click-sud.pro — Romanian TV Piracy Farm,
.in APK Malware Network & Indonesian Gambling Traffic Sale

A WordPress piracy portal serving 500+ unlicensed Romanian TV episodes attracts the diaspora with free content, then monetises via a confirmed malicious ad surface (zero CSP, ANY.RUN verdict on sister domain), eight Indian-operated Android APK install-partner links, and the sale of its legacy clicksud.org domain traffic to an Indonesian illegal online gambling operation. A three-continent revenue loop built entirely on other people's content and malware delivery.

The operator runs a domain-hopping strategy to survive copyright enforcement. The original clicksud.org domain has been abandoned and now 301-redirects, cycling through intermediate hops before landing on an entirely unrelated Indonesian gambling site. The current active site is click-sud.pro, registered January 21, 2026 via Spaceship, Inc. with full identity privacy through WITHHELD FOR PRIVACY LLC (Delaware). The .pro TLD is a deliberate choice: harder to trademark-challenge than .org or .com, and Spaceship has a weaker abuse track record than larger registrars.

Sister domain clicksud.biz received a confirmed MALICIOUS verdict from ANY.RUN sandbox analysis, with 27 threat indicators and a "Potential Corporate Privacy Violation" flag from Chrome processes. This directly links the operator's broader domain network to malware behaviour, not just piracy.

Despite Cloudflare proxying hiding the origin IP, a passive HTTP headers check reveals the backend server type via the X-Turbo-Charged-By: LiteSpeed header. LiteSpeed Web Server is the dominant backend for Indian shared hosting providers (Hostinger IN, HostGator IN, BigRock), strongly indicating the physical origin server sits on Indian infrastructure. This aligns with the Indian-operated APK partner network in Finding 3.

Critically, the site serves no Content-Security-Policy header. With no CSP, any ad network or injected script can execute arbitrary JavaScript, load external iframes, exfiltrate cookies, or deliver drive-by malware to visitors. This is not an oversight: running piracy portals with aggressive ad networks requires CSP to be absent so ad tech can insert pop-unders, redirectors, and crypto miners without being blocked by the browser.

The site's footer carries eight outbound links, all pointing to .in TLD domains hosting Android APK download pages for well-known piracy and utility apps. This is not organic linking. These are Cost Per Install (CPI) affiliate arrangements: the site operator earns $0.10–$2 per APK installed by a Romanian visitor. Each APK is a repackaged version of a legitimate app bundled with adware, spyware, or data-harvesting payloads.

PikaShow and Dooflix are well-documented malware vectors in the Android threat research community. MT Manager's .in TLD clone grants root-level file system access. The .in TLD pattern confirms a single Indian affiliate network operating all eight domains. Romanian users who download these APKs expose their devices to SMS interception, credential theft, and location tracking.

The original clicksud.org domain, which historically held the site's SEO authority and backlink profile, has been sold or leased to an unrelated operation. A passive HTTP follow reveals a two-hop redirect chain ending at taysentotologin.com, an Indonesian online TOTO lottery and slot machine portal. The intermediate domain ishtiz.com appears to be a traffic broker or redirect monetisation service.

The gambling site impersonates TeePublic's UI template and operates registration flows at online.taysentoto-pintu.com. It advertises "4D Lottery Generator" tools, promises large prizes and fast withdrawals, and provides no business registration or gambling licence information. Online TOTO operations of this type are illegal in most EU jurisdictions and unregistered in Indonesia. Romanian users following old bookmarks or search-engine cached links to clicksud.org now land on a gambling lure targeting them without consent.

The site is a fully SEO-optimised WordPress installation using Yoast SEO to generate sitemaps and maximise search engine ranking for Romanian TV show queries. The post sitemap confirms over 500 indexed episode pages updated through September 2026 — daily publishing cadence. The CMS choice, LiteSpeed hosting, and aggressive SEO configuration are consistent with a content farm operator who treats piracy as a traffic acquisition strategy rather than incidental.

The content catalogue is drawn entirely from Romania's two dominant broadcast groups: Pro TV (Las Fierbinți, Românii Au Talent, Power Couple Romania, Survivor Romania) and Antena Group (Mireasa, Chefi la Cuțite, O Nouă Șansă, Asia Express). Both broadcasters hold exclusive digital rights. No licence, no attribution, no takedown mechanism. The "Lumea ta Digitală" ("Your Digital World") branding is the only on-site text.

Evidence — WHOIS & Domain Chain

Evidence — Monetisation Map