Binge, Bot, Repeat: Unpacking the Ecosystem of Video Piracy on Telegram

• URL: http://arxiv.org/abs/2605.08418v1
• Date: Fri, 08 May 2026 19:24:39 GMT
• Title: Binge, Bot, Repeat: Unpacking the Ecosystem of Video Piracy on Telegram
• Abstract summary: We present the first large-scale study of video piracy on Telegram through a mixed-method analysis of 1,057 channels that shared 209k posts between December 2023 and January 2026.<n>We develop a fine-grained taxonomy that enables a structured understanding of the activity and intent of these channels on a per-post level.<n>The scale and persistence of this ecosystem motivated the development of Anti-RIP, a real-time framework for detecting emerging video piracy communities on Telegram.
• Score: 2.272052150526026
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Telegram has emerged as a major platform for large-scale video piracy, where copyrighted content is rapidly distributed among users. Despite its prominence, the structural and operational dynamics of this ecosystem remain insufficiently understood. To address this gap, we present the first large-scale study of video piracy on Telegram through a mixed-method analysis of 1,057 channels that shared 209k unique posts between December 2023 and January 2026 - systematically characterizing their content, distribution strategies, and how the ecosystem is sustained at scale. Central to our approach is the development of a fine-grained taxonomy that enables a structured understanding of the activity and intent of these channels on a per-post level. The channels collectively distributed 19,033 unique copyrighted titles originating from 175 countries, accumulating over 4.85B unique views and resulting in a lower-bound estimated financial loss of $17.49B for content rights holders. We also find that this ecosystem is deliberately engineered to be resilient against takedown efforts, frequently redirecting users through chains of intermediary channels and automated bots that collectively handle hosting, access control, monetization, and channel discovery. The scale and persistence of this ecosystem motivated the development of Anti-RIP, a real-time framework for detecting emerging video piracy communities on Telegram. Anti-RIP utilizes our taxonomy to generate contextual, interpretable insights that stakeholders confirmed improve the triaging action against reported posts and channels. Over a 61-day period, the framework facilitated the takedown of 524 previously unknown piracy channels and 71 bots. To support reproducibility and future research, we open-source both the dataset and the Anti-RIP framework.

Related papers

• Customization under Fire: Plugin Poisoning in Text-to-Image Ecosystem [51.46397124066055]
  This paper introduces PoisonLoRA, the first systematic study of LoRA plugin supply-chain risks that exploits the trust and characteristics within the T2I ecosystem.<n>We achieve approximately 100% attack success rates (ASR) on both Civitai and Liblib on 6 datasets across 4 scenarios, without being detected by the platforms.
  arXiv  Detail & Related papers  (2026-06-08T07:45:17Z)
• Building Digital Societies as Ecosystems: How Recognition and Repeat Relationships Sustain Cross-Community Work in Open Source [0.525685083367962]
  We measure cross-boundary collaboration in an open-source software (OSS) ecosystem by reconstructing the bipartite contributor-repository graph of 464 cybersecurity projects and 11,372 contributors active over October 2001-May 2022.
  arXiv  Detail & Related papers  (2026-05-24T13:04:24Z)
• Making MLLMs Blind: Adversarial Smuggling Attacks in MLLM Content Moderation [54.38271718421492]
  Adversarial smuggling attacks exploit the Human-AI capability gap.<n>It encodes harmful content into human-readable visual formats that remain AI-unreadable.<n>We conduct a preliminary exploration of mitigation strategies.
  arXiv  Detail & Related papers  (2026-04-08T11:13:16Z)
• Mining the YARA Ecosystem: From Ad-Hoc Sharing to Data-Driven Threat Intelligence [0.30586855806896046]
  YARA has established itself as the de facto standard for "Detection as Code"<n>Despite its pervasive use, the open-source YARA ecosystem remains characterized by ad-hoc sharing and opaque quality.<n>We conducted a large-scale mixed-method study of 8.4 million rules mined from 1,853 GitHub repositories.
  arXiv  Detail & Related papers  (2026-03-15T03:01:13Z)
• Cluster-Aware Attacks on Graph Watermarks [50.19105800063768]
  We introduce a cluster-aware threat model in which adversaries apply community-guided modifications to evade detection.<n>Our results show that cluster-aware attacks can reduce attribution accuracy by up to 80% more than random baselines.<n>We propose a lightweight embedding enhancement that distributes watermark nodes across graph communities.
  arXiv  Detail & Related papers  (2025-04-24T22:49:28Z)
• DarkGram: A Large-Scale Analysis of Cybercriminal Activity Channels on Telegram [2.9982223037163998]
  We present the first large-scale analysis of 339 cybercriminal activity channels (CACs)<n>These channels share a wide array of malicious and unethical content with their subscribers.<n>We developed DarkGram, a framework that automatically identifies malicious posts from the CACs with an accuracy of 96%.
  arXiv  Detail & Related papers  (2024-09-22T21:19:37Z)
• Exploiting CPU Clock Modulation for Covert Communication Channel [0.3277163122167433]
  We unveil a novel covert channel exploiting the duty cycle modulation feature of modern x86 processors. Specifically, we illustrate how two collaborating processes, a sender and a receiver can manipulate this feature to transmit sensitive information surreptitiously. Our live system implementation demonstrates that this covert channel can achieve a data transfer rate of up to 55.24 bits per second.
  arXiv  Detail & Related papers  (2024-04-08T19:23:04Z)
• Detecting Suspicious Commenter Mob Behaviors on YouTube Using Graph2Vec [1.1371889042789218]
  This paper presents a social network analysis-based methodology for detecting suspicious commenter mob-like behaviors among YouTube channels. The method aims to characterize channels based on the level of such behavior and identify com-mon patterns across them. The analysis revealed significant similarities among the channels, shedding light on the prevalence of suspicious commenter behavior.
  arXiv  Detail & Related papers  (2023-11-09T23:49:29Z)
• Uncovering the Dark Side of Telegram: Fakes, Clones, Scams, and Conspiracy Movements [56.49045238318727]
  We perform a large-scale analysis of Telegram by collecting 35,382 different channels and over 130,000,000 messages.<n>We find some of the infamous activities also present on privacy-preserving services of the Dark Web, such as carding.<n>We propose a machine learning model that is able to identify fake channels with an accuracy of 86%.
  arXiv  Detail & Related papers  (2021-11-26T14:53:31Z)
• Channel-wise Gated Res2Net: Towards Robust Detection of Synthetic Speech Attacks [67.7648985513978]
  Existing approaches for anti-spoofing in automatic speaker verification (ASV) still lack generalizability to unseen attacks. We present a novel, channel-wise gated Res2Net (CG-Res2Net), which modifies Res2Net to enable a channel-wise gating mechanism.
  arXiv  Detail & Related papers  (2021-07-19T12:27:40Z)
• Decentralized Learning for Channel Allocation in IoT Networks over Unlicensed Bandwidth as a Contextual Multi-player Multi-armed Bandit Game [134.88020946767404]
  We study a decentralized channel allocation problem in an ad-hoc Internet of Things network underlaying on the spectrum licensed to a primary cellular network. Our study maps this problem into a contextual multi-player, multi-armed bandit game, and proposes a purely decentralized, three-stage policy learning algorithm through trial-and-error.
  arXiv  Detail & Related papers  (2020-03-30T10:05:35Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.