Analysis of U.S. Pirate Site Domain Seizures During FIFA World Cup 2022

After gathering data and in the absence of announcements by U.S. law enforcement agencies, on December 10 TorrentFreak reported on a wave of domain seizures.

Many of the affected sites displayed a banner indicating the involvement of three government agencies – IPR Center, Homeland Security Investigations, and the Department of Justice.

Data clearly showed that the domains were all connected to illicit live sports streaming, but it took another three days for that to be officially confirmed.

On December 13, the United States Attorney for the District of Maryland confirmed that more than 50 domains had been seized to protect FIFA World Cup 2022. None of the domains were mentioned by name, but TorrentFreak independently identified just over three dozen.

Less than a week later, with some sites using backup domains and some investing in replacements, U.S. law enforcement followed up with a new wave of seizures that attempted to whack-the-moles as they resurfaced.

The Domain Seizure Mystery

At least for the time being, the domain seizures appear to have stopped, but that in itself only adds to the growing list of questions.

Why seize these domains and not others? Why seize domains to protect FIFA when a) football isn’t exactly popular in the U.S. and b) there are plenty of bigger sites covering NFL/NBA/NHL/UFC etc, and continue to do so? Why not seize domains every month, every week, or even every day?

We don’t have definitive answers on any of these questions, but data collected by TorrentFreak on close to 70 seized domains (listed at the end of this article) offers pointers on why some domains could be more vulnerable than others. The bigger picture over millions of domains suggests that many pirate sites are already vulnerable to domain seizures.

Seizures Targeted Some High Traffic Domains

The live sports streaming piracy market is both huge and global. Public streaming websites are just a part of a larger picture where even the seizure of 70+ domains has limited impact, despite inconveniencing hundreds of millions of monthly visitors.

The chart below shows the seized domains that enjoyed the most traffic, measured by their visits in November 2022, before the seizures began. The list started as a ‘Top 10’ but due to some replication of traffic across WeakStreams and SoccerStreams, one of the domains was excluded.

Given that the United States is behind these domain seizures, we wanted to determine where these sites were (and in some cases still are) most popular. The domains listed below are followed by monthly visits data for November 2022 (SimilarWeb data, rounded), their five most popular visitor countries, and the percentage of each domain’s total traffic they accounted for.

Librefutbol.com – 70m – Argentina 45%, Peru 14%, Columbia 9%, Mexico 5%, Chile 4%
Score808.com – 32.1m – Malaysia 9%, Kenya 9%, Indonesia 6%, Nigeria 5%, UAE 5%
Hesgoal.com – 30.1m – UK 14%, U.S. 11%, Belgium 6%, Sweden 6%, Netherlands 4%
Freestreams-live1 – 21.1m – U.S. 23%, UK 13%, Canada 9%, Poland 3%, Germany 3%
Soccerstreams.net – 16.4m – U.S. 22%, Canada 12%, UK 12%, Portugal 6%, India 3%
istream2watch.com – 10.8m – U.S. 26%, Canada 9%, UK 6%, Portugal 5%, Germany 3%
Rojadirectatv.tv – 11.7m – Spain 32%, Columbia 17%, Mexico 14%, Argentina 8%, Chile 8%
Steamlivenow.me – 10.7m – U.S. 28%, Canada 9%, UK 6%, Portugal 5%, Germany 4%
Yalla-Shoots.com – 8.4m – Egypt 19%, Morocco 15%, Algeria 9%, UAE 6%, Germany 6%

While visitors from the U.S. account for around a quarter of visits to three of the most popular domains in the list, Argentina’s love for Librefutbol.com amounted to 31.5m visits per month in November alone – in a nation of fewer than 46 million people.

New domains for the site are reportedly in operation, but the seizure will have had a significant effect on traffic, at the worst possible time for Argentinian football fans.

Domain Registrars

The domains listed above show a reasonable spread of extensions – from .com to .tv, through .net and .me – but the full list offers even more variety and clearly no better protection against seizure.

Despite having a reputation for being at least a little more resilient than most, a pair of .to domains also found themselves directed toward U.S. Government servers. A pair of domains registered with Sarek Oy stood up no better, despite the registrar having a reputation for being an awful lot more resilient than others.

