When IPTV management system Xtream-Codes was taken down as part of an EU anti-piracy operation last week, chaos ensured. With a large proportion of the illicit market estimated to use the software, large numbers of services went dark. According to data provided to TorrentFreak by networking equipment company Sandvine, illicit traffic nosedived by 50%.
Last week the illicit IPTV market was thrown into turmoil when Italian authorities teamed up with law enforcement groups in the EU.
Their operation, dubbed ‘Black IPTV‘, targeted individuals and equipment behind at least one Italy-based IPTV provider. More importantly, however, it also targeted Xtream Codes, a management system utilized by many providers and sellers of IPTV services.
While Xtream Codes claimed to be a content-agnostic system, its popularity in the unlicensed market is hard to understate. With an estimated 5,000 providers of varying kinds on its books servicing around 50 million end-users, its closure had an immediate and dramatic impact.
In the immediate aftermath of the raids, suppliers reported an inability to sign up new customers or renew customer subscriptions. Within several hours, it became clear that anyone reliant on the system would be more seriously affected, with IPTV services going dark and paying customers seeing red.
As soon as news of the raids appeared on our radar, we contacted several previously responsive players in the IPTV market. Precisely zero responded to our requests for comment amid the chaos, which was widespread and by some estimates affected up to 90% of the market. Data from Google Trends does seem to indicate that plenty of people hit its search engine for news.
With no obvious central source for information on the impact of the operation, the day after the raids TorrentFreak contacted Sandvine, a networking equipment company that has previously provided detailed analysis on general Internet and piracy-related traffic.
An external source that requested anonymity told us that due to technical issues the full force of the raid may not be felt until Thursday or Friday, the two days directly after the raids took place. So, we asked Sandvine if the company had noticed any significant drop in illicit streaming traffic during that period – it had.
This week a spokesperson for the company told TorrentFreak that on Friday September 20, Sandvine estimated that illicit streaming traffic had decreased 50% from the levels seen on Thursday, a massive drop by any standards.
That many illicit IPTV providers had been seriously affected by Xtream Codes’ removal from the market didn’t really come as a shock. Equally, it wasn’t really a surprise when providers began to adapt to the loss either.
Slowly but surely, some providers and sellers began migrating to alternative management systems, as detailed in emails to subscribers seen by TF. By Saturday, better news for them began to filter through, with services not only returning but also with subscriber payment and subscription information intact.
Sandvine gave TF a brief list of five providers, all of which went down completely between the 19th and 21st of September. By 21st/22nd all were recovering to a greater or lesser extent, with only one failing to return at all.
That being said, the overall market is huge, so it’s almost impossible to say how many have now returned, in whole or in part. It isn’t difficult to find complaints that services are still down even today but there are also several reports of providers that weren’t affected at all by the Xtream Codes situation.
Typically, there are individuals and groups out there trying to make hay even before the storm clouds have cleared. TF has heard of a handful of hopeful end-users who believed they were paying to access a service that was still up, only to have their ‘supplier’ cut and run.
Equally, we were pointed to a service that claims to be an Xtream Codes replacement but is probably nothing more than an elaborate scam. Since the prices were so high, we didn’t feel tempted to test that theory out.
On the other hand, real Xtream Codes alternatives are out there but how vulnerable they are to similar action will remain to be seen. In particular, one service seems happy to take orders and is reportedly in use by a number of previously stranded providers and resellers.
If nothing else, most of those in the chain should now be more prepared if there’s similar action in the future. Or less surprised at least.
