Piracy is a chain, not a list of sites

The misconception

Ask the market how anti-piracy is going and the answer comes back as a list of sites: how many domains were blocked, how many pages went dark, how many entries a blocking order added this season. Vendors are compared by the length of their site lists. League tables rank the most visited piracy destinations. Underneath all of it sits one unstated assumption: that a site is the thing being fought.

It is not. A site is the cheapest, most disposable component of a piracy operation, and the operators price it accordingly. What follows is a set of observations from Randy labs’ own monitoring that make the point better than any argument could, ending with a rare event: the collapse of a hosting network that piracy operators had relied on for years, and what its tenants chose to save.

What a piracy operation actually is

Strip any live-sports piracy operation down and the same shape appears. At the top, many front ends: sites, apps and IPTV portals, replaced within days when they are blocked. Beneath them, a small number of players, the embedded components that actually connect a page to a stream, shared across whole families of sites. At the bottom, the fewest pieces of all: the stream servers that deliver the video itself.

Audience concentrates at the top of that chain. Infrastructure concentrates at the bottom. Every step down means fewer targets and more of the audience reached per action, which is why the bottom of the chain is where enforcement pays.

The concentration is hard to overstate. In one market we monitor, the leading piracy site, the number one search destination for live football there with close to two million search clicks a month, is delivered by one player and one stream server. So are nineteen other sites, most of which have no measurable audience at all. And the chain does not stop at the border: through shared players, that same stream network serves more than two hundred further sites in other markets. Every one of those links is an observed embed on a real page, not an inference from shared infrastructure.

Why a list of sites cannot keep up

Once the chain is visible, the failure modes of list-based enforcement stop being mysterious:

• Sites are replaceable. A blocked domain comes back as a mirror or a new name within days, and the audience follows it.
• Lists age fast. A list fixed in advance names last month’s domains, while the audience has already moved on.
• Small sites lead to the source. A site with no measurable audience can share the stream server of the market leader. Leaving it off the list closes that path of discovery.
• The source covers every site. Cutting a player or a stream server takes the match off every site it feeds, listed or not.

Then the test case arrived

This September, one of the better known hosting networks in the piracy ecosystem went dark. An autonomous system that operators had trusted for years, carrying piracy infrastructure serving multiple markets, dropped off the internet. Events like this are rare, and they are the closest thing the industry gets to a controlled experiment: operators who lose a data centre overnight must decide what to rebuild first, and their choices reveal which parts were disposable all along.

Randy labs had 75 piracy hosts under observation on that network when it went down, spanning site pages, players, IPTV channels and stream sources. We checked every one of them again after the event. The results, host by host:

• 39 hosts moved and were live again, most within a day. Almost all of them were players, IPTV channels and stream sources: the layers that actually deliver video.
• 26 hosts stayed dead. Almost all of them were site pages, the mirrors and front ends the operators did not bother to save.
• 7 hosts never went down at all, because one block of addresses stayed announced throughout the event.
• 3 hosts moved but were not yet answering.

The operators told us what matters

Read those numbers as a statement of priorities, because that is what they are. Within a day of losing their host, the operators had re-homed the players and the stream layer, and twenty IPTV channel hosts moved together to the same new network. That is not scrambling. That is an executed migration plan. The site pages, the layer the industry’s lists point at, were simply abandoned. Many still resolve to dead addresses today.

The aftermath completed the point. New piracy domains that appeared on industry blocking lists in the weeks that followed embedded the same relocated player the old sites had used. The lists were chasing fresh pages, while the operation had kept the one component that mattered and dressed it in new domains. And for anyone tracking players rather than pages, the move was not a setback at all: the relocated players led directly to the operation’s new stream servers. Chasing pages means chasing replacements. Following the chain means arriving where the operator does, at the same time.

What rights holders should take from this

The measure of an enforcement programme is not how many sites it covers or how many domains went dark. Those numbers reward exactly the layer the operators have priced at zero. The questions worth asking are different ones. Does detection trace every site, app and IPTV channel through to the player and the stream server behind it? When the infrastructure moves, does the map move with it, the same day? Is enforcement aimed where a single action removes the match from every front end at once, listed or not?

A list of sites is a photograph of where the audience was. The chain is the operation itself. September’s collapse did not settle the argument because anyone made it well. It settled it because the pirates, forced to choose what to save, chose exactly what chain-led enforcement would have targeted.