Anti-piracy techniques described herein are performed on a server that includes one or more processors and a non-transitory memory. The server enters a state to accumulate a portion of a bitstream extracted from parts of a clip obtained from a pirate service. The server then identifies a set of suspected piracy devices for the piracy service based on a confidence score of suspected piracy calculated for each client using the accumulated portion of the bitstream exceeding a threshold set relative to the state. The server additionally determines whether or not the set of suspected piracy devices for the pirate service satisfies a stable collusion state criterion corresponding to the state. The server enters a next state to iteratively perform the accumulating and the identifying upon determining the set of suspected piracy devices for the pirate service not satisfying the stable collusion state criterion corresponding to the state.