Last month, Chinese streaming giant Tencent won the first round of its legal battle against the pirate site Olevod, when a Florida judge ruled that the case can proceed in the United States.

Tencent is not the only Chinese platform to try its luck there. Last year, rival streaming service iQIYI used the same court and the same legal team to sue Aiyifan, a pirate streaming service for Chinese speakers outside China.

Aiyifan also operates under the names YFSP and IYF, with domains including aiyifan.tv, yfsp.tv and iyf.tv. According to Similarweb, yfsp.tv alone drew roughly 14 million visits last month.

Unlike Olevod, Aiyifan never appeared in court, and none of its operators were named as defendants. However, the U.S. case isn’t the only legal trouble the pirate site is up against. In China, one of the site’s operators has been sentenced to prison recently.

Operator Jailed in China

In August, iQIYI informed the Florida court that the Shanghai Third Intermediate People’s Court had upheld the criminal conviction of Wang Jianyang, describing him as one of Aiyifan’s principals.

According to the ruling, Wang ran a company in Chongqing that provided the technical support for Aiyifan’s website and app. He also handled advertising and promotion, working on the pirate platform since 2022.

The Chinese police detained Wang in March 2024, which was more than a year before iQIYI filed its lawsuit in Florida.

Wang had been convicted before. In 2021, a court in Jiangsu gave him a suspended prison sentence of three years and a 6 million yuan fine for setting up another pirate site.

Aiyifan launched while he was still on probation. In March of this year, a Shanghai district court revoked the suspension and added a new sentence of three and a half years, plus a 1 million yuan fine. Combined, Wang faces four and a half years in prison and a 7 million yuan fine.

Wang appealed the verdict, arguing that the evidence was insufficient and that, at most, he merely provided technical support. The appeals court disagreed, however, concluding that he played a major role in the operation. That ruling is final.

Florida: $1.96 Million Instead of $196 Million

In Florida, iQIYI’s civil case was launched in hopes to shut down the site. Aiyifan didn’t respond to the complaint in the U.S. federal court, after which a default was entered in July 2025.

iQIYI asked for a massive $196.55 million in damages. Most of that came from applying the $150,000 statutory maximum to 776 registered works, while thousands of unregistered works added another $78.55 million in proposed damages.

In January, Judge Melissa Damian ruled that Aiyifan is indeed liable. However, she rejected the damages award because it lacked support. iQIYI responded with a revised request for $54.4 million, but that was still too much for the court.

In an order issued last week, Judge Damian awarded $1,000 per registered work, doubled for willfulness, for a total of $1.8 million. The award covers a total of 901 works as more copyright registrations had been processed as the case moved on.

The trademark claims added $160,000, but there were no damages awarded for the roughly 5,000 unregistered works. This brings the total to $1.96 million, about 1% of the original request.

The reduces damages is not the only setback for the Chinese streaming company either, as its requested injunction is also limited.

Judge Won’t Transfer Domains

iQIYI specifically targeted the pirate site’s domain names, asking the court to hand them over and redirect them to iQIYI’s own site. It also wanted ISPs, hosting companies, CDNs, payment processors and WeChat to stop serving Aiyifan.

The amended motion for a default judgment dropped most of these third parties, but it still requested the domain takeovers, as that kept the sites online.

Judge Damian was not convinced that this would be appropriate. iQIYI admitted that it couldn’t say how much of the content on the sites was infringing, or whether any of the other content is licensed.

Aiyifan streams plenty of content that is not owned by iQIYI. Taking over the domains entirely would therefore go too far, the judge concluded.

The order acknowledges that “some other judges in this District have a more liberal approach to the dispensation of injunctive relief.” However, Judge Damian sided with the Eleventh Circuit’s requirement that injunctions must be narrowly tailored.

Partial Domain Registrar Suspensions?

Instead of transferring the domains, the judgment orders domain registrars to cancel the pages and subdomains that feature iQIYI’s shows or trademarks, once iQIYI provides a list.

If a registrar fails to comply, the registry must move the domain to a registrar of iQIYI’s choosing. That changes the registrar but would not transfer the ownership.

Whether registrars can comply is questionable. A registrar controls the domain registration, not the pages on a website, so the only tools at its disposal are suspending or redirecting a domain as a whole.

That is exactly the broad outcome the court is trying to avoid.

Even the subdomains are a stretch. Two of the listed sites, m.yfsp.tv and www.yfsp.tv, share a single domain, and a registrar can only switch one of them off if it also runs the domain’s DNS.

For now, the Aiyifan sites remain online. Without a response from the operators, it’s also unclear whether iQIYI will be able to collect any of the damages.

—

A copy of the final default judgment, issued at the U.S. District Court for the Southern District of Florida, is available here (pdf). The accompanying order can be found here (pdf), and the translated Shanghai ruling, as filed by iQIYI, here (pdf).

The seven (sub)domains listed in the judgment: m.yfsp.tv, www.yfsp.tv, www.yfsp.lv, www.iyf.tv, www.iyf.lv, www.aiyifan.tv and www.ayysp.com.

From: TF, for the latest news on copyright battles, piracy and more.

In May, the Paris Judicial Court ordered several VPN providers to block ten pirate sites and IPTV services that streamed WTA tennis matches, including thetvapp.to and tennistream.com.

The order followed a familiar pattern. It was requested by beIN Sports, which holds the exclusive French rights to most WTA tour matches. A day later, the broadcaster secured a similar order against Cloudflare.

In its initial request, beIN asked for penalties of €2,000 per day for each domain that two of the VPN providers failed to block. The court refused to grant that, however, as nothing showed that the providers intended not to comply. If problems arose, the parties could return to court. That’s exactly what happened.

beIN Loses Penalty Request

As first reported by L’Informé, the broadcaster went back to the Paris court, complaining that VPN providers and Cloudflare had not fully blocked the sites. This time, it requested a daily penalty of €10,000 for every domain that remained accessible.

Cloudflare, Surfshark and NordVPN, all represented by the same lawyer, cited technical constraints and said they had done their best to comply. Proton was also targeted but did not show up at the hearing.

