• To chevron_right

      Game Industry Asks U.S. to Flag Denuvo Cracker ‘voices38’ as Notorious Piracy Threat

      news.movim.eu / TorrentFreak • 8:06 • 4 minutes

    voices38Every year, the Office of the United States Trade Representative (USTR) asks rightsholders to nominate the foreign piracy sites and services they see as the biggest threats.

    The resulting list of ‘notorious markets’ traditionally features torrent sites, cyberlockers and streaming portals. In recent years, hosting companies and other intermediaries were added as well.

    Last week, the Entertainment Software Association (ESA), which represents many of the major video game companies, submitted its latest recommendations. These include the usual suspects, but also a target that doesn’t have a website of its own.

    A Game Cracker as a Piracy ‘Market’

    ESA’s submission lists ‘voices38’ as one of its new threats. The game industry group describes the anonymous cracker as a persistent operation that specializes in beating Denuvo Anti-Tamper, the popular technical protection measure that’s used by at least nine of its members.

    Voices38

    Voices38

    According to ESA, Reddit’s r/CrackWatch index attributes roughly two dozen cracked or bypassed games to ‘voices38’. The gaming group stresses that the cracker plays a key role in the piracy ecosystem as its releases are picked up by repackers, torrent sites, cyberlockers and piracy forums.

    “Each crack therefore unlocks an entire downstream market for an unauthorized copy of that title. For a title that no other actor has made usable, but for Voices38’s crack there would be no functioning pirated copy for those markets to offer,” the submission notes.

    “Treating only those downstream services as markets would overlook the upstream operation that determines whether protected games can be offered by them at all.”

    The fact that the cracker has no public identity or “traditional homepage” shouldn’t stand in the way of a Notorious Markets listing either, ESA notes. In fact, it argues that a listing could help rightsholders crack down on the cracking operation.

    “Designation would focus attention on identifying the operator, preserving evidence, disrupting distribution accounts and donation channels, and coordinating action across the forums, repositories, hosting services, peer-to-peer infrastructure, and other intermediaries used to seed each release,” ESA writes.

    ESA’s recommendation

    ESA's recommendation

    Ideally, ESA would like to identify the person or people behind the popular cracker handle and it’s not alone in this. Identifying the operator is also what Denuvo is trying to do through a U.S. federal court.

    Lawsuit Doesn’t Stop the Cracks

    Last month, Denuvo sued ‘voices38’ at a California federal court and it recently asked for permission to subpoena Discord, Valve and Reddit. ESA’s submission doesn’t mention this lawsuit.

    So far, this hasn’t stopped the cracks from coming out. After a few quiet weeks, ‘voices38’ released cracks for Atomfall and The Adventures of Elliot: The Millennium Tales last week, as well as a crackfix for Dead Space Remake.

    Atomfall-voices38

    voices38

    These releases swiftly spread over torrent sites and cyberlockers. Popular repacker FitGirl has already picked them up too, which brings us to ESA’s next target.

    Billion Dollar FitGirl

    After already being included in USTR’s 2024 and 2025 notorious markets lists, FitGirl gets a recommendation from ESA for the next installment.

    FitGirl’s site is currently blocked in Germany, Italy, Spain and elsewhere, but ESA notes that these measures didn’t change much. The repack site received 41.77 million visits in August and continues to offer games published by ESA members.

    “FitGirl’s scale and persistence demonstrate that prior blocking and designation have not induced meaningful remediation by its operator. ESA’s takedown notices to the site are ignored, with zero links removed between August 2025 and August 2026,” ESA writes.

    The game companies also put a billion-dollar price tag on the losses, which they report down to the last cent.

    “Between March and August 2026 alone, ESA detected 15,484,145 users in peer-to-peer swarms for games repacked by FitGirl, with an estimated lost value of $1,083,735,308.55,” the submission notes.

    A footnote explains that this figure is based on a retail price of $69.99 for every user ESA spotted in a swarm.

    Hypothetical Losses

    hypothetical losses

    Other targets are not very responsive either. DODI-Repacks removed 22% of the reported links and RuTracker, the Russian torrent site, complied with just 3% of ESA’s notices over the past year.

    While these sites are not responding, ESA highlights that tracking their finances, including crypto transactions that go to KYC-vetted platforms such as Binance, could help to identify these targets.

    Handheld Consoles as ‘Superfakes’

    This year, the USTR’s review has a special focus on high-quality counterfeit goods, known as superfakes. ESA uses this opportunity to highlight handheld consoles that come preloaded with pirated games, which it sees as the video game equivalent of superfakes.

    The group nominates Anbernic.com, the official store for a widely sold line of handheld emulation devices. ESA says these are routinely offered or shipped with memory cards that hold hundreds or thousands of unauthorized games, and notes that they are sold through Amazon and eBay as well.

    The submission further lists G2A, FunPay and Eldorado.gg, where game accounts and in-game items are traded, as well as cheat sellers including Cronus Zen. ESA argues that cheats belong on a piracy list because they circumvent the technological protection measures of games.

    It’s now up to the USTR to decide which of these recommendations make the final list. The previous edition was published in March, so we might have to wait a while before the final Notorious Markets list arrives.

    —

    A copy of ESA’s submission for the 2026 Notorious Markets review is available here (pdf).

    From: TF, for the latest news on copyright battles, piracy and more.

    • To chevron_right

      AI-Built Torrent Site Looks Inside Downloads to Catch Fakes and Malware

      news.movim.eu / TorrentFreak • 1 day ago • 5 minutes

    torrentclawTorrentClaw is a relatively new torrent search engine that launched in February.

    The site is built on links from its own DHT crawler and dozens of external torrent sites and aggregators. In just a few months, the site has grown into an index of more than six million torrents, including the latest Hollywood blockbusters and hit series.

    The homepage looks more modern than traditional torrent sites and has some clear AI-design tells. That’s not a secret. On the contrary, AI plays a central role in the site’s development and marketing.

    TorrentClaw.com

    torrentclaw's homepage

    According to TorrentClaw’s developers, who all use the name Deivid Soto, the platform is largely built and run with the help of AI.

    “Basically, the core framework is Claude Code combined with local LLMs for specific execution and ingestion tasks,” Soto tells us.

    For example, AI is used to match torrents to film and TV titles, so these can be neatly organized. The AI-driven categorization process takes over tasks that would otherwise be manual work, and AI helped to build novel tools as well.

    One of the features built this way is TrueSpec, which checks whether torrents actually contain what their names suggest. That helps to spot fake torrents and malware.

    TrueSpec: Download and Verify

    On most torrent sites, release names are the main source of information for torrent users. They list the resolution, codec, audio and release group, but there’s no guarantee that any of it is accurate.

    Mislabeled torrents are often handled by moderators on well-run torrent sites, but most automated indexes have no active moderation. That’s where TrueSpec comes in.

    TrueSpec joins the torrent swarm, reads the file listing, and downloads enough pieces to check the video with the analysis tool ffprobe. According to the site and its developers, that’s between 10 and 20 MB per torrent.

