From international investigation to Sheikh Zayed raid: StreamEast is an idea, and ideas never die

In May 2024, Los Angeles Lakers star LeBron James was sitting courtside. He wasn't playing or celebrating, and he didn't seem preoccupied with what was happening on the court. He was watching a stream of an NBA game on StreamEast — the world's largest pirated sports streaming platform — while inside an arena hosting an official NBA game.

Shortly afterward, the Alliance for Creativity and Entertainment (ACE), which includes some 50 media and entertainment companies, among them Amazon, Apple TV, Netflix and Paramount, announced the closure of StreamEast following a year-long investigation.

The downfall of StreamEast was more than just the shutdown of a piracy website. It represented the dismantling of a massive digital network that streamed global sporting events for free. This included major European leagues, most notably the English Premier League and the UEFA Champions League, as well as the American major football, basketball and baseball leagues, the NFL, NBA and MLB respectively, in addition to boxing and mixed martial arts matches, Formula 1 races and other major American sports.

Traffic data on the website was evidence of the network's reach, with its primary domains originating from the United States, Canada, the United Kingdom, the Philippines and Germany. In just one year, the network generated approximately 1.6 billion visits, averaging 136 million visits per month.

“I'm under no illusion that I've obliterated the StreamEast brand off the face of the earth,” said Larissa Knapp, who leads anti-piracy efforts at the US Motion Picture Association. Knapp, a former FBI official, spoke proudly in a podcast interview, produced by The New York Times’ sports department, The Athletic, about her efforts to bring down, in cooperation with Egyptian authorities, two men who ran the largest pirated sports network from Sheikh Zayed in Giza, Egypt.

In early March, months after the two men were arrested in August last year, the Egyptian Public Prosecution announced they had been referred to trial. 

The case files and evidence seized from the defendants, including digital evidence, of which Mada Masr obtained a copy, indicate that the two men, in collaboration with a group of hackers, were responsible for operating the world’s largest piracy streaming channel. To understand the broadcasting mechanism and business environment that allowed StreamEast to function, Mada Masr speaks with technical engineers, Internet Protocol Television (IPTV) dealers and security sources.

Twenty-two officers were deployed to two different locations to carry out the sting operation to arrest two individuals at their residence in Sheikh Zayed, near Cairo, ACE lead investigator Dani Bacsa, explained in the podcast.

The first defendant, Sherif Ismail Mostafa, said to the prosecution that about ten police officers, including one in plainclothes, arrived at his home at 11:15 pm on August 25. They searched the house and arrested him before taking him to the residence of his accomplice, Amr Mamdouh, the second defendant in the case, whose residence they also searched. Afterward, they took both men to the Sheikh Zayed Police Station, confiscating several documents, mobile phones, laptops, an apartment ownership contract, cash and various bank cards.

The investigation report, of which Mada Masr obtained a copy, was prepared by the director of the Department for the Investigation of Artistic Products and Intellectual Property Rights, Haitham al-Tohamy. In the report, the defendants are accused of violating Intellectual Property Rights Law 82/2002 by offering and distributing audiovisual works and rebroadcasting encrypted content owned by companies outside Egypt without the rights holders' consent. They are also accused of operating the StreamEast website without a license from the Supreme Media Regulatory Council.

The investigation asserts that the defendants made deals with international advertising companies to display ads on the network's websites to generate profits. The raids yielded evidence of illegal activity, including a Binance cryptocurrency wallet containing US$26,451 and LE6.6 million as well as another wallet with LE300,000.

A laptop seized during the searches was used to control about 690 domains for various websites, with an average of 2.5 billion views. Fifteen IPTV servers used as technical support for uploading pirated content were also found, along with international advertising transfers exceeding $6 million since May 2023, a US-based Wise account and real estate purchase contracts in Sheikh Zayed.

Mostafa, 37, is a private physician residing in Sheikh Zayed. He was born in Monufiya Governorate and attended Kom al-Ahmar School there before enrolling and graduating from the Faculty of Medicine at Cairo University. He is married and has four children: two daughters and two sons.

After graduating, Mostafa worked in a public hospital for a year before his military conscription in 2015. During his service, he met Mamdouh, and a friendship developed between the two. After completing his military service in 2016, Mostafa worked in several public hospitals until 2021, when he moved to work in the private sector.

