Three Second-Hand Fire Sticks From a Car Boot Sale: What Was Really Inside

A very British experiment

There is a particular kind of optimism at a UK car boot sale on a Sunday morning. You are looking for a spare HDMI cable, maybe a fondue set, and instead you find a Fire TV Stick in a sandwich bag with a handwritten label that says 'fully loaded'. It costs less than a takeaway. The seller assures you it has 'everything on it'.

We have all seen these listings. They pop up on Facebook Marketplace, at market stalls, and in WhatsApp groups. In 2026, the pitch is usually some variation of 'no monthly fees' or 'all channels'. So we bought three: one from a car boot sale in the Midlands, one from a Facebook Marketplace seller who met us in a supermarket car park, and one from a market stall that also sold phone cases and dodgy charging cables. We did not enter any personal credentials. We tested them on an isolated network and documented what was installed.

This is not a moral panic. It is a buyer's guide to what 'fully loaded' really means.

What we bought

All three were Amazon Fire TV Sticks, two older generation models and one newer 4K unit. Prices ranged from £25 to £55. Each seller used the same language: 'ready to go', 'no setup', 'all the apps'. One came with a handwritten note listing a Wi-Fi password and a warning not to update anything. That was our first clue.

Out of the box, each stick booted into a custom launcher rather than the standard Fire TV interface. The launchers looked vaguely professional but had misspelled menu items and icons that did not match the official app logos. One had a 'Live TV' section, a 'Movies' section, and a 'Sports' section. Another had a '24/7' folder. None of these are official Amazon categories.

The app drawer archaeology

We went through each device's installed apps. The pattern was consistent. There were a handful of legitimate apps — YouTube, a mainstream catch-up service, a music app — presumably installed to make the device look normal. Then there were the sideloaded APKs: IPTV players, file managers, downloaders, and apps with generic names like 'Player Pro' or 'Stream Hub'.

Some of these apps are not inherently illegal. IPTV players are legitimate tools. But the configuration around them matters. Two of the sticks had playlists and login details pre-loaded. One had a shared username and password for a major streaming service saved in a third-party app. That is a red flag for account compromise: shared credentials are exactly the kind of thing that gets reused, leaked, or resold.

One stick had developer options enabled and an unknown app with device administrator permissions. Another had a sideloaded app store that could install updates without going through Amazon's review process. That is how a device can quietly gain new software long after you bought it.

What was phoning home

We did not need sophisticated tools to see strange behaviour. On our isolated network, two of the sticks made DNS requests to domains that had nothing to do with Amazon or the official apps. One repeatedly contacted an IP address in a different country. Another tried to establish connections on unusual ports. We cannot say definitively what every connection was for — some could be analytics or app updates — but the pattern was not typical for a clean streaming device.

The practical risk is straightforward. A pre-owned stick can carry:

• Shared or stolen logins for streaming accounts, which may get you locked out or breach terms.
• Sideloaded apps with broad permissions, including access to the local network.
• Payment details if you ever enter them into a compromised app.
• Malware or unwanted software that survives a casual factory reset if the seller has configured persistence.
• A device that phones home to unknown servers, adding your household to someone else's botnet or analytics pool.

For a UK household, the biggest immediate risk is account compromise. If a shared login is used across a family's email, shopping, or streaming accounts, a seller or another buyer could trigger password resets, lockouts, or fraudulent purchases.

Where the legality line sits

This is where plain English helps. Buying a streaming device is legal. Installing a legitimate IPTV player is legal. What is not legal is accessing copyrighted content without the rights holder's permission. If a device is pre-loaded with apps and playlists that provide premium channels, live sports, or new-release films without a licensed subscription, that is the line.

There is also the terms-of-service line. Sharing a Netflix or Disney+ password outside your household may breach the provider's terms. Selling a device with someone else's login pre-installed is worse: it is a account security problem and a terms breach, even before any copyright question. And if a seller is advertising 'all channels' for a one-off fee, ask yourself where the licence is. If there is no clear provider, no billing relationship, and no legal entity, the answer is usually uncomfortable.

None of this is legal advice. But as a consumer, the safe rule is simple: if the convenience depends on someone else's account or a mystery playlist, it is not a bargain. It is a liability.

The 'set up properly' alternative

Here is the frustrating part: the convenience these sellers promise is not that hard to build legitimately. A clean Fire TV Stick, a Roku, an Apple TV, or an Android TV box can give you a tidy streaming setup without the mystery meat.

Start with a factory reset if you bought second-hand. Better still, buy new or from a reputable refurbisher. Sign into your own Amazon account, use the official app store, and install only apps from known publishers. If you want live TV, use a licensed IPTV service with clear billing and terms, or a free-to-air app like BBC iPlayer, ITVX, Channel 4, or My5. Use your own logins, enable two-factor authentication where possible, and never let a seller set up your accounts for you.

A few practical habits make a big difference:

• Put the stick on a guest Wi-Fi network if your router supports it, at least until you trust the device.
• Check the app list and remove anything you did not install.
• Keep the device updated through official channels.
• Use a password manager so shared logins never become a habit.
• If a deal sounds too good and the seller will not explain how it works, walk away.

The verdict

Our three car boot sticks were a masterclass in false convenience. They looked ready to go, but the 'ready' part depended on shared credentials, unknown software, and a complete lack of transparency. The legitimate route takes twenty minutes longer and costs a bit more, but you keep control of your accounts, your network, and your household.

That is the Modaiptv argument demonstrated rather than preached: the best streaming setup is not the one with the most apps pre-installed. It is the one you can explain, update, and trust.