The blocking efforts were indeed not bulletproof. Cloudflare blocked three of the four sites, but only through its CDN. Surfshark and NordVPN blocked six of eleven, and only through the DNS service on their servers in France.

‘Reasonable Effort’

For the court, those measures were enough. In two rulings issued on October 7, it concluded that the intermediaries must make a reasonable effort to block the sites, but they don’t have to guarantee the outcome, in line with EU Court of Justice case law. The case files also showed that all companies had carried out the orders, at least in part.

“The requested penalty (…) therefore does not appear necessary or proportionate, given the need to strike a fair balance between the protection of the intellectual property rights of copyright and neighboring rights holders, and the freedom to conduct a business enjoyed by economic operators,” the court wrote, as quoted by L’Informé (translated).

The original blocking orders themselves remain in effect until the end of the WTA season, which is currently set for November 14. Meanwhile, beIN can still appeal.

The outcome mirrors the Paris court’s ruling in Canal+’s case against Cloudflare last month. There, Canal+ was refused daily penalties of €50,000 per site, as the court concluded that Cloudflare only had to take reasonable measures, which it did by blocking through its CDN.

DNS resolver Quad9 is next in line. According to the Swiss foundation, beIN wants €10,000 per domain, per day, which adds up to €580,000 a day. Quad9’s position is different, however, as it isn’t blocking any of the domains at all. A decision on that request is expected later this month.

Appeals Court Hits Pause

The penalty rulings are not the only setback for rightsholders. The VPN providers are also fighting the blocking orders directly, and that effort just got room to run.

Last year, NordVPN, Proton and CyberGhost appealed one of the first VPN blocking orders, which French football league LFP obtained in May 2025.

At the request of the VPN providers, the Paris Court of Appeal put that case on hold on September 30. Instead of ruling on the appeal, it will wait for France’s Supreme Court, the Cour de cassation, to decide on appeals against seven earlier rulings.

These rulings, issued in March and May this year, upheld blocking orders that Canal+ obtained against DNS providers. In the March cases, Google, Cloudflare and Cisco lost their appeals. Several DNS providers then took the matter to the Supreme Court.

The appeals court acknowledged that these cases are not identical to the VPN dispute. However, it sees enough overlap to pause the case and wait for the Supreme Court outcome.

“Despite the differences, namely that the seven decisions under appeal concern DNS providers rather than VPNs, and that they were issued at the request of the Canal Plus companies rather than LFP and LFP1, the present case has many legal questions in common with the rulings under appeal before the [Supreme Court],” the court writes (translated).

These overlapping questions include who can be ordered to help stop piracy, whether the French blocking law complies with EU law, how infringements must be proven, and when blocking measures are proportionate.

When the Supreme Court will rule on the matter is unknown, but the appeals court believes the outcome could affect the VPN case as well.

—

A copy of the Paris Court of Appeal’s ruling (RG 25/09229) is available here (pdf).

From: TF, for the latest news on copyright battles, piracy and more.

Every year, the U.S. Trade Representative (USTR) invites rightsholders and other stakeholders to suggest foreign sites and services for its list of “notorious markets.”

The annual review doesn’t make any legal findings. Instead, it aims to encourage the listed services, and the countries they operate from, to take proper action against piracy and counterfeiting.

Last week, the RIAA responded with a submission that mostly mentions familiar targets. It lists torrent sites, stream-rippers and cyberlockers, many of which were flagged in previous years. There are some notable newcomers too, including Anna’s Archive.

Anna’s Archive and the Spotify Scrape

In December last year, the shadow library announced that it had downloaded 86 million music files from Spotify, plus metadata for 256 million tracks. This prompted an aggressive legal response.

A few days later, the RIAA coordinated an emergency court action on behalf of its members and Spotify, which resulted in a temporary restraining order against the site. Following this order, domain registry PIR suspended the site’s .org domain, and RIAA says Cloudflare also stopped providing services to the shadow library.

Following this crackdown, Anna’s Archive initially reported that its Spotify metadata torrent was “unavailable until further notice.” In February, however, the site quietly released roughly 3 million music files.

While the torrents for those releases were delisted shortly after, the lawsuit continued, with the labels and Spotify on the winning end.

“On April 14, 2026, RIAA and Spotify obtained a $322 million default judgment against the unknown operators of Anna’s Archive,” the RIAA writes in its USTR submission.

Despite the legal victory, the music group stresses that Anna’s Archive remains available through its .gl, .pk and .gd domains.

The RIAA isn’t the only rightsholder group that flagged the shadow library to the USTR. The Association of American Publishers (AAP) also lists Anna’s Archive as a “notorious” online site (pdf). According to the publishers, traffic to Anna’s Archive’s domains grew 28% despite their enforcement efforts, to an average of 41 million visitors a month.

The AAP also highlights that Anna’s Archive offers AI developers high-speed access to its collection, in exchange for what the site describes as an “enterprise-level donation.”

Voice Clones and Leaks

The AI angle also applies to newcomer Lalals, a service operated by a company based in the United Arab Emirates. This AI platform allows users to change a vocal recording to sound like popular artists such as Taylor Swift and Drake, without their permission.

According to the RIAA, that infringes the artists’ rights of publicity and likely also infringes its members’ rights in the sound recordings that were used to train the voice models.

“The sound recording artists whose voices are being exploited include Taylor Swift, Drake, Ariana Grande, Bruno Mars, Ed Sheeran, Lady Gaga, Chris Martin, and Rihanna, among many others,” RIAA writes.

In the cyberlocker category, meanwhile, Mega is a familiar target. The European Commission added the file-hosting service to its own piracy watch list in 2022, and the RIAA now lists it among the notorious markets it wants the USTR to include.

“While Mega removes content that is specifically reported by rights holders, it does not implement effective measures to prevent the re-upload of infringing material or deter repeat infringement,” the RIAA writes.

RIAA stresses that users of the platform continue to share pre-release music and AI-related content, such as vocal models and cloned recordings. On what grounds Mega is required to prevent reuploads is not mentioned by the music group.