    TrueSpec

    How TrueSpec works

    In addition to verifying the names, TrueSpec also checks suspicious files. It looks up their hashes on VirusTotal and, if the files are small enough, uploads these for a scan. TorrentClaw doesn’t run its own virus scanner, the malware verdicts come from VirusTotal.

    When TrueSpec finds malware, the torrent remains listed on the site, but with a “Malware detected” label and the download button disabled. At the time of writing, one fake Jujutsu Kaisen episode with this label still had 34 seeders while it remained available on some external sites.

    ‘Malware detected’

    example of suspected malware torrents

    Not Perfect

    The TrueSpec system isn’t perfect. In July, an earlier dataset counted 6,450 malware cases, but many were false positives. These included the harmless RARBG_DO_NOT_MIRROR.exe file, fansub scripts that switch audio languages, and scripts that simply open a website.

    The TrueSpec data from late September paints a different picture. TorrentClaw now only counts malware when VirusTotal confirms it, which leaves 34 torrents. We checked some of these against the evidence in the data, which links to a VirusTotal report for every confirmed case.

    Detected malware is rare, but the count is likely too low. TrueSpec doesn’t download large executables, it prioritizes well-seeded torrents, and dead swarms can’t be checked at all. TorrentClaw also focuses on films and TV shows, so pirated software and games are largely left out.

    Malware is only part of what TrueSpec flags. In total, 1,265 of the 687,057 probed torrents were flagged as deceptive, including programs disguised as videos and fake resolutions. That’s less than 0.2% of all checked torrents.

    The most common type of ‘mislabeling’ is actually quite harmless. More than half of all probed torrents, 55%, include subtitle tracks that their release names don’t mention. TorrentClaw flags this as a missing label, but subtitles are typically not added to titles unless they are hardcoded. Scene rules don’t require this either.

    VLC Player Malware

    Most of the confirmed malware torrents follow the same pattern. In 31 of the 34 cases, the torrent includes an executable named after a new episode or film, a file called libvlc.dll, and a playable video in a subfolder.

    The application is a renamed copy of the genuine VLC media player. According to TorrentClaw, it’s identical to VideoLAN’s official release and carries its code signature. The malicious part is the DLL, which VLC loads when it starts, and which VirusTotal engines flag as a trojan.

    The torrents are named after popular new releases, including episodes of The Boys, Jujutsu Kaisen and Frieren, and films such as Dune: Part Three and Zootopia 2. Many also carry the names of known release or distribution groups, including SubsPlease, ETHEL and YTS.

    This type of malware vector is not new. Earlier this year, a security researcher documented a campaign that used fake SubsPlease releases on Nyaa to spread the Vidar infostealer. These were reportedly uploaded from a stolen account.

    TorrentClaw sourced its 31 torrents between February and August. Most of them, 22, came in through its own DHT crawler, while the rest were found via Nyaa, The Pirate Bay and TorrentDownload. All had seeders when indexed, and 15 were still active in early October, according to Soto.

    Built For AI, By AI

    TrueSpec isn’t the only thing that sets TorrentClaw apart. The torrent site also offers an MCP server, which allows AI assistants such as Claude and Cursor to search the index and fetch .torrent files directly.

    MCP server

    torrentclaw and mcp

    Technically, this means that users can ask an AI assistant to find a release and load the torrent file, without ever visiting the site. According to Soto, some accounts make around 10,000 API requests a day, which might be external sites or services that use it.

    Running TrueSpec doesn’t cost much either. In July, Soto said the system ran on three nodes costing well under $50 a month combined.

    “The implicit point: if verification is this cheap, any indexer could be doing it, and none are,” Soto explained.

    That said, partially downloading content from hundreds of thousands of torrents can also come with a legal cost. TorrentClaw’s DMCA page states that the site doesn’t host, store, upload or distribute files, but rightsholders may see things differently.

    When asked about this, Soto describes TrueSpec as a read-only client that doesn’t upload or seed. It only fetches the first part of a video file, enough to read the container headers.

    “[It] deletes everything once the analysis is done. We don’t store or serve any content, and we process every valid takedown notice we receive,” Soto says.

    TorrentClaw also uses AI to handle these notices. It introduced an AI-managed system in late September that has handled 23 takedowns so far. Before that, the site received just over 300 notices, mostly duplicates.

    TorrentClaw also charges for its premium features. PRO costs $3.99 a month, while PRO+ adds a VPN for $6.99. Whether that business model will hold up has yet to be seen, but commercial torrent services typically draw more attention from rightsholders than free ones.

    From: TF, for the latest news on copyright battles, piracy and more.

    • To chevron_right

      Pirate Streaming Portal Series.ly Has Domain Suspended, Rebrands Instantly

      news.movim.eu / TorrentFreak • 3 days ago • 5 minutes

    Series.ly logoSeries.ly was once one of Spain’s best-known pirate link sites. The original operation dropped its piracy links in late 2014. In 2021, the domain was bought at auction by a new team, which says it isn’t part of the original one.

    “The current Series.ly is a separate project from the one that existed until 2015. We bought the domain at an auction in 2021 and we’re not part of the original team,” the operator tells TorrentFreak (translated).

    According to the operator, the new team liked the old site and wanted to bring back that experience. There was plenty of debate internally about whether to go ahead, especially because of what the original creators went through. The operator describes their legal ordeal as “deeply unfair” (translated).

    The new Series.ly, which requires a login to access, became reasonably popular. The site ranked among the 35,000 most-visited sites worldwide earlier this year, with nearly 90% of its traffic coming from Spain.

    That popularity didn’t go unnoticed by rightsholders, which haven’t given up on shutting it down yet. In May, film and TV producers’ group EGEDA filed a complaint with the Second Section of Spain’s Intellectual Property Commission, which falls under the Ministry of Culture, aiming to shut the site down.

    The Commission’s investigator checked a sample of 42 of the 110 titles that were listed in the complaint. Of these, 35 could be streamed or downloaded from Series.ly at the time. The Commission also ordered the site to remove the infringing content in July, but it says Series.ly never responded.

    From Google to a Libyan Registrar

    At the end of July, the Commission sanctioned a series of anti-piracy measures against the site, targeting third-party intermediaries. For example, the resolution requires Google and Bing to remove the site from their search results, while ISPs with a market share of more than 1% must block the domain name.

    The ISPs are also urged to redirect visitors to a government page. This informs users that the Commission blocked the domain “for having illegally facilitated access to content protected by intellectual property rights” (translated).

    The order also lists Cloudflare and Ukrainian hosting company Virtual Systems, whose Kyiv data centers were hit by Russian missile strikes last month, as well as Series.ly’s domain registrar, Libyan Spider Network. These measures apply to the current domain name, as well as new ones that the operator may use for the same purpose.

    The Commission’s order

    The Commission's order

    The Commission’s resolution needs court approval before it can be enforced. This came on September 28, when a judge at the Central Court of First Instance in Madrid concluded that the measures were proportionate, approving them as requested.

