版权方授权的。但很遗憾的是，处于不知道何种原因，MarkScan 的这类 URL 都带有 AWS 签名—链接仅在生成后有效。
https://mediascan-filestore.s3.ap-south-1.amazonaws.com/LoA/1F73321E-205F-41A8-A961-35A3E8F43788?X-Amz-Expires=604800&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAVNKIIPBEJFFVJHGO%2F20260422%2Fap-south-1%2Fs3%2Faws4_request&X-Amz-Date=20260422T150255Z&X-Amz-SignedHeaders=host&X-Amz-Signature=48de0df1918d510466d8104e95cd6f0f19c793299c2fdd066795422c9feeac54让我们看一下这个 AWS 签名，其中 X-Amz-Expires 代表此链接的过期时间，单位是秒。这里的 604800 代表此链接在生成后 604800 秒后就会过期。也就是 7 天。
而 X-Amz-Date 部分代表此链接的具体生成时间。这里的 20260422T150255Z 代表此链接生成于格林威治时间2026年04月22日15时02分55秒。也就是该链接会在 2026 年 04 月 29 日失效。
但 MarkScan 发送的 DMCA 实际时间是 2026 年 6 月 28 日，CloudFlare 也才在 2026-06-28 23:07:45 收到投诉：
这也意味着实际接受此 DMCA 邮件的人根本无法查看授权函。遗憾的是似乎大部分主机商都不在乎它，只要收到，就关机。
消失的具体投诉内容
以下是 MarkScan 发送的邮件的，由 CloudFlare 转发的原文：
Hello,
Cloudflare received an DMCA copyright infringement complaint regarding: sparkle[.]ghostchu-services[.]top.
We have forwarded this complaint to your hosting provider.
If you have questions about this abuse report, please send an email to abusereply@cloudflare.com with the following details:
- The report identification number included in the subject line
- Any additional details, context or evidence you can provide regarding the content that was reported.
Below is the report we received:
Report ID: 8236cd2c6a7f2890
Logs or other evidence of abuse:
Reported URLs:
hxxps://sparkle[.]ghostchu-services[.]top:443/announce
Original Work Description:
Dear Madam/Sir,
We, MarkScan Digital IP Pvt. Ltd., represent Sony Interactive Entertainment, 10 Great Marlborough Street W1F 7LP. (“Our Client”) and are duly authorized to issue this notice under the Information Technology Rules, 2021, OCILLA, and the Digital Millennium Copyright Act, 1998 (DMCA), which require service providers to promptly disable access to infringing material upon notice.
Proof of ownership of the copyrighted work(s) is available at: https://sonyinteractive.com/
We are escalating this matter as the infringing website(s) are using Cloudflare’s reverse proxy services. We request Cloudflare to disclose the origin hosting IP address, hosting service provider name, and abuse contact email to enable issuance of a formal takedown notice.
We state in good faith that the use of the copyrighted work(s) identified in the infringing material is not authorized by the copyright owner, its agents, or the law.
Under penalty of perjury, we confirm that the information provided in this notice is accurate and that we are authorized to act on behalf of our client.
URL of Authorization Letter of the Copyright Owner: https://mediascan-filestore.s3.ap-south-1.amazonaws.com/LoA/1F73321E-205F-41A8-A961-35A3E8F43788?X-Amz-Expires=604800&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAVNKIIPBEJFFVJHGO%2F20260422%2Fap-south-1%2Fs3%2Faws4_request&X-Amz-Date=20260422T150255Z&X-Amz-SignedHeaders=host&X-Amz-Signature=48de0df1918d510466d8104e95cd6f0f19c793299c2fdd066795422c9feeac54
Digital Signature for Copyright Claim
Ishita Singh
MarkScan Digital IP Pvt. Ltd.
Email: internet-enforcement@markscan.in
E-14C, 1st Floor, Sector-8, Noida, U.P. – 201301, India
Website: https://markscan.co.in/
COPYRIGHT OWNERS: Sony Interactive Entertainment
Below are the report submitter's details:
Submitter's Name: Ishita Singh
Copyright Holder's Name: Sony Interactive Entertainment LLC.
Submitter's Email Address: internet-enforcement@markscan.in
Submitter's Company Name: Markscan
Submitter's Telephone Number: 120-4297246
Submitter's Address: E-14C, 1st Floor, Sector-8
Noida
Uttar Pradesh
IN
This report was handled automatically and this email is an automated reply.