Mostafa’s interest in programming began at a young age. In his testimony to the prosecution, he states that his work involved “digital marketing for websites on Google search engines,” explaining that he began using this skill during his fourth year of university.

Over time, he started working with Mamdouh in search engine optimization (SEO), especially as Mamdouh shared his interest in that area. They worked together for a while, then stopped, before resuming their collaboration in 2022.

In his testimony, Mostafa said the scope of his work expanded, and he began collaborating with others in India to perform some tasks on a subcontract basis. He would agree with a client on a fee of $1,000, then subcontract the work to others for $500. As time passed, the workload increased, and he was contracted for a number of websites, reaching about 700. He also began receiving payments in US dollars through Wise, a money transfer application, before transferring them to various bank accounts in his name.

Mostafa added that he used the cryptocurrency application Binance to receive money transfers from clients then transferred these funds to his employees, indicating that he preferred to invest his money in real estate.

According to his statement, he started working in this field in 2010, explaining that he dealt with about 150 clients and around 690 websites, including StreamEast.

The prosecution questioned Mostafa about Binance, to which he replied that it is a cryptocurrency application that his clients use to transfer funds to him, and that, in turn, he transferred the funds to his employees, who were of Indian nationality. He added that he had started using the app about a year prior. Mostafa stated that his cryptocurrency balance amounted to 6,400 USDC.

The prosecution also questioned him about his use of the Top application, a tool used to manage and organize digital accounts and transactions. He stated that he used it for marketing the websites and his medical work, not for managing websites for third parties, and denied using it to manage websites through an international information company.

Mostafa also denied managing StreamEast in his testimony, saying, “I market these websites, but I do not manage them.” He also denied receiving large financial transfers amounting to $6 million, asserting that the total amount he received from marketing was about $300,000.

Mamdouh, the second defendant, 33, is a freelance engineer residing in Sheikh Zayed. Originally from Sohag, he was born into a family of six, and is married with one child. He graduated with a degree in civil engineering in 2014.

After graduating, he worked in the contracting field until 2020, before beginning to learn programming and SEO. He then turned to working through the online freelance platform Upwork, from which he earned an average monthly income of $500.

A year later, Mamdouh began working with Mostafa, and, as the number of clients increased, they started subcontracting some tasks to others, mostly from India, for a fee equivalent to about 20 percent of the project value. Mamdouh said he received payments via a blockchain application (a digital currency wallet for cryptocurrencies), and he also participated in promoting popular websites, including StreamEast. He clarified that he had access to the database for technical purposes related to search engine optimization, not for managing the site.

Mamdouh denied managing those websites in his testimony. When asked by the prosecution why he had access to the control accounts of several sites, including StreamEast, he said it was “for the sake of the site's database, to work on it and restore it so I could start promoting it or improving its search engine rankings.”

“I have access to the database, but I don't manage it. Of course, I could modify and delete things on the site and manage it, but I didn't do that because of our work's reputation,” he added.

When asked about using the blockchain app, he said it was for “trading BTC [Bitcoin] and I downloaded it without using it.”

How the investigation into StreamEast played out was first reported by The Athletic. According to the report, the investigation began in late 2023 with a focus on the domain www.streameast.app. ACE’s working group on streaming piracy and then DAZN, a global sports streaming service, identified StreamEast as a major piracy threat. 

Bacsa, the lead investigator, said in the podcast that initial research linked the site to Egypt, but noted that “the majority of the traffic going to that service came from the US, from Canada or the UK.”

In addition to its huge reach, the site’s resistance to takedown notices and warnings made it “a high priority target,” Bacsa added. 

The investigators were able to hone in on a specific IP address in Egypt and, from there, followed the digital money trail. 

“We found one of the companies’ crypto movements, so we went through this rabbit hole,” said Bacsa, adding that investigators soon realised the operation was multi-jurisdictional. “It led to an offshore shell company that funnelled the funds to two locations: one in the APAC [Asian-Pacific] region and one in Dubai.”

The investigation, Bacsa said, determined that an Egyptian national was the “lynchpin” behind all the entities they were tracking. With assets spanning “real estate, cash, other crypto movements,” as well as “gold bars,” the “criminal network” was trying to spread the funds to avoid detection. But the “funds left a fingerprint,” he said.