    The Libyan Registrar Acts

    Little more than a week later, at least one intermediary appears to have taken action. Earlier this week, Series.ly unexpectedly lost its domain name after the domain registrar, Libyan Spider, stepped in.

    WHOIS records show that series.ly was placed on ‘clientHold’, a status set by the registrar to take a domain offline. This pulls the domain from the .ly zone, which means that Series.ly no longer resolves.

    clientHold

    clientHold

    Libyan Spider hasn’t commented publicly, but the Series.ly operator says the notice cited the Spanish order. It reached them through the auction house that sold them the domain, which acts as a reseller for the registrar.

    “The reason they gave us was a Spanish copyright resolution and a court order authorizing suspension measures against the domain,” the operator tells TorrentFreak (translated).

    It is not clear whether the other intermediaries have taken action yet, but the court order remains valid.

    The site didn’t wait for the domain to come back. Series.ly’s operator confirmed to TorrentFreak that it swiftly switched to a new brand, Cinubo, which runs on a freshly registered .com domain.

    Cinubo.com

    cinubo website

    No Plans to Appeal

    The operator says it didn’t see the warnings before the domain was suspended. An EGEDA email it later found was sent to support@series.ly, while the address listed on the site is soporte@series.ly.

    The registrar’s heads-up also went unnoticed.

    “Our provider forwarded the notice to us quickly, but it went to an account we didn’t check regularly, which also received the catch-all mail for series.ly, meaning messages sent to any address on the domain. We didn’t see those notices in time,” the operator says (translated).

    According to the operator, Series.ly is a non-profit that hasn’t generated any revenue since it launched. The site doesn’t host any video files, and the links to other services are added by the community, he explains.

    “Our position is that complaints about those video files should be directed at the services that host or distribute them,” the operator says (translated).

    “We think it’s disproportionate that a complaint about content hosted by third parties ends up getting our entire domain suspended, including email and the personal library features.”

    For now, the operator doesn’t plan to appeal the Spanish order. The company behind the project is based in Nevis, which raises questions about the reach of the Spanish order, the operator argues.

    “We question whether a procedure handled in Spain justifies suspending our domain worldwide, which also affects email and services that have nothing to do with the works in question,” the operator notes (translated).

    This may not be the end of it though. The Spanish order also covers new domain names that are used for the same purpose, which could include the new Cinubo one. In addition, other intermediaries may take action as well.

    —

    Update October 9, 2026: A few days after it was suspended, the series.ly domain appears to be back under the control of its owner. The operator informs us that the registrar lifted the suspension, but stressed that the domain can no longer be used to link to copyright-infringing content.

    —

    A copy of the Commission’s resolution is available here (pdf). The court’s authorization can be found here (pdf). The Series.ly operator’s answers were provided in Spanish. The quotes in this article were translated by TorrentFreak.

    From: TF, for the latest news on copyright battles, piracy and more.

    • To chevron_right

      Cloudflare Keeps 1.1.1.1 Out of Piracy Blocking, Escapes Penalties in France

      news.movim.eu / TorrentFreak • 4 days ago • 5 minutes

    cloudflare 1.1.1.1 logoOver the past two years, French courts have ordered a growing list of intermediaries to block access to pirate sports streams.

    In addition to regular ISPs, the orders now target public DNS resolvers, VPN services, search engines and CDN providers, all of which can help people bypass existing blockades.

    Internet infrastructure company Cloudflare has received several of these orders. In April, the Paris Judicial Court ordered the company to block 21 domains linked to pirate Formula 1 streams and 16 linked to MotoGP.

    The orders covered Cloudflare’s DNS resolver as well as its CDN. However, they didn’t prescribe how the sites should be blocked, only that access from France had to be prevented “by any effective means.”

    French pay-TV provider Canal+, which requested the blockades, concluded that Cloudflare’s efforts fell short. The broadcaster went back to court and, as first reported by L’Informé, it didn’t get what it wanted.

    Canal+ Requested €50,000 a Day

    In May, Canal+ asked the Paris court to add daily penalties to the April orders. It requested €50,000 per day for every site that remained accessible, and the same amount for every new site that media regulator Arcom reports to Cloudflare.

    From the order (translated)

    50k requested by canal+

    According to Canal+, Cloudflare had deliberately failed to comply with the site blocking orders.

    “[Cloudflare] allegedly circumvented the measures by only implementing the decision through its CDN service, which meant that only three of the 21 domain names listed by the court were blocked,” Canal+ argued, according to the court’s summary (translated).

    In the MotoGP case, Canal+ counted three blocked domains out of 16. In both cases, it added that two of the three blocked sites were back online a week later; one switched to a different CDN, while the other used a mirror site.

    Court Sides With Cloudflare

    On September 17, a panel of three judges ruled on both penalty requests. Cloudflare had pointed to technical constraints that only allowed it to comply through its CDN. It also stressed that the court had expressly left it free to choose which of its services to use, as long as it contributed meaningfully to the fight against sports piracy.

    The court first noted that the way Cloudflare implements the blocking orders is not in dispute.

    “It is undisputed that Cloudflare only implements the ordered measures by blocking through its CDN service, when the site uses that service,” the court writes (translated).

    CDN only

    CDN only

    Cloudflare told the court that this is incomparably more effective than DNS blocking. It added that the architecture of its public DNS resolver doesn’t allow for blocking, making such measures unreasonable.

    Canal+ had argued that Cloudflare only blocked 72.6% of the domain names the court ordered it to block. The court, however, saw the figure as evidence of a genuine willingness to help stop the infringements.

    The ruling doesn’t explain how this percentage relates to the three out of 21 blocked domains that Canal+ cited earlier.

    The court also concluded that Cloudflare can’t be blamed for the sites that switched to another CDN or moved to a mirror.

    “Cloudflare cannot be held responsible when the owners of the sites in question switch to another CDN or set up a redirect to a mirror site,” the court writes (translated).

    Not Cloudflare’s responsibility

    Not Cloudflare's responsibility

    Instead, it is up to Canal+ to ask the new intermediary to block these sites and to report mirror sites to Arcom, the court notes.

    Canal+ also argued that, under the EU Court of Justice’s UPC Telekabel Wien ruling, intermediaries must block effectively. The Paris court disagreed. In its view of the same ruling, intermediaries only have to take reasonable measures, which Cloudflare did with its CDN blocks.

    The court therefore rejected the requested penalties as neither necessary nor proportionate. In addition, Canal+’s request for €20,000 in legal costs was also denied.

    1.1.1.1 Stays Block-Free

    As a result, Cloudflare will not be penalized under these orders, even though its public DNS resolver is not blocking the sites in question. That is in line with the company’s long-standing claim that it doesn’t interfere with its DNS.

    In its recent transparency reports, Cloudflare repeatedly stated that it hasn’t blocked any content through 1.1.1.1, despite orders from French and Italian courts.

