Research
Threat research and exposure reports built on what Modat Magnify sees across the open internet.
Stadium of Shadows: Inside the IPTV Piracy World
On the night of June 11, a billion people watched the 2026 FIFA World Cup opening match, but millions did so through a shadow ecosystem of pirate panels, burner domains and rebranded apps, paying a fraction of what licensed broadcasters charge. The money flows to organised crime. In the days around kickoff, we went inside the infrastructure powering that parallel feed. This is what the pirate stadium looks like from the inside.
Read →
Scammers Target Dutch Taxpayers in Seasonal Phishing Surge
Phishing attacks targeting Dutch taxpayers are evolving, using advanced techniques and fake Belastingdienst pages. Modat's findings highlight a shift to interactive scams, with a growing focus on stealing cryptocurrency and other high-value digital assets.
Beyond the Blackout Narrative: How Internet Infrastructure Is Reshaped During The Middle East Conflict
Internet "blackouts" during conflict are not full shutdowns but structural transformations. Analysis shows three patterns: Iran restricts access, Israel expands deceptive infrastructure, and Gulf states stabilise while redistributing systems.
Neutralizing the Watchdog: Automated Security Removal in a Modular Cryptomining Campaign
A cryptomining campaign recently uncovered by Modat, working alongside Recorded Future, demonstrates a high level of modular efficiency that poses a direct threat to organisational infrastructure.
Internet-Exposed RTSP: A Global Analysis
Nearly a million RTSP video services are exposed on the open internet, most without authentication. Of 973,819 active services across 210 countries, 8,074 streamed live video with zero credentials required, including thermal sensor arrays and systems co-located with SCADA dashboards.
Moltbot Unmasked: A Global Deployment Analysis
mDNS discovery, internet-facing control interfaces, and open directory leakage: an analysis of Moltbot deployment security across thousands of internet-exposed instances.
Exposed to the Bare Bone: When Private Medical Scans Surface on the Internet
Over 1.2 million healthcare devices and systems are available on the open internet, exposing MRI scans, X-rays, and patient records due to misconfigurations and weak credentials.
Modat Magnify Feature Findings
Our Feature Finding series is designed to empower cybersecurity professionals to help them get ahead of cyber attacks. Our findings are done by our in-house research team using access to the largest Device DNA set available to find and then conduct further research.
Doors Wide Open: hundreds of thousands of employees exposed; thousands of organisations physically vulnerable
Research: 50K internet-exposed Access Management System misconfigurations detected across multiple industries and countries, indicating a global security issue.
Mopping up after leaky buckets: the rising tide of spilled secrets
An empirical analysis of secret leaks in cloud buckets and responsible disclosure outcomes. Most data leaks don't happen because of criminals breaking in: they happen because of misconfigurations, oversights, and lax system administration.
Knock, Knock, I'm Coming In. Addressing the Gray Area on the Ethics of Internet Scanning
If I leave my house unlocked and unprotected, is that an invitation for you to come in? A look at the ethics of internet scanning through the lens of a neighborhood, and why intent, not just action, is what matters.