The BeStreamWise anti-piracy campaign run by Sky, Premier League, FACT, ITV, CrimeStoppers, and the UK Intellectual Property Office, aims to deter piracy by linking illegal streaming services with criminality and malware. In an ironic twist, multiple security vendors are flagging the campaign's website for suspected suspicious activity. On closer inspection, this unusual and unlikely situation may pre-date the campaign's official launch.

The launch of the BeStreamWise online anti-piracy campaign early October was preceded by action in the ‘real’ world.

After being offered free lifetime subscriptions to a new streaming service from a pop-up stand in London’s Paddington Station, commuters were encouraged to sign up to ‘MalStreams’ using their real personal details.

Shortly after, a ‘scam’ was revealed; MalStreams didn’t exist but participants had been given a valuable lesson in security. Handing over personal and credit card details to strangers can be more dangerous than people think. Handing over financial details for a lifetime of free service suggests that some people don’t even think at all.

Run by Sky, Premier League, FACT, ITV, CrimeStoppers, and the UK Intellectual Property Office, among others, the campaign aims to raise awareness of the potential risks of using illegal streaming services.

Handing over personal and financial information to strangers can have unexpected consequences, as the ‘customers’ of MalStreams quickly discovered. The same applies when people install streaming apps offering premium content for free. Football matches and movies for nothing may sound attractive, the campaign explains, but exposing devices to the risk of malware infection is something few people want.

Further details on malware risks are available on the BeStreamWise website, at least for those able to access it right now.

BeStreamWise.com Blocked For Security Reasons
After being informed that BeStreamWise.com was ‘down’ last evening for no obvious reason, some quick tests revealed a curious situation. The site could be accessed as normal using a VPN but without one it simply wouldn’t load.

Hoping to find out who, if anyone, was blocking the site, a few network tests revealed that requests were being blocked before even escaping the LAN. The culprit was found in one of the routers where for the first time in over a year, a site had triggered blocking measures on non-VPN outbound traffic.
According to the AI protection service supplied by Trend Micro, the domain had been blocked for phishing. A subsequent test on the Trend Micro global portal returned the same result, with the following detail: Fraudulent sites that mimic legitimate sites to gather sensitive information, such as user names and passwords.

Since so-called ‘false positives’ are not unusual, checking with other security vendors can help to shine a light on situations like these. Unfortunately, that failed to clear things up as expected, at least not initially.

Multiple Security Vendors Report Malicious Behavior
Subsequent tests revealed that Avira had also flagged BeStreamWise.com for phishing, CDRF and CyRadar had settled on malicious, while AlphaMountain simply reported suspicious activity.

Thanks to its bold layout, however, URLScan.io quickly provided information that may explain why BeStreamWise was flagged for suspected phishing, which entity it was believed to be masquerading as, and who vendors may have been trying to protect.
TorrentFreak has been wrongfully categorized as a media-sharing platform on more than one occasion, which led to readers being prevented from accessing the site via public WiFi services on more than one occasion.

In 2018, Comcast erroneously blocked TorrentFreak for being ‘suspicious’ and in 2013, customers of Sky were unable to access the site after an exploit placed us on the UK’s pirate site blocking list.

So to summarize, watch out for malware but remember that not all reports of malware are accurate. Also be aware that when pirate apps receive a clean bill of health following a malware scan, in a worrying number of more recent cases that can mean absolutely nothing. Not exactly a comfort, but reality nonetheless.