    “To date, Cloudflare has not blocked content through the 1.1.1.1 Public DNS Resolver,” the company’s latest report reads.

    From Cloudflare’s transparency report

    transparency report 1.1.1.1 not blocked

    Blocking through the CDN is another matter. According to the same report, Cloudflare geoblocked 1,238 domains in France in the second half of 2025, all under a single court order. In the first half of the year, it geoblocked 662 domains under seven orders.

    Cloudflare recently explained its position to the European Commission, in a submission to its Counterfeit and Piracy Watch List consultation, stressing that global public DNS resolvers should not be used to block or restrict access.

    Instead, it highlights its real-time pirate stream blocking program, which allows vetted rightsholders to flag pirate streams that run through its network. These streams are disrupted “within seconds,” Cloudflare says, without any DNS or IP address blocking.

    “For live content, where speed is crucial, Cloudflare has built real-time mitigation mechanisms that allow vetted rightsholder partners to flag infringing streams. When those streams are running through our network, we act on them in seconds,” Cloudflare informed the Commission.

    Stream mitigation

    Stream mitigation

    For now, Cloudflare can continue to block pirate sites through its CDN only, while its 1.1.1.1 DNS resolver remains untouched. Canal+ can still appeal the rulings, so it may not be the last we hear of it.

    Non-profit DNS resolver Quad9 faces a similar, potentially bankrupting penalty request from beIN Sports for not blocking pirate content on its DNS resolver. How the Paris court will view this will become apparent later this month.

    —

    Copies of the Paris Judicial Court’s rulings in the Formula 1 (RG 26/08243) and MotoGP (RG 26/08228) cases are available here (pdf) and here (pdf). Cloudflare’s submission to the EU Counterfeit and Piracy Watch List consultation can be found here (pdf).

    From: TF, for the latest news on copyright battles, piracy and more.

    • To chevron_right

      Pirate App MovieBox Passes 300 Million Downloads as Rightsholders Alert EU

      news.movim.eu / TorrentFreak • 5 days ago • 3 minutes

    Last year, Nigeria’s copyright watchdog celebrated the suspension of MovieBox.ng, a pirate streaming site that drew tens of millions of visits per month.

    The site swiftly moved to a new domain, as we reported at the time, and its Android app remained widely available.

    However, the app is now drawing attention in Brussels. In submissions for the European Commission’s 2027 Counterfeit and Piracy Watch List, both the Motion Picture Association (MPA) and French TV company Canal+ report MovieBox as a large piracy operation.

    From 243 to 305 Million

    Both rightsholders highlight the same app distribution channel. In its overview of piracy apps, the MPA notes that MovieBox was downloaded more than 243 million times from Palm Store alone.

    Palm Store is the app store that comes preinstalled on Tecno, Infinix and itel phones. These brands all belong to Chinese phone maker Transsion, which sold 61.5% of all mobile phones in Africa in 2024, according to its own filings.

    Canal+ adds more detail. It notes that MovieBox switched to moviebox.ph after enforcement action against its .ng domain in 2025.

    According to Canal+, the app continued to grow after this switch. The site remains online today and the same is true for the app, which more than doubled its number of downloads in less than a year.

    “As of 16 June 2026, PalmStore reported approximately 243.3 million MovieBox application downloads, representing growth of approximately 108% since August 2025, with MovieBox continuing to rank as the number one application in the Entertainment category on the PalmStore platform,” Canal+ writes.

    From Canal+’s submission

    From Canal+'s submission

    The reported June count is already outdated. At the time of writing, Palm Store lists 305.6 million downloads for the app, an increase of more than 60 million in less than four months.

    305.6M downloads

    305.6M downloads

    MovieBox’s store listing explicitly promotes movies, TV series and live sports. “Enjoy free access to sports live streams right in our app,” the description reads, with a specific mention of Europe’s five biggest leagues. Its promotional artwork shows copyrighted shows and categories such as Marvel and Disney.

    Transsion’s Own App Store

    Palm Store is not an independent app marketplace. In a draft prospectus for its planned Hong Kong listing, Transsion describes it as its own app distribution platform, which had more than 180 million monthly active users on average last year.

    This prospectus also explains how the app store makes money. Transsion states that it typically charges third-party developers based on the number of installs that go through its distribution platform. Whether this also applies to MovieBox is unknown.

    ‘Closely Linked’

    Hosting an app in a store doesn’t mean that the store’s owner has anything to do with it. However, Canal+ suggests that the ties run deeper.

    “MovieBox has been closely linked to the Transsion / Transsnet ecosystem. Historical domain registration records identified Transsion-linked registration details for moviebox.ng, while technical analysis of the Android application revealed certificates signed under the Transsion name and references to Transsion-owned infrastructure and services,” Canal+ writes.

    Canal+ on Transsion

    Canal+ on Transsion

    The submission doesn’t explain what these registration details and certificates revealed. It also doesn’t state that Transsion owns or operates MovieBox.

    Canal+ further mentions Excellent Innovation Limited, a Hong Kong company it connects to MovieBox through domain registrations, SSL certificates, developer attributions and trademark filings. Palm Store indeed lists this company as the app’s developer.

    The MPA’s submission doesn’t mention Transsion at all. The Hollywood group merely notes that MovieBox is believed to be operated out of China.

    From the MPA’s submission

    From the MPA's submission

    Canal+ also has a more direct commercial interest in the matter. The French group owns MultiChoice, the pay-TV company behind DStv, which operates in the same African markets.

    Neither of the submissions mentions whether anyone has asked Palm Store or Transsion to remove the app.

    Before the Commission decides, the services that are reported will be offered a chance to respond.

    “The Commission will also make reasonable efforts to contact the service providers reported in the submissions and invite them to respond in writing to the allegations made against them,” the consultation document reads.

    The new list is expected to be released in the spring of next year. The Commission notes that a mention wouldn’t be a finding of wrongdoing or a confirmation of legal violations. It is simply meant to encourage operators and governments to take action against infringement.

    —

    A copy of Canal+’s submission is available here (pdf) and the MPA’s submission can be found here (pdf).

    From: TF, for the latest news on copyright battles, piracy and more.

    • To chevron_right

      Denuvo Asks Court to Unmask Game Cracker ‘voices38’, Reveals Crypto Transactions

      news.movim.eu / TorrentFreak • 6 days ago • 3 minutes

    denuvo logoLast month, Denuvo filed a DMCA anti-circumvention lawsuit against the anonymous game cracker ‘voices38’ at a federal court in California.

    The Irdeto-owned company accuses the cracker of bypassing its Anti-Tamper protection on 26 games, including Hogwarts Legacy and Black Myth: Wukong.

    For now, Denuvo does not know who it is suing. The complaint listed voices38’s Discord user ID, a Reddit account, and seven Steam profiles, but no name. As the lawsuit unfolds, Denuvo hopes to change that, with the court’s help.

    In a recent filing, the company asked the court for permission to subpoena the platforms for information that could identify the cracker, ahead of the regular discovery phase.

