The company has targeted both individual pirates and private torrent trackers through U.S. federal courts.

Earlier this year, the Illinois-based company filed a high-profile lawsuit against Gay-Torrents.org, targeting the site’s operators, administrators, a Bulgarian shell company, and hundreds of individual members. That lawsuit prompted the operators to shut the site down, but that did not end their legal worries.

The tracker’s users also remain on the radar and are at the center of a new legal campaign. A new complaint filed last week at an Illinois federal court targets a fresh batch of 75 members, including one named defendant and 74 John Does who are identified only by their site usernames. Notably, Flava filed it as a RICO case.

RICO Complaint Against Torrent Users

The complaint describes Gay-Torrents.org as an “association-in-fact enterprise” with the goal to profit from the unauthorized distribution of copyrighted works. The RICO complaint, referring to the federal racketeering statute, alleges that the tracker’s members contributed to the racketeering operation. This claim comes in addition to a copyright infringement allegation.

Members who uploaded and downloaded infringing content are characterized as “lower-rung participants” who supplied the site’s infringing inventory, participating in Gay-Torrents’ sharing-ratio system. Those members who paid for VIP access are seen as “funders” and face an additional allegation of wire fraud.

FlavaWorks argues that every VIP payment was a fraudulent act. Members were sent to sham web-hosting fronts and ordered ‘VPS plans’ they knew did not exist. The goal of these disguised payments was to conceal the true nature of the transaction from banks and payment processors.

“On information and belief, the enterprise generated in excess of €7,000,000 since 2009 across more than 15,000 documented VIP payment events, each invoiced as a sham “web-hosting” fee,” the complaint reads.

This €7 million figure is an estimation based on Flava’s calculations, covering all revenue that was generated in 17 years. This same number was also cited in the April lawsuit, where Flava requested an asset freezing order targeting the tracker’s alleged payment providers, including PayPal.

Unique Forensic Identifier

The sole named defendant is Jason A. S., a Virginia man who, according to the complaint, was a paying subscriber to FlavaWorks’ legal websites from March 2020 to July 2021. During that period, he allegedly downloaded more than 200 of the company’s works.

FlavaWorks uses a forensic watermarking system that embeds a unique identifier into every file it delivered to subscribers. So when pirated copies of the videos with his identifier appeared on Gay-Torrents, Flava knew where they originated.

These copies were first spotted in 2022 and Flava writes that it sent a cease-and-desist notice to the defendant at the time. However, the man allegedly continued to use the site and copies of the content kept circulating up until 2025.

In addition to distributing pirated content, Jason A. S. allegedly paid for a VIP membership too. That means he is both an uploader and a funder under the complaint’s RICO theory. This makes him the “anchor defendant” whose connection to Illinois gives the court jurisdiction over the remaining defendants through RICO’s provisions.

The Case for RICO

The first lawsuit also targeted members, but relied on copyright and state-law claims. That legal approach ran into a common problem: the amended complaint had to drop hundreds of defendants, apparently because they would not fall under the jurisdiction of an Illinois court.

RICO solves that problem. The statute authorizes nationwide service of process, so Flava only needs one “anchor defendant” with ties to Illinois. After that, all co-conspirator defendants can be added to the case, as long as they live in the United States.

It also raises the legal stakes. RICO provides higher damages and introduces conspiracy liability, which effectively means that a member who only paid VIP fees and never uploaded a single file could still face liability for the enterprise’s copyright infringement.

To make the RICO theory work, Gay-Torrents’ operators should remain out of the case. Indeed, the complaint identified the operators as non-party co-conspirators instead of defendants.

74 Does & the Evidence Trail

The complaint lists 74 John Does, who are all identified by their Gay-Torrents.org username and internal user-ID number. Flava will try to identify these defendants as the case moves forward.

Some of the evidence trail is straightforward. Usernames and user IDs are presumably visible to any member of a private tracker, and FlavaWorks clearly had at least one account on the site. After all, the forensic identifier matches come from FlavaWorks’ own system, comparing copies downloaded from the tracker against its subscriber records.

In addition, the evidence shows that a Flava investigator purchased a VIP subscription at the tracker.

The VIP payment data can also come from a different source. The complaint notes that subpoenas were issued to Skrill and PayPal in the first lawsuit, and those records would show which users paid for VIP memberships.

How Flava identified the user download activity and other internal records is not immediately clear to us. The complaint refers broadly to “the Site’s own per-member records” without explaining how they were obtained.

RICO Raises the Bar

The RICO complaint accuses the defendants of direct and contributory copyright infringement, a RICO violation, and RICO conspiracy. It lists 85 copyrighted works, with statutory damages of up to $150,000 per work on the copyright claims. The RICO counts could add treble damages on top of that.

However, RICO comes with a higher evidence bar. The criminal copyright infringement allegations, for example, need to show willfulness and commercial advantage or financial gain. On top of proving that, Flava must show a pattern of racketeering activity, how each defendant is involved, and more.

The wire-fraud count also requires detailed evidence, to document the who, what, when, and how of each alleged fraudulent transaction.

Whether Flava will litigate these claims in a trial has yet to be seen. Filing a RICO case raises the pressure on the defendants, but actually proving these claims against individual users at trial is much harder than pursuing a standard copyright infringement claim.

For now, however, Flava has already reached its key goal by shutting the tracker down. In a way, this means that everything it gets out of the RICO complaint is a bonus. For the users, however, the stakes have been raised and the concerns are real.

—

copy of the complaint, filed by FlavaWorks Entertainment, Inc. at the U.S. District Court for the Northern District of Illinois, is available here (pdf).

From: TF, for the latest news on copyright battles, piracy and more.

These worries didn’t come out of nowhere as the site has been under quite a bit of legal pressure in recent months.

Lawsuit Takes Domains Offline

In January, the site lost its flagship .org domain. Initially it wasn’t clear what was behind this action but unsealed court records eventually connected it to a lawsuit filed by music companies. This case was a direct response to a Spotify scrape Anna’s Archive announced a few weeks earlier.

The music companies obtained an injunction from a U.S. federal court to go after the site’s domain names. This took out not only the .ORG domain but also the .SE domain, as well as the .PM and .VG domains that were put in place as backups.

Anna’s Archive eventually landed on .GL, .PK, and .GD domains, which remain active today. These are connected to registrars and registries based outside the United States that, apparently, do not comply with U.S. court orders.

Two Lawsuits, $340 Million

The music industry injunction also came with a substantial default judgment that was handed down in April. This includes a $322 million default judgment against the unknown operators of Anna’s Archive, who failed to show up in court.

This judgment was soon followed by a similar request from a group of major book publishers, including Penguin Random House, Elsevier, and HarperCollins, who sued the shadow library at a New York federal court.

That case also resulted in a default judgment, with a damages award that is smaller, but still substantial at $19.5 million. In addition, the court also issued an injunction targeting Anna’s Archive’s domain registrars and registries.

‘Coordinated Attack’

With this backdrop, it is no surprise that legal troubles came to mind when the site became unreachable earlier this month. However, this time around, the threat appears to have come from elsewhere.

After the site came back online, the official AnnaArchivist account attributed it to a coordinated attack by an unnamed party.

“Apologies for the issues. We suspect a coordinated attack. We’ve mitigated the attack vectors…” the message read, while noting that memberships already include one to two extra days per month to account for downtime.

Theoretically, an attack can also come from a rogue anti-piracy group, but there’s no evidence for that. A scam or phishing operation, which tries to cash in on Anna’s Archive search traffic, is another option. Neither is confirmed.

What Options Are Left?

Looking more broadly at the enforcement action that has taken place over the past months, we see that U.S. courts have run into their jurisdictional borders on the Internet.

This likely comes as a disappointment for rightsholders, but it also offers a clear takeaway.

U.S. courts can’t reach domains registered beyond their jurisdiction. That’s likely to increase calls for site-blocking legislation, a measure the industry has long favored and that remains high on the political agenda in the United States.

From: TF, for the latest news on copyright battles, piracy and more.

Downloading content without permission is copyright infringement. These torrent download statistics are only meant to provide further insight into piracy trends. All data are gathered from public resources.

This week we have two newcomers on the list.

“Mutiny” is the most shared title.

The most torrented movies for the week ending on August 24 are:

Note: We also publish an updating archive of all the list of weekly most torrented movies lists.

From: TF, for the latest news on copyright battles, piracy and more.

Rockstar Games and its parent company, Take-Two Interactive, have kept the game’s marketing under tight control, with a planned “Extended Look” at the gameplay premiering on Netflix later this month.

However, a few days ago, millions of fans already got a sneak peek. On August 18, someone identifying as “Cyberleek” started posting unreleased gameplay footage online. These clips went viral on social media, despite Take-Two issuing a barrage of takedown notices.

The leak came with a manifesto, criticizing the move away from physical discs, among other things. In addition, the leaked gameplay was branded with a Solana token advert.

The Discord and Microsoft ‘Dragnet’ Subpoenas

Take-Two did not take this leak lightly. As widely reported in the media, the game company requested two DMCA subpoenas at the U.S. District Court for the Southern District of New York, directed at Discord servers and at Microsoft’s internal cyberleek investigation, device identifiers, IP logs, and OneDrive content tied to GTA.