Several new cyberlockers are flagged for their role in pre-release piracy as well. These include Gofile, Sendgb and Imgur.gg.

Links to these services are reportedly shared on music leak forums, and the RIAA mentions Leaked.cx by name in the entries for Sendgb, Imgur.gg and Pixeldrain, which was already included in last year’s submission.

This Imgur.gg hosting platform doesn’t appear to be affiliated with the popular image host Imgur. When we checked, the site didn’t list any company details, but it did promote a music streaming app “Built by the imgur.gg team.”

RIAA goes on to mention that Telegram and Discord remain the primary mechanisms through which pre-release music is distributed. That accusation isn’t new, as the passage is nearly identical to last year’s submission.

Familiar Names, Familiar Words

Many other entries are familiar as well. The Pirate Bay, 1337x and RuTracker are listed in the torrent category, Rapidgator and Krakenfiles are flagged as cyberlockers, and Y2mate and Savefrom remain in the stream-ripping section.

Krakenfiles is still listed, even though the RIAA notes that it removed its upload functionality this year.

Whether any of the newly nominated sites will make it onto the USTR’s final list has yet to be seen. Last year, the USTR included several of the RIAA’s picks, including Y2mate, Savefrom and Krakenfiles.

Before the USTR makes its decision, the sites and services mentioned in the submissions can respond with rebuttals of their own, which Mega plans to do.

Responding to our request for comment, the company says that it removes reported content and permanently closes the accounts of repeat infringers, as is required under U.S. law.

According to Mega, infringing activity represents a small fraction of the overall use of the service. Last year, it processed close to 3.9 million copyright takedown requests and removed links represented around 0.002% of the more than 208 billion files stored by its 338 million registered users.

In the same period, 5,627 accounts were suspended under its “three strikes in six months” repeat infringer policy.

“Mega respectfully disagrees with the RIAA’s characterization, which fundamentally mischaracterizes the nature of the service, and will be filing its own submission with USTR setting out why its inclusion on the Notorious Markets List would be unwarranted,” Mega’s Legal and Compliance Manager Csaba Szabó informs TorrentFreak.

—

The RIAA’s full 2026 list of “notorious” sites and services can be found below, and the full report is available here (pdf). The cursive listings marked (new) are newcomers and those that were removed are crossed out. The RIAA stresses that this list is a non-exhaustive overview.

Stream-Ripping Sites

– Y2mate.gs (formerly y2mate.nu)
– Savefrom.net
– Ssyoutube.com
– Notube.net
– Y2mate.is (new)
– Snaptube app and related domains

Music Download/Streaming Sites

– Mp3.pm (new)
– Tubidy.cool (previously listed as a stream-ripper)
– Scnlog.me
– newalbumreleases.net
– waploaded.com
– hiphopkit.com

BitTorrent Indexing Sites

– ThePirateBay.org
– 1337x.to
– Rutracker.org

Cyberlockers

– Rapidgator.net
– Krakenfiles.com
– Chomikuj.pl
– Pixeldrain.com
– Pillows.su
– Mega.nz (new)
– Gofile.io (new)
– Sendgb.com (new)
– Imgur.gg (new)
– Ddownload.com (new)

Additional Issues

– Anna’s Archive (annas-archive.gl, .pk, .gd) (new)
– Lalals.com (new)
– Other intermediaries: Telegram and Discord
– Bulletproof ISPs: PRQ, Frantech Solutions/BuyVM/PONYNET, DDoS Guard
– Domain Name Registrars: NameCheap, Tucows and others

Physical Markets

– Counterfeit CDs and vinyl from China and Russia, sold through Amazon, eBay, Vinted, Marktplaats, Leboncoin and Wallapop (new)

From: TF, for the latest news on copyright battles, piracy and more.

Last year, Anna’s Archive warned its users about WeLib, a “new entrant” in the shadow library ecosystem.

The site appeared to have mirrored most of Anna’s collection and used a fork of its codebase. Since WeLib wasn’t sharing new collections or code improvements in return, Anna’s Archive cautioned prospective users.

“We recommend not using them,” the team wrote at the time.

In June, major book publishers came to a similar conclusion, but for different reasons. They filed a lawsuit against WeLib in New York federal court, alleging that the site “was created after its operators copied the source code and most of the contents of” Anna’s Archive.

Despite these and other copyright infringement allegations, WeLib’s anonymous operators never responded to the lawsuit. This prompted the publishers to move forward and the court clerk entered a default in August, opening the door to a final judgment request.

$19.5 Million, Again

On Monday, the publishers, including Penguin Random House, Elsevier, and HarperCollins, asked U.S. District Judge Victor Marrero to issue a default judgment against WeLib and its unnamed operators.

“Defendant WeLib is a pirate site whose sole business is the distribution of protected content in violation of the rights of Plaintiffs and other copyright owners,” their brief reads.

The publishers request the maximum statutory damages of $150,000 for each of the 130 works listed in the complaint, ten per publisher. That adds up to $19.5 million, the same amount Judge Jed Rakoff awarded in the Anna’s Archive case.

The brief also puts a spotlight on WeLib’s revenue model. The site can be used for free, but it asks users for “donations” of up to $90 a month. According to the publishers, these are simply payments for faster downloads.

In addition to the damages, the publishers want a permanent injunction. This would require domain registries and registrars to disable welib.org, welib.st, and welib-public.org, and to block their transfer to anyone other than the publishers. Hosting providers would have to stop serving the sites.

The injunction would apply to all applicable intermediaries, but the proposed order names five specifically: Public Interest Registry, Cloudflare, Tucows, and two Njalla entities. That’s a much shorter list than the Anna’s Archive judgment, which named more than twenty.

Borrowed From Anna’s Archive

It is not unusual that arguments from a similar case are reused and that also applies here. Large parts of the WeLib brief mirror the one that law firm Oppenheim + Zebrak filed against Anna’s Archive in May, on behalf of the same publishers.

However, not everything fits. According to the brief, WeLib diverts revenue from the publishers “at a scale made worse by their use of the viral BitTorrent protocol.”

