Loading story…
U.S. authorities seized more than 1,000 domains allegedly used to illegally stream World Cup 2026 matches in an enforcement campaign known as Operation Offsides, led by Homeland Security Investigations and the National Intellectual Property Rights Coordination Center. The Justice Department said earlier actions in June had already targeted nearly 400 domains and related infrastructure tied to Bulgaria and Peru, while partner agencies in Latin America and Europe blocked thousands of additional piracy sites during the broader crackdown.
The international investigation also led to the arrest in Colombia of four suspected members of Los Ciberinfiltrados, a group accused of illegally accessing telecommunications systems since 2024 and selling pirated streaming services using fraudulent credentials, VPNs, intercepted security codes, and manipulated corporate profiles. Colombian authorities also carried out search-and-seizure operations tied to counterfeit sports apparel, resulting in 11 arrests and convictions, while U.S. officials warned that illicit streaming platforms can expose users to malware, scams, and payment or data theft.
See the reporting duties and controls this puts on the clock.
6 events from the most recent confirmed update back to the earliest known activity.
Colombian authorities also carried out search-and-seizure operations tied to counterfeit sports apparel, resulting in 11 arrests and convictions.
Colombian authorities arrested four suspected members of Los Ciberinfiltrados in connection with the broader investigation into illegal access to telecom systems and pirated streaming sales.
Partner agencies across Latin America and Europe blocked thousands of additional piracy sites as part of the same international enforcement operation targeting illegal World Cup streams.
The U.S. Department of Justice announced that authorities seized more than 1,000 domains allegedly used to illegally stream World Cup 2026 matches during the tournament under Operation Offsides.
U.S. and Colombian authorities said the group Los Ciberinfiltrados had been illegally accessing telecommunication systems and selling pirated streaming content since 2024, using methods such as fraudulent credentials, VPNs, intercepted security codes, and manipulated corporate profiles.
Earlier enforcement actions in June targeted nearly 400 domains and related infrastructure tied to Bulgaria and Peru as part of the broader anti-piracy campaign around World Cup streaming.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
5 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourcebleepingcomputer.com
Open sourcesecurityonline.info
Open sourcejustice.gov
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Department of Justice said it seized nearly 400 internet domains that were illegally broadcasting live **2026 FIFA World Cup** matches, calling the action part of **Operation Offsides**. The enforcement effort was led by the National Intellectual Property Rights Coordination Center with support from Homeland Security Investigations, international partners, and private-sector rights holders including FIFA and media organizations. According to the DOJ, the domains were providing unauthorized real-time streams in violation of U.S. copyright law, and the seizures were backed by an affidavit filed in the Eastern District of Virginia. Authorities said the operation also targeted infrastructure tied to servers in **Peru** and **Bulgaria**, with coordinated disruptions in **Croatia, Romania, Poland, and Colombia**, reflecting a broad international crackdown. U.S. officials warned that illegal sports-streaming sites are not only piracy hubs but also a cybersecurity risk, exposing visitors to **malware**, insecure connections, and theft of personal or financial data; reporting cited prior threat intelligence linking such platforms to malicious advertising campaigns that delivered information stealers including `Lumma` and `Doenerium`. The Justice Department said the operation remains active as investigators continue pursuing the operators behind the seized domains.
Jul 2, 2026
A coordinated anti-piracy operation seized 44 domains tied to the **PirloTV** sports streaming network, disrupting one of the most heavily used sources of unauthorized live match streams in Latin America. The action was carried out by the Alliance for Creativity and Entertainment, **UEFA**, **UC3**, and Mexican authorities including the **Mexican Institute of Industrial Property (IMPI)**. PirloTV does not typically host content directly; instead, it aggregates and embeds illicit streams, a model that helped the network draw more than **950 million annual visits** worldwide, including roughly **230 million from Mexico**, with additional heavy use in Colombia, Spain, and the United States. The takedown was timed ahead of the UEFA Champions League final and comes during the **FIFA World Cup**, when PirloTV has reportedly been widely used for mobile viewing of matches. Investigators said some linked domains were still indexed by search engines and a number remained accessible, continuing to offer streams from broadcasters such as ESPN, Fox Sports, and TNT Sports, underscoring the network's ability to quickly migrate to new domains after enforcement actions. ACE said the operation marked its first collaboration with IMPI under a new anti-piracy memorandum of understanding.
Jun 29, 2026
The U.S. Department of Justice announced the seizure of three **U.S.-registered domains** used by Bulgaria-based piracy sites—**`zamunda.net`**, **`arenabg.com`**, and **`zelka.org`**—alleged to have distributed thousands of pirated movies, TV shows, video games, and other copyrighted works. Authorities said the sites drew **tens of millions of visits annually** (with at least one frequently ranking among Bulgaria’s top 10 most-visited domains), generated significant advertising revenue, and enabled **millions of illegal downloads** with an estimated retail value in the **millions of dollars**. The domains now display seizure banners warning that copyright infringement is a crime; the investigation involved U.S. agencies alongside Bulgarian law enforcement and **Europol** support. In parallel, European law enforcement actions highlighted a broader, coordinated crackdown on piracy infrastructure. Italy-led **Operation “Switch Off”**—coordinated with **Europol, Eurojust, and Interpol**—reported the seizure of infrastructure supporting **industrial-scale illegal IPTV services** that allegedly redistributed content from major broadcasters and streaming platforms (including **Sky, DAZN, Mediaset, Amazon Prime, Netflix, Paramount, and Disney+**) to **millions of end users**. Italian authorities said they identified **31 suspects** tied to a transnational organized crime group and noted the use of **anonymization and financial obfuscation tactics** such as cryptocurrency payments and shell companies; industry group ACE publicly named seized services including *IPTVItalia*, *migliorIPTV*, and *DarkTV*.
Jun 29, 2026