Cloudflare Trust & Safety
这里可以看到，被投诉的 URL 是 hxxps://sparkle[.]ghostchu-services[.]top:443/announce。但这里出现了几个问题：
- sparkle.ghostchu-services.top 上没有运行 Tracker 服务器，所以访问 /announce 根本不会成功。
- 真正的 Tracker 服务器运行在 tracker.ghostchu-services.top，而这不在 Netcup 服务器上，而是 BuyVM。
- Tracker 于 2026/05/06 就停止服务了，而在接近三个月之后的 2026/06/29 才收到了 MarkScan 的邮件（并且几乎所有人都是同时在这一天收到的邮件）。
不知道出于何种原因，MarkScan 在认错服务器的情况下，又在很长时间后扔来了一封耐人寻味的 DMCA 的邮件。令人摸不到头脑。
Netcup Abuse Notice
尽管使用了 CloudFlare Tunnels，但 CloudFlare 显然也知道背后的主机托管商是哪里。先前提到 MarkScan 草台班子给 sparkle 子域错误的发去了邮件，那么 CloudFlare 自然也就把邮件转发给了其背后的 Netcup。
不过 CloudFlare 并未将这个投诉标记为 “需要处理”，也没有添加 “CloudFlare 缓解”。原因也很简单，CloudFlare 就算想验证，服务早关了，从 CloudFlare 的角度来看这个投诉似乎根本就不成立……
但 CloudFlare 仍然决定给外部主机发一份，于是第二天就又收到了 Netcup 团队的邮件：
--- English version ---
Hello <已删除>,
we have received an external DMCA copyright infringement complaint regarding your product <已删除> (see full original report at the end of this message).
According to the complainant, copyrighted material may have been made publicly available through your service without proper authorization.
Please note: We are required to review such reports in order to assess and, if necessary, prevent potential legal violations. This does not represent any judgment of you or your company but serves to ensure compliance with legal requirements and our Terms and Conditions.
**Required actions**
Please review the matter within 24 hours based on the original report included below and verify whether the reported content is accessible via your system.
If this is the case, please remove or disable access to the content immediately.
Please submit your statement within 24 hours via the Customer Control Panel (CCP): https://www.customercontrolpanel.de
* Go to the "Abuse Notices" menu item and click the Magnifying Glass Icon next to the abuse notice.
* Reply via the "Statement" field and include the following Information:
- whether the reported content was accessible through your system,
- which specific actions have been taken,
- and whether the content has been fully removed or permanently disabled.
If you require additional information to complete your review, please inform us within the same time frame.
If we do not receive a response within 24 hours, we reserve the right to temporarily suspend the affected product as a precaution to prevent further potential infringement.
Requesting a maintenance window (if required)
If your product has been suspended due to missing or delayed feedback, it can only be reactivated once you have confirmed that the reported content has been removed.
A maintenance window is required for reactivation during which your product will be reactivated for a limited period of time.
* To do so, request a maintenance window via the Customer Control Panel (CCP): https://www.customercontrolpanel.de
* Please note that all communication must take place exclusively via the designated "Statement" field in the Customer Control Panel (CCP). Responses via email, ticket, or phone will not be considered.
* Go to the "Abuse Notices" menu item and click the Magnifying Glass Icon next to the abuse notice.
* Please let us know your specific desired timeframe in the "Statement" field.
Please note:
* Maintenance windows can be scheduled at any time.
* Processing takes place Monday to Friday between 10:00 and 18:00 (Europe/Berlin).
* A notice period of at least 2 hours is required.
* All times must be provided in the Europe/Berlin time zone.
* Requests submitted outside processing hours will be scheduled on the next business day.
* Without a specific time slot (date and time), no maintenance window can be set up. Immediate activation is not possible.
For more information on abuse reports, please visit our Help Center: https://www.netcup.com/en/helpcenter/documentation/security/abuse-notices
Best regards,
The netcup Abuse Team
========== Originalmeldung / Original Report ==========
(The following message has been forwarded unchanged.)
Hello,
Cloudflare received a DMCA copyright infringement complaint regarding sparkle[.]ghostchu-services[.]top
Please be aware Cloudflare offers network service solutions including pass-through security services, a content distribution network (CDN) and registrar services. Due to the pass-through nature of our services, our IP addresses appear in WHOIS and DNS records for websites using Cloudflare. Cloudflare is generally not a website hosting provider, and we cannot remove material from the Internet that is hosted by others.