We haven’t seen any evidence that WeLib uses BitTorrent, and the WeLib complaint doesn’t mention it either. Instead, the cited paragraphs discuss various harms including lost sales and harm to the market for AI training data.

The same sentence appears, word for word, in the brief against Anna’s Archive. There, it was backed up by the complaint, which described how Anna’s Archive offers torrent files for bulk downloads on a dedicated “Torrents” page.

WeLib’s own complaint mentions another download mechanism. It describes how the site serves files directly from its servers, through “slow” and paid “fast” downloads.

The brief also mentions that WeLib’s infringement continued “despite this and several other cases against them.” That entire paragraph comes straight from the Anna’s Archive brief. While Anna’s Archive was sued before, we are not aware of any other lawsuits against WeLib’s operators.

Even a typo and a garbled sentence with a double negative were copied. Both briefs mention what happens if the court “is satified” that the default standards are met, and both argue that the defendants “cannot establish that they have not presented any meritorious defenses.”

A Paper Victory?

It’s now up to Judge Marrero to decide on the request. Whatever the outcome, the publishers are unlikely to collect much, if anything, as WeLib’s operators remain anonymous.

Anna’s Archive lost several domains to an earlier injunction obtained by music companies. However, it remains online through .gl, .pk, and .gd domains, which are tied to registries and registrars outside the United States.

If Anna’s Archive is any indication, the injunction may cost WeLib some of its domains. However, that is no guarantee that the site will shut down permanently.

—

A copy of the publishers’ memorandum in support of the motion for default judgment is available here (pdf). The proposed default judgment and the statement of damages can be found here (pdf) and here (pdf). The publishers’ earlier brief against Anna’s Archive is available here (pdf).

We reached out to Oppenheim + Zebrak for comment on the BitTorrent claim, but they did not respond before publication.

From: TF, for the latest news on copyright battles, piracy and more.

With more than 160 million visits in July, Cineby was one of the most popular pirate streaming sites on the Internet.

That changed in August, when the operators announced a surprise shutdown. The site was taken offline in stages over more than a week, with the last domains going dark it early September.

At first, the operators did not explain why they threw in the towel. In a final statement, however, they said that their two main video providers, which they named as the “Sflix group” and “1Movies group,” went down about three months earlier, and that the service never fully recovered.

No anti-piracy operation was mentioned and the usual enforcement groups, including the Alliance for Creativity and Entertainment (ACE), did not claim it either, until now.

The MPA Takes Credit

Last week, the Motion Picture Association (MPA) sent its annual overview of notorious foreign piracy markets to the U.S. Trade Representative (USTR). Before listing the threats that remain, the Hollywood group highlights what it sees as positive developments since its previous submission.

The demise of Cineby is one of them, together with the linked embed service Videasy.

“On another positive note, 2025 submissions Cineby[.]app and Videasy[.]net have ceased operations following MPA and ACE actions,” the MPA writes.

Earlier in the new filing, the MPA links the takedown of Cineby-associated domains to an “extensive investigation and multi-region enforcement effort.”

Following this effort, the main cineby.at domain is “nonfunctional” and Videasy is offline, the MPA notes. Vidking, which is mentioned alongside them, is still accessible but “has no connected source servers.”

The submission doesn’t mention a court or a police force, so it appears to be a private enforcement effort. Further details are not shared.

The same filing does credit Vietnamese law enforcement with dismantling the HiAnime piracy network, which according to the MPA also included Sflix/MyFlixer and Megacloud/Vidcloud. Seven suspected operators were charged in July.

This is likely the same “Sflix group” Cineby referred to, suggesting that Cineby used services from the Vietnamese group was was shut down.

While the MPA lists Cineby as “no longer active,” the brand hasn’t disappeared entirely. There are several copycats that popped up, including cineby.vg, which the MPA mentions in its report.

AnimeFLV Too

Cineby isn’t the only unexplained shutdown that the MPA now counts as a victory. The submission also lists the Spanish-language anime portal AnimeFLV which previously received more than a billion annual visits, according to the MPA.

“Additionally, the AnimeFLV family of sites included in last year’s submission has shut down following MPA and ACE actions. This shutdown represents a significant enforcement success,” the MPA writes.

In July, we reported that AnimeFLV had stopped serving video in mid-June. The operators stayed silent and no anti-piracy group took credit, until now.

Today, the AnimeFLV domain no longer loads anything. Instead, it returns an HTTP 502 error. Of course, this brand has also been taken over by copycats since.

The Hydra Keeps Growing

Aside from the successes, the MPA’s submission lists dozens of sites and services that remain a problem. The group stresses that its overview is not intended to be comprehensive, but it highlights several key threats.

Last year, Myflixerz/Sflix, Cuevana, and HiAnime were listed as priority linking and streaming sites. This year, Kisskh is the only priority entry, while Cuevana moved to the regular list.

Kisskh, which specializes in Asian dramas and Hollywood content, received more than 70 million visits on its kisskh.is domain in August, mostly from India.

The “hydra sites” category that the MPA introduced last year remains a key concern. These pirate portals often rely on third-party Piracy-as-a-Service (PaaS) platforms for their videos. This includes the live sports PaaS service Streamed.

According to the MPA, the roughly 30 sites that use the live sports PaaS Streamed had 463 million visits in July, up from 134 million a year earlier.

New hydra threats include 1Shows/1Flex, CineHD/VidBox, and StreamEX. On the PaaS side, Videasy and MegaCloud are shut down and no longer listed, but there are newcomers. VidFast, for example, is reportedly used by at least 158 pirate sites with roughly 629 million monthly visits combined.

In the cyberlockers and video hosting category, Telegram now tops the priority list, while DoodStream moved to the regular list. Among other things, the MPA notes that Telegram’s response to takedown notices ranges from swift processing to weeks of inaction.

“Telegram is a platform of immediate concern,” the MPA writes.

In the hosting category, the MPA shares new details on Netulu, which was already mentioned last year. The company was incorporated in Delaware in April and MPA says that, at that time, all piracy sites hosted by Private Layer were transferred to it. According to the MPA, U.S.-based investigators are “following leads.”