According to the investigation, around US$200,000 were found in several crypto wallets, while the site generated advertising revenue worth 4.9 million British pounds. These ads are often called “malvertising,” as illegal streaming sites sell advertising space to others who plant malware on users' devices via pop-up windows.

The amount of wealth associated with the site allowed ACE to hand over evidence to Egyptian authorities in June. While one of the biggest challenges in combating piracy is the reliance on cooperation from law enforcement agencies in different countries, Egyptian officials agreed that action was necessary and set a date for the raid and arrests, according to Bacsa.

But raids and arrests do not seem to be stopping the spread of illegal streaming worldwide. For one thing, the technology is readily available, especially through IPTV. This protocol mimics the way legitimate streaming platforms work, allowing them to be used for online broadcasting.

Through this technology, service providers offer their services through illegal broadcasting, in exchange for monthly or annual subscription fees — usually ranging between LE300 and LE1,000 per month — in exchange for making available thousands of linear television channels from around the world, and often tens of thousands of Video on Demand (VOD) titles, including movies that are still showing in cinemas, and full episodes of television series.

Information security expert Mohamed Askar tells Mada Masr that IPTV is essentially broadcast piracy. What happens, he explains, is that a person subscribes to a legitimate broadcasting service, then illegally rebroadcasts its content. Devices are installed with cards that capture the video, and then the content is rebroadcast over the internet, which explains the delay of a few seconds or a minute compared to the original broadcast.

“I might subscribe on a device, capture the image, and then stream it online. I get the broadcast with a subscription and then sell it to people at very low prices.” Often, part of the screen, especially the account numbers, is blurred to conceal the original subscriber's identity. Askar points out that IPTV, in principle, is not illegal, as watching channels online has become commonplace. However, the violation occurs when someone offers this service without owning the rights to broadcast the content they are showing.

An Interior Ministry official, who spoke to Mada Masr on condition of anonymity, says that “IPTV is essentially a data exchange technology, and it is legitimate, but people have been confused because it is the most commonly used method for content piracy.” He explains that the technology is originally a means of exchanging television broadcast files, but it only becomes a crime when content is broadcast through it that the service providers do not own the rights to, whether it be channels or movies. “Having a server that broadcasts a channel that has the legal rights is not a crime, but the problem is with unlicensed broadcasting,” he adds.

A former official in the Artistic Products Police Department explains to Mada Masr that “the main reason for the illegality of IPTV services is that they contain unpaid channels, and most of the management of these applications broadcasts from outside Egypt.” 

“According to the information we have, those in charge of these applications cooperate with hackers from several countries, most of whom come from England, according to what we have observed,” the source adds.

The Intellectual Property Rights Law 82/2002 and the Anti-Cyber and Information Technology Crime Law 175/2018 regulate the issue of rebroadcasting content over online. Articles 147, 167, 168 and 169 of the first law grant the exclusive right to digital rebroadcasting to authors, production companies and satellite broadcasting bodies, in accordance with the contracts concluded between them.

Article 181 of the same law also criminalizes “publishing a protected work, sound recording, radio program or performance via computer devices, the internet, information or communications networks, or any other means, without prior written permission from the author or the neighboring holder of the right.” The penalty set for the violation is imprisonment for no less than one month and/or a fine of LE5,000 to LE10,000, without prejudice to any more severe penalty stipulated in another law.

The most severe penalty is stipulated in Article 13 of the Anti-Cyber and Information Technology Crimes Law, which dictates imprisonment for no less than three months and/or a fine of LE10,000 to LE50,000 for anyone who benefits unlawfully through the information system network or one of the means of information technology.

Reducing illegal broadcasting to just two people indicates a limited understanding of the complexity of this phenomenon and the scale of the logistical requirements upon which it is based. Illegal broadcasting depends on a complex chain of technology owners and suppliers.

According to several wholesalers and retailers speaking to Mada Masr on condition of anonymity, this chain begins with owners of server infrastructures, on which every type of video content one can imagine is cataloged. These server owners sell access to their database to wholesalers for a certain amount of time, and wholesalers, in turn, sell that access to various retailers. The retailers are the ones who sell directly to customers that watch the content. 

This whole system runs on a credit, or point, system. 

The wholesaler purchases credits from the server owner. Each set of points allows the service to be activated for a specific period. In return, the wholesaler receives a number of codes, which they can later sell to the retailer.

