Italian police dismantle CINEMAGOAL piracy app used to access Sky, DAZN, Netflix, Disney+, and Spotify

Italian authorities have dismantled a large audiovisual piracy network built around CINEMAGOAL, an app that gave paying users unauthorized access to major streaming services.

The operation was led by the Guardia di Finanza in Ravenna under the direction of the Bologna Public Prosecutor’s Office. According to Reuters, investigators estimated about €300 million in damages to rights holders, including Sky, DAZN, Netflix, Disney+, and Spotify.

The crackdown, known in Italy as Operation “Tutto Chiaro,” involved searches and seizures across Italy, with coordinated actions in France and Germany. Police also identified the first 1,000 users, who face administrative fines ranging from €154 to €5,000.

CINEMAGOAL was not a typical IPTV service

Investigators described CINEMAGOAL as more advanced than a normal illegal IPTV service. Instead of simply redistributing a pirate video feed, the app connected users to foreign servers that decrypted content from legitimate subscriptions registered under fictitious identities.

The Next Web reported that virtual machines in Italy captured active subscription codes every three minutes and relayed them to paying users almost in real time. That design allowed customers to watch content without connecting directly to the streaming platforms.

The system allegedly made detection harder because a user’s device did not appear as a direct viewing endpoint for the original streaming provider. This was one of the features resellers reportedly used to market the service as safer and harder to trace.

Item	Details reported by investigators
App name	CINEMAGOAL
Operation name	Tutto Chiaro, or All Clear
Lead agency	Guardia di Finanza, Ravenna
Judicial authority	Bologna Public Prosecutor’s Office
Countries involved	Italy, France, and Germany
Estimated damages	About €300 million

How the piracy system allegedly worked

The CINEMAGOAL setup relied on a chain of legitimate-looking accounts, virtual machines, foreign servers, and end-user devices. Investigators said the system captured original access codes from lawful subscriptions and retransmitted them to users as decrypted streams.

BleepingComputer reported that police seized CINEMAGOAL servers in France and Germany containing the app’s source code and functions used to decode protected streams. The operation was coordinated through Eurojust.

This structure helped the operators sell access to several platforms through one illegal subscription. Users could reportedly choose service packages and pay a much lower annual price than legitimate subscriptions would cost.

• Users installed the CINEMAGOAL app on their devices.
• The app connected to servers outside Italy.
• Virtual machines captured valid access codes from legitimate subscriptions.
• The system refreshed and retransmitted those codes every three minutes.
• Paying users received unauthorized access to protected streaming content.

More than 70 resellers sold annual packages

The service reached customers through a reseller network across Italy. Investigators identified more than 70 people who allegedly distributed access to the illegal platform.

Annual subscription packages reportedly cost between €40 and €130, depending on the services included. Payments were handled through cryptocurrency, foreign accounts, or accounts registered under fictitious names.

Reuters reported that proceeds moved from resellers to the main operators behind the infrastructure. Police also found traditional illegal streaming devices, known in Italy as “pezzotto,” during the investigation.

Network element	Reported role
Core operators	Managed the technical infrastructure and received part of the proceeds
Resellers	Sold access packages to end users across Italy
Foreign servers	Supported stream decryption and app operations
Virtual machines	Captured and retransmitted active subscription codes
End users	Paid for unauthorized access and now face possible fines

Police carried out searches across Italy, France, and Germany

The operation included more than 100 searches and seizures. Italian media reported that more than 200 financial police officers took part in the enforcement action.

Sky TG24 said the case began with social media monitoring and led investigators to thousands of people connected to the illegal service. The same report said the first 1,000 identified subscribers are set to receive fines between €154 and €5,000.

The investigation remains ongoing. Forensic analysis of seized servers, devices, payment records, and app source code could identify more users, resellers, and financial beneficiaries.

Why the case matters for streaming platforms

The CINEMAGOAL case shows how piracy services have moved beyond basic IPTV playlists. Modern operations can combine app development, credential misuse, cloud infrastructure, anonymization, reseller networks, and hard-to-trace payment methods.

For streaming services, the alleged use of legitimate subscription codes creates a different problem from simple content rehosting. Platform defenses must detect abnormal account behavior, suspicious code reuse, unusual device patterns, and near-real-time retransmission activity.

The estimated €300 million damage figure reflects lost subscription revenue across several major services. The affected platforms named in reports include Sky, DAZN, Netflix, Disney+, and Spotify.

Platform category	Why pirates targeted it
Sports streaming	Live sports subscriptions carry high demand and high resale value
Film and TV streaming	Users seek access to several paid catalogs through one cheap illegal app
Music streaming	Bundled access makes the illegal package look more valuable
Pay-TV content	Premium channels and live events make piracy packages easier to sell

Users could face fines, not just service shutdowns

The case also targets customers, not only operators. Authorities identified the first 1,000 users and plan administrative sanctions ranging from €154 to €5,000.

BleepingComputer noted that more users may be identified as investigators examine seized data. That could include subscription records, payment trails, app logs, and reseller communications.

This is a key warning for consumers who treat illegal streaming apps as low-risk. A cheap subscription can still leave payment records, device evidence, reseller chats, and server-side traces.

Charges under investigation

Authorities are investigating possible offenses linked to audiovisual piracy, unauthorized access to computer systems, and computer fraud. The case remains in the preliminary investigation stage, so criminal liability will depend on judicial proceedings.

Sky TG24 reported that the Guardia di Finanza found an “innovative” system for accessing paid content through the CINEMAGOAL app. Investigators also found traditional piracy devices during the same enforcement activity.

That hybrid setup matters because it suggests operators were using both new and old piracy models. The app-based system offered more technical sophistication, while the traditional “pezzotto” model remained part of the wider market.

• Audiovisual piracy
• Unauthorized access to computer systems
• Computer fraud
• Distribution of unauthorized access to protected content
• Financial flows through cryptocurrency and foreign or fictitious accounts

Operation All Clear shows piracy enforcement is expanding

Streaming piracy investigations now look more like cybercrime operations than simple copyright cases. Investigators must track servers, virtual machines, code, accounts, payment channels, social media marketing, and reseller networks.

The Next Web described CINEMAGOAL as an unusual system because it relied on active credentials from legal subscriptions rather than a normal pirate content library. That technical model could push platforms and law enforcement agencies to focus more closely on account abuse and infrastructure monitoring.

The Italian operation also shows that authorities may pursue users when they can link them to illegal services. For streaming platforms, the seizure of source code and foreign servers could provide more information about how these networks operate and how similar systems can be disrupted faster.

FAQ