Pirate app MovieBox is back on the list as well. The MPA cites more than 243 million downloads from Palm Store alone, but as we reported last week, the store’s counter has already passed 300 million.

The USTR will review the MPA’s submission, together with input from other stakeholders, in the coming months. Its own notorious markets list is expected early next year.

—

A list of all sites and services highlighted and categorized in the MPA’s 2026 notorious markets submission (pdf) can be found below. For additional context, we highlight the new entries, while also indicating those from the 2025 report that have since been removed.

Linking and Streaming Websites

Priority sites

– Kisskh.is / Kisskh.do / Kisskh.co (previously additional)
– Myflixerz / Sflix
– Hianime.to, hianime.nz, etc

Additional sites

– 1Shows / 1Flex (new)
– 1tamilmv
– Animeflv.net
– Anime-Sama.to
– Animepahe.ru (new)
– Aniwaves.ru (new)
– Buffstream.io
– Burningseries.ac (bs.to)
– Cda.pl
– Cineby.app
– CineHD / VidBox (new)
– Cuevana3i.bio (previously priority)
– Dytt8899.com, dytt8.net, dytt89.com, etc.
– Gimy.ai
– Goojara.to / levidia.ch / supernova.to
– HydraHD.ru / HydraHD.ws
– Librefutboltv.su
– LiveTV.sx
– Netmirror
– Nunflix.org
– Redecanais / Redecanaistv / Futemax
– Rezka.ag
– RiveStream (new)
– Serienstream.to (s.to)
– Soap2day.day
– StreamEX (new)
– Streamingcommunity
– Vegamovies
– Veronline[.]in
– Xalaflix.gg / xalaflix.art
Piracy-as-a-Service (PaaS)

– Belintersat (new)
– Fire Video Player
– MegaCloud / VidCloud / RapidCloud (formerly 2embed.to)
– Njalla
– Streamed.pk (previously Streamed.su)
– Videasy[.]net
– VidFast[.]vc (new)
– Vidlink[.]pro
– Vidsrc[.]me
– WHMCS Smarters
– XPass[.]top (new)
Direct Download Cyberlockers and Streaming Video Hosting Services

Priority sites

– Telegram
– Streamtape.com
– Voe.sx

Additional sites

– Baidu Wangpan
– Chomikuj.pl (previously listed as a linking site)
– DoodStream (previously priority)
– Mixdrop.co (returns)
– Rapidgator
– VK.ru / VK.com
Illegal IPTV Services

Priority services

– MagisTV / FlujoTV
– Gogo IPTV

Additional services

– Apollo Group TV
– Atlas Pro
– GenIPTV
– Spider Receiver
– TVExpress
Piracy Devices and Apps

– EVPAD
– LokLok, RookTV, LokTV, LokiOK
– MovieBox (returns)
– PikaShow
– SVICloud (returns)
– Unblock Tech (unblocktech.com & ub1818.com)
Peer-to-Peer Networks & BitTorrent Portals

– 1337x.to
– Rutracker.org
– ThePirateBay.org
– Yggtorrent.top
– Yts.mx
Hosting Providers

– Crypto Servers Ltd
– Ddos-Guard.net
– Netulu, Private Layer, Swiss Global, and affiliated companies
– Squitter, ABC Consultancy, Peenq, ESTOXY, BestDC, SERDECH
– Veesp
– Virtual Systems, V-Sys
Registries

– .CC Registry
– .IO Registry
– .RU Registry
– .SX Registry
– .TO Registry
– .TV Registry
– .SU Registry

From: TF, for the latest news on copyright battles, piracy and more.

Every year, the Office of the United States Trade Representative (USTR) asks rightsholders to nominate the foreign piracy sites and services they see as the biggest threats.

The resulting list of ‘notorious markets’ traditionally features torrent sites, cyberlockers and streaming portals. In recent years, hosting companies and other intermediaries were added as well.

Last week, the Entertainment Software Association (ESA), which represents many of the major video game companies, submitted its latest recommendations. These include the usual suspects, but also a target that doesn’t have a website of its own.

A Game Cracker as a Piracy ‘Market’

ESA’s submission lists ‘voices38’ as one of its new threats. The game industry group describes the anonymous cracker as a persistent operation that specializes in beating Denuvo Anti-Tamper, the popular technical protection measure that’s used by at least nine of its members.

According to ESA, Reddit’s r/CrackWatch index attributes roughly two dozen cracked or bypassed games to ‘voices38’. The gaming group stresses that the cracker plays a key role in the piracy ecosystem as its releases are picked up by repackers, torrent sites, cyberlockers and piracy forums.

“Each crack therefore unlocks an entire downstream market for an unauthorized copy of that title. For a title that no other actor has made usable, but for Voices38’s crack there would be no functioning pirated copy for those markets to offer,” the submission notes.

“Treating only those downstream services as markets would overlook the upstream operation that determines whether protected games can be offered by them at all.”

The fact that the cracker has no public identity or “traditional homepage” shouldn’t stand in the way of a Notorious Markets listing either, ESA notes. In fact, it argues that a listing could help rightsholders crack down on the cracking operation.

“Designation would focus attention on identifying the operator, preserving evidence, disrupting distribution accounts and donation channels, and coordinating action across the forums, repositories, hosting services, peer-to-peer infrastructure, and other intermediaries used to seed each release,” ESA writes.

Ideally, ESA would like to identify the person or people behind the popular cracker handle and it’s not alone in this. Identifying the operator is also what Denuvo is trying to do through a U.S. federal court.

Lawsuit Doesn’t Stop the Cracks

Last month, Denuvo sued ‘voices38’ at a California federal court and it recently asked for permission to subpoena Discord, Valve and Reddit. ESA’s submission doesn’t mention this lawsuit.

So far, this hasn’t stopped the cracks from coming out. After a few quiet weeks, ‘voices38’ released cracks for Atomfall and The Adventures of Elliot: The Millennium Tales last week, as well as a crackfix for Dead Space Remake.

These releases swiftly spread over torrent sites and cyberlockers. Popular repacker FitGirl has already picked them up too, which brings us to ESA’s next target.

