Qualified triples from the transcripts. Origin, speaker, and evidence stay attached. These are not independently verified facts.
Beatdapp USES Anomaly detection
Beatdapp uses many detection models and anomaly-detection methods to identify fraudulent streams and abnormal playback patterns.
Explicit Confidence 98% · Andrew Batey EP 171 Details
“We’re building — we have probably close to 700 models looking for different things”
“they were mostly using rules-based anomaly detection.”
Andrew Batey USES YouTube
Andrew says his group loaded muted YouTube videos into pop-under windows to rapidly increase view counts and reach YouTube's front page.
Explicit Confidence 99% · Andrew Batey EP 171 Details
“We would load it with YouTube videos on mute”
“we could basically break into the algorithm on the front page”
Beatdapp receives anonymized, hashed streaming data and uses it while avoiding personally identifiable information.
Explicit Confidence 99% · Andrew Batey EP 171 Details
“We’re seeing an anonymized version, generally hashed data”
“we didn’t have any PII ever”
Beatdapp USES Private permission chain
Andrew says the company operated its blockchain as a private permission chain capable of very high transaction throughput.
Explicit Confidence 99% · Andrew Batey EP 171 Details
“10 million transactions per second per region in a private permission chain”
Andrew Batey USES Ad arbitrage
Andrew says his group used ad arbitrage by buying inexpensive traffic while selling higher-priced advertising inventory.
Explicit Confidence 99% · Andrew Batey EP 171 Details
“Another thing we did in the early days was kind of an ad arbitrage.”
“we would be able to sort of print money”
Beatdapp USES Community clustering
Beatdapp uses community-clustering techniques over streaming-service metadata and device characteristics to identify coordinated activity.
Explicit Confidence 99% · Andrew Batey EP 171 Details
“we have all these types of community-clustering techniques”
Beatdapp USES Blockchain
Beatdapp initially used blockchain as the proposed solution for tracking music plays and later built blockchain infrastructure for that purpose.
Explicit Confidence 98% · Andrew Batey EP 171 Details
“we believe blockchain could be a solution”
“we built one of the fastest blockchains in the world”
SuperBox ASSOCIATED_WITH Kimwolf
D3ada55 confirms that SuperBoxes were part of the Kimwolf botnet.
Explicit Confidence 99% · D3ada55 EP 172 Details
“They were confirmed as part of that botnet.”
vSeeBox ASSOCIATED_WITH SuperBox
The vSeeBox exhibited similar characteristics to the SuperBox and communicated with Tencent infrastructure; the episode presents the devices as related.
Explicit Confidence 96% · D3ada55 EP 172 Details
“it’s also beaconing straight to China via Tencent infrastructure.”
“they all start talking to each other.”
SuperBox ASSOCIATED_WITH Pre-positioning
Jack speculates that the boxes may be a pre-positioning move, while acknowledging that the final intent is unknown.
Uncertain Confidence 78% · Jack Rhysider EP 172 Details
“It’s possible that all this is just some pre-positioning move of some kind”
SuperBox ASSOCIATED_WITH BadBox 2.0
D3ada55 identifies the SuperBox as part of what was being called the BadBox botnet, specifically in the BadBox 2.0 context.
Explicit Confidence 97% · D3ada55 EP 172 Details
“this thing was part of what’s now referred to as the BadBox botnet.”
SuperBox ASSOCIATED_WITH Tencent
The SuperBox was observed communicating with Tencent infrastructure.
Explicit Confidence 99% · D3ada55 EP 172 Details
“The first thing it does is call out to Tencent.”
D3ada55 identifies the Tencent communication as involving QQ/qq.com.
Explicit Confidence 98% · D3ada55 EP 172 Details
“Like, in China, yeah, like qq.com.”
Magabox ASSOCIATED_WITH SuperBox
The Magabox looked and behaved like the SuperBox, including using a similar app-store and video-app arrangement.
Explicit Confidence 96% · D3ada55 EP 172 Details
“it looked just like the SuperBox.”
“it worked like the other two.”
SuperBox DISCOVERED_BY D3ada55
D3ada55 investigated and discovered suspicious behavior in a SuperBox taken from her father’s house.
Derived Confidence 92% · Jack Rhysider EP 172 Details
“D3ada55 discovered something that was like discovering something you weren’t supposed to see”
SuperBox EXPLOITS SCADA vulnerability
The SuperBox triggered an alert for a SCADA vulnerability, which the episode presents as an attempted SCADA exploit.
Explicit Direction flagged Confidence 93% · D3ada55 EP 172 Details
“I get a hit in my vulnerability log, like in the threat log on my Palo Alto firewall, and it’s for a SCADA vulnerability.”
D3ada55 says she worked at Palo Alto.
Explicit Confidence 98% · D3ada55 EP 172 Details
“I’ve worked at some of the biggest names in security, so Palo Alto, Google, Apple.”
D3ada55 says she is a senior sales engineer at CENSUS.
Explicit Confidence 99% · D3ada55 EP 172 Details
“now I’m over at CENSUS”
D3ada55 says she worked at Google.
Explicit Confidence 98% · D3ada55 EP 172 Details
“I’ve worked at some of the biggest names in security, so Palo Alto, Google, Apple.”
Jack states that Dort made the Kimwolf botnet and controls the infected SuperBoxes; this is presented as the episode’s account.
Explicit Confidence 97% · Jack Rhysider EP 172 Details
“this guy, Dort, who’s the one who made the Kimwolf botnet, controls the SuperBoxes.”
SuperBox USES SuperBox App Store
The SuperBox requires its own app store instead of the Google Play Store to access its streaming applications.
Explicit Confidence 99% · Jack Rhysider EP 172 Details
“install something called the SuperBox App Store.”
D3ada55 suspected that the boxes were using Nmap to scan a Raspberry Pi.
Uncertain Confidence 90% · D3ada55 EP 172 Details
“are you guys nmapping this little Raspberry Pi in here?”
Aisuru-Kimwolf botnet USES DDoS
Cloudflare reportedly identified Aisuru-Kimwolf as the busiest botnet and mitigated more than 2,000 attacks originating from it.
Attributed Confidence 95% · D3ada55 EP 172 Details
“Cloudflare put out a report that talks about the DDoS statistics for the year for 2025”
“over 2,000 attacks they mitigated originating from this botnet”
The SuperBox runs Android rather than Android TV.
Explicit Confidence 99% · Jack Rhysider EP 172 Details
“the operating system on this thing is just Android, and not Android TV, just Android.”
D3ada55 ran tcpdump on Raspberry Pis while monitoring the boxes’ network activity.
Explicit Confidence 99% · D3ada55 EP 172 Details
“I’ve got tcpdump running on them”