The origin was a costume
Author
Sma Das
On this page
Objective
The original question was not 'is piracy bad.' It was whether a specific pipeline exists: easy living-room access, SuperBox-class prepaid hardware and Cineby-class hydra catalogs, feeding botnet capacity, cash, or credential theft, with adversary-subsidized compute or tasked brands sitting behind it. I wanted to know if frustrated cord-cutters were being recruited into a collection surface, and whether Beijing, Moscow, or Pyongyang had a hand on the SKU.
That is a national-security question asked of a commercial market. I kept the constraints I started with. Public OSINT only. No logins, no streams, no origin probes, no exploits. Hosting country is not operator nationality. Operator nationality is not tasking. I am not going to write a ministry caption because a board was made in Shenzhen or a domain sat on a St Petersburg host in 2025.
Method
I treated brand pages, USTR lists, and regulator PDFs as claims to test, not as findings. For each object I opened the first-party record that could kill the claim: FCC internal photos, USPTO assignments, EGRUL, RIPEstat historical WHOIS, Dutch BAG, RDAP, AGCOM determinas, MPA and RIAA nomination PDFs, the USTR list, DDoS-Guard's Russian AUP, Videasy's live docs, and a GET of fmovies.gd. Where a lab teardown already existed I credited it and did not pretend I reversed the sample. Plume SuperProxy is theirs. Google on BADBOX is theirs. I opened what they did not put next to each other, and what my own earlier notes had taken at face value.
Languages followed the evidence. Italian for AGCOM. Russian for Dialogue-M and the DDoS-Guard AUP. Dutch for KvK and BAG. Chinese for Sword Net and the EVPADPro aisle. English for FCC, USPTO, USTR, MPA, Plume, FBI. Date lock is 29 August 2026 unless a cited instrument is older.
I used four labels on purpose. Established means I opened the primary. Corroborated means two independent primaries agree. Alleged means a stakeholder said it. Inferred means I am joining established facts and saying so. Unsupported means I will not print it.
Stage 1. The pipeline is real. The ministry SKU is not.
This stage is the negative I had to clear before anything else mattered. SuperBox is a prepaid Android player with a privileged private store and a MAC leash. Cineby is a browser hydra. Magis is an APK plus credits, on USTR's list. Videasy is a no-auth iframe factory. Those are parallel on-ramps, not one control plane. Plume showed that a tested SuperBox S6MAX was quiet until the custom store and Cyberflix, then io.popanet enrolled a commercial residential proxy and other people's sessions went through the house. Store auth is device JSON, MAC and model. It is not a user-password vault.
GTIG saw 550 tracked groups using IPIDEA exits, including China, DPRK, Iran, and Russia clusters. The verb is using. SuperBox is not the OEM. Volt Typhoon and QTFY are real. They live on end-of-life SOHO, cameras, NAS, Fastlink. I opened AA24-038A. EoL Cisco and NETGEAR as multi-hop C2. Not Blue TV. DPRK cash on the official page is crypto, IT workers, gambling sites. Manbang is a leash on their own people. Burma's documented digital cash is scam compounds. None of that is a SuperBox SKU.
So thesis 1.1, a named service tasked these brands as a collection platform, stays unsupported. Thesis 1.2, criminals run the market and states can buy the exits, holds as an emergent market. That is not the novel part. That is the floor. The novel part is what happened when I stopped believing the captions on that floor.
Stage 2. I opened the 2026 origin. It was a ghost.
I had been writing AGCOM 163/26 as if Dialogue-M in Orsk were a live 2026 hosting shop for cineby.at. The Italian PDF prints three facts: Registrar.eu for Active Media, Zaltbommel; hosting that appears to be Ddos-guard Corp., Belize; servers attributed to DLM.Сеть, Dialogue-M Ltd., Mira 23, Orsk. I took the third sentence as geography. Then I opened the company.