The Discord subpoena is particularly broad. As highlighted by Tom’s Hardware, Kotaku, and others, the subpoena sought identifying details for every account that communicated in three named Discord servers since June 1, not only those tied to the leaks.

Take-Two also seeks “all identifying information associated with all user accounts that are/were members of the Discord community servers and channels listed below.”

The Discord and Microsoft DMCA subpoena requests were filed by law firm Kirkland & Ellis. While some media reports suggest they have been issued, that’s not the case yet. A judge signed an order directing the clerk to issue, but the clerk hasn’t issued them.

The docket does include a proposed subpoena, requiring Discord and Microsoft to disclose the requested information, as shown above. But there’s more.

Take-Two Targets X

A day after the initial subpoenas were requested, Take-Two applied for DMCA subpoenas against X Corp. and Google, again at the Southern District of New York. These filings came from a different law firm, Ruttenberg IP Law, and are more narrowly targeted.

The proposed X subpoena lists three usernames: @cyberleek_ar_io, @cyberleekario, and @MrCyberLeek. For each, it demands the account ID, registration email, IP access logs, phone numbers, connected accounts, and any associated device identifiers, again covering June 1 to the present.

Notably, the GTA fan community had flagged these accounts as impostors before the subpoena was filed. Cyberleek also watermarked “CYBERLEEK DOES NOT HAVE TWITTER” onto later leaked videos. The named X accounts are now all suspended.

Whether Take-Two treats these X accounts as impostors who copied the leaks, or as the source, is not mentioned in the filing.

The YouTube Channel Subpoena

The Google/YouTube subpoena is a lot narrower than the Discord sweep. It names a single YouTube video and three channels that are believed to be associated with it: CyberLeeks, Surfer24k, and Cyberleek_ar_io.

Surfer24k also appears in the Discord subpoena, as it is linked to one of the named servers. Obtaining personal records for this user from both Google and Discord allows Take-Two to compare the information of both platforms.

An exhibit filed with the petition lists Rockstar’s takedown request on YouTube. The company logged a reference file as “UNAUTH_2026AUG_VIDEO2,” and YouTube’s Content ID system flagged and claimed the matching upload shortly after it went live.

The same exhibit shows a “BUY $CYBERLEEK ON SOLANA” watermark on the footage, as shown above.

Not Disclosed, Yet

None of the four filings is a lawsuit. They are subpoenas issued under Section 512(h) of the DMCA, which lets a copyright holder compel a service provider to identify an alleged infringer without first suing anyone.

These subpoenas do not require a ruling on the merits and a signature from the court clerk is sufficient, as long as all other conditions are met.

As it stands, none of the four subpoenas has been issued. Judge Andrew L. Carter Jr. and Judge Jennifer L. Rochon each signed an order directing the clerk to act, but the clerk has not yet done so. No user data has changed hands as a result.

Notably, DMCA subpoenas are restricted to targeting alleged infringers that are tied to specific material. Whether that covers thousands of Discord users, many of whom may have posted nothing at all, is up for debate.

Take-Two’s counsel declared that the purpose of the subpoenas is “to obtain the identity of an alleged infringer or infringers, and that such information will only be used for the purpose of protecting Take-Two’s rights.” This means that a lawsuit could eventually follow.

Before that happens, however, it is possible that the targeted intermediaries or their users will file an objection. Service providers regularly resist DMCA subpoenas which they see as being overbroad, and targeted users can move to quash.

It’s clear that Take-Two is determined to get the leaker’s identity, but how broad its DMCA dragnet can reach has yet to be seen.

—

A copy of the request for a DMCA subpoena directed at Google/YouTube is available here (pdf, pdf, pdf) and the X Corp variant is here (pdf, pdf, pdf).

From: TF, for the latest news on copyright battles, piracy and more.

For Nintendo, Switch emulators have become the main challenge, one that keeps rearing its head.

Most of these emulators were killed off long ago. Yuzu settled in February 2024, for example, Ryujinx shut down that October, and the successors that tried to keep edited versions online have been targeted in waves ever since.

These waves keep coming. Earlier this week, Nintendo filed seven separate DMCA anti-circumvention notices at GitHub, all on the same day, targeting a variety of Switch emulator repositories and their forks. The combined reach is substantial. In the seven notices, more than 400 repositories were targeted.

More Than 400 Repos

The most detailed notice targets suyu, an emulator that became popular after Yuzu’s collapse. Because the reported network was larger than 100 repositories, GitHub processed the notice against the entire network, which covered 311 repos.

The remaining six notices ranged from a lone repository to networks of a few dozen, including the independent Skyline emulator, as shown below.

For four of the seven notices, the table shows GitHub’s own count of the processed network, including the parent repo. For the other three, no network details were published, so the table shows the repositories named in the notice itself, including some that were redacted as “[private].”

The legal argument is the same in all seven. Nintendo argues that the emulators exist to bypass the encryption that protects its games, which violates the DMCA.

“During operation, the emulators at the reported repositories necessarily use unauthorized copies of these cryptographic keys to decrypt unauthorized copies of Nintendo Switch games, or ROMs, at or immediately before runtime without Nintendo’s authorization,” the notice read.

Most of these repositories now link to notices informing visitors that they were removed. In some cases, they point to a 404 error, suggesting that the developer voluntarily removed the repository after being notified.

Precedents Without a Trial

To back the circumvention argument, every notice cites two court decisions as precedents, neither of which was challenged in court.

The first is the 2024 consent judgment against Tropic Haze, the company behind Yuzu, which ended in a $2.4 million settlement. The second is newer: Nintendo’s case against streamer Jesse Keighin, aka “EveryGameGuru,” who was ordered to pay $17,500 last October after a Colorado court entered a default judgment against him.

One was a settlement, the other a default judgment after Keighin reportedly stopped responding and destroyed evidence. In neither case did a court weigh the emulator circumvention question on the merits.

At the takedown stage Nintendo does not need to show a legal precedent. GitHub says it reviews circumvention claims carefully and will “err on the side of the developer, and leave the content up” when validity is unclear. The Yuzu framework has made Nintendo’s notices close to routine anyway.

Defunct Skyline & Future Horizon

Among the targeted emulators Skyline stands out, as it was a Switch emulator for Android devices, not a yuzu fork. Skyline’s developers shut the project down voluntarily in 2023, but as is often the case, the open source code survived.

This week, Nintendo’s takedown notice cleared a network of 29 Skyline repos, including code that has been dormant for years. This doesn’t necessarily deal with the problem permanently, as future takedown efforts are likely on the horizon.

Every emulator on this week’s list was already supposed to be gone. However, they were forked, mirrored, or revived, which put them on Nintendo’s radar again.

For Nintendo, getting these emulator repos removed from GitHub is the easy part. Keeping the code offline is a bigger challenge, as forks may reappear faster than the notices can remove them.

From: TF, for the latest news on copyright battles, piracy and more.

These trackers, including PassThePopcorn, BroadcasTheNet, KaraGarga, HDBits, and Beyond-HD, allegedly shared several of his works without permission.

At the time, multiple sources informed TorrentFreak that several of the “infringing URLs” submitted as evidence did not point to working torrent pages and used URL structures that didn’t match the targeted sites. The films could not be found on several of the trackers either.

After that, the docket went quiet, until last December, when the person identifying himself as Schneider escalated the matter through a federal copyright lawsuit.

Filmmaker Files Federal Lawsuit

In a complaint filed in the Northern District of Illinois, the filmmaker sued ten unnamed ‘John Doe’ defendants, alleging that all six trackers are part of a single coordinated “piracy Enterprise” run by the same people.

The complaint named PassThePopcorn.me, BroadcasTheNet, KaraGarga.in, HDBits.org, Beyond-HD.me, and Bibliotik.me, calling them “coordinated access points to the same underlying BitTorrent-based distribution service.”

The plaintiff filed pro se, which means that he’s not represented by an attorney. He listed a mailing address in Sanborn, New York, while the complaint described him as a UK-based filmmaker.

Fabricated Evidence?

In February 2026, the court allowed Schneider to subpoena seven companies, Reddit, GoDaddy, Cloudflare, PayPal, Stripe, Namecheap, and X Corp, requesting identity information on the Doe defendants.

This triggered an objection from several of the Doe defendants, who filed motions to quash through their attorneys. As a result, all seven subpoenas were placed in abeyance in May, until these outstanding motions would be decided.

One of the defendants, identified as Doe 7 and linked to a Reddit account, accused the plaintiff of building the case on fabricated evidence.

Doe 7 wrote that the sworn declaration supporting the discovery motion came from “Saumya Shah, Partner and Senior Investigator” at a UK firm called “Northbridge Digital Investigations.” Doe 7 searched the UK Companies House registry and found no such company. No trace of Shah appeared anywhere online. TorrentFreak independently confirmed these claims.

The same Doe defendant also challenged the roughly 130 URLs submitted as evidence. Intriguingly, the exhibit also includes URLs from other pirate sites and WHOIS lookups on at least ten additional private tracker domains not named in the complaint.

Schneider, meanwhile, doubled down that the copyright infringement claims against Doe 7 are valid, but he did not address whether an investigator named Shah exists or Northbridge is a real company.

The Real Matthew Schneider

Yesterday, TorrentFreak listened in as all parties were present at a telephonic hearing before Judge Andrea R. Wood, to address the motions to quash and a motion to proceed anonymously. However, that hearing took an unexpected turn, which changes the stakes.