One retailer, an electronics technician, tells Mada Masr that the system consists of the provider, then the big trader, followed by the retailer who buys access to a number of servers from the big trader to make a profit from them, but often does not know the real owner of the server.

Different servers offer different content streams: sports channels, movie libraries or on-demand content. Prices vary depending on server quality and internet speed. Most customers are from Gulf countries, Europe and the United States, and services are advertised through Facebook and other social media platforms. These platforms play a crucial role in promoting the services and directing users to pre-loaded applications and subscription devices.

“Server owners make huge profits, but retailers make little profit, and this is often not their main profession,” says the retailer, adding that most of those arrested so far are retailers, while the server owner or importer is not usually arrested, “and we as retailers don’t even know who made the server.”

Another retailer points out that the server consists of a group of packages, such as Shahid or beIN Sports content, explaining that there are various servers, such as Nova, Hyper and Dolphin. “The best of them of course is Nova, because it does not lose connection at all even in important matches,” the retailer says. “The receiver that runs Nova must have certain capabilities. The RAM size must not be less than 8 RAM.”

Since IPTV providers pay nothing for distribution rights, their costs are extremely low, allowing them to offer vast amounts of content in their packages. These packages often include extensive catalogs of Video on Demand (VOD), along with live channels, at prices that legitimate distributors find difficult to compete with. They also operate without geographical licensing restrictions, offering hundreds or thousands of channels from around the world. Because they are not subject to security limitations, their services can be installed on a wide variety of devices.

Often, the provider does not acquire the content or technology themselves, but rather relies on third parties to steal the content, build the technical platform and maintain it.

In this scheme, the retailer is the point of contact between the consumer and the larger piracy network, as they advertise the services to the public and direct users to the sales interface site, where they can download the application, purchase a device pre-loaded with content or get instructions for accessing the service and making a payment.

“I don’t have as many customers as a wholesaler. I buy 600 points, and when they start to run out, I buy more. The points determine how many devices I can top up. Some devices last a year, some two years, some three and a half years and some five years. A device that lasts three and a half years consumes more than 200 points, sometimes up to 260,” says the second retailer. 

The retailer’s profits are small compared to wholesalers. “I have 270 subscribers, and the profit per user on the server is LE150, but the wholesaler’s profits are much larger,” the source says.

A wholesaler explains the point system to Mada Masr: “The more points I have, the more subscribers I have. The most popular servers are Nova, Hyper, Dolphin, Biscuit, Masrawy, Active, Express and Xdream, and the servers differ in speed and quality.”

“What we know is that the people in charge of the servers are engineers who collaborate with hackers from different countries, including England and China, to provide links to broadcast encrypted channels, and they are the ones who divide the channels. There are wholesalers who do this work,” another wholesaler tells Mada Masr. 

The wholesaler operates discreetly, and their business structure is more complex. Many also act as retailers and may have one or more front companies through which they sell subscriptions directly to consumers. In November 2024, the European Union Agency for Law Enforcement Cooperation (Europol) uncovered a network of wholesalers collaborating to supply dozens of retailers with services, providing IPTV subscriptions to more than two million subscribers worldwide.

In some cases, the wholesaler manages an entire operation, collecting the broadcasts of pirated channels, developing their own technology, and using their servers and software to extract movies and series from the internet for VOD services, but more often than not, part of these functions is assigned or traded to other parties. 

Rebroadcasting is a common practice among wholesalers, and may involve paying money for content or bartering it for packages of other channels. It is difficult, and very expensive, for a single wholesaler to pirate thousands of channels on their own, especially those that do not have much value in the local market, so they resort to bartering or buying to rebroadcast the additional channels.

Conversely, the exorbitant prices of legal streaming services contribute significantly to the continued proliferation of illegal ones, according to the second wholesaler. They note that a three-month subscription to beIN SPORTS costs nearly LE1,900 and only includes sports channels along with a limited number of free-to-air channels. In contrast, IPTV services offer all sports and entertainment channels, including movies and series, at prices far lower than official subscriptions, making them an attractive option for many users despite their illegality.

Hence, the issue of illegal sports streaming remains, given the steady rise in the cost of following sports, which excludes millions of fans from watching a sport that now legally requires subscribing to more than one paid service at an increasing cost.

According to estimates, only 7 percent of the money generated by the biggest European leagues goes back to the game itself, while the remaining 93 percent goes to major clubs, broadcasters and investors. 