Rusprofile for ООО «Диалог-М», INN 5615003044. Wired ISP. Brand DLM.Сеть. dlm.ru. Liquidated 17 May 2023. Ufanet took the subscribers in February 2022. Wayback is a local ISP homepage. RIPEstat historical WHOIS for AS44556:
AS44556 until 2022-10-03 org=Dialogue-M, Ltd descr=DLM-NET
AS44556 from 2022-10-03 org=DDOS-GUARD LTD name=IQ-NET
95.129.232.0/21 announced AS57724 allocated DDoS-Guard
EGRUL 2023-05-17 ООО Диалог-М ликвидированаWhoIsMind still spits Dialogue-M and Orsk. IPinfo prints Rostov and DDoS-Guard. AGCOM matched the stale card. I will not write GRU-in-Orsk because CARR's Pankratova also has an Orsk address. Different street. Different person from Media Land's Pankova.
Unpaid KvK search does not show Active Media at Zaltbommel. Kadaster lists Stationsweg huisnummers 4, 6, 18, 26, 28. PDOK for huisnummer 172 is zero. The street number on the WHOIS card is not a door. cineby.sc, created 25 March 2026, reprints org Active Media, Gelderland. I did not buy a paid uittreksel. On the free record this is a costume.
What recurs is the registrar 159/25 already named for cineby.gd: Immaterialism Limited, IANA 710008, 'for an unidentified subject.' I ran RDAP on other hydras. Same registrar on hydrahd.cc, hydrahd.io, hdtoday.tv, flixbaba.tv, vidsrc.me, bitcine.tv. Admin contact on njalla.is is IMMATERIALISM LIMITED. I searched AGCOM for a second Dialogue-M hydra. I did not find one. The Orsk plus Zaltbommel triad is unique. The privacy-reg is a class.
159/25 still stands for cineby.gd in November 2025: Cloudflare told AGCOM origin hosting appeared to be Media Land LLC. That is a listed-BPH customer fact for that domain and date. 163/26 does not keep Media Land. I had left Media Land as the forever origin. That was wrong too.
Stage 3. I opened the FCC photos. SuperBox is a silkscreen.
I had been calling SuperBox Amlogic-class Android TV because Manbang was an Aisat S805 and the cheap pirate boxes live in that world. Then I opened 2A8W5S6MAX internal photos. The die print is ALLWINNER H618. A stick antenna in the same exhibit is labeled NO Transmit. Brown Fine's S6 Pro sample reports hardware sun50iw9p1. That is the H6x family. The 2A8W5 family letters treat several SKUs as the same PCB with a model stamp. I was wrong, and the photos are not ambiguous.
FCC 2AZCT-T95MAX-H618, Shenzhen Nanxiangzi, is the same H618 die family. HUMAN and Google already talk T95/X96 uncertified AOSP as BADBOX hardware. Google says the enterprise buys boxes and flashes AOSP. SuperBox is unnamed. Flashers are not BAODE. Williams's Manbang unit remains Aisat S805, KCTV on the tiles. Different generation. Shared die family is not shared operator. It is a shoppable board class. I had flattened three captions onto one chip house. The photos split them.
USPTO assignment 8557/0986: Bryan Wong assigned SUPERBOX to TAIS on 22 August 2024 for one dollar. The radio grant did not move. 47 C.F.R. § 2.929. EVPADPro sells 易播, 安博, 小雲, and SuperBox in one catalog. Reseller aisle, not a common officer. IIPA's China PD-export list still does not name SuperBox.
Stage 4. I opened who got listed. It was not the years-on-LAN SKU.
Inside MPA's 2 October 2025 nomination PDF, MagisTV is PRIORITY illegal IPTV. magistv.ai had 44,645 visits in the month they printed. The working sentence is the trademark story. Same file, Cineby.app: 68.8 million monthly visits, 37.6 percent of traffic from the United States. Videasy.net: 163 sites, 314 million visits. USTR's March 2026 list has MAGISTV. It does not have Cineby. It does not have Videasy. USTR page 1 says illustrative examples, not a census, not a legal finding.
I grepped SuperBox, vSeeBox, Vidking, TAIS, BAODE across MPA 2025, IIPA 2026 China, the 232-page IIPA compilation, IIPA's 2025 NML comment, Simpletv, LALIGA, and IBCAP. Zero. DISH is on IBCAP's member roll. DISH did not nominate SuperBox. DISH sued a California seller, C.D. Cal. 8:25-cv-01482, prepaid box at about $329 to $429. TAIS holds live US registration 6224165 SUPERBOX. Magis's US wordmark died on 21 July 2025 for no Statement of Use. USTR still listed MAGISTV. Twenty-one docket attachments 403'd. A SuperBox string could hide in BCI.
