A large Internet Protocol Television (IPTV) piracy network spanning more than 1100 domains and over 10,000 IP addresses has been uncovered by cybersecurity researchers.
The operation, active for several years, has reportedly impacted more than 20 well-known entertainment and sports brands.
The Silent Push investigation linked the piracy network to two companies profiting from hosting unlicensed content – XuiOne and Tiyansoft.
The cybersecurity firm also identified one individual, Nabi Neamati of Herat, Afghanistan, as a key figure in its operations. Evidence suggests that Neamati owns Tiyansoft and has directly managed domains associated with the network.
The findings highlight how lucrative piracy remains. According to prior studies, pirated IPTV streams and related content generate billions of dollars each year. In one example, a website connected to the network, JVTVlive, claimed to run 2000 servers in 198 countries, a boast that appears accurate based on Silent Push’s data.
Major Brands Targeted
Major brands affected include:
-
Prime Video
-
Disney Plus
-
Netflix
-
Apple TV
-
Hulu
-
HBO
-
Formula 1
-
Premier League
-
UFC
Read more on digital piracy: Hackers Hijack Jupyter Servers for Sport Stream Ripping
The pirated services offer premium content at heavily discounted rates, sometimes advertising thousands of channels for as little as $15 per month.
Beyond copyright infringement, these platforms pose dangers to users. Silent Push noted that consumers often face fraudulent charges, identity theft or exposure to malware when engaging with illegal IPTV providers.
Technical Infrastructure Behind the Piracy Network
Unlike legitimate streaming platforms, IPTV networks typically rely on private infrastructure to distribute content. This makes them harder to track and easier to abuse for large-scale piracy.
Silent Push researchers noted that the number of IP addresses exceeded the number of domains, a pattern consistent with IPTV rather than other types of cyber-threat.
Investigators traced the network back to multiple sites. While the domains shifted IP addresses and registration details over time, technical fingerprints and social media accounts tied them to Neamati and his companies.
Silent Push emphasized that, while the network’s content appears to be almost entirely unlicensed, final confirmation depends on responses from the affected media companies.
“Without such confirmation, it is technically possible that some media companies may have a licensing agreement with these hyper-aggressive IPTV networks,” Silent Push wrote.
“However, our team has observed no evidence to support that conclusion.”
The firm plans to discuss its findings in a webinar on September 23 2025, titled Stopping Piracy Distribution Networks at Scale.
Image credit: Top_CNX / Shutterstock.com