Finding your stolen software cracked and listed for free download is a rite of passage for anyone who ships commercial code. It is also one of the most enforceable forms of piracy you will ever face: the files are literally yours, the copies are exact, and every layer of infrastructure behind them, file hosts, search engines, payment processors, carries obligations it would rather meet than argue about.
The work happens in a fixed order: kill the download first, then the listing, then the search results, then the revenue. This guide walks that sequence, plus the two moves most developers skip, the anti-circumvention claim and scheduled monitoring.
Know what you're looking at before you file anything
A warez release is two artifacts. The listing page, on an index site, a forum, or a blog, carries your product name, a version number, screenshots, and download links. The payload sits somewhere else entirely: your installer bundled with a crack, a keygen, or a preactivated repackage, stored on a file locker, a mirror network, or a torrent. File against both layers, and know which one you are filing against at any moment.
The vocabulary matters because your notice should use it. A crack is your binary with its license check removed. A keygen generates keys that satisfy your validation routine. A patch alters your files after installation. Each one modifies or ships your copyrighted code, except the standalone keygen, which falls under a different statute, covered below. An abuse desk takes a notice more seriously when it names the artifact precisely instead of saying "they stole my app."
Verify the leak without executing anything. The listing's version string, release date, file size, and screenshots are usually conclusive once you match them against your own release notes.
Capture evidence before you file. The listing URL, every download link, dated screenshots, the host behind each link, pages and mirrors vanish quickly once enforcement starts, and an evidence checklist keeps the record organized so a later escalation, or a court filing, still has its exhibits. And if what leaked is your source code rather than a compiled build, code-hosting platforms run their own DMCA channels; GitHub's own takedown process is the model, and a plain-text code dump is the easiest kind of target to prove.
Kill the payload first: the file hosts
The listing is the storefront; the payload is the warehouse. Remove the warehouse first: a crack page whose download links are all dead is a billboard for nothing, and file hosts are the fastest-moving targets in this process. Under 17 U.S.C. § 512(c), a provider that stores user-uploaded files keeps its safe harbor only if it removes infringing material expeditiously once notified, which is exactly why every serious locker operates a DMCA form. It is not friendliness. It is self-protection, and it works for you.
Work the listing page link by link. Copy each download URL, resolve shorteners and interstitial pages to their final destination, and file one notice per link per host. The large locker and cloud-drive services typically process copyright reports within days, you can calibrate expectations by how long DMCA takedowns take across provider types.
Torrents need a different mental model. You cannot DMCA a swarm: peers trade pieces directly and there is no central copy to remove. What does sit on servers is the .torrent file, the index page, and the tracker, and those are actionable like any hosted page or file, notice the host that stores them and delist the index from search. A torrent that new users cannot find stops growing.
Take down the listing: the warez site's host
Start with a two-minute host lookup on the warez domain. WHOIS records, nameserver trails, and reverse DNS expose the provider actually serving the site, even when a CDN or reverse proxy masks it. Send a copy of the notice to that fronting provider too; most forward abuse reports to the host behind them, and the forward starts a clock the origin host cannot ignore.
Draft to the statute. Cite 17 U.S.C. § 512(c) if the site stores the files, and § 512(d) if it only links, (d) covers information location tools, meaning link directories and search functions, and most filers never invoke it. A warez index that hosts nothing is still exposed under (d). Its host knows that.
The notice needs the statutory elements: identification of your work, the exact infringing URLs, your contact information, the good-faith and accuracy statements, and a signature. The pre-drafted letter in our DIY toolkit already matches every element.
Add the paragraphs most filers omit. State that the listing distributes circumvention tools in violation of 17 U.S.C. § 1201, keygens and cracks exist to defeat your license check, and how § 1201 anti-circumvention enforcement works is a second, independent basis for removal. Then remind the host that safe harbor under § 512(i) depends on reasonably implementing repeat-infringer policies, and a warez domain is, by definition, a repeat infringer. Together those two paragraphs change an abuse desk's arithmetic.
One candid caveat: the uploader can send a counter-notice under § 512(g), and if you do not file suit within roughly ten to fourteen business days, the host restores the material. Rare with warez, but know the rule before you need it. Keep every claim precise; § 512(f) creates liability for knowing misrepresentation in a notice.
Erase the search footprint
Warez traffic is overwhelmingly search-driven, which makes search your third front. File copyright removal requests with Google and Bing for every listing URL you have captured. Delisting does not remove the page, but it removes discovery, and for an offshore site you cannot touch, discovery is the whole game.
There is a multiplier here most developers never learn: Google treats the accumulation of valid takedown notices against a domain as a ranking signal, demoting sites that collect many of them through its piracy demotion signal. Every notice you file does two jobs, it removes one URL and degrades the visibility of the entire domain. Enforcement compounds.
Follow the money: key stores and storefront cracks
Storefronts selling activated or cracked builds, and resellers moving volume keys at a fraction of your price, are businesses with merchant accounts. Merchant accounts are the fastest kill switch on the internet: processors prohibit sales of illegal goods and suspend merchants who break the rule. Report the storefront to its processor with evidence, listing URL, screenshots, a plain statement of what is being sold. How payment processors cut off pirate merchants explains where the report goes and what evidence moves fastest.
