Loading story…
The U.S. Department of Justice announced the seizure of three U.S.-registered domains used by Bulgaria-based piracy sites—zamunda.net, arenabg.com, and zelka.org—alleged to have distributed thousands of pirated movies, TV shows, video games, and other copyrighted works. Authorities said the sites drew tens of millions of visits annually (with at least one frequently ranking among Bulgaria’s top 10 most-visited domains), generated significant advertising revenue, and enabled millions of illegal downloads with an estimated retail value in the millions of dollars. The domains now display seizure banners warning that copyright infringement is a crime; the investigation involved U.S. agencies alongside Bulgarian law enforcement and Europol support.
In parallel, European law enforcement actions highlighted a broader, coordinated crackdown on piracy infrastructure. Italy-led Operation “Switch Off”—coordinated with Europol, Eurojust, and Interpol—reported the seizure of infrastructure supporting industrial-scale illegal IPTV services that allegedly redistributed content from major broadcasters and streaming platforms (including Sky, DAZN, Mediaset, Amazon Prime, Netflix, Paramount, and Disney+) to millions of end users. Italian authorities said they identified 31 suspects tied to a transnational organized crime group and noted the use of anonymization and financial obfuscation tactics such as cryptocurrency payments and shell companies; industry group ACE publicly named seized services including IPTVItalia, migliorIPTV, and DarkTV.
See the reporting duties and controls this puts on the clock.
5 events from the most recent confirmed update back to the earliest known activity.
Following the U.S. action, the seized domains began displaying law-enforcement banners warning that copyright infringement is a crime. The investigation involved U.S. agencies working with Bulgarian law enforcement and Europol as part of broader international anti-piracy enforcement.
The U.S. Department of Justice seized the U.S.-registered domains zamunda.net, arenabg.com, and zelka.org, which were allegedly used by Bulgaria-based websites to distribute pirated movies, TV shows, video games, software, and other media. The domains were described as highly popular in Bulgaria, drawing tens of millions of visits annually and generating significant advertising revenue.
Italian authorities said evidence linked 31 people to a transnational organized criminal group behind the IPTV operation, with additional suspects identified in several European countries. Investigators alleged the group used cryptocurrency payments, shell companies, and anonymization techniques to conceal proceeds and operations.
As part of Operation Switch Off, law enforcement seized three major illegal IPTV services identified by ACE as IPTVItalia, migliorIPTV, and DarkTV. Italian police said the network served millions of users, involved at least 250 resellers and 100,000 subscribers in Italy, and included servers dismantled in Romania and one located in Africa.
Italian authorities led a coordinated international anti-piracy operation, supported by Europol, Eurojust, and Interpol, targeting industrial-scale illegal IPTV services and related infrastructure across 11 cities and 14 countries. The action was prioritized in part because of the upcoming Milan Winter Olympics and the risk of illegal sports broadcasts.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
3 references tracked. Mallory keeps watching after this page renders.
therecord.media
Open sourcecyberscoop.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
European and international law enforcement agencies dismantled **nine organized crime groups** and arrested **29 suspects** in **Operation KRATOS 2**, a seven-month crackdown on illegal IPTV and unauthorized streaming services coordinated by Bulgaria with Europol support. The operation ran from September 2025 to April 2026 and involved authorities from **13 countries**, targeting not only piracy websites but also the wider criminal and technical infrastructure used to host, manage, and conceal the services across borders. Investigators identified more than **18,000 IP addresses**, **4,370 piracy-linked domains**, nearly **400,000 URLs** flagged for suspension or removal, and over **126,000 infringing objects**, while taking down more than **27,000 illegal streaming URLs**. The action also led to **148 house searches**, **59 judicial referrals**, **72 additional criminal investigations**, and the identification of **86 suspects**. Europol said the operation focused on the broader ecosystem behind piracy services and warned that users of illegal streaming platforms also face cybersecurity risks including **malware**, **spyware**, and **data theft**.
Jun 29, 2026
A coordinated anti-piracy operation seized 44 domains tied to the **PirloTV** sports streaming network, disrupting one of the most heavily used sources of unauthorized live match streams in Latin America. The action was carried out by the Alliance for Creativity and Entertainment, **UEFA**, **UC3**, and Mexican authorities including the **Mexican Institute of Industrial Property (IMPI)**. PirloTV does not typically host content directly; instead, it aggregates and embeds illicit streams, a model that helped the network draw more than **950 million annual visits** worldwide, including roughly **230 million from Mexico**, with additional heavy use in Colombia, Spain, and the United States. The takedown was timed ahead of the UEFA Champions League final and comes during the **FIFA World Cup**, when PirloTV has reportedly been widely used for mobile viewing of matches. Investigators said some linked domains were still indexed by search engines and a number remained accessible, continuing to offer streams from broadcasters such as ESPN, Fox Sports, and TNT Sports, underscoring the network's ability to quickly migrate to new domains after enforcement actions. ACE said the operation marked its first collaboration with IMPI under a new anti-piracy memorandum of understanding.
Jun 29, 2026
U.S. authorities seized more than 1,000 domains allegedly used to illegally stream World Cup 2026 matches in an enforcement campaign known as **Operation Offsides**, led by Homeland Security Investigations and the National Intellectual Property Rights Coordination Center. The Justice Department said earlier actions in June had already targeted nearly 400 domains and related infrastructure tied to Bulgaria and Peru, while partner agencies in Latin America and Europe blocked thousands of additional piracy sites during the broader crackdown. The international investigation also led to the arrest in Colombia of four suspected members of **Los Ciberinfiltrados**, a group accused of illegally accessing telecommunications systems since 2024 and selling pirated streaming services using fraudulent credentials, VPNs, intercepted security codes, and manipulated corporate profiles. Colombian authorities also carried out search-and-seizure operations tied to counterfeit sports apparel, resulting in 11 arrests and convictions, while U.S. officials warned that illicit streaming platforms can expose users to **malware**, scams, and payment or data theft.
Jul 22, 2026