Before the hearing began, defense counsel Erin Russell, representing Doe 1, had contacted the judge’s chambers directly to address an important matter. Russell acknowledged that this was an extraordinary step that wasn’t taken lightly. However, she felt it needed to be addressed before any rulings would be made.

Russell, working alongside counsel for the other Does, Haley Finch, told the court they had developed serious suspicions that the person litigating as Matthew Schneider is not the real Matthew Schneider.

Both counsel conducted detailed research and traced the listed films and Schneider to a Canadian production company, Dirtbag Films, which we had separately identified in our earlier coverage.

However, the finding that Schneider is Canadian does not match the information shared by the person who presented himself as Schneider in court.

Finch, who is a Canadian attorney, had a personal contact connected to Dirtbag Films and through that connection, she eventually reached the actual filmmaker. Russell, meanwhile, reached out to a Dirtbag contact separately and was also connected to the Canadian Matthew Schneider.

The attorneys informed the court that the real Matthew Schneider signed a declaration confirming his identity and that he resides in Ontario, Canada.

After being confronted with this information, Judge Wood asked the plaintiff on the call to respond. He said he did not see why this information would delay any rulings. At the end of the hearing, he stated, “I’m Matthew Schneider,” while stressing that the case should not be delayed.

The Stakes Shift

Judge Wood did not rule on any of the pending motions to quash or proceed anonymously. She also denied the plaintiff’s motion to strike Doe 7’s filings.

Instead, she signaled that, if the allegations are true, the plaintiff could face sanctions, directing the defense to file a motion supported by the declaration from the Canadian Matthew Schneider. In addition, she scheduled an in-person hearing next month to resolve the identity questions.

In the meantime, Judge Wood stressed that the plaintiff may not seek to obtain personal information about the Does and that nothing identifying the defendants should be filed on the docket.

Doe 7, who also appeared on the call with his prospective counsel, indicated that he anticipates filing a motion to join the defense filings submitted by the other Does.

Before yesterday’s hearing, this lawsuit was already quite novel, as it is the first one that targets multiple prominent private torrent trackers. Now, the stakes have completely changed, with an unprecedented impersonation claim, which, if it turns out to be true, will likely lead to a dismissal and sanctions for the plaintiff.

—

Update, August 20: After publication, we learned that the case has taken a new turn. The court has sealed the filings. This will complicate further coverage, for now.

From: TF, for the latest news on copyright battles, piracy and more.

The system started as an administrative scheme without judicial oversight. CUII’s own committee issued blocking recommendations, and the Federal Network Agency signed off before providers acted.

This setup changed in mid-2025, when the stakeholders rewrote their code of conduct so that every block now starts with a rightsholder suing one ISP. Once a court confirms the block, the other providers follow.

CUII no longer issues the orders, but it will still communicate the recommendations to all participants. In recent weeks, the clearing body published several new ones based on orders from the Cologne Regional Court, targeting KinoGo and Streamed.

The structural infringement check

The court orders are not available to us, but according to CUII’s paperwork, these targets are classified as structurally copyright infringing websites, making the blocking orders “reasonable and proportionate.”

As is typical in Germany, the requesting rightsholders and the targeted domains are not mentioned. However, based on the brands and data from the independent transparency portal CUIIListe, streamed.pk, streamed.st, and kinogo.ec were all blocked in Germany this month.

CUII’s paperwork does reveal one hard statistic. For each site, a private investigator pulls a random sample of the site’s content, to see how much of it infringes at a 95.5 percent confidence level. This number is used to determine whether the target site is indeed ‘structurally’ infringing.

For example, for Streamed, the investigator put the infringing share somewhere between 96.16 and 100 percent. For KinoGo, meanwhile, between 82.4 and 94.6 percent of the content is pirated.

The 82.4 percent floor is the lowest we have seen so far, below all previous German blocking orders we have seen, including the ones below.

The 81.5% ‘Line’

In a March 2025 order targeting HDFILME, STREAMCLOUD and FILMPALAST, CUII specifically stated when illegal content clearly outweighs the legal content on a site.

“The illegal content on the websites far outweighs the legal content. This is the case in any event when at least 81.5% of the website’s content is illegal,” the order reads, translated from German.

It is the only CUII order we found that puts a number on it. The figure traces back to the Cologne Regional Court, which set it in a January 2025 default judgment against the download portal NOX, a case the operator never contested. That same judgment triggered NOX’s own block.

In KinoGo’s example, the 82.4 percent floor is getting quite close to the 81.5 percent.

This percentage is not a hard benchmark for the court or for CUII to determine whether a site is blockable. However, one can imagine that it’s not a good look when it drops lower than that, especially when legal content would outweigh their pirated counterparts.

This doesn’t mean that KinoGo is a questionable target. The site has been a thorn in the side of rightsholders for many years. It has more than 50 million monthly visits, mostly from Belarus and Ukraine, which it has historically targeted.

Hiding in Plain Content?

The open question is how much of a site’s library has to be pirated before a block can be issued in Germany, and whether 81.5 percent is considered to be a general benchmark or just a figure tied to that one case.

If there is a fixed percentage, there are some obvious exploits that come to mind. In theory, an operator could pad an archive with public domain films or AI generated filler, pushing the investigator’s interval below the line while the pirated library stays intact.

We asked CUII whether the 81.5 percent can be treated as a fixed benchmark.

—

Update, August 20: CUII has responded to our questions. Its comments are added below.

Update August 20: CUII told TorrentFreak that 81.5% is not a fixed quantitative limit. It cited the underlying proportionality test from the Federal Court of Justice, under which a block is proportionate when illegal content so clearly dominates that only a negligible share of legal content is affected. CUII added that the decisive question is not a percentage but whether a site operates an infringement-based business model that is criminal under German copyright law, and said it blocks only domains used for such sites. On that reasoning, padding a library with legal filler would not change a site’s character.

Update August 19: Romsns.com is also blocked. CUII just published the associated recommendation. The Virustotal scan below shows that there are multiple malware warnings for this domain.

—

A copy of the Streamed order can be found here (pdf) and the KinoGo order can be found here (pdf). An archive of all CUII determinations is also available on the clearinghouse’s official website.

From: TF, for the latest news on copyright battles, piracy and more.

The streaming portal has been a thorn in the side of Hollywood, with the Motion Picture Association (MPA) listing it as a notorious pirate site in its submission to the USTR last fall.

“Cineby is a fast-growing one-stop-shop piracy site in the ‘hydra site’ category. These are a rapidly expanding category of one-stop piracy sites offering content somewhat comparable to IPTV services, but without the need for subscriptions or dedicated devices,” MPA wrote at the time, linking the operation to Russia.

Enforcement Pressure Builds

In addition to the diplomatic pressure, the movie industry was also the driving force behind several high-profile blocking orders against the site this year.

In May, Cineby was listed as a target in the new UK “omnibus” site blocking order, for example, which also covers the site’s successors preemptively. The same applies to the recent “expanded scope” order from Canada’s federal court, which also covers Cineby and any potential successors.

In July, a Delhi High Court order obtained by HBO and other movie studios went further. This injunction covered four Cineby domains and directed Indian ISPs to block the sites, while domain registrars were ordered to suspend them.

Despite the Indian order, Cineby’s main .at domain name remains online, suggesting that Registrar.eu has not complied with the Indian order. However, according to a recent announcement by the site’s operators, there soon might be no need to take action anymore.

A Voluntary Shutdown?

Visitors to Cineby’s website are currently greeted with a new announcement, suggesting that the site will shut down permanently in a few days.

“Cineby and all related services will cease operations on August 26th. It’s been a good run, but the time has come to stop,” the site announces, adding that “all servers will be shut down, and every user account will be deleted.”

The operators provide no rationale for this surprising decision. However, it is a reasonable assumption to suggest that the mounting enforcement pressure played a role.

What will happen to the domain name when the site shuts down has yet to be seen. With millions of daily visits, the site has a massive audience, which will be looking for an alternative.

The Hydra…

Whether the operators will indeed shut down the site and get out of the business has yet to be seen. In the past, other sites have simply rebranded in an attempt to shake off the legal pressure. This includes the now-defunct HiAnime operation, which started as Zoro and also used the Aniwatch brand.

According to the MPA, Cineby relied heavily on piracy-as-a-service (PaaS) infrastructure, embedding videos from third party sites. These remain online, which means that the underlying piracy problem remains.

In the typical ‘hydra’ fashion, Cineby’s planned shutdown will result in plenty of new sites popping up; whether these are linked to the original site or not.

This problem is one of the key reasons why the UK and Canadian site blocking orders were expanded to cover future Cineby copycats and successors, even if they don’t use the same brand. If everything happens according to plan, this new blocking power can be put to the test later this month.

For now, however, cineby.at remains online, streaming pirated movies and TV shows as usual.

—

Update: Cineby’s sister sites Cineplay and Fmovies+ show the same shutdown message.

From: TF, for the latest news on copyright battles, piracy and more.

While much of this occurs beyond the company’s purview, pirates appear to be drawn to the platform, sharing links to pirated movies, TV-shows and other content in dedicated channels.

Despite this reputation, the platform’s piracy ecosystem has rarely been mapped in any detail. A new academic paper sets out to fill that gap, while also trying to offer a potential AI-powered solution to the problem.

Researchers from Louisiana State University and the University of Texas at Arlington examined 1,057 channels that shared roughly 209,000 posts between December 2023 and January 2026. They describe it as the first large-scale study of video piracy on the platform.

The results are detailed in the paper titled “Binge, Bot, Repeat: Unpacking the Ecosystem of Video Piracy on Telegram,” which provides some interesting new insights.

The findings reveal that piracy is certainly not a fringe activity on Telegram. On the contrary, it is massively popular.

4.85 billion post views for 19,033 titles

To map the ecosystem, the researchers relied on a locally run large language model to label posts. This helped them to identify 19,033 unique pirated titles across various Telegram channels, including 14,632 movies and 4,401 TV shows produced by 3,941 companies.

As on regular pirate sites, anime is rather popular. The most pirated rightsholder is Japan’s Toei Company, home to One Piece and Dragon Ball, which accounted for 17% of the titles. As shown below, Netflix is in second place with 15%, followed by Warner Bros. at 12.4%.

These numbers get more context when looking at the total views. According to the researchers, the ‘pirate’ posts were found on 983 channels where they amassed 4.85 billion views.

The views are not per title, as a single post can include more titles. Nonetheless, the researchers estimate a total loss of $17.49 billion, with United States content accounting for $8.17 billion and Japanese content $3.72 billion.

This is a loose estimate, assuming that 1% of the views translate into lost sales, based on the cheapest legal option available. Also, the researchers capped lost sales at a single subscription cost when multiple titles from one service were linked.

Built to Survive Takedowns

One of the most noteworthy findings is that piracy channels use a wide variety of distribution techniques, with content scattered across interconnected channels, bots, and backup accounts.

Roughly 94% of the AI-mapped channels were connected to at least one other and many of these were unfindable using traditional searches.

“We also find that this ecosystem is deliberately engineered to be resilient against takedown efforts, frequently redirecting users through chains of intermediary channels and automated bots that collectively handle hosting, access control, monetization, and channel discovery.”

Most pirate links pointed to external hosting platforms such as TeraBox, Terashare, and GoFile. Torrents and magnet links, meanwhile, were a rarity, and the researchers only spotted nine of these links in their research.

In addition to posting links to pirated content, some channels also shared compromised Netflix, Hulu, Disney+, and Crunchyroll logins, and VPN tutorials to help people bypass blocking measures.

Anti-RIP: AI Powered Channel Hunting

The researchers went beyond simply mapping the ecosystem. Their findings also motivated the development of “Anti-RIP,” a real-time AI-powered tool that can detect video piracy on Telegram.

To catch channels before they grow, the researchers generated candidate Telegram handles and probed them to see which ones were linked to piracy communities. Between February 3 and April 10, 2026, the tool scanned 249,133 newly discovered channels.

From that sweep, Anti-RIP flagged 802 piracy channels with a median age of less than 5 days, along with 299 connected channels and 108 bots.

Rather than sending bare links, the team compiled the findings into evidence reports that paired each flagged channel with contextual labels describing what it was doing, from hosting and redirecting to monetizing content. These reports were sent to Telegram’s abuse department as well as 17 major U.S. rightsholders.

The research notes that 14 of the 17 US studios acknowledged the reports, and 4 explicitly stated that the contextual labels helped them assess and prioritize the notices.

“Over a 61-day period, the framework facilitated the takedown of 524 previously unknown piracy channels and 71 bots,” the paper reads. Additionally, Telegram removed many flagged posts.

AI Tool Isn’t Flawless

Anti-RIP’s reports produced measurable results. Within two weeks, 524 of the 1,101 reported channels had become inaccessible, and Telegram removed many individual flagged posts on top of that.

The AI tool is far from perfect, and the researchers acknowledge that it produces false positives. When two coders reviewed a random sample of 1,000 posts used to validate the system, they found that the model had wrongly flagged 4 legitimate posts as piracy.

The detection model built for the live tool is reported to be 98% accurate in testing. That figure comes from a controlled test set, however, and the paper does not publish a verified error rate for the channels that were flagged during its real-world run.

The researchers have open-sourced Anti-RIP and released the dataset publicly through GitHub. This means that Telegram and rightsholders can put it to use, if they like. Similarly, pirates will likely use AI tools to evade detection, triggering an AI-driven game of cat-and-mouse.

—

A copy of the paper, “Binge, Bot, Repeat: Unpacking the Ecosystem of Video Piracy on Telegram,” is available here. It is a preprint that hasn’t been peer-reviewed yet.

From: TF, for the latest news on copyright battles, piracy and more.

These channels are highly popular and generate many millions of views. While they only use clips from anime shows, often with narration and commentary, the publisher equates it to piracy.

In January, KADOKAWA tried to unmask three YouTubers, each with hundreds of thousands of subscribers, through a U.S. federal court. The company requested a DMCA subpoena, compelling YouTube to expose their identifying information.

These subpoenas are often a mere formality and only need a signature of a court clerk to be issued. However, in this case, YouTube could not simply hand over the requested information as three of the targeted YouTubers filed a motion to quash.

Motion to Quash

The three creators argued that their YouTube channels were not simple piracy operations. Instead, they described their videos as Korean-language commentary, review, and analysis content aimed at a Korean-speaking audience.

“The videos used selected portions of the underlying works in connection with Korean narration, explanation, summary, commentary, and creator-specific presentation. They were not uploaded as full episodes or as raw reproductions of the copyrighted works,” they wrote.

The three channels are certainly not small fish. Bongseop Kim and Woohyuk Yang both have more than half a million subscribers, while Youngyoon Ko is not far behind with nearly 350k followers.

All channels feature hundreds of videos, covering a wide variety of anime content. This includes the contested KADOKAWA titles, as summarized in the table below.

In their defense, the creators argue that, instead of competing with the original content, they are driving traffic to it.

All three included links to Korea’s licensed anime streaming platform Laftel in their video descriptions and pinned comments. According to analytics data shared by Kim, he generated 114,494 click-throughs to Laftel from his channel, with an 82 percent engagement rate.

The creators also pointed out that KADOKAWA had taken down their videos before, but that it failed to take any legal steps when they filed counter-notifications. As a result, the videos were restored by YouTube. This could mean that the current effort is used as a pressure tactic, they argue.

“Such repeated conduct suggests that the present subpoena may not be directed toward a genuine intent to pursue litigation, but rather reflects an overbroad or coercive use of the DMCA process,” the creators note.

Court Orders Fair Use Briefing

In April, the case took an unusual procedural turn when Judge Trina L. Thompson ordered both sides to submit supplemental briefing specifically on fair use. That’s rare in a DMCA subpoena case.

The creators, who filed their response after the deadline, again pointed out that they only used limited content without competing with the official releases.

Bongseop Kim, for example, noted that his video reviewed episode 4 of A Ninja and an Assassin Under One Roof, using roughly 15 percent of that episode, according to his filing.

In response, KADOKAWA’s attorneys pointed out several procedural errors. Since two of the three videos were no longer online, the company argued that the remaining one did little more than summarize the plot.

KADOKAWA’s brief also pointed out that the creators’ ‘pro se’ defense incorrectly argued that DMCA subpoenas should not permit unmasking where the alleged infringement is disputed and the videos have been removed.

That “reads like an AI hallucination, because it is wholly unsupported by the statute or case law,” the company’s attorneys wrote.

Narration and Summary Are Not Fair Use

In an order issued on July 17, Judge Thompson denied the motion to quash. The court found the factual record “sparse,” partly because the videos had been made private, and concluded that the creators’ videos “describe and narrate” the copyrighted work rather than criticize, parody, or alter it.

“Unlike criticizing, parodying, or otherwise altering copyrighted work, Movants’ treatment of Petitioner’s work is not the sort of creative and transformative use of a copyrighted work that the law permits,” the order states.

The ruling concludes that the creators are not protected by the fair use doctrine, as they “reproduce significant portions” of KADOKAWA’s content without being sufficiently transformative.

Thompson pointed to Barnes v. YouTube, a similar ruling from the same court in February, where a channel that narrated chapters of copyrighted books was denied the same fair use protection. Two rulings in a short time span suggest the court is skeptical toward the narration-and-recap video format.

Regarding the broader market effect, Thompson held that even when the financial impact of the YouTube videos is not substantial, the copyright owner’s exclusive right to reproduce the work is enough to weigh against a fair use finding.

YouTubers Appeal

The ruling on the DMCA subpoena is not a full review on the merits, but it shows that YouTube’s popular narration and commentary genre is not considered fair use by definition.

The case is not over yet, as the three YouTubers have filed a notice of appeal at the Ninth Circuit, which has yet to get underway. They also filed a motion to delay the unmasking of their personal information while the appeal is pending. This has yet to be decided.

The U.S. case is not KADOKAWA’s only enforcement action against anime summary content. In April 2026, the Tokyo District Court convicted 39-year-old Wataru Takeuchi for running a monetized website that posted detailed written plot summaries of anime and films, including Godzilla Minus One and the anime Overlord.

The man received a suspended 18-month prison sentence and a 1 million yen fine. His site reportedly earned around 36 million yen (~$225,000) in advertising revenue in 2023 alone.

For the three South Korean creators, there is no federal copyright claim yet. For now, this case is purely about whether YouTube must hand over their personal details or not.

—

A copy of the DMCA subpoena request is available here (pdf). Evidence in support of the motion to quash is here (pdf) and KADOKAWA’s supplemental opposition can be found here (pdf). The order denying the motion to quash is available here (pdf).

From: TF, for the latest news on copyright battles, piracy and more.

The “omnibus” order would make it easier and quicker to block new domain names and pirate site brands that pop up in response to blocking efforts.

According to the MPA, it allows Hollywood studios to seek blocking of any “structurally infringing audiovisual piracy services that meet defined criteria, without having to bring a fresh court application for each new domain or site name available in the future.”

Cited but Inaccessible

As we reported at the time, the order itself was nowhere to be found. The judgment was not on BAILII or in the National Archives, and none of the targeted ISPs had mentioned it. The MPA’s summary was the only public account.

The significance of the order was clear though. The MPA prominently featured it at WIPO and the UK ruling was also referenced and used as an example in a Canadian site blocking order that was handed down last month.

Canada’s Federal Court noted that the purpose of the order is to “address increased fragmentation in the Internet piracy landscape” that is the result of people switching from blocked to non-blocked sites and domains.

This “expanded scope” order, as Canada’s Federal Court called it, allows Hollywood studios and broadcasters to add unrelated sites to the blocklist, without having to go back to court. However, the UK order that it was based on remained unpublished, until recently.

This week, we spotted a new transparency filing from Cloudflare, which was added to the Lumen database. This filing references the UK omnibus order and also attaches a copy of it.

Omnibus Order Details Surface

That attachment is, as far as we know, the first public copy of the omnibus order. It is headed a “Public Version,” a copy with a confidential schedule removed, which confirms the broad powers the MPA described as well as other details.

The order, handed down by Mr Justice Mellor on 7 May 2026, was requested by Columbia, Disney, Netflix, Paramount, Universal and Warner Bros. The respondents are the UK’s six largest ISPs: BT, EE, Plusnet, Sky, TalkTalk and Virgin Media.

Like previous UK blocking orders, the ISPs are required to block access to a series of websites. In this case, the first part of schedule 1 specifically lists 345movie.nl and 456movie.nl, cineby.app, movies2watch.watch and streamm4u.com.co. These are the ‘seeds,’ followed by an open-ended category in part 2 of the same schedule.

Since 2022, UK court orders also support subsequent blockades of similarly branded websites. The latest order expands this power to a much broader list of pirate sites, regardless of the brand used, as long as these are similar in functionality.

“[E]ach Part 2 Target Website has essentially the same mode of operation as one or more of the Part 1 Target Websites in so far as it enables users to stream film/audiovisual content by indexing and aggregating links to unauthorised copies of such content,” the order reads.

There is a clear set of boxes newly added sites have to tick, so future expansions are not unlimited. In this case, all pirate movie streaming sites that are available in the UK and unresponsive to complaints, should be fair game.

The order does not come with a transparency clause that requires the list of blocked domains to be made public, which makes it impossible for the public and journalists to review the blocking efforts.

Voluntary Expansion

Importantly, adding new sites to the blocklist does not involve a judge. When the studios flag a new Part 2 site, they notify the ISPs that the conditions are met, and it is added. There is no court hearing or independent review.

The order states that the ISPs are “wholly reliant on the Applicants accurately identifying” the URLs to block, and that they “have no obligation to verify whether the Applicants’ or their agents’ determination is correct.” The studios are in charge of expanding the blockades.

These expansions are not limited to the ISPs either. As mentioned earlier, Cloudflare published the order without being a party. This is because the American company voluntarily blocks targeted sites if these use its CDN services. These blocks are limited to the UK, as we documented before.

As shown above, Cloudflare shows an Error HTTP 451 to UK visitors that try to access movies2watch.watch, explaining that the site is unavailable for legal reasons.

Guardrails and Limitations

The order is not without safeguards. In addition to the earlier mentioned expansion requirements, site operators or other people caught up in these blocking efforts have the right to object.

Importantly, rightsholders are also strictly prohibited from asking ISPs to block an IP address if the underlying server also hosts legitimate, non-infringing websites. This should prevent overblocking incidents.

Finally, there is also a relatively short time limit on the order, which expires after six months.

“This Order shall cease to have effect at 23:59pm on the date 6 months from the date of this Order, unless the Court orders otherwise,” it reads.

This doesn’t mean that the blocking order will cease to exist after that. In practice, it means that the Hollywood studios will return to court to request an extension. While there is no formal blocklist review, if there are any concerns they can be brought up then as well.

As far as we know, the judgment linked to the order has yet to be added to BAILII or the National Archives. Ironically, we only know of it because of the transparency efforts of Cloudflare, which isn’t even a formal party in the case.

—

Here is a copy of the public “omnibus” blocking order is available here (pdf). The Cloudflare blocking notice, published at the Lumen Database, can be found here.

From: TF, for the latest news on copyright battles, piracy and more.

Ahead of each new football season, broadcaster Canal+ goes to the Paris Judicial Court, requesting site blocking orders to stop pirate streaming sites and services.

Over several years, these blocking requests have grown from simple ISP blocks to cover DNS resolvers, CDN providers, VPN services, and search engines. Initially these orders were scattered, but a batch signed last month reveals a clear pattern.

On July 17, Vice-President Irène Benac signed the latest batch. The fourteen orders are split evenly between the 2026/2027 Champions League and Premier League seasons. These two batches cover every type of intermediary Canal+ has pursued since 2022, all in one coordinated action.

ISPs, DNS, CDN, VPNs, and Search Engines

The Premier League orders target 47 domain names and the Champions League orders cover 26 domain names. This includes ones using popular brands such as Totalsportek, LiveTV, Kevinsport, as well as various IPTV gateways. An overview of all domain names is available below.

The ISP orders will have the most direct impact. They cover France’s largest providers, including Orange, SFR, Free, and Bouygues Telecom, who all have to block access to the listed domain names. The other orders aim to cover potential bypasses.

If subscribers try to get around these ISP blocks by switching to an alternative DNS resolver, the orders against Google DNS, Cloudflare DNS, Quad9 and DNS4EU prevent this. The latter two did not present a defense in court.

The Cloudflare orders are not limited to the 1.1.1.1 DNS resolver either. The Internet infrastructure company must also block the domains across its CDN, and its reverse proxy service under the same rulings, by whatever technical means it chooses.

The orders add search engines in the same sweep. Google and Microsoft Bing are ordered to de-index the domains, so they no longer surface in results for users in France.

Finally, VPN services are covered as well. Canal+ secured orders against Proton, CyberGhost, and ExpressVPN, to shut down another bypass. That part of the blocking batch was also the most heavily contested, as covered below.

All the blocks are dynamic. This means that domains can be added throughout the season once ARCOM, France’s audiovisual regulator, approves them. The Premier League measures run from August 22, 2026 to May 30, 2027, while the Champions League blocks expire on June 5, 2027.

VPN Defense Fails

Canal+ previously named five VPN providers in previous seasons. This round it pursued only three, dropping NordVPN and Surfshark without explanation.

The most detailed defense came from CyberGhost and ExpressVPN. They first asked the court to pause the case pending a referral to the EU Court of Justice. This is the Anne Frank Stichting case, which was decided shortly before the Paris ruling and shielded VPNs from liability in a copyright dispute.

The Paris court already refused to pause the case, explaining that the Anne Frank case concerns a different directive and a publication that was itself lawful, which is different from the pirate streaming sites that are at stake here.

The VPN providers further argued that Article L. 333-10 of the Sports Code conflicts with the EU E-Commerce Directive and should be set aside. The court disagreed, stressing that this is a dispute between private companies. Since an EU directive has no “horizontal direct effect,” a national law can’t be disapplied on that basis.

The court also spelled out why a neutral intermediary can be required to take action, as it enables the transmission of infringing content. The “mere act of serving as a bridge enabling access to the infringing sites fulfills the transmission function,” the ruling states (translated).

The court stressed that, even though an intermediary may act passively and neutrally, it can still be an essential link in transferring infringing data.

Google also pushed back in response to the DNS and search orders. It questioned whether Canal+ had enforceable exclusive rights in France, and argued that the Canal+ companies had not proven repeated infringements per channel for every disputed domain. The court rejected both these points.

Up Next: Automated Real-Time Blocking

The orders were issued on July 17 but haven’t been picked up in the press, as far as we know. With hindsight, the timing is notable, as they were handed down just four days before the French Parliament adopted a new sports law that rewrites the blocking process.

As we reported previously, the law replaces the current manual system, where ARCOM agents verify each domain before a block, with an automated process that can add new targets in real time during a live broadcast. ARCOM’s agents keep a review role, but after the fact rather than before.

The law has not yet been implemented; that’s expected later this year. For now, these orders still run under the old framework. However, if the new law is implemented, Canal+ and other rightsholders will likely switch as soon as they can.

—

1. empire-sport.live
2. empire-sports.store
3. kevinsport.org
4. kzontop.site
5. sports24.cc
6. sportsonline.vc
7. streamonsport.art
8. witv.team
9. kevinsport.lat
10. kevinsport.quest
11. lovetier.bz
12. kevinsport.homes
13. kzontop.space
14. wilderness.click
15. v3.sportssonline.click
16. 7y306yg5flk3x4.dynmaspect.net
17. j7x31108tgeg77x.dynmaspect.net
18. woundsilk.net
19. swopglow.net
20. iptv-abonnement.tv
21. tv.business-cloud-8k.ru
22. cf.orion-2026.xyz
23. ott-premium.tv
24. smartippon.com
25. iptvpremium-europe.com
26. line.snssmarters.store

From: TF, for the latest news on copyright battles, piracy and more.

The EU heard these calls and in 2023 it published a targeted recommendation, “encouraging” member states to introduce measures to facilitate prompt takedowns of live streams.

This advice was largely seen as a disappointment by rightsholders, since it was not binding. While some EU member states have increased their enforcement efforts since, with Italy’s “Piracy Shield” as the prime example, others took no notable action.

EU Study Proposes 30-minute Takedown Timer

A new study commissioned by the European Parliament’s Committee on Legal Affairs (JURI) argues that the EU-wide response, as it stands, is not strong enough.

The report, titled “Countering online piracy of sports and broadcast in the EU”, is written by Professor Giovanni Maria Riccio of the University of Salerno. It recommends that the EU move from voluntary guidance to a binding Regulation that’s aimed specifically at combating live-streaming piracy.

“The current EU response to live-content piracy remains fragmented and not fully adapted to the speed and technical complexity of live broadcasts. Existing rules provide useful tools, but they do not yet ensure consistent and timely enforcement across Member States,” the study concludes.

The study recommends a swift takedown obligation for streaming intermediaries, requiring these to take action within a certain time limit. As an example, it mentions 30 minutes, following the example of Italy’s Piracy Shield.

This takedown requirement should not only apply to Internet providers. Other intermediaries including third-party DNS resolvers such as Google and OpenDNS, VPN providers, and CDNs such as Cloudflare, should also take action.

“It would likewise be desirable for the personal scope of application to extend to the entire chain of intermediaries technically involved in the distribution of unauthorised content – including providers of content delivery networks, VPN services, dedicated servers and DNS resolution systems,” the study recommends.

The report notes that courts in Europe have already started to issue broader injunctions. This includes the Paris Judicial Court, which required DNS resolvers and VPN providers to block pirate sites.

An AGCOM in Every EU Member State

The report models a lot of its suggestions after the Italian “Piracy Shield” legislation, which has been widely criticized by opponents. This applies to the 30-minute clock and the broad range of intermediaries it covers, as well as the oversight body.

In Italy, the administrative AGCOM agency handles pirate site blocking procedures and the report suggests that all EU member states should have their own version of AGCOM.

“[I]t is advisable for each EU Member State to establish an independent administrative authority – or, where appropriate, to confer the necessary powers upon an existing one (again on the example of AGCOM) – to ensure consistent oversight, effective enforcement, and regulatory coordination,” it suggests.

Blunt Tools

While the study leans heavily on the Italian model, it doesn’t pretend that blocking is a perfect fix. It openly admits that these often-used anti-piracy tools have their shortcomings.

“IP and DNS blocking remain inherently blunt instruments,” the report warns, noting that they can’t reliably separate unlawful streams from legitimate services that share the same infrastructure.

That’s the overblocking problem that has plagued Piracy Shield from the start, where blocks aimed at pirate streams have taken down access to unrelated sites and services.

Curiously, the study makes part of its case using research that points the other way. For example, it cites an empirical study published by the Open Observatory of Network Interference (OONI) which found that following a LaLiga blocking order in Spain, more than 554,000 domains were blocked at least once during football match broadcasts. This included websites from Amnesty International and the ACLU, UNICEF, UNHCR, the Australian Senate, and Amazon S3 endpoints.

It also cites a report from the Centre for European Policy Studies (CEPS), which TorrentFreak covered earlier this year, that called for banning IP-based blocking, while also making rightsholders liable for collateral damage.

The report references those warnings, but recommends rolling out the Piracy Shield approach across the entire Union anyway. To keep it in check, it proposes safeguards such as limiting blocks to the duration of the live event, keeping judicial or administrative oversight in place, and sticking to the proportionality standards set by the EU Court of Justice.

Fragmented and Expensive Options

Finally, the report recognizes that no amount of blocking will kill piracy if watching sports legally is an expensive hassle.

It notes that fragmented and expensive legal offerings are a key piracy driver. This often means that fans are forced to sign up for multiple subscriptions, run into geo-blocking barriers, or face other artificial hurdles just to enjoy their favorite sports.

To improve the demand side, the study calls for more attractive and accessible legal options.

For now, this all remains a wishlist. The study is third-party advice, not law, and it arrives while the Commission’s review of the Copyright in the Digital Single Market Directive is still ongoing. That includes input from both pro- and anti-blocking advocates.

—

A copy of the study, “Countering online piracy of sports and broadcast in the EU”, is available here (pdf).

From: TF, for the latest news on copyright battles, piracy and more.

The site was launched more than two decades ago and the brand is still going strong today, as it’s traditionally one of the most visited torrent sites.

NYAA’s popularity hasn’t gone unnoticed by rightsholders. The MPA previously targeted the site’s GitHub repo, although that was later restored. Additionally, Japan’s Content Overseas Distribution Association (CODA) has been trying to disrupt its activities for many years.

Among other enforcement efforts, CODA teamed up with Japan’s Ministry of Economy, Trade and Industry (METI) in a Cross-Border Enforcement Project to identify NYAA uploaders. This effort recently resulted in a high-profile arrest.

Police Arrest NYAA Seeder

Last week, the Cyber Investigation Division of the Kyoto Prefectural Police, working with Fushimi Police Station, arrested a 56-year-old unemployed man from Sagamihara, Kanagawa Prefecture. Kyodo News named the suspect as Masakazu Ono.

CODA announced that the man allegedly was the “first uploader” or initial seeder for the NHK drama ‘Midnight Taxi.’ The series is copyrighted by NHK and WOWOW, both connected to CODA member companies.

According to the police, the man allegedly uploaded roughly a thousand NHK recordings over some five years. He reportedly admitted the offense, noting that he wanted people around the world to see NHK’s work.

As the initial NYAA seeder, the suspect allegedly had a full copy of the file, suggesting that he might be the original source for the leak. CODA notes that the arrest is part of a landmark case.

“CODA regards the arrest of this first uploader as a landmark case in addressing copyright infringement involving torrent sites,” the group announced, noting that more actions may follow.

“While closely monitoring the details of the case as they are revealed through future investigations and criminal proceedings, CODA will continue to work toward the proper protection of copyright and implement effective measures against similar acts of infringement.”

Sankei previously reported that Kyoto police opened the investigation around April 2024, which also suggests that this case isn’t just about tracking an IP-address.

Hacker Tool Didn’t Touch the Swarm

CODA partially credits the successful enforcement action to an analysis tool developed by the Japan Hacker Association, a cooperating organization in its Cross-Border Enforcement Project.

The mention of this tool triggered immediate speculation in the anime community that it simply logged IP addresses inside a BitTorrent swarm, the same technique copyright holders have used against file-sharers for close to two decades, and that the suspect had failed to use a VPN.

However, CODA says that isn’t what happened.

“The tool does not analyse activity within the BitTorrent swarm itself. Instead, it analyses how data moves through torrent sites, such as index sites and tracker sites,” CODA informed TorrentFreak.

While this answer rules out a simple torrent-logging tool, it raises many new questions. What is this tool tracking exactly, how did it identify the suspect? After all, analysis at the index and tracker layer does not ordinarily produce the address of a broadband subscriber.

CODA notes it is unable to disclose the specific analytical or investigative techniques, as that could negatively impact future investigations and enforcement activities. It stressed that the suspect was ultimately identified through an investigation conducted by the Kyoto Prefectural Police.

Three Leechers Were Caught

While the arrest of the seeder is the lead angle, CODA informs us that it wasn’t the only enforcement action.

“While the primary objective of this case was to identify and apprehend the first uploader, three secondary uploaders (i.e., leechers) were also apprehended as part of the investigation,” CODA said.

The group later clarified that these three were handled by a different police force, in a subsequent action connected to the same site.

Local reports say that three men, in their forties and sixties, were referred to prosecutors on the same charge, rather than arrested. They allegedly downloaded the files, which BitTorrent shares back to other users by default.

That last detail is important, as this suggests that anyone who shared the torrent could have been caught. After all, BitTorrent clients share back by default, including the qBittorrent software the main suspect reportedly used.

CODA made the same point in its public announcement, warning that many torrent clients upload automatically, so simply using them can result in criminal liability under Japanese law. This type of messaging also helps increase the deterrent effect of the enforcement action.

Not Over Yet

CODA declined to say whether it’s also pursuing NYAA’s operators, whether more uploaders have been reported to police, and whether further arrests are expected this year, citing the ongoing investigation.

In April, CODA signed memorandums of understanding with French media regulator ARCOM and the Alliance for Manga and Webtoon, and it also renewed its agreement with the MPA two weeks later. We asked whether these deals cover the sharing of data that identifies individual uploaders, but that question remained unanswered.

CODA pointed to “the confidentiality clause contained in the MOUs” and said it couldn’t disclose the level of intelligence that it shares with other organizations.

For now, NYAA remains online. Based on SimilarWeb data, the site was good for more than 22 million visits last month, with more than a third of these originating from Japan. This means that plenty of potential targets are still out there.

From: TF, for the latest news on copyright battles, piracy and more.

The operators threw in the towel, and in July the French Gendarmerie arrested twelve people it accused of running the operation.

However, someone apparently still sees value in the brand.

Until recently, visitors to yggtorrent.org landed on a domain sale pitch. The domain name, bundled with 59 others into what the listing called a “comprehensive portfolio” and an “established brand with millions of users,” had a substantial $700,000 asking price. That’s just for the domains.

The twelve arrests came after the domain went up for sale, which might suggest the deal would fall through. We can’t confirm this either way, but new messaging on the official domain shows ‘someone’ is attempting to make a comeback.

‘Grand Return’

The yggtorrent.org domain currently redirects to yggtorrent.to, where a countdown clock ticks toward a relaunch on September 1 at midnight Paris time. An accompanying message explains that a ‘new team’ has taken over.

“YggTorrent rises from the ashes,” the (translated) page reads. “The largest French-language sharing platform is making its grand return. The catalogue, the community, the Ygg spirit: nothing has changed, everything is ready.”

The comeback announcement notes that the YggTorrent community still comprises 6 million members, who have access to over a million torrents. How many of the former users plan to return after the hack and the police arrests has yet to be seen, but the tracker suggests that YggTorrent’s remnants are still going.

‘Nothing Has Changed’

The comeback teaser notes that ‘nothing has changed’ and it points to a tracker status page which shows that many YggTorrent torrents are still being actively shared.

At the time of writing, it reported 455,300 torrents and more than 1.5 million connected peers, roughly 94% of them seeders. This suggests that the ‘new team’ that controls the domain also has a working tracker, or access to the old one.

Who’s in charge of the new team remains a mystery. The domain name WHOIS data shows no recent changes. This doesn’t mean that it didn’t change owners, as the registrar accounts might have been sold in full, but there are no public traces of that.

Whether the teased comeback is a true revival, a potential scam, or anything in between remains unclear. For now, the clock is ticking, and with the French police not ruling out further arrests, they might be keeping an eye on the comeback too.

From: TF, for the latest news on copyright battles, piracy and more.

A recent federal lawsuit filed in a Florida federal court, shows that this can result in a sweeping piracy blocking that does real damage to the targeted platforms.

The case was originally filed by the Mexican broadcaster TelevisaUnivision (TU) in early June. The case was relatively targeted, naming the IPTV services Thunder TV, Sunset TV, Pop TV, Kaelus TV, and Tele Latino, as well as their alleged operators.

The broadcaster argued that these pirate IPTV services threatened its business. TU holds the World Cup rights for sixteen Latin American territories, and its license with FIFA requires it to keep the Mexican broadcast signal from reaching the United States. The pirate services, it argued, put it in breach of that contract, exposing it to “termination and forfeiture of hundreds of millions of dollars in payments.”

To stop this immediate threat, the company requested a temporary restraining order, hoping to shut down the IPTV services effective immediately.

Judge Kathleen Williams granted the temporary restraining order on June 5, one day after the case was filed, without hearing from any of the defendants. The initial order prohibited the defendants from infringing TU’s own copyrighted works, which include telenovelas and other programming, and from using its trademarks, including all content linked to its licensed World Cup broadcast.

Importantly, the order also targeted third parties acting “in active concert,” including ISPs, hosts, CDNs, domain registrars, registries, app stores, ad networks, social platforms, search engines, and payment processors. These were ordered, on TU’s request and with notice, to disable the listed domains and IP addresses and unmask whoever was behind them.

The order specifically names various intermediaries such as Cloudflare, Namecheap, and GoDaddy, and directed financial players to take action. Mexican bank BBVA Bancomer and the payment channel Spin by OXXO were ordered to freeze funds and disclose the identities behind the accounts.

On July 24, Judge Williams converted the TRO into a preliminary injunction. By then the order had grown into something far larger than the case that started it, and that could only be the beginning, as the injunction appears to be self-expanding by nature, in multiple ways.

Injunction Covers Future Targets

While the injunction is noteworthy for many reasons, the most striking feature is that it’s specifically written to include things that don’t yet exist.

That starts with the content it protects. The order isn’t limited to TU’s current catalog or the World Cup rights, it covers the infringement of “any copyrighted works or broadcasts that Plaintiffs may in the future produce, license, or acquire rights to transmit.”

In other words, it covers future copyrights that did not exist when the order was signed.

The same applies to the pirate services themselves. The injunction defines its target as the named IPTV operations “and any comparable system,” whether “currently in existence or developed in the future,” and it applies “regardless of the branding, domain name, or technical configuration used.”

This effectively covers a pirate site or service that hasn’t launched, under a brand that is currently unknown, on a domain name that hasn’t been registered yet. As long as TU says it carries its pirated content, it can be targeted.

The injunction goes beyond pirate streaming targets too and specifically notes that the BitTorrent protocol and other content devivery categories are also included.

Self-Expanding Without a Judge

The injunction does have more novel characteristics. For example, one of the clauses allows TU’s lawyers to add these additional targets by filing a sworn declaration, without needing approval from a judge.

“Plaintiffs may supplement Schedule A by filing a verified declaration identifying additional infringing services, IP addresses, domains, applications, or platforms, which supplementation shall take effect immediately upon filing and service,” the injunction reads.

This effectively makes it a dynamic injunction, instead of a fixed one. Rightsholders have obtained dynamic blocking orders for years in the UK, Spain, and elsewhere in the EU, but for the United States this is new.

The broadcaster has already used the power twice. A first supplementation was filed on June 12. A second, filed on July 10, added an entire tier of piracy brands that were never named as defendants: XuperTV, Tarjeta Roja, Pirlo TV, Roja Directa, RBTV, Strikeout, and StudioMax.

Domain Registrars Suspend Domains

While the injunction covers a wide range of intermediaries, including Internet providers, it has not been used as a typical ISP site blocking order. Instead, it appears to be used mostly to target domain registrars and Cloudflare.

To get an idea of the effect this had, TorrentFreak ran a WHOIS check on many of the targeted domains this week.

Of 474 domains queried, 203 have a clientHold status, indicating that the registrars suspended these. One domain was suspended by the registry and the rest of the domains were not suspended.

Which registrars complied is largely explained by the location of the registrars. U.S.-facing registrars acted on nearly everything, with NameCheap and GoDaddy taking action on most domains.

Meanwhile, the domains that were left untouched are linked to foreign registrars, including Russia’s REGTIME-SU and the Dutch company Registrar.eu, which both hadn’t suspended a single listed domain according to our information.

This is the expected shape of the result rather than a failure of it. An order that binds “all persons in active concert” still depends, in practice, on whether the party served answers to a U.S. court. Where the registrar does, the domain goes dark. Where it doesn’t, it stays up.

The timing of the suspensions makes sense too. More than 90% of the suspended domains were updated during either the days around the June 5 restraining order, or the days after the July 24 injunction.

It is worth stressing that in addition to domain suspensions, the services may have also gone offline because other parts of their infrastructure were hit. That includes the hosting services that are listed in the injunction, as well as Cloudflare.

A Dedicated Cloudflare Section

Cloudflare stands out as the only intermediary to receive its own tailored rules, detailed in several pages of the order.

The company is directed to disable its CDN, reverse-proxy, and DNS service for a long list of domains within 24 hours. It must also hand over origin-server IP addresses, DNS records, account holder names, payment details, and 14 days of request logs for the targeted domains.

In addition, Cloudflare must check whether any other account in its system shares an email address or billing name with a flagged account, and to unmask those accounts too.

Cloudflare did secure some limits. It only has to produce data it already holds, it has no duty to monitor content, and its compliance is not an admission of liability. This is similar to the “no fault” injunctions we see in Europe.

Dropped Hosting Companies and More Intermediaries

When the complaint was filed early June, it also named the hosting companies Enzu, Dash Networks, DigitalOcean, and HostGator as defendants. All four were targeted by the restraining order, but they were voluntarily dismissed after less than two weeks.

Beyond these, the injunction named dozens of other intermediaries, from registrars and hosts in Russia, Bulgaria, Romania, Iceland, and Iran, to mainstream services such as GitHub, Akamai, and Linode. They are all named because they allegedly provided services to the pirate operations.

As far as we can see, none of the defendants, operators or intermediaries, ever appeared in court to object.

The broad injunction remains valid until the case is decided, and TU can keep adding names, brands, and domains to it for at least two years. Whether there will be any transparency regarding these seemingly unlimited expansions is not immediately clear from the legal paperwork.

—

A copy of the preliminary injunction, issued by the U.S. District Court for the Southern District of Florida, is available here (pdf). Magistrate Judge Enjoliqué Lett’s Report and Recommendation can be found here (pdf), and the original June 5 temporary restraining order here (pdf).

From: TF, for the latest news on copyright battles, piracy and more.

Run by ESA’s Science Program, it hosts mission-support pages and public data archives for Gaia, Euclid, XMM-Newton, and dozens of other missions, backed by a science archive that now runs to more than a petabyte of data.

European Space IPTV Recommendations

This valuable archive provides key information for researchers and, more recently, it also started to appeal to people who are looking for a cheap pirate IPTV subscription. This clearly isn’t official ESA material, but an exploit by scammers who uploaded hundreds of scammy PDF files to the site’s repository.

A simple site:cosmos.esa.int search shows the scope of the problem. In addition to genuine results, such as a notice that the Gaia satellite was switched off in March 2025, Google returns a series of documents with titles including “Top 10 IPTV Providers Right Now: The Definitive 2026 Rankings” and “Best IPTV Service Provider in the USA 2026…”

Because ESA’s .int domain has a good reputation and high authority, these scammy PDF files also rank well in regular search results. Those who search for the best premium IPTV subscriptions for Android will get the ESA domain as the first result through a featured Google snippet.

Google’s AI Overview is also picking up ESA’s recommendations for the top IPTV services, with information that comes straight from the scammers’ PDFs.

IPTV, Instagram Followers, and Free Robux

There are hundreds of these results, with many new ones being added while we write this article. The PDFs we checked don’t appear to be malicious. They function as advertisements for pirate IPTV services. Whether these indeed offer what they promise is unknown, but visiting these hyperlinked URLs is not advised.

The IPTV ads are only part of the problem. The same corner of ESA’s portal also hosts unrelated scam content, including a “Free Coin Master Spins Guide” aimed at mobile-game players, “Free Instagram Followers,” and “Free Robux codes.” These free offerings undoubtedly come at a cost and should be avoided too.

The broad mix of scammy offers shows that ESA’s website is being exploited more broadly. How these people gained access to the server is unknown. According to ESA’s documentation, uploading requires site-editor access to the Cosmos portal, but there might be a weakness in the system.

Known SEO Exploit

The goal of these PDFs is to rank high in Google search results for popular terms. This is a known SEO hack that we have seen numerous times before.

Last year, for example, the European Commission’s Eurostat portal was exploited in the same way, with scam PDFs climbing to the top spot for terms like “best IPTV providers of 2025.”

To find out more, TorrentFreak reached out to ESA yesterday, asking whether it was aware of the documents, how they were uploaded, and how long they had been online. We will update this article if we hear back.

At the time of writing, the IPTV documents remain live on the Cosmos portal. If history is any guide, cleaning them up won’t be the end of it. They will either come back, or they will resurface on another website, repeating the same trick.

From: TF, for the latest news on copyright battles, piracy and more.

A Texas federal jury found the Internet provider liable for willful contributory copyright infringement and ordered it to pay $46.8 million in damages, after Grande failed to disconnect pirating subscribers.

The verdict was a milestone in the recording industry’s campaign to hold ISPs responsible for their subscribers’ piracy. The ruling was later affirmed on appeal by the Fifth Circuit, which also vacated the damages award, sending that question back for a new trial.

That new trial might not come after Cox v. Sony changed the playing field. In March, the Supreme Court reversed a billion-dollar verdict against Cox Communications, holding that an Internet provider is not liable for contributory infringement simply because it keeps serving subscribers it knows have been flagged for piracy.

A few weeks later, the Supreme Court also wiped out the Grande verdict, ordering the Fifth Circuit to reconsider the case in light of the new standard.

Labels Offer to Walk Away

That reconsideration process was set in motion but, according to new filings submitted by both parties last week, it appears that the record labels are ready to throw in the towel.

In their supplemental letter brief, filed on Wednesday, the record labels effectively inform the court they are done.

“The Cox decision represents a material intervening change in law governing contributory copyright infringement by internet service providers. Plaintiffs do not
intend to litigate the merits of this case further in light of the new standard,” the labels write.

This offer to retreat is in line with earlier decisions in ISP liability cases. Since the Cox ruling, the labels have already dropped similar lawsuits against Altice and Verizon, for example.

The music companies say they informed Grande of their “willingness to dismiss the case voluntarily”. That would be with prejudice and with both parties paying their own bills. However, Grande does not agree.

Grande Wants More

Instead of simply dismissing the matter, Grande prefers to end the case with a clear win. In their own letter, the ISP asks the Fifth Circuit to “render judgment in favor of Grande” and declare that the labels cannot win under the new standard.

“The Court should render judgment for Grande. Because the Labels cannot prove contributory infringement under Cox, there is ‘no clear benefit to remanding
this case to the district court’,” the ISP argues.

This isn’t just a matter of principle, there’s a significant amount of money at stake too. To postpone that payment of the $46.8 million judgment during the appeal, the company had to post a bond, and it says the premiums added up.

According to the labels, Grande previously communicated that it incurred roughly $4 million in bond premium costs.

The record labels are pushing back hard against this potential multi-million dollar bill. They accuse the ISP of needlessly inflating its own costs by waiting over nine months to discharge the bond after the initial damages award was vacated.

In addition, the labels argue that any potential payout should be offset by $191,618 in unpaid sanctions that Grande still owes them for filing a “meritless” motion earlier in the litigation.

It’s worth stressing that Grande has not mentioned an exact cost figure in its letter. The exact amount will likely be detailed later, if it gets that far.

It is now up to the Fifth Circuit to decide whether this case should end quietly, by simply vacating the earlier judgment and splitting the costs. Alternatively, it can grant Grande a formal win on the merits, with potential compensation for the costs it made.

—

The record labels’ supplemental letter brief, filed last week, at the U.S. Court of Appeals for the Fifth Circuit, is available here (pdf). Grande’s supplemental letter brief can be found here (pdf).

From: TF, for the latest news on copyright battles, piracy and more.

From the start of the FIFA World Cup through the final, U.S. authorities and their partners seized more than 1,000 domains, while close to 2,000 more were blocked across Latin America.

The Motion Picture Association, which coordinated the effort through its Alliance for Creativity and Entertainment (ACE), previously praised the operation as a massive success. However, in an op-ed published by RealClearMarkets yesterday, MPA’s leadership admits that domain seizures have their limitations.

“It Does Not Dismantle the Business”

The op-ed, titled “Blowing the Whistle on World Cup Piracy,” is written by MPA Chairman and CEO Charles Rivkin and IPR Center Director Ivan Arvelo. It celebrates the operation as a clear success, noting that the seized sites racked up more than 156 million visits in July alone before they were taken offline.

Indeed, disrupting millions of potential visits has an impact. However, the crackdown also had its limitations, as it does not take out the operations running these sites. These limitations are also recognized in the op-ed.

“A takedown is essential, and it can interrupt access for a moment. But it does not dismantle the business behind it,” Rivkin and Arvelo write.

This is not the type of admission you expect from the MPA or the IPR Center, who just completed the largest piracy domain seizure round in U.S. history. However, the framing does nicely set up the policy argument that follows. At the same time, it corroborates our earlier coverage.

The Russian and Iranian Domains That Survived

Two weeks before the op-ed appeared, we reported that several major pirate streaming brands had switched to fallback domains on Iran’s .ir country-code TLD, in an apparent effort to move to infrastructure that is harder for U.S. law enforcement to reach.

Iranian domains have significant drawbacks of their own, especially for those operations who want to run ads, so there is no mass exodus. However, many that migrated to the .ir TLD remain online today.

A check this week shows that Buffstreams, Footybite, Totalsportek, and Nflbite brands all remain reachable on their .ir fallbacks. None have been suspended or seized, which is no surprise since Iranian authorities are not eager to cooperate with the U.S.

Meanwhile, the largest sites were never dependent on U.S.-controlled infrastructure to begin with. A popular Futbol-libres domain, for example, operating on the Russian-run .su registry, was not among the seized domains and reportedly drew more than 200 million visits in July, according to Similarweb data. That is more than the 156 million visits the MPA counted across all seized domains.

MPA Sees More Attack Vectors

While domains are just part of a site’s infrastructure, it is clear that domain seizures have their limitations. This is not news to the MPA and ACE, who are constantly tracking these domain name migrations.

Speaking with TorrentFreak, MPA’s Executive Vice President and Chief Content Protection Officer Larissa Knapp notes that these familiar tactics are not without weaknesses.

“Piracy operators regularly move domains and infrastructure in an effort to evade enforcement. The migration to .ir domains is another example of that tactic, but changing a domain does not put an illegal operation beyond reach,” Knapp says.

“These services still depend on identifiable operators, hosting, distribution, payment systems, and other technical and commercial infrastructure. That is why ACE works closely with law enforcement and industry partners around the world to identify and disrupt the people and infrastructure that keep these criminal networks operating.”

Knapp suggests that pirate sites rely on a broader infrastructure than domain names alone, so MPA and ACE try to find other weak spots to bring them down. And that’s not all.

Pirate Site Blocking as Solution

This brings us back to the op-ed, which ends with a clear policy ask. Rivkin and Arvelo argue that domain seizures alone cannot solve live sports piracy, and that the U.S. needs “every tool” available to fortify its anti-piracy work.

“Chief among them would be judicial site blocking in the U.S.,” they write, describing it as an anti-piracy tool that’s already used in nearly 60 countries.

The MPA and IPR Center heads see domain seizures as part of a broader enforcement toolbox, which should be complemented with site blocking. While Iranian and ‘Soviet Union’ domains are not mentioned, these could be key site blocking targets.

The site blocking call comes at a time when U.S. site blocking legislation is high on the political agenda again. On June 30, the House IP subcommittee held a hearing on online copyright enforcement, where Chairman Rep. Darrell Issa signaled that bipartisan, bicameral agreement was near.

Thus far, such a unified U.S. site blocking bill has yet to be introduced, but it seems to be only a matter of time. That also applies to the overblocking concerns, which will undoubtedly come, as will the eventual evasive tactics of pirates.

From: TF, for the latest news on copyright battles, piracy and more.