Billion Dollar FitGirl

After already being included in USTR’s 2024 and 2025 notorious markets lists, FitGirl gets a recommendation from ESA for the next installment.

FitGirl’s site is currently blocked in Germany, Italy, Spain and elsewhere, but ESA notes that these measures didn’t change much. The repack site received 41.77 million visits in August and continues to offer games published by ESA members.

“FitGirl’s scale and persistence demonstrate that prior blocking and designation have not induced meaningful remediation by its operator. ESA’s takedown notices to the site are ignored, with zero links removed between August 2025 and August 2026,” ESA writes.

The game companies also put a billion-dollar price tag on the losses, which they report down to the last cent.

“Between March and August 2026 alone, ESA detected 15,484,145 users in peer-to-peer swarms for games repacked by FitGirl, with an estimated lost value of $1,083,735,308.55,” the submission notes.

A footnote explains that this figure is based on a retail price of $69.99 for every user ESA spotted in a swarm.

Other targets are not very responsive either. DODI-Repacks removed 22% of the reported links and RuTracker, the Russian torrent site, complied with just 3% of ESA’s notices over the past year.

While these sites are not responding, ESA highlights that tracking their finances, including crypto transactions that go to KYC-vetted platforms such as Binance, could help to identify these targets.

Handheld Consoles as ‘Superfakes’

This year, the USTR’s review has a special focus on high-quality counterfeit goods, known as superfakes. ESA uses this opportunity to highlight handheld consoles that come preloaded with pirated games, which it sees as the video game equivalent of superfakes.

The group nominates Anbernic.com, the official store for a widely sold line of handheld emulation devices. ESA says these are routinely offered or shipped with memory cards that hold hundreds or thousands of unauthorized games, and notes that they are sold through Amazon and eBay as well.

The submission further lists G2A, FunPay and Eldorado.gg, where game accounts and in-game items are traded, as well as cheat sellers including Cronus Zen. ESA argues that cheats belong on a piracy list because they circumvent the technological protection measures of games.

It’s now up to the USTR to decide which of these recommendations make the final list. The previous edition was published in March, so we might have to wait a while before the final Notorious Markets list arrives.

—

A copy of ESA’s submission for the 2026 Notorious Markets review is available here (pdf).

From: TF, for the latest news on copyright battles, piracy and more.

TorrentClaw is a relatively new torrent search engine that launched in February.

The site is built on links from its own DHT crawler and dozens of external torrent sites and aggregators. In just a few months, the site has grown into an index of more than six million torrents, including the latest Hollywood blockbusters and hit series.

The homepage looks more modern than traditional torrent sites and has some clear AI-design tells. That’s not a secret. On the contrary, AI plays a central role in the site’s development and marketing.

According to TorrentClaw’s developers, who all use the name Deivid Soto, the platform is largely built and run with the help of AI.

“Basically, the core framework is Claude Code combined with local LLMs for specific execution and ingestion tasks,” Soto tells us.

For example, AI is used to match torrents to film and TV titles, so these can be neatly organized. The AI-driven categorization process takes over tasks that would otherwise be manual work, and AI helped to build novel tools as well.

One of the features built this way is TrueSpec, which checks whether torrents actually contain what their names suggest. That helps to spot fake torrents and malware.

TrueSpec: Download and Verify

On most torrent sites, release names are the main source of information for torrent users. They list the resolution, codec, audio and release group, but there’s no guarantee that any of it is accurate.

Mislabeled torrents are often handled by moderators on well-run torrent sites, but most automated indexes have no active moderation. That’s where TrueSpec comes in.

TrueSpec joins the torrent swarm, reads the file listing, and downloads enough pieces to check the video with the analysis tool ffprobe. According to the site and its developers, that’s between 10 and 20 MB per torrent.

In addition to verifying the names, TrueSpec also checks suspicious files. It looks up their hashes on VirusTotal and, if the files are small enough, uploads these for a scan. TorrentClaw doesn’t run its own virus scanner, the malware verdicts come from VirusTotal.

When TrueSpec finds malware, the torrent remains listed on the site, but with a “Malware detected” label and the download button disabled. At the time of writing, one fake Jujutsu Kaisen episode with this label still had 34 seeders while it remained available on some external sites.

Not Perfect

The TrueSpec system isn’t perfect. In July, an earlier dataset counted 6,450 malware cases, but many were false positives. These included the harmless RARBG_DO_NOT_MIRROR.exe file, fansub scripts that switch audio languages, and scripts that simply open a website.

The TrueSpec data from late September paints a different picture. TorrentClaw now only counts malware when VirusTotal confirms it, which leaves 34 torrents. We checked some of these against the evidence in the data, which links to a VirusTotal report for every confirmed case.

Detected malware is rare, but the count is likely too low. TrueSpec doesn’t download large executables, it prioritizes well-seeded torrents, and dead swarms can’t be checked at all. TorrentClaw also focuses on films and TV shows, so pirated software and games are largely left out.

Malware is only part of what TrueSpec flags. In total, 1,265 of the 687,057 probed torrents were flagged as deceptive, including programs disguised as videos and fake resolutions. That’s less than 0.2% of all checked torrents.

The most common type of ‘mislabeling’ is actually quite harmless. More than half of all probed torrents, 55%, include subtitle tracks that their release names don’t mention. TorrentClaw flags this as a missing label, but subtitles are typically not added to titles unless they are hardcoded. Scene rules don’t require this either.

VLC Player Malware

Most of the confirmed malware torrents follow the same pattern. In 31 of the 34 cases, the torrent includes an executable named after a new episode or film, a file called libvlc.dll, and a playable video in a subfolder.

The application is a renamed copy of the genuine VLC media player. According to TorrentClaw, it’s identical to VideoLAN’s official release and carries its code signature. The malicious part is the DLL, which VLC loads when it starts, and which VirusTotal engines flag as a trojan.

The torrents are named after popular new releases, including episodes of The Boys, Jujutsu Kaisen and Frieren, and films such as Dune: Part Three and Zootopia 2. Many also carry the names of known release or distribution groups, including SubsPlease, ETHEL and YTS.