Marketplace listings route differently. If the seller lives on an eBay-style marketplace, the platform's own IP protection program applies and moves faster than any external notice, because the platform controls the listing directly; the marketplace takedown guide walks those channels.
One distinction keeps your reports credible. Reselling activation keys is usually a licensing and trademark problem rather than a copyright one, a key is not a copy of anything. The moment a seller ships your installer, a crack, or a patched build alongside the key, it is copyright again. The trademark versus copyright line determines which team at the processor or platform picks up your report, so match the claim to the conduct.
When the host ignores notices: offshore and bulletproof hosting
Some warez operations sit in jurisdictions that do not answer US legal process, and a few use bulletproof providers whose business model is not answering. Your notice is still not wasted: it starts the paper trail and triggers escalation.
Escalate in this order. The lockers carrying your build are often US-based even when the listing is offshore, so kill the files no matter where the index lives. Search delisting works on any domain from anywhere. If the site monetizes, report it to the ad networks serving its inventory, mainstream advertising providers run pirate-site policies and pull revenue. If you hold a trademark on the product name, a UDRP complaint can reach the domain itself through its registrar. And whether DMCA works internationally depends less on geography than on the platform: many overseas hosts run DMCA-style processes voluntarily because their own upstream providers demand it. Several countries also enforce site-blocking orders against piracy domains through their courts, a remedy that does not exist in the US but is live elsewhere.
Set the goal correctly. An offshore page with dead download links and no search presence is functionally dead, even if the HTML still loads somewhere. You do not need the page gone; you need the downloads unreachable and the audience unable to find them.
Build the moat: monitoring, registration, and stale cracks
Crack sites re-list from mirror backups on a schedule, so a one-time cleanup starts decaying within weeks. Enforcement against warez is a watch, not an event. Scheduled detection, scanning for your product name and version strings, including strings inside the installer, weekly or daily, surfaces relists on arrival, with evidence captured and hashed per detection. Content fingerprinting works the same way in principle, and this ongoing watch is what software and app protection looks like as a service; Protection Pro is our version of it.
Engineering choices buy time between detections. Server-side license validation makes a local crack fail at the API rather than the installer; frequent releases age out old cracks; per-customer identifiers inside each build make a leak traceable to its source. None of this replaces takedowns. It lowers the damage each incident does.
Register the current build with the US Copyright Office before you ever need a courtroom. Federal courts require registration before an infringement suit, and registering within three months of publication, or before infringement begins, makes statutory damages and attorney's fees available, which is the difference between a lawsuit that makes economic sense and one nobody files. Whether copyright registration is worth it has the longer answer; for commercial software, the short one is yes.
Frequently asked questions
Is a keygen for my software copyright infringement, or something else?
Mostly something else. A keygen contains none of your code, so hosting it is not direct infringement, but trafficking in tools that defeat technological protection measures violates 17 U.S.C. § 1201, and platforms accept notices on that basis. If your actual build sits beside the keygen, that part is ordinary infringement under § 512. Cite both in one notice.
Do I need to register my copyright before sending a DMCA notice?
No. A § 512 notice only asks you to identify your work and state a good-faith belief that the use is unauthorized, no registration required. Registration matters at the courthouse door: US federal courts require it before an infringement suit, and registering within three months of release makes statutory damages and attorney's fees available. Send the notices today and register in parallel.
The crack site is hosted offshore and ignores DMCA notices, what still works?
Plenty. The file lockers carrying your build are often US-based and will still remove payloads, search engines will still delist the pages, and payment processors will still cut off any key store. If you hold a trademark on the product name, a UDRP action can reach the domain itself. Dead links plus zero search presence equals a dead warez page, wherever it is hosted.
Can I find out who uploaded my cracked build?
Under 17 U.S.C. § 512(h), you can ask a federal court clerk to issue a subpoena compelling a service provider to identify the alleged infringer behind material stored on its system. It works best against file lockers and platforms with registered DMCA agents, and poorly against offshore bulletproof hosts. Preserve your evidence first, files and logs disappear fast.
How fast will my cracked build actually come down?
Payload first pays off here: file lockers typically remove infringing files within days, because § 512(c) conditions their safe harbor on prompt removal once notified. Warez listings on cooperative hosts follow within days to a couple of weeks. Offshore hosts may never respond, which is why you pair host notices with delisting and payment-rail reports.
What to do right now
The full sequence, in the order it works:
- Capture the listing, URLs, download links, dated screenshots, before anything moves.
- File a DMCA notice with every file host behind the listing's download links, one per link.
- Run a host lookup on the warez domain and send its host the full notice citing § 512(c), § 512(d), and § 1201.
- File copyright removal requests with Google and Bing for the listing pages.
- Report key stores to their payment processors and marketplace listings to the platform's IP program.
- Register the current build, then put scheduled monitoring in place so the next relist surfaces on arrival.