    Subpoenas for Discord, Valve and Reddit

    In its ex parte motion, Denuvo explains that it reached out to the three companies directly, without success. Valve and Reddit replied that their privacy policies prevent them from sharing user data without legal backing and Discord didn’t respond at all. A subpoena is the next step.

    “Denuvo seeks leave of the Court to serve limited discovery on Discord, Inc., Valve Corporation, and Reddit, Inc. solely to determine Defendant’s true identity,” the motion reads.

    The proposed subpoenas show what type of information Denuvo is after. Valve, for example, is asked to hand over the registration data, names and billing addresses for seven identified Steam user accounts.

    One of the Steam profiles listed in the filing uses the name Enzo Favara, the main character of Mafia: The Old Country. That is one of the games Denuvo alleges voices38 cracked.

    One of the Steam profiles

    One of the Steam profiles

    Denuvo’s proposed subpoena also requests the payment methods and transaction histories of these accounts, as well as IP addresses with timestamps, device identifiers, and any linked accounts.

    Steam payment data

    Steam payment data

    The seven Steam profiles don’t show much activity, but Denuvo likely linked them to cracking activity associated with ‘voices38’.

    The proposed subpoenas for Discord and Reddit request detailed account data as well. Discord should list the servers the account is a member of and the roles assigned there. Reddit, meanwhile, is asked to produce all posts and comments by ‘voices38’, as well as the account’s subreddit memberships.

    Crypto Transactions on FixedFloat

    The motion also reveals new details. For example, it shows that Denuvo’s own investigation did not stop at these three platforms.

    In a declaration filed alongside the motion, attorney Ryan Morris writes that Denuvo uncovered cryptocurrency transactions by the cracker on the exchange FixedFloat. These crypto transactions involve Bitcoin, Ethereum, and Solana.

    From the declaration

    From the declaration

    The declaration doesn’t explain how Denuvo linked these transactions to ‘voices38.’ It also doesn’t say whether the transactions reveal anything about the person behind the handle.

    FixedFloat is an instant crypto exchange that promotes its service as hassle free, with “no registration and unnecessary details.” Despite mentioning it explicitly, Denuvo doesn’t ask the court for permission to subpoena the crypto platform, and the filing doesn’t say why.

    What’s Next

    It’s now up to Judge Haywood S. Gilliam Jr. to decide whether Denuvo can send its subpoenas to Discord, Valve and Reddit.

    Meanwhile, the lawsuit already appears to have caused some broader damage. Late last month, Tom’s Hardware reported that DenuvOwO, a group that released hypervisor bypasses for dozens of Denuvo games, had disbanded. A member reportedly said the lawsuit was a concern, while the CS.Rin forum removed links to the group’s releases.

    The person or group targeted in the lawsuit didn’t seem impressed when the complaint was filed. “All is fine. Everything will continue as normal,” voices38 wrote on Reddit, shortly after the news broke.

    voices38 comment

    Since then, however, no new ‘voices38’ releases have been posted. Whether that’s related to the lawsuit is unknown.

    —

    A copy of Denuvo’s ex parte motion for expedited discovery is available here (pdf).

    From: TF, for the latest news on copyright battles, piracy and more.

    • To chevron_right

      DNS Resolver Quad9 Rejects French Piracy Blocks, Weighs Exit as beIN Seeks Up to €580K a Day

      news.movim.eu / TorrentFreak • 5 October 2026 • 5 minutes

    quad9Since 2024, French courts have repeatedly ordered public DNS resolvers to block access to pirate sports streaming sites.

    Not every provider accepted this. For example, OpenDNS suspended its service in France in response to the first blocking order.

    Quad9 stayed in France. The Swiss non-profit foundation said that it had to block the targeted sites for all users worldwide to remain in compliance, and announced that it would appeal. Meanwhile, the blocking orders kept coming.

    In May, the Paris Judicial Court required Google, DNS4EU operator Whalebone and Quad9 to block pirate streams of WTA tennis matches for users in France. This order was requested by beIN Sports and initially listed six domains. According to Quad9, 52 more were added in two later updates, bringing the total to 58.

    Now, Quad9 is not blocking any of the domains. In fact, the foundation informed TorrentFreak that it never has. That is a conscious decision, and one that may come at a price.

    beIN Returns for Penalties

    beIN wanted financial penalties from the start. When it requested the blocking order, the broadcaster asked the court to add a penalty of €2,000 per day for every domain Quad9 failed to block. Quad9 was singled out specifically and the other DNS resolvers didn’t face the same request.

    The court declined beIN’s penalty request, explaining that nothing indicated at that point that the foundation intends to resist (“entende résister”) the order. If problems arose later, the parties could return, the court wrote.

    Penalty denied

    Penalty denied

    That is what beIN has done indeed. Quad9 informed TorrentFreak that the broadcaster went back to the Paris court to request penalties. According to Quad9, beIN now seeks €10,000 per domain, per day, which adds up to €580,000 per day for the 58 domains on the list.

    The case was heard before the Paris court last Thursday and a decision is expected to follow in three weeks. The potential penalties would apply from the moment the order comes in and run in the millions of euros per week.

    There are no public notes of the hearing that we know of, but Quad9 explained in detail why it is not blocking any of the domain names, despite facing the potentially bankrupting fines.

    The DNS Blocking Problem

    Technically Quad9 can block the domain names and avoid further pressure. However, the foundation says that it can’t limit the pirate site blocks to users in France, which is what the court order requires.

    The DNS resolver doesn’t collect user data. This means that it would have to rely on third-party databases that link IP addresses to locations to pinpoint users. That’s a problem, Quad9 argues, because these databases are incomplete or inaccurate.

    “There is no legally useful way for us to define a French user,” Quad9 tells us.

    The foundation has learned this the hard way. In Germany, where Sony Music took the DNS resolver to court and, according to Quad9, judges found that its attempt to limit a block to German users was not good enough. Quad9 eventually won the case on appeal, but that finding was never overturned.

    Convincing the Paris court will not be straightforward either. In the May order, the court noted that the defendants failed to show that limiting the blocks to French territory would be costly or technically impossible.

    Alternatively, Quad9 can block the domain names globally, as it said it would in 2024. It also did so in Germany in 2023, under the threat of penalties. When asked why it isn’t doing the same now, the foundation explained that the German block was a temporary measure while the case played out. It added that conditions in Germany were different, and that it approaches each case on its own terms.

    “We remain entirely confident in our core argument: DNS recursive resolvers are the wrong place to counter the problem of online piracy, and will result in significantly worse outcomes for the citizens of France,” Quad9 says.

    Quad9 is not the only party that raises these concerns. Earlier this year, a report published by the Internet Society warned that smaller DNS operators pay the highest price for blocking orders.

    “Large, well-resourced operators may be able to absorb the compliance costs, but smaller and non-profit operators risk being excluded from the market if they cannot afford the staffing and compliance infrastructure demanded by jurisdiction-specific blocking orders,” the report reads.

