On the night of June 11, a billion people watched the 2026 FIFA World Cup opening match, but millions did so through a shadow ecosystem of pirate panels, burner domains and rebranded apps, paying a fraction of what licensed broadcasters charge. The money flows to organised crime. In the days around kickoff, we went inside the infrastructure powering that parallel feed. This is what the pirate stadium looks like from the inside.

Nearly a million RTSP video services are exposed on the open internet, most without authentication. A global scan found 973,819 active RTSP services across 210 countries. Of those, 8,074 streamed live video with zero credentials required, including thermal sensor arrays, server facility interiors, and systems co-located with SCADA dashboards. One in five viewable feeds was in a conflict-affected country.

Phishing campaigns targeting Dutch taxpayers are growing more sophisticated, combining classic tactics with modern third-party services to steal sensitive data. This research analyses phishing pages impersonating the Belastingdienst, revealing common patterns and infrastructure choices. Beyond traditional form-based methods, attackers are shifting toward interactive, service-driven models, with a strong focus on cryptocurrency theft as a high-value target.