The actual host for sparkle[.]ghostchu-services[.]top are the following IP addresses. <IPV6地址>. Using the following command, you can confirm the site in question is hosted at that IP address: curl -v -H "Host: sparkle[.]ghostchu-services[.]top" <IPV6地址>/
Below is the information we received:
Reporter's Name: Ishita Singh
Reporter's Email Address: internet-enforcement@markscan.in
Reporter's Company Name: Markscan
Reporter's Telephone Number: 120-4297246
Reporter's Address: E-14C, 1st Floor, Sector-8
Noida
Uttar Pradesh
IN
Reported URLs:
hxxps://sparkle[.]ghostchu-services[.]top:443/announce
Original Work: Dear Madam/Sir,
We, MarkScan Digital IP Pvt. Ltd., represent Sony Interactive Entertainment, 10 Great Marlborough Street W1F 7LP. (?Our Client?) and are duly authorized to issue this notice under the Information Technology Rules, 2021, OCILLA, and the Digital Millennium Copyright Act, 1998 (DMCA), which require service providers to promptly disable access to infringing material upon notice.
Proof of ownership of the copyrighted work(s) is available at: https://sonyinteractive.com/
We are escalating this matter as the infringing website(s) are using Cloudflare?s reverse proxy services. We request Cloudflare to disclose the origin hosting IP address, hosting service provider name, and abuse contact email to enable issuance of a formal takedown notice.
We state in good faith that the use of the copyrighted work(s) identified in the infringing material is not authorized by the copyright owner, its agents, or the law.
Under penalty of perjury, we confirm that the information provided in this notice is accurate and that we are authorized to act on behalf of our client.
URL of Authorization Letter of the Copyright Owner: https://mediascan-filestore.s3.ap-south-1.amazonaws.com/LoA/1F73321E-205F-41A8-A961-35A3E8F43788?X-Amz-Expires=604800&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAVNKIIPBEJFFVJHGO%2F20260422%2Fap-south-1%2Fs3%2Faws4_request&X-Amz-Date=20260422T150255Z&X-Amz-SignedHeaders=host&X-Amz-Signature=48de0df1918d510466d8104e95cd6f0f19c793299c2fdd066795422c9feeac54
Digital Signature for Copyright Claim
Ishita Singh
MarkScan Digital IP Pvt. Ltd.
Email: internet-enforcement@markscan.in
E-14C, 1st Floor, Sector-8, Noida, U.P. ? 201301, India
Website: https://markscan.co.in/
COPYRIGHT OWNERS: Sony Interactive Entertainment
Please address this issue with your customer.
To respond to this issue, please reply to abusereply@cloudflare.com.
Regards,
Cloudflare Trust & Safety
相对于 CloudFlare，Netcup 的要求就比较着急了，收到邮件后 24 小时内必须回复处理。
Netcup 的申诉要求包含这几个要素：你进行了哪些调查，是否包含邮件里提到的违规内容，以及做了哪些措施避免此类情况发生。
由于 Tracker 程序根本不在 Netcup 服务器上，流量也根本不经过 Netcup 的服务器，所以我在 Netcup 这边没什么好做的。而由于 Tracker 服务器也已经入土了三个月有余，所以添加了 “BITTORRENT DENY ALL”DNS TXT 记录后，用 CloudFlare 阻断 “/announce”，再把 DNS 解析干掉，就可以回复了。
回复后，不到10分钟服务器就解封了：
Guten Tag <已删除>,
Ihr Hostingpaket <已删除> wurde entsperrt.
想必 Netcup 对此也一头雾水，因为从它们那边看来：1) 没有这个域名的 Tracker 流量进入服务器 2) 访问查看也根本不通，所以也是很快就解封了。当然快速对 Netcup Abuse Notice 回复并采取行动想必也是加分点。
总结
MarkScan 显然是一个流氓公司。
MarkScan 的自动化扫描工具非常蠢。
MarkScan 的法务肯定不够专业，或者员工效率太慢了，以至于这种法律文件链接都能过期失效。
MarkScan 发 DMCA 这种机械化的工作相比对于印度三哥肯定还是手到擒来。他们似乎从不疲倦。
MarkScan 对 Tracker 下手并没什么用，因为还有 DHT, PeX 存在。就算有用，显然换一个抗投诉的主机也就没办法了。
CloudFlare 仍然是互联网佛祖，毋庸置疑。
Netcup 合规团队十分尽责，处理效率也很高。
对于印度三哥的刻板印象和成见又牢固了几分😅。