    Excluded from the market

    Excluded from the market

    Leaving France?

    If the court grants beIN’s request, Quad9 will have to take action to avoid millions of euros in fines per week. The foundation told us that it essentially has three options left then.

    Quad9 can implement a block for French users only, which it says would be inaccurate and still leave it open to fines. Alternatively, it can block the domains globally which, according to Quad9, would essentially extend French jurisdiction across the world.

    The final option is to stop serving users it believes are in France altogether, as OpenDNS did in 2024. How accurate that measure is remains to be seen as well.

    Quad9 says it has yet to discuss these options with its Foundation Council, noting that it must remain law-abiding without putting its own existence at risk.

    “Additionally, we are required by Swiss law to abide by our founding principles of privacy, security, and stability of the internet and how those principles are applied to our user community in a consistent and predictable manner in all areas,” Quad9 notes.

    ‘Recklessly Dangerous’

    The decision isn’t getting any easier now that France prepares to expand its blocking measures. In July, the French Parliament adopted a law that allows new domains to be added automatically during live broadcasts, with regulator ARCOM reviewing them after the fact.

    Quad9 sees this as a dangerous development, on top of an already quite concerning blocking requirement.

    “An unfettered, unencumbered and delegated power given to an unspecified list of commercial parties to block any content they desire seems to us recklessly dangerous, un-necessary, and counter-productive,” it tells us.

    The foundation believes that this will drive people to use less secure systems in unknown jurisdictions. At the same time, the costs associated with continued real-time updates would likely rule out any meaningful vetting, Quad9 adds.

    “Dynamic injection of false answers weaponizes the DNS against end users,” the foundation says. “This blocking method will be proven to be ineffective, wasteful, and will not achieve the goal of removing the content which remains as reachable as ever.”

    For now, the next step in this blocking saga is up to the Paris court. A decision on the penalties is expected to come in later this month and Quad9 will likely announce its response shortly after.

    —

    A copy of the May 13 order (RG 26/02207) is available here (pdf). We reached out to beIN Sports for a comment, but the company informed us that it will not comment on the ongoing procedure.

    From: TF, for the latest news on copyright battles, piracy and more.

    • To chevron_right

      Two U.S. Site-Blocking Bills Compete Over VPN Rules and ISP Liability

      news.movim.eu / TorrentFreak • 3 October 2026 • 12 minutes

    congressFor more than a decade after the SOPA protests, pirate site blocking was a subject U.S. lawmakers preferred to avoid.

    That changed last month, when two site blocking bills were introduced in Congress within ten days of each other.

    The first, introduced by Rep. Darrell Issa, is the American Copyright Protection Act (ACPA) which would allow courts to order ISPs, DNS resolvers, and VPNs to block foreign pirate sites.

    The second is the DEFEND IP Act, introduced by Reps. Zoe Lofgren and Ben Cline in the House, with Senators Thom Tillis, Chris Coons, Marsha Blackburn, and Adam Schiff leading in the Senate. It merges Lofgren’s FADPA and the Senate’s Block BEARD proposal into the unified bill TorrentFreak reported on in April.

    At first glance, both bills look fairly similar. They use federal courts to target foreign pirate sites only, and both leave the technical blocking measures up to the providers. The differences are in the details, however, starting with which intermediaries can be ordered to block.

    ACPA (H.R. 10364) DEFEND IP Act (H.R. 10575)
    VPNs Covered Excluded (if exclusively a VPN)
    ISP threshold 100,000 monthly users or subscribers 50,000 subscribers
    DNS resolvers Covered Only public resolvers with over $100 million in revenue
    Pirate site test “Only limited” commercially significant purpose beyond infringement “No” commercially significant purpose beyond infringement
    ISP damages shield Yes, for all providers, from day one No
    Cost reimbursement Must be ordered, may be reduced; covers staff time At the court’s discretion; no overhead
    Rightsholder bond Yes No
    Overblocking compensation Up to $250,000 (rightsholder’s error only) None
    Courts Designated judge roster Any district court

    Who Has to Block?

    Under the ACPA, any broadband provider, DNS resolver, or VPN with 100,000 or more monthly users or subscribers in the United States can be named in a blocking order. Smaller services are exempt, as well as root nameservers and top-level domain registries.

    The DEFEND IP Act takes a different approach. It covers broadband providers with at least 50,000 subscribers, which effectively means that more smaller ISPs are covered. DNS resolvers, however, only qualify if they are public and have more than $100 million in annual revenue.

    VPNs are left out altogether. The DEFEND IP Act explicitly excludes services that exclusively provide VPN connections or similar encrypted routing, as well as DNS services that only work through encrypted protocols, such as DoH.

    That makes VPNs the clearest different between the two U.S. blocking bills. A VPN provider with 100,000 American users could be ordered to block pirate sites under Issa’s bill, while it would not be targeted by Lofgren’s version.

    Who has to block

    ACPA (H.R. 10364)§1601(6)(B) and (C)

    (B) INCLUSIONS.—The term ‘service provider’ includes providers of broadband internet access services, providers of domain name resolution services, and virtual private networks, but excludes root nameserver operators and top level domain registries.

    (C) EXCLUSIONS.—The term ‘service provider’ excludes—

    (i) any entity that provides services to fewer than 100,000 monthly users or subscribers in the United States; […]

    DEFEND IP Act (H.R. 10575)§502A(a)(1) and (6)

    (1) BROADBAND PROVIDER.—The term ‘broadband provider’ means a provider of broadband internet access service, […] that provides such service to not fewer than 50,000 subscribers.

    (6) SERVICE PROVIDER.—The term ‘service provider’—

    (A) means—

    (i) a broadband provider; or

    (ii) a provider of public domain name resolution services that has an annual revenue of more than $100,000,000; and

    (B) does not include—

    (i) an entity that provides domain name system resolution functions or services exclusively through encrypted DNS protocols;

    (ii) an entity that exclusively provides virtual private network services or similar service that encrypt and route user traffic through intermediary servers; […]

    Highlights added by TorrentFreak

    The ACPA wasn’t always this broad in scope. The discussion draft that we covered last year exempted any ISP with 1% or less of the U.S. broadband market. That excluded pretty much every provider with fewer than 1.2 million customers. The introduced bill dropped that exemption, adding smaller ISPs and VPNs as blocking intermediaries.

    What is a Pirate Site?

    Both bills rely on a three factor test to decide if a foreign site can be blocked. A site qualifies if it is primarily designed for infringement, if it is marketed to promote infringement, or if it has little legitimate use. The bills describe that requirement differently.

    The DEFEND IP Act requires that a site has no commercially significant purpose or use beyond copyright infringement. The ACPA, on the other hand, settles for a site that has only limited commercially significant purpose beyond providing access to infringing material. That is a lower bar.