As a result, ticket prices continue to rise, subscriptions double, and fans are pushed both off the pitch and off the screen. In the ongoing Champions League, UEFA is distributing a small fraction of its billions to support the game’s wider base, while the lion's share flows to clubs already saturated with money, broadcasters scrambling to recoup inflated rights deals and investors who see sport as just another cash machine. Sports broadcasting rights have become a global industry worth over $60 billion annually, and the higher the fees for these rights, the greater the pressure on broadcasters to recoup their investments.

The effective result is simple and harsh: higher subscription prices and the fragmentation of tournaments among multiple packages. Fans who used to be sated with a single cable bill are now forced to subscribe to three or four different streaming platforms, or to pull away from watching altogether.

This is the reason the number of consumers of pirated content has increased. In a survey conducted in February 2017 by the British market researcher YouGov regarding “the percentage of consumers who pirate content more than once a week,” in which 25,738 people from 30 countries participated, 23 percent of Egyptian participants admitted to watching live sports events via pirated broadcasts, placing Egypt second after Portugal.

Overall, 16 percent of Egyptians surveyed admitted to watching pirated content more than once a week. 

Piracy is also competing with content production companies operating in the Egyptian television and content creation market. In August 2024, Statista, a German market and consumer data company, estimated the market size at approximately $1.05 billion in 2023, with projections indicating growth to $1.43 billion by 2029.

Understanding this market and the amount of money it generates, along with the complexity of the service supply chain within it, highlights an important paradox: reducing the largest illegal sports broadcasting network to just two people seems illogical.

November 18 saw a detention renewal session for Mostafa and Mamdouh in the South Giza Court. Outside courtroom number five, a number of lawyers gather daily, waiting for the clerk to call out the defendants' names for the renewal hearings. He called out names, without any order, from various areas of Giza Governorate. In about an hour, the clerk had called out the names of ten defendants. 

Each defendant entered accompanied by one lawyer, but when he called Mostafa and Mamdouh's names, about five lawyers came forward to attend the hearing with them.

About five minutes later, two lawyers came out of the courtroom. One of them tells Mada Masr on condition of anonymity that “the investigations are unclear. This is something the investigating authorities have never encountered before. That’s why it’s unclear to them. Mamdouh has no authority over the website, and he doesn’t have the username or password. And the questioning in Sheikh Zayed shows they didn’t understand this. When the case was referred to the Economic Affairs and Money Laundering Prosecution, they referred it to an IT expert to write a report.”

“My clients’ detentions have been renewed since late August, each renewal for 45 days. The officer who arrested them doesn’t understand the situation. The simplest thing is there’s no data on the laptops. A channel like this needs massive servers, an entire building with servers, and none of that is in the case. Not a single server was seized. At the time of their arrest, the website was online,” the lawyer explains.

“The money laundering charges haven’t been proven. There’s a clear disconnect between the Sheikh Zayed Prosecution and the Economic Court. The money laundering prosecution is the one investigating. The investigations in this case are unserious and lack even the most basic technical expertise. I expect my client to be released, and the case will end with a fine for operating a website without a license,” the lawyer continues.

Regardless of the nature of the relationship of the defendants in this case to the StreamEast network or their responsibility for it, closing the platforms and arresting those in charge does not seem to be a sufficient solution. The issue is deeper than just chasing websites. When sports become an expensive commodity for its audience, pirated broadcasting turns from a crime into a normal choice.

What drives people to piracy is not greed, but exclusion. The exclusion of millions from following the sport they love because they cannot afford it.

This is why illegal streaming platforms keep popping up and operating. “We had the previous StreamEast — targeted by US Homeland Security Investigations in 2024 — and then obviously a bunch more copycat sites came up,” Knapp toldThe Athletic. “The most recent StreamEast, the one the Egyptian authorities took down, was a copycat site. But it was the biggest, with an audience of 136 million global users every month.” 

“When we take one down, five more will come up or more, because folks have that brand recognition,” she adds.

Knapp recalls a conversation she had with her son after he saw the news and wondered if the “real StreamEast” had actually been taken down. She says, “I analogized this to him. So when you say, ‘Hey mom, my nose is runny. Can you gimme a Kleenex?’ Kleenex is a brand. What you actually mean is tissue, and this is StreamEast.”