Nearly 15% of the seized domains were registered with GoDaddy, but with 4.4m domains and almost 15% of the domain market overall, that looks normal. NameCheap-registered domains accounted for almost 27% of seizures against its 14% market share but with 4.06m domains overall, anything could happen if another 50 or 100 domains were added to the seizure list.

After examining close to 70 domains in search of a pattern or anomaly, little about the domains suggest anything out of the ordinary. All are clearly susceptible to seizure whenever U.S. authorities decide that’s the appropriate course of action.

Location, Location, Location

One thing is glaringly obvious, however. When U.S. authorities need something done, it certainly doesn’t hurt when domain companies are on home soil. And they are, overwhelmingly so.

Of all domains seized in December based on allegations of illegal streaming, almost 69% were registered with US-based companies. The runner-up with just over 13% of the domains was India-based PDR Ltd, but ultimately even that has US-based owners.

That leads to the biggest question of all: if 70 or so domains can be seized in the blink of an eye, why can’t 700 or 7,000? Even if the domains were seized as part of an adversarial legal process, the chances of any domain owners appearing in the U.S. to fight for their return are vanishingly small. And that means only one thing – more domain seizures.

Given the tendency towards symbolism, a new wave of seizures may coincide with a major sporting event or a notable date in Hollywood’s diary. Precisely when is unknown but one thing is certain; any domain with a connection to the U.S. is vulnerable and finding alternatives may not be as easy as it sounds.

Suggestions That .org Domains Are ‘Safe’

The Pirate Bay has operated from thepiratebay.org for years, which may be seen as a plus for domains with a .org extension. Indeed, it appears that operators of a handful of the sports streaming sites listed below have switched to a .org variant, despite the controlling Public Interest Registry and parent Internet Society both having a base in Virginia, United States.

Indeed, when more than 240 Z-Library domains were seized last month, among them were z-lib.org, b-ok.org, book4you.org, hk1lib.org, art1lib.org, ca1lib.org, eg1lib.org, and at least two dozen more with a .org extension.

For reference, we compared the WHOIS records of thepiratebay.org (registrar easyDNS Technologies – Canada) with the WHOIS records of ten random Z-Library .org domains that currently have DNS records pointing to SeizedServers.com.

Book4you.org is the only domain with a registrar in the United States (GoDaddy.com, LLC). The next seven – b-ok.org, zlib.org, hk1lib.org, cl1lib.org, art1lib.org, ca1lib.org, eg1lib.org and au1lib.org – were all registered with Canada-based Tucows Domains.

2lib.org was also registered with Tucows, with Njalla-owner 1337 Services LLC as the registrant. Privacy was most likely maintained but the domain was still seized, unlike The Pirate Bay’s which appears impossibly bulletproof. For now, at least.

Domains Seized By U.S. Authorities (December 2022, list may be incomplete)

– 222live.com
– 247football.net
– 88kanqiu.tv
– 88zhibo.net
– 9goal.tv
– 9goaltv.cc
– 9goaltv.to
– acrackstreams.com
– ajsports.tv
– amzfootball.com
– beeduball.com
– bongtron1.live
– cado89.com
– crichd.pro
– eplsite.football
– extremotvplay.com
– freestreams-live1.com
– futbollatam.com
– futbollatin.com
– futboltv-envivo.com
– futboltv.biz
– futboltv.live
– ghiban1.live
– ghiban2.com
– goaltime.tv
– guduballs.com
– hesgoal.com
– hesgoal.me
– hesgoal.pro
– hesgoal.tv
– ijube.com
– istream2watch.com
– juventus-live-stream.com
– koragol.com
– librefutbol.com
– live-sports-stream.net
– livetv605.me
– mythethao.com
– mythethao.live
– ovopremium.com
– polysportstv.info
– releasesky.com
– rojadirecta-futbol.live
– rojadirecta.global
– rojadirecta.me
– rojadirecta.vip
– rojadirectaliga.com
– rojadirectatv.tv
– rojadirectatvlive.com
– rojadirectatvonline.net
– score808.com
– soccer24hd.com
– soccerstreams.net
– soccerstreams.to
– sportstream.tv
– streamlivenow.me
– tarjetarojaonlinetv.com
– tenorsky.com
– toplivematch.com
– toplivematch.net
– tructiep99.com
– tvrojadirectaonline.net
– vipleagues.net
– weakstream.net
– weakstreams.com
– wizwig1.com
– yalla-shoots.com

From: TF, for the latest news on copyright battles, piracy and more.