29 August 2026 I fetched videasy.to/docs. HTTP 200. Still no-auth. JS still dates a 15 September 2026 shutdown. Delhi CS(COMM) 1009/2025 names VidSrc. UEFA CS(Comm) 106/2026 names Streamed. videasy and vidking are zeros in those orders and in AGCOM 163/26. MPA had already pointed at Videasy. USTR printed MegaCloud instead. ACE can hit a factory. They hit a different one. fmovies.gd the same day 301'd to cineby.at. The 2024 Hanoi Fmovies case is two named people and MGID. I am not carrying that invoice onto the 2026 skin.
I opened DDoS-Guard's Russian AUP because USTR says the firm ignores takedowns. §2.2.4 forbids пиратство. §5.2 and §5.6.4 require a 149-FZ court order or state-body act before a complaint is accepted. That is a statutory gate, not only reputation. EU 2026/1714 lists Media Land for LockBit, EvilCorp, BlackBasta, involved in, Art. 3(3)(b). Impuls on the same annex is owned by a GRU 29155 officer. Different verbs. Cineby is unnamed in 1714. A 2025 Cineby domain sat on a host the Union later listed for ransomware BPH. A 2026 Cineby domain sat on a CDN USTR listed as pirate BPH. I will print that. I will not print GRU runs Cineby.
Conclusion
The pipeline I set out to test exists as a commercial enrollment surface. A prepaid HDMI box with a privileged store can become someone else's exit after a catalog app. A hydra bookmark can sit on listed BPH and unlisted CDN without a named operator. States use residential-proxy exits as customers. They task SOHO routers when they want last-mile C2. They did not need to task Blue TV. DPRK did not productize Hollywood on a brick. Burma's digital cash is scam compounds. Those negatives are real. They are not the paper.
The needle is this. The public objects we use as 'the Russian origin' and 'the unique SuperBox appliance' do not survive first-party opens. AGCOM's 2026 origin is a liquidated Orsk ISP and a Dutch house number that does not exist. SuperBox is an Allwinner H618 white-label with a dummy antenna, same die family as T95MAX boards already in the uncertified-AOSP inventory, sold in the same overseas aisle as 安博. The living-room SKU built to sit on a named LAN for years, gated by MAC, was never nominated to the list that caught Magis on a trademark story. The iframe factory MPA named was omitted. The bookmarks were the defendants.
If you hunt ministries in brand names and regulator origin lines, you miss the durable stack: white-label AOSP board, privileged store, privacy-reg hydra skins, BPH and CDN landlords. That is where Plume's exit sits. That is what still enrolls homes after hops, listings, and shutdown calendars. I infer commercial recruit of a low-admin household, and tolerate of pirate tenancy on roofs already described as ransomware BPH. I do not infer task. The grandmother copy and FBI I-031226's free-sports class describe the same household. The Bureau did not name the brand. Plume did not print the 0x1001 payee. Those holes stay holes.
What I will not print
- Russia or China subsidizes SuperBox or Cineby.
- PLA, MSS, GRU, or FSB tasked those brands.
- Dialogue-M is a live 2026 Orsk BPH.
- Active Media is a Dutch trading firm at Stationsweg 172.
- SuperBox is Amlogic.
- SuperBox is BADBOX.
- 1714 means GRU runs Cineby.
- 2024 Fmovies is Cineby.
- SuperBox Inc commissioned Popanet.
- SuperBox is a password vault.
Kill conditions
- A 2026 RIPE object still named Dialogue-M on cineby.at's prefix.
- A KvK extract putting Active Media at Stationsweg 172.
- A later FCC exhibit that the S6MAX die is Amlogic.
- One public USTR-2025-0018 comment that nominates SuperBox, or a 2026 NML row for Cineby.
- A Videasy-named order, or a 15 September death with no 301 onto the same stack.
- A printed 0x1001 value identifying SuperBox Media as payee.
- A 1714 reason that names Cineby, or a Media Land count for IPTV.