    Pirate site test

    ACPA (H.R. 10364)§1602(b)(5)

    (5) the accused online service—

    (A) is primarily designed or provided for the purpose of providing access to material that violates an exclusive right or protection afforded under this title;

    (B) has only limited commercially significant purpose or use other than providing access to material that violates an exclusive right or protection afforded under this title; or

    (C) is marketed by or at the direction of the operator of the accused online service to promote the use of the foreign online service in committing a violation of an exclusive right or protection afforded under this title.

    DEFEND IP Act (H.R. 10575)§502A(b)(2)(B)

    (B) upon a showing by the petitioner that the foreign online location described in subparagraph (A)—

    (i) is primarily designed or primarily provided for the purpose of violating an exclusive right or protection afforded under this title;

    (ii) has no commercially significant purpose or use other than committing a violation described in clause (i); or

    (iii) is intentionally marketed by or at the direction of the operator of the foreign online location to promote the use of the foreign online location in committing a violation described in clause (i).

    Highlights added by TorrentFreak

    There is a second difference that’s more subtle. The ACPA targets sites that provide access to pirated material, which covers linking and indexing sites as well as hosts. The DEFEND IP Act refers to sites designed for the purpose of infringing, which is less explicit about sites that only link to content hosted elsewhere.

    Both bills also let rightsholders act before any infringement takes place. The ACPA covers operators who will violate a right, not only those already doing so. DEFEND IP does something similar for live events, allowing a site to be targeted when a transmission will likely infringe, and it lets courts issue designations ex parte, without hearing the site operator first.

    The Liability Shield

    The largest difference between the two bills has little to do with blocking itself. It relates to what happens to the piracy liability of ISPs and other providers after a site has been declared a pirate site.

    The ACPA includes a broad liability shield, which covers every service provider the bill applies to, whether it was ordered to block anything or not.

    “A service provider, whether or not named in an order issued under section 1604(d), shall not be liable for monetary relief for any claim of direct or secondary infringement of copyright arising from the service provider having provided or enabled, or continuing to provide or enable, access to a foreign piracy site, unless the service provider acted or is acting in active concert with the foreign piracy site to infringe the exclusive rights of any copyright owner,” the bill reads.

    This means that, once a court has declared a site a pirate site, no copyright holder can win damages from a provider for carrying traffic to it, unless that provider is actively working with the site. This provision takes effect on the day the bill is signed, which is six months before the rest of the law.

    The shield has expanded quite a bit since last year. Issa’s early discussion draft only protected providers that were named in an order, only against the rightsholder that obtained the order, and only for activity after the order was issued. The introduced bill dropped these limits.

    The DEFEND IP Act takes a different approach. It protects providers that implement an order in good faith, and it shields them from claims by the blocked site. There’s no piracy liability shield. In fact, the text specifies that nothing in the bill affects the DMCA’s safe harbors or the principles of secondary liability.

    Liability

    ACPA (H.R. 10364)§1610(b)

    A service provider, whether or not named in an order issued under section 1604(d), shall not be liable for monetary relief for any claim of direct or secondary infringement of copyright arising from the service provider having provided or enabled, or continuing to provide or enable, access to a foreign piracy site, unless the service provider acted or is acting in active concert with the foreign piracy site to infringe the exclusive rights of any copyright owner.

    DEFEND IP Act (H.R. 10575)§502A(i)

    (i) Rules of construction.—Nothing in this section may be construed to affect—

    (1) the applicability or interpretation of any other provision of law or principle of equity, including—

    (A) the requirements of section 512 or any other provision of this title;

    (B) principles of secondary liability; or

    (C) section 1651 of title 28; or

    (2) the limitation on the liability of a service provider under section 512.

    Highlights added by TorrentFreak

    Liability was a key point of contention in site-blocking discussions last year. In May 2025, Senator Chris Coons told a Senate hearing that progress was finally being made, but that Internet providers wanted something in return.

    “It finally feels like we’re making some real progress here on site blocking after years. One of the key roadblocks to getting a final deal is whether ISPs should benefit from immunity, both prospectively and retrospectively,” Senator Coons said.

    The MPA’s Karyn Temple responded that site blocking laws elsewhere had not led to lawsuits against ISPs, so there was little to protect them from.

    “ISPs have not routinely been sued for enforcing site blocking regimes. So, you know, I think in our experience, we don’t think that this is a provision that is necessary at all,” Temple replied.

    Sixteen months later, the bill Coons co-sponsors has no piracy-damages shield, while Issa’s has a broad one.

    Who Pays?

    Site blocking costs money, and both bills allow providers to recover some expenses from rightsholders. How much differs between the two proposals.

    Under the DEFEND IP Act, reimbursement is at the court’s discretion and only direct compliance costs can be claimed. Capital expenditures, infrastructure, overhead, and attorneys’ fees are excluded.

    “Upon motion by a service provider subject to an order issued under this subsection, the court may order the petitioner that sought the order to pay reasonable costs directly incurred by the service provider to comply with the order,” the bill reads.

    The ACPA is more generous. If a provider documents its costs, the court must order reimbursement. It can’t deny it, but the amount can be reduced. These costs can also include overhead that’s linked directly to the order, such as the salary costs of specialized staff for the time they spend on it.

    Costs

    ACPA (H.R. 10364)§1609(c)(1) and (d)

    (1) The reimbursement awarded may include any commercially reasonable cost actually and directly incurred by the named service provider to implement the order, including portions of overhead costs directly incurred specifically to implement the order, such as portions of salary costs for specialized personnel directly attributable to time spent on implementing the specific order at issue and not other orders or other tasks.

    (d) […] the court shall issue an order requiring the copyright owner to provide the reimbursement to the named service provider within a time period set by the court, except that the court may reduce the reimbursement to prevent imposing an undue burden on the copyright owner considering the resources of the copyright owner.

    DEFEND IP Act (H.R. 10575)§502A(c)(10)

    (A) IN GENERAL.—Upon motion by a service provider subject to an order issued under this subsection, the court may order the petitioner that sought the order to pay reasonable costs directly incurred by the service provider to comply with the order.

    (B) CONTENTS.—A motion made under subparagraph (A)—

    (i) shall include a detailed list of each cost described in that subparagraph;

    (ii) may not include costs for capital expenditures, infrastructure, overhead, or attorneys’ fees; and

    (iii) shall be filed not later than 60 days after the date on which the costs sought to be recovered were incurred.

    Highlights added by TorrentFreak

    The ACPA requires rightsholders to post a bond for each site blocking order, to cover any provider that is wrongfully enjoined. DEFEND IP doesn’t have this requirement.

    Overblocking is treated differently too. Under the ACPA, the operator of a legitimate site that gets blocked by mistake can claim up to $250,000 in compensation, provided the rightsholder caused the error. DEFEND IP allows site operators to ask the court to fix an order, without offering compensation.

    A Public Blocklist?

    Transparency is a key element to inform the public on site-blocking, but it is often lacking. In most countries, the public has no official way to find out what is blocked. The U.S. bills do offer transparency, at least on paper.

