An AI scanner flagged 802 pirate Telegram channels. Half are already gone
Photo: Иллюстрация vpnlab.io
Researchers from Louisiana State University and the University of Texas at Arlington have built a scanner that finds pirate video channels on Telegram while they are still new, and they have published the code. Over two months the tool probed 249,133 freshly created channels and flagged 802 of them as piracy, most of them less than five days old. Together with linked channels and bots, 1,101 reports went to Telegram and to rights holders. Two weeks later 524 of those were gone.
How the scanner works
The interesting part is not the model but the pipeline around it. Candidates are found by asking a search engine for pages on t.me that mention a film or series title, drawing the titles from a public movie database of roughly 248,000 films and 141,000 shows. From each channel found this way the crawler expands to the channels it links to, two steps deep. Everything it collects is public: channels anyone can open without an invitation.
Classification is done by a language model running locally, not by a cloud service. The research pass used a 27-billion-parameter model and identified whether a post constituted piracy with 99.2 percent accuracy; the live tool runs a distilled model of about one billion parameters at 98 percent accuracy on the yes-or-no question. That size matters more than the percentage. A model that small runs on an ordinary laptop, which means the whole apparatus of discovery, classification and reporting no longer requires a company behind it.
What the census of the ecosystem showed
Alongside the live scanner the team mapped the ecosystem itself, from December 2023 to January 2026: 1,057 channels, around 209,000 posts, 19,033 distinct titles, of which 14,632 films and 4,401 series. Posts on 983 of those channels accumulated 4.85 billion views. The paper also carries an estimated damage figure of 17.49 billion dollars, and that number deserves a warning label: it is built on an assumption that one percent of views equals actual consumption, so it is a modelled estimate rather than a measurement, unlike the channel counts.
The structure is more telling than the totals. The channels are served by bots split by function: delivery, search, promotion and user uploads. Monetisation runs through credits for downloads, paid higher-quality versions and Telegram's own payment interfaces. Part of the trade is not films at all but access itself: shared VPN and proxy accounts, mirrors and modified streaming apps sold as a service. The scanner treats that behaviour as one of its signals.
- Data collection: 1,057 channels and roughly 209,000 posts are catalogued, and a taxonomy of piracy behaviour is built from them.
- The live scanner probes 249,133 newly discovered channels and flags 802 piracy channels, 299 connected channels and 108 bots.
- Reports go to Telegram and to 17 major US rights holders; 14 of them confirm receipt.
- 524 of the 1,101 reported channels are inaccessible, and individual flagged posts are removed on top of that.
Why this matters beyond piracy
Strip out the subject matter and what remains is a general-purpose machine for finding and reporting public channels at scale. The crawler does not know what piracy is; it knows how to enumerate channels and hand each one to a classifier. The classifier's behaviour is set by a written description of what to look for. Change that description and the same pipeline hunts channels about a war, a protest, a religion or a minority, at the same cost and the same speed. The code is public, so the cost of building it again is now a weekend rather than a budget.
The second half of the result is just as important as the first: reporting works. More than half the reported channels disappeared within two weeks, without any court involved. That is the part worth remembering when the same technique is aimed at something other than films. A pipeline that produces plausible reports faster than humans can review them turns moderation into a numbers game, and the side with automation wins it by default.
About accuracy. Two human coders reviewed 1,000 posts and found four legitimate ones marked as piracy. As a rate that is 0.4 percent, which sounds like nothing until it meets scale: at a quarter of a million channels scanned in two months, a fraction of a percent is measured in hundreds of wrong flags, each of them somebody's channel. Automated detection does not remove the error, it just moves it out of sight.
What it means if you run or read a channel
Two practical facts follow from the method. A public channel is discoverable even if you never advertised it, because handles can be guessed and links can be followed from anywhere. And a channel is not an archive: the study measured how quickly reported channels stop opening, and the answer was days, not months.
- Treat a public channel as a broadcast, not as private space. If the material would be a problem in the wrong hands, the channel is the wrong container for it.
- Keep anything you cannot lose outside the platform as well. Whatever the reason for a takedown, the recovery path is the copy you made yourself.
- If you rely on someone else's channel, save the material that matters to you now, not when the link stops working.
- Remember that reports work by volume. A channel can go down over a mistaken flag as easily as over a real one, which is an argument for having a second route to your audience.
The researchers built their tool against an ecosystem that is genuinely commercial and genuinely large. That is a fair target, and the takedown numbers show the method works. The uncomfortable part is that it works equally well for anyone else, and the deciding factor is no longer capability but who points it at what.
