Research and investigations concerning internet platforms can be incredibly time-consuming, despite most of the necessary tools being readily available to the public free of charge.
Threat intelligence platform Silent Push combines the essence of these tools into a graphical interface that does much more than the sum of its parts. Historical data, for example, allows connections to be built in cases where evidence no longer exists on the ‘live’ web. Straightforward tasks such as WHOIS lookups, on the other hand, only rarely look this good.
According to Silent Push researchers (SPR), the platform makes it easy to “map out the entire infrastructure supporting IPTV networks” by “combining just a few technical fingerprints.” The results of an investigation published today claim to identify a major IPTV network and an individual the researchers claim is closely involved.
A Domain Name Gets Things Rolling
SPR say their investigation began with a domain name – premiumplustv[.]xyz – which had been reported as hosting pirated content. Using the Silent Push Web Scanner they were then able to connect the service to 10,000 IP addresses and 1,100 domains, with one standing out in particular.
“The xuione[.]com website, seen below, is a massive IPTV provider that appears to support numerous pirated content schemes – confirming the initial suspicions of our research partner,” SPR write.
“For several years, the xuione[.]com website listed details indicating the registrant was based in Herat, Afghanistan.”
Records were updated to remove references to Afghanistan in March 2025, but historical records are more difficult to change.
SPR Identify an Individual With Close Links to the Network
SPR’s investigation led them to identify an individual that they believe is closely linked to the pirate IPTV network, who is also the “likely” operator of the pirate IPTV service at jvtvlive[.]xyz.
That service allegedly exploits content from the world’s leading entertainment and sports brands including Prime Video, Bein Sports, Disney Plus, NPO Plus, Formula 1, HBO, Viaplay, Videoland, Discovery Channel, Ziggo Sports, Netflix, Apple TV, Hulu, NBA, RMC Sport, Premier League, Champions League, Sky Sports, NHL, WWE, and UFC.
While that individual may indeed be everything SPR say he is, an OPSEC note accompanying the investigation notes that the methods used by the team to enumerate the piracy network, and the process used to identify the individual (located in Herat, Afghanistan), “cannot be shared publicly.”
We have no reason to doubt their findings, but there’s no replacement for seeing the evidence first hand.
Evidence Mounts
Ultimately, however, SPR were able to link the domain xuione[.]com to an IP address – 158.220.114[.]199 – used by many apparent IPTV-linked services [here] including streamxpert[.]net, jvtvlive[.]xyz, and tiyanhost[.]com.
Tiyanhost[.]com is the domain name of Tiyan Software Development, a business entity also based in Herat, Afghanistan. Public records show that the person identified by SPR shares the same name as the owner of that company. Sites with links to XuiOne display a WhatsApp number with an Afghan country code that perfectly matches a number directly linked to the same person, researchers say.
Overall, that led to the researchers feeling “comfortable assessing his involvement” in the pirate network’s operations.
Food For Thought
Exactly what additional evidence was obtained by the researchers is unknown, but we assume that it’s pretty compelling after naming the individual in public. It also seems reasonable to assume that information has been shared with anti-piracy companies and other interested parties in advance. If not, publication of the research is a pretty loud ‘headsup’ for those involved.
Yet, as far as we know, the service remains active. Enforcement in Afghanistan may present more than a few stumbling blocks, but the country isn’t known for cutting edge technical infrastructure. The service’s infrastructure has a fairly significant European presence, but perhaps the time isn’t quite right to do anything about it.
Finally, online databases used for investigations aren’t always accurate and at times can deliver the occasional curveball. All things considered, the existence of an $84 million turnover ad agency in the same Afghan town seems unusual. Even more so when allegedly operated by an individual with a familiar name, which some databases link to an even bigger operation in the Netherlands.
Silent Push (Community Edition) is available for free here (pdf). The investigation report is available here
From: TF, for the latest news on copyright battles, piracy and more.
Powered by WPeMatico