    The ACPA requires the Copyright Office to keep a public registry of all active blocking orders. In addition, rightsholders must also file a notice of each case at the Copyright Office, which is then published in the Federal Register.

    The DEFEND IP Act requires courts to notify the Register of Copyrights whenever an order is issued, amended, or rescinded, and those notifications are published on the Copyright Office website. Since courts can amend orders when a site moves to a new domain, those updates should be added to the public record as well.

    How useful either registry will be depends on what the orders contain. The bills don’t require domain names and IP addresses to appear in the published version. As TorrentFreak noted last year, publishing orders without those details creates a transparency illusion. The public sees that something is blocked but without further detail, which makes it hard to check for overblocking.

    The two bills also differ on who handles the blocking requests. The ACPA sends everything to a roster of district judges picked by the Judicial Conference. DEFEND IP leaves cases with any appropriate district court.

    Finally, it’s worth noting that two of the sponsors have limited time. Issa retires at the end of the year and Tillis’s term ends in January, so their bills have to move before the session closes. Whether the two will be merged, or one will simply overtake the other, has yet to be seen.

    —

    The full text of the ACPA (H.R. 10364) is available on Congress.gov, as is the DEFEND IP Act (H.R. 10575).

    From: TF, for the latest news on copyright battles, piracy and more.

    • To chevron_right

      LaLiga Wants Major VPNs on EU Piracy Watch List Over Affiliate Marketing

      news.movim.eu / TorrentFreak • 30 September 2026 • 5 minutes

    laligaEvery few years, rightsholders get the opportunity to tell the European Commission which pirate sites and services deserve a spot on its Counterfeit and Piracy Watch List.

    These submissions traditionally focus on torrent sites, cyberlockers and pirate IPTV services. In recent editions, however, intermediaries such as hosting companies and Cloudflare have been added to the mix.

    LaLiga takes this expanding reach a step further. In its submission for the 2027 edition, the Spanish football league asks for NordVPN, ProtonVPN, ExpressVPN and Surfshark to be listed.

    The 14-page submission targets a wide range of sites and services, including traditional piracy threats, but the VPN section is new. The league notes that it doesn’t take offense with the technology itself, but with how these providers are marketed by others through their affiliate programs.

    “The conduct that takes these services beyond neutral technical provision is the deliberate marketing of circumvention, conducted at arm’s length through affiliate programmes,” LaLiga writes.

    Geo-Unblocking Free Football Broadcasts

    LaLiga explains that publishers and influencers with affiliate deals publish guides, updated for the 2026/27 season, on how to watch its football matches for free using these VPNs. Those pages rank the providers and link to discounted subscriptions, while earning a commission on resulting sales.

    Some of these guides point out that football fans can use the VPNs to circumvent geoblocking, allowing them to watch free or cheap broadcasts in other countries. This isn’t linked to pirate streams, but LaLiga notes that it harms the territorial exclusivity of its licensing deals.

    “the loss of neutrality”

    affiliate marketing

    Guides of this type are not hard to find. We came across several Spanish-language pages, updated for the new season, that recommend connecting to a foreign VPN server to watch matches on free broadcasts abroad.

    These recommendations are published by affiliates, not by the VPN providers themselves. LaLiga’s submission doesn’t claim that the providers write the guides themselves, but it argues that the providers profit from them.

    Circumventing Pirate Site Blockades

    In addition to bypassing geo-blocking, the submission also flags guides that it sees as a more serious concern. These are affiliate pages that name pirate streaming sites and services, explaining that a VPN can bypass court-ordered site blocking measures.

    LaLiga says that anyone can verify this affiliate marketing activity, but the submission doesn’t name or link to a single guide or influencer that’s crossing a line.

    According to LaLiga, the publishers behind the guides are not always independent, linking the vpnMentor review site to Kape Technologies, which owns several VPN services.

    “Publishers of the guidance are in some cases not independent. Within one of the corporate groups identified above, VPN review and ranking publications are under the same ownership as the products they rank, a relationship those publications disclose,” the submission reads.

    Which of these publications include the guides LaLiga describes isn’t mentioned.

    Independence

    independent

    The submission also argues that some VPN providers have released marketing material timed around its match calendar. This is not backed up with examples, but in February a Spanish court in Córdoba reached a similar conclusion when it issued an ex parte site blocking order against ProtonVPN and NordVPN.

    Without hearing the VPN providers, the court reportedly concluded that both NordVPN and ProtonVPN actively advertise their ability to bypass geo-restrictions, citing match schedules in their marketing materials, while describing the VPNs as active participants in the piracy chain.

    The matter is not settled yet. In May, the same court refused to fine NordVPN for not complying, accepting that the targeted IP addresses of pirate streams changed frequently. The main proceedings are still ongoing.

    VPN Technology is Fine

    LaLiga asks the Commission to list the four providers because they allegedly facilitate access to blocked pirate sites and services. The league stresses that it’s not targeting the technology itself.

    “This request is based not on the provision of VPN services as such, but on the commercial exploitation and active promotion of their ability to circumvent court-ordered blocking measures,” LaLiga writes.

    The submission also opens with a disclaimer. “This submission does not assert any finding of legal liability against the entities named,” it reads.

    The main allegation hinges on the affiliate promotion angle, without naming any specific guides. Whether that will be sufficient for the European Commission has yet to be seen, especially since it is still contested in courts and among lawmakers whether VPN providers should be required to implement blocking orders.

    AFTVnews Downloader Short Codes

    VPNs are not the only general-purpose tools in LaLiga’s submission. The league also targets Downloader by AFTVnews, a popular app for Fire TV and Android TV devices that lets users download files by entering a URL or a numeric short code.

    LaLiga says it catalogued 341 of these codes, 262 of which lead to pirate apps. The league describes the codes as a curated catalogue, under the operator’s “exclusive editorial control.”

    “The ease and simplicity with which applications can be discovered and installed through this catalogue is itself demonstrative of its nature as an editorially-curated platform, distinct from the underlying distribution infrastructure,” LaLiga writes.

    AFTVnews, which boasts more than 100 million users, describes the codes as being “generated by the AFTVnews URL Shortener,” which suggests that they are created from links submitted by users.

    Downloader

    downloader

    Downloader has been targeted before. In 2023, Google removed the app from its Play Store following complaints from Israeli TV companies, and again after a DMCA notice from Markscan. The app was later reinstated.

    Whether the Commission will mention Downloader or any of the four VPN providers in its 2027 piracy watchlist has yet to be seen. The latest Counterfeit and Piracy Watch List, released in 2025, did not include any VPN services, but did mention various hosting providers, IPFS, and domain name privacy service Njalla.

    —

    A copy of LaLiga’s submission to the European Commission is available here (pdf).

    We reached out to ProtonVPN, the VPN Trust Initiative and AFTVnews for comment, but they did not respond before publication.

    Disclosure: TorrentFreak uses VPN affiliate links, but not in a circumvention context.

    From: TF, for the latest news on copyright battles, piracy and more.