This type of malware vector is not new. Earlier this year, a security researcher documented a campaign that used fake SubsPlease releases on Nyaa to spread the Vidar infostealer. These were reportedly uploaded from a stolen account.

TorrentClaw sourced its 31 torrents between February and August. Most of them, 22, came in through its own DHT crawler, while the rest were found via Nyaa, The Pirate Bay and TorrentDownload. All had seeders when indexed, and 15 were still active in early October, according to Soto.

Built For AI, By AI

TrueSpec isn’t the only thing that sets TorrentClaw apart. The torrent site also offers an MCP server, which allows AI assistants such as Claude and Cursor to search the index and fetch .torrent files directly.

Technically, this means that users can ask an AI assistant to find a release and load the torrent file, without ever visiting the site. According to Soto, some accounts make around 10,000 API requests a day, which might be external sites or services that use it.

Running TrueSpec doesn’t cost much either. In July, Soto said the system ran on three nodes costing well under $50 a month combined.

“The implicit point: if verification is this cheap, any indexer could be doing it, and none are,” Soto explained.

That said, partially downloading content from hundreds of thousands of torrents can also come with a legal cost. TorrentClaw’s DMCA page states that the site doesn’t host, store, upload or distribute files, but rightsholders may see things differently.

When asked about this, Soto describes TrueSpec as a read-only client that doesn’t upload or seed. It only fetches the first part of a video file, enough to read the container headers.

“[It] deletes everything once the analysis is done. We don’t store or serve any content, and we process every valid takedown notice we receive,” Soto says.

TorrentClaw also uses AI to handle these notices. It introduced an AI-managed system in late September that has handled 23 takedowns so far. Before that, the site received just over 300 notices, mostly duplicates.

TorrentClaw also charges for its premium features. PRO costs $3.99 a month, while PRO+ adds a VPN for $6.99. Whether that business model will hold up has yet to be seen, but commercial torrent services typically draw more attention from rightsholders than free ones.

From: TF, for the latest news on copyright battles, piracy and more.

Series.ly was once one of Spain’s best-known pirate link sites. The original operation dropped its piracy links in late 2014. In 2021, the domain was bought at auction by a new team, which says it isn’t part of the original one.

“The current Series.ly is a separate project from the one that existed until 2015. We bought the domain at an auction in 2021 and we’re not part of the original team,” the operator tells TorrentFreak (translated).

According to the operator, the new team liked the old site and wanted to bring back that experience. There was plenty of debate internally about whether to go ahead, especially because of what the original creators went through. The operator describes their legal ordeal as “deeply unfair” (translated).

The new Series.ly, which requires a login to access, became reasonably popular. The site ranked among the 35,000 most-visited sites worldwide earlier this year, with nearly 90% of its traffic coming from Spain.

That popularity didn’t go unnoticed by rightsholders, which haven’t given up on shutting it down yet. In May, film and TV producers’ group EGEDA filed a complaint with the Second Section of Spain’s Intellectual Property Commission, which falls under the Ministry of Culture, aiming to shut the site down.

The Commission’s investigator checked a sample of 42 of the 110 titles that were listed in the complaint. Of these, 35 could be streamed or downloaded from Series.ly at the time. The Commission also ordered the site to remove the infringing content in July, but it says Series.ly never responded.

From Google to a Libyan Registrar

At the end of July, the Commission sanctioned a series of anti-piracy measures against the site, targeting third-party intermediaries. For example, the resolution requires Google and Bing to remove the site from their search results, while ISPs with a market share of more than 1% must block the domain name.

The ISPs are also urged to redirect visitors to a government page. This informs users that the Commission blocked the domain “for having illegally facilitated access to content protected by intellectual property rights” (translated).

The order also lists Cloudflare and Ukrainian hosting company Virtual Systems, whose Kyiv data centers were hit by Russian missile strikes last month, as well as Series.ly’s domain registrar, Libyan Spider Network. These measures apply to the current domain name, as well as new ones that the operator may use for the same purpose.

The Commission’s resolution needs court approval before it can be enforced. This came on September 28, when a judge at the Central Court of First Instance in Madrid concluded that the measures were proportionate, approving them as requested.

The Libyan Registrar Acts

Little more than a week later, at least one intermediary appears to have taken action. Earlier this week, Series.ly unexpectedly lost its domain name after the domain registrar, Libyan Spider, stepped in.

WHOIS records show that series.ly was placed on ‘clientHold’, a status set by the registrar to take a domain offline. This pulls the domain from the .ly zone, which means that Series.ly no longer resolves.

Libyan Spider hasn’t commented publicly, but the Series.ly operator says the notice cited the Spanish order. It reached them through the auction house that sold them the domain, which acts as a reseller for the registrar.

“The reason they gave us was a Spanish copyright resolution and a court order authorizing suspension measures against the domain,” the operator tells TorrentFreak (translated).

It is not clear whether the other intermediaries have taken action yet, but the court order remains valid.

The site didn’t wait for the domain to come back. Series.ly’s operator confirmed to TorrentFreak that it swiftly switched to a new brand, Cinubo, which runs on a freshly registered .com domain.

No Plans to Appeal

The operator says it didn’t see the warnings before the domain was suspended. An EGEDA email it later found was sent to support@series.ly, while the address listed on the site is soporte@series.ly.

The registrar’s heads-up also went unnoticed.

“Our provider forwarded the notice to us quickly, but it went to an account we didn’t check regularly, which also received the catch-all mail for series.ly, meaning messages sent to any address on the domain. We didn’t see those notices in time,” the operator says (translated).

According to the operator, Series.ly is a non-profit that hasn’t generated any revenue since it launched. The site doesn’t host any video files, and the links to other services are added by the community, he explains.

“Our position is that complaints about those video files should be directed at the services that host or distribute them,” the operator says (translated).

“We think it’s disproportionate that a complaint about content hosted by third parties ends up getting our entire domain suspended, including email and the personal library features.”

For now, the operator doesn’t plan to appeal the Spanish order. The company behind the project is based in Nevis, which raises questions about the reach of the Spanish order, the operator argues.

“We question whether a procedure handled in Spain justifies suspending our domain worldwide, which also affects email and services that have nothing to do with the works in question,” the operator notes (translated).

This may not be the end of it though. The Spanish order also covers new domain names that are used for the same purpose, which could include the new Cinubo one. In addition, other intermediaries may take action as well.

—

Update October 9, 2026: A few days after it was suspended, the series.ly domain appears to be back under the control of its owner. The operator informs us that the registrar lifted the suspension, but stressed that the domain can no longer be used to link to copyright-infringing content.

—

A copy of the Commission’s resolution is available here (pdf). The court’s authorization can be found here (pdf). The Series.ly operator’s answers were provided in Spanish. The quotes in this article were translated by TorrentFreak.

From: TF, for the latest news on copyright battles, piracy and more.

Over the past two years, French courts have ordered a growing list of intermediaries to block access to pirate sports streams.

In addition to regular ISPs, the orders now target public DNS resolvers, VPN services, search engines and CDN providers, all of which can help people bypass existing blockades.

Internet infrastructure company Cloudflare has received several of these orders. In April, the Paris Judicial Court ordered the company to block 21 domains linked to pirate Formula 1 streams and 16 linked to MotoGP.

The orders covered Cloudflare’s DNS resolver as well as its CDN. However, they didn’t prescribe how the sites should be blocked, only that access from France had to be prevented “by any effective means.”

French pay-TV provider Canal+, which requested the blockades, concluded that Cloudflare’s efforts fell short. The broadcaster went back to court and, as first reported by L’Informé, it didn’t get what it wanted.

Canal+ Requested €50,000 a Day

In May, Canal+ asked the Paris court to add daily penalties to the April orders. It requested €50,000 per day for every site that remained accessible, and the same amount for every new site that media regulator Arcom reports to Cloudflare.

According to Canal+, Cloudflare had deliberately failed to comply with the site blocking orders.

“[Cloudflare] allegedly circumvented the measures by only implementing the decision through its CDN service, which meant that only three of the 21 domain names listed by the court were blocked,” Canal+ argued, according to the court’s summary (translated).

In the MotoGP case, Canal+ counted three blocked domains out of 16. In both cases, it added that two of the three blocked sites were back online a week later; one switched to a different CDN, while the other used a mirror site.

Court Sides With Cloudflare

On September 17, a panel of three judges ruled on both penalty requests. Cloudflare had pointed to technical constraints that only allowed it to comply through its CDN. It also stressed that the court had expressly left it free to choose which of its services to use, as long as it contributed meaningfully to the fight against sports piracy.

The court first noted that the way Cloudflare implements the blocking orders is not in dispute.

“It is undisputed that Cloudflare only implements the ordered measures by blocking through its CDN service, when the site uses that service,” the court writes (translated).

Cloudflare told the court that this is incomparably more effective than DNS blocking. It added that the architecture of its public DNS resolver doesn’t allow for blocking, making such measures unreasonable.

Canal+ had argued that Cloudflare only blocked 72.6% of the domain names the court ordered it to block. The court, however, saw the figure as evidence of a genuine willingness to help stop the infringements.

The ruling doesn’t explain how this percentage relates to the three out of 21 blocked domains that Canal+ cited earlier.

The court also concluded that Cloudflare can’t be blamed for the sites that switched to another CDN or moved to a mirror.

“Cloudflare cannot be held responsible when the owners of the sites in question switch to another CDN or set up a redirect to a mirror site,” the court writes (translated).

Instead, it is up to Canal+ to ask the new intermediary to block these sites and to report mirror sites to Arcom, the court notes.

Canal+ also argued that, under the EU Court of Justice’s UPC Telekabel Wien ruling, intermediaries must block effectively. The Paris court disagreed. In its view of the same ruling, intermediaries only have to take reasonable measures, which Cloudflare did with its CDN blocks.

The court therefore rejected the requested penalties as neither necessary nor proportionate. In addition, Canal+’s request for €20,000 in legal costs was also denied.

1.1.1.1 Stays Block-Free

As a result, Cloudflare will not be penalized under these orders, even though its public DNS resolver is not blocking the sites in question. That is in line with the company’s long-standing claim that it doesn’t interfere with its DNS.

In its recent transparency reports, Cloudflare repeatedly stated that it hasn’t blocked any content through 1.1.1.1, despite orders from French and Italian courts.

“To date, Cloudflare has not blocked content through the 1.1.1.1 Public DNS Resolver,” the company’s latest report reads.

Blocking through the CDN is another matter. According to the same report, Cloudflare geoblocked 1,238 domains in France in the second half of 2025, all under a single court order. In the first half of the year, it geoblocked 662 domains under seven orders.

Cloudflare recently explained its position to the European Commission, in a submission to its Counterfeit and Piracy Watch List consultation, stressing that global public DNS resolvers should not be used to block or restrict access.

Instead, it highlights its real-time pirate stream blocking program, which allows vetted rightsholders to flag pirate streams that run through its network. These streams are disrupted “within seconds,” Cloudflare says, without any DNS or IP address blocking.

“For live content, where speed is crucial, Cloudflare has built real-time mitigation mechanisms that allow vetted rightsholder partners to flag infringing streams. When those streams are running through our network, we act on them in seconds,” Cloudflare informed the Commission.

For now, Cloudflare can continue to block pirate sites through its CDN only, while its 1.1.1.1 DNS resolver remains untouched. Canal+ can still appeal the rulings, so it may not be the last we hear of it.

Non-profit DNS resolver Quad9 faces a similar, potentially bankrupting penalty request from beIN Sports for not blocking pirate content on its DNS resolver. How the Paris court will view this will become apparent later this month.

—

Copies of the Paris Judicial Court’s rulings in the Formula 1 (RG 26/08243) and MotoGP (RG 26/08228) cases are available here (pdf) and here (pdf). Cloudflare’s submission to the EU Counterfeit and Piracy Watch List consultation can be found here (pdf).

From: TF, for the latest news on copyright battles, piracy and more.