The U.S. continues to crack down on sports streaming sites, seizing well over a hundred additional domain names this weekend. While these enforcement actions sorted effect, several of the targeted domains now use fallback domains on Iran’s .ir country-code TLD, which might be harder to reach for American law enforcement.
With the FIFA World Cup nearing its conclusion this week, the crackdown on sports streaming sites continued this weekend.
As part of the “Operation Offsides” enforcement action, led by U.S. authorities, more than 100 domain names were seized over the past days.
These new seizures came more than two weeks after the U.S. Department of Justice officially announced the action. While no new announcement was released, the recent seizures in part target fallback domains that pirate sites switched to following the initial crackdown.
For example, when the buffstreams.plus domain name was seized, ibuffstreams.app took its place, pointing to the same server infrastructure. This backup domain did not go unnoticed and was subsequently seized, pointing to the now-familiar banner.
These secondary domain seizures also targeted many other domains and brands, including sportsurge.ws, footybite.app, totalsportekz.app, and istreameast.app. A longer list with more examples is available below.
Iranian Fallback
As long as the people running these sites are not caught, they will often launch new domain names. This is not new, but a recent series of domains caught our eye, as it is using seemingly more resilient fallback: Iran’s .ir country-code top-level domain.
OSINT data gathered by TorrentFreak found that buffstreams.ir, sportsurge.ir, and footybite.ir are all active and operational. These domains resolve to the same Ukrainian IP-address, which was previously used by the now seized buffstreams.plus, ibuffstreams.app, and sportsurge.ws domains.
The Iranian domains are paired with Iranian nameservers, ns1.pars.cloud and ns2.pars.cloud, which are also new as the earlier domains relied on Cloudflare nameservers. This suggests that the operators are intentionally moving away from American infrastructure.
Three Years in the Making
Iranian WHOIS data doesn’t reveal when the domains were registered, but SSL certificate logs tell us these .ir domains are not recent emergency registrations.
Both buffstreams.ir and sportsurge.ir received their first SSL certificates on September 22, 2023, within six minutes of each other. Their certificate chains have been renewed without interruption every 90 days since.
In other words, the .ir domains were set up nearly three years before Operation Offsides was announced. All this time they were presumably kept in reserve as a fallback and following the recent seizure actions they were brought to the fore.
The same certificate information also shows that, a few days ago, these .ir domains moved away from the Google SSL certificates they have been using for years. Instead, they switched to certificates from Let’s Encrypt.
More Iranian Links
The three domains on pars.cloud are not the only pirate streaming brands using .ir. Our investigation identified at least 20 additional streaming-related .ir domains spread across several operator clusters.
This includes Totalsportek, nflbite, and nflstreams branded sites with .ir domains, which are all share the same Cloudflare nameserver pair, indicating that they are run from the same account. There is also a separate .ir-linked mlb66 and nhl66 operation, which has been in use for a while.
These .ir domains are not necessarily a response to the recent U.S. domain seizures, as they’ve been around for much longer, but they show that more operators have discovered the .ir ccTLD.
In fact, we have also seen a cluster of Iranian sports streaming domains that are registered, but are not serving any content. These include nbabite.ir, nbastreams.ir, nhlbite.ir, mmastreams.ir, nflstream.ir, stream2watch.ir, and streameastt.ir. These may be waiting to be deployed at a later moment.
Political Tensions
Iran’s .ir country-code TLD is managed by IRNIC, which is part of the Institute for Research in Fundamental Sciences, an academic institution based in Tehran. This makes it essentially unreachable for U.S. law enforcement.
Because of American sanctions, U.S. domain registrars are not allowed to resell .ir domain names. At the same time, given the current state of U.S.-Iran relations it is unlikely that IRNIC will voluntarily cooperate with U.S. authorities to target these domain names.
For pirate sites operators, .ir domains are also appealing due to a revision of IRNIC’s WHOIS policy in 2023. As a result, public queries no longer return registration dates, registrant names, or other contact information. For outsiders, these domains are essentially anonymous.
Notably, Iran’s copyright laws do not cover works from outside Iran, as the country is not a signatory to the Berne Convention, the WIPO Copyright Treaty, or a member of the WTO. This further complicates enforcement actions.
Of course, there are plenty of downsides to using .ir domain names. The international sanctions will make it challenging to monetize these domains, while Iranian domains are more complicated to register, and may also seem less trustworthy to the broader public.
Also, if an Iranian domain name gets millions of monthly visits, including a large American audience, the U.S. authorities may try to target these operations from alternative angles.
—
Below is a list pirate sports streaming domains that were seized this past weekend. This is addition to the domain names that were seized earlier.
– 247sports1.live
– 4kstream.online
– 808score.net
– acrli.org
– alamalkoora.info
– alphastreams1.online
– arkooora.live
– articletech.info
– asyallakora.live
– bally-sports.click
– bintv.net
– bracupgi.org
– buffstreams.app
– coollkoora.live
– cupshots.live
– daddylive.org
– daysports.online
– deporte-libre.live
– deporte-libre.online
– dingdongsport.org
– dosenow.net
– dotsport.online
– embedhd.org
– exorbitantprivilege.net
– extremesportstv.online
– falconstreams.org
– firstrowsports.org
– foorja.live
– footfytv.live
– footstreams.link
– footy100.net
– footybite.app
– footybitez.app
– fotoklikk.live
– funteam.info
– futbollibre.gratis
– goal-koora.live
– goal2.live
– goto-matchat.live
– halastream.net
– ibuffstreams.app
– kkooora4live.net
– knatech.info
– kooora4live.online
– kooora4lives.net
– koora-yallashoot.live
– kooraiive.info
– koorastar.org
– kora24.online
– kora999live.org
– korahnet.live
– koralives.mov
– koralivetv.online
– korallive.online
– koratcity.info
– koratonline.net
– korats.net
– korax90.net
– korralive.info
– livehd7.online
– livehd7s.info
– livesoccers.live
– livesyria.info
– livevss.net
– livevstv.net
– mjumbo.dad
– movish.net
– okkora.live
– onesportsworld.online
– onionstream.live
– openphacts.org
– pelotalibreargentina.org
– pirlotvs.app
– powerstreams.online
– qiuke.app
– qiuyou.live
– ripplenetwork.forum
– rojadirectahd1.club
– rojadirