Every year, the U.S. Trade Representative (USTR) invites rightsholders and other stakeholders to suggest foreign sites and services for its list of “notorious markets.”

The annual review doesn’t make any legal findings. Instead, it aims to encourage the listed services, and the countries they operate from, to take proper action against piracy and counterfeiting.

Last week, the RIAA responded with a submission that mostly mentions familiar targets. It lists torrent sites, stream-rippers and cyberlockers, many of which were flagged in previous years. There are some notable newcomers too, including Anna’s Archive.

Anna’s Archive and the Spotify Scrape

In December last year, the shadow library announced that it had downloaded 86 million music files from Spotify, plus metadata for 256 million tracks. This prompted an aggressive legal response.

A few days later, the RIAA coordinated an emergency court action on behalf of its members and Spotify, which resulted in a temporary restraining order against the site. Following this order, domain registry PIR suspended the site’s .org domain, and RIAA says Cloudflare also stopped providing services to the shadow library.

Following this crackdown, Anna’s Archive initially reported that its Spotify metadata torrent was “unavailable until further notice.” In February, however, the site quietly released roughly 3 million music files.

While the torrents for those releases were delisted shortly after, the lawsuit continued, with the labels and Spotify on the winning end.

“On April 14, 2026, RIAA and Spotify obtained a $322 million default judgment against the unknown operators of Anna’s Archive,” the RIAA writes in its USTR submission.

Despite the legal victory, the music group stresses that Anna’s Archive remains available through its .gl, .pk and .gd domains.

The RIAA isn’t the only rightsholder group that flagged the shadow library to the USTR. The Association of American Publishers (AAP) also lists Anna’s Archive as a “notorious” online site (pdf). According to the publishers, traffic to Anna’s Archive’s domains grew 28% despite their enforcement efforts, to an average of 41 million visitors a month.

The AAP also highlights that Anna’s Archive offers AI developers high-speed access to its collection, in exchange for what the site describes as an “enterprise-level donation.”

Voice Clones and Leaks

The AI angle also applies to newcomer Lalals, a service operated by a company based in the United Arab Emirates. This AI platform allows users to change a vocal recording to sound like popular artists such as Taylor Swift and Drake, without their permission.

According to the RIAA, that infringes the artists’ rights of publicity and likely also infringes its members’ rights in the sound recordings that were used to train the voice models.

“The sound recording artists whose voices are being exploited include Taylor Swift, Drake, Ariana Grande, Bruno Mars, Ed Sheeran, Lady Gaga, Chris Martin, and Rihanna, among many others,” RIAA writes.

In the cyberlocker category, meanwhile, Mega is a familiar target. The European Commission added the file-hosting service to its own piracy watch list in 2022, and the RIAA now lists it among the notorious markets it wants the USTR to include.

“While Mega removes content that is specifically reported by rights holders, it does not implement effective measures to prevent the re-upload of infringing material or deter repeat infringement,” the RIAA writes.

RIAA stresses that users of the platform continue to share pre-release music and AI-related content, such as vocal models and cloned recordings. On what grounds Mega is required to prevent reuploads is not mentioned by the music group.

Several new cyberlockers are flagged for their role in pre-release piracy as well. These include Gofile, Sendgb and Imgur.gg.

Links to these services are reportedly shared on music leak forums, and the RIAA mentions Leaked.cx by name in the entries for Sendgb, Imgur.gg and Pixeldrain, which was already included in last year’s submission.

This Imgur.gg hosting platform doesn’t appear to be affiliated with the popular image host Imgur. When we checked, the site didn’t list any company details, but it did promote a music streaming app “Built by the imgur.gg team.”

RIAA goes on to mention that Telegram and Discord remain the primary mechanisms through which pre-release music is distributed. That accusation isn’t new, as the passage is nearly identical to last year’s submission.

Familiar Names, Familiar Words

Many other entries are familiar as well. The Pirate Bay, 1337x and RuTracker are listed in the torrent category, Rapidgator and Krakenfiles are flagged as cyberlockers, and Y2mate and Savefrom remain in the stream-ripping section.

Krakenfiles is still listed, even though the RIAA notes that it removed its upload functionality this year.

Whether any of the newly nominated sites will make it onto the USTR’s final list has yet to be seen. Last year, the USTR included several of the RIAA’s picks, including Y2mate, Savefrom and Krakenfiles.

Before the USTR makes its decision, the sites and services mentioned in the submissions can respond with rebuttals of their own, which Mega plans to do.

Responding to our request for comment, the company says that it removes reported content and permanently closes the accounts of repeat infringers, as is required under U.S. law.

According to Mega, infringing activity represents a small fraction of the overall use of the service. Last year, it processed close to 3.9 million copyright takedown requests and removed links represented around 0.002% of the more than 208 billion files stored by its 338 million registered users.

In the same period, 5,627 accounts were suspended under its “three strikes in six months” repeat infringer policy.

“Mega respectfully disagrees with the RIAA’s characterization, which fundamentally mischaracterizes the nature of the service, and will be filing its own submission with USTR setting out why its inclusion on the Notorious Markets List would be unwarranted,” Mega’s Legal and Compliance Manager Csaba Szabó informs TorrentFreak.

—

The RIAA’s full 2026 list of “notorious” sites and services can be found below, and the full report is available here (pdf). The cursive listings marked (new) are newcomers and those that were removed are crossed out. The RIAA stresses that this list is a non-exhaustive overview.

Stream-Ripping Sites

– Y2mate.gs (formerly y2mate.nu)
– Savefrom.net
– Ssyoutube.com
– Notube.net
– Y2mate.is (new)
– Snaptube app and related domains

Music Download/Streaming Sites

– Mp3.pm (new)
– Tubidy.cool (previously listed as a stream-ripper)
– Scnlog.me
– newalbumreleases.net
– waploaded.com
– hiphopkit.com

BitTorrent Indexing Sites

– ThePirateBay.org
– 1337x.to
– Rutracker.org

Cyberlockers

– Rapidgator.net
– Krakenfiles.com
– Chomikuj.pl
– Pixeldrain.com
– Pillows.su
– Mega.nz (new)
– Gofile.io (new)
– Sendgb.com (new)
– Imgur.gg (new)
– Ddownload.com (new)

Additional Issues

– Anna’s Archive (annas-archive.gl, .pk, .gd) (new)
– Lalals.com (new)
– Other intermediaries: Telegram and Discord
– Bulletproof ISPs: PRQ, Frantech Solutions/BuyVM/PONYNET, DDoS Guard
– Domain Name Registrars: NameCheap, Tucows and others

Physical Markets

– Counterfeit CDs and vinyl from China and Russia, sold through Amazon, eBay, Vinted, Marktplaats, Leboncoin and Wallapop (new)

From: TF, for the latest news on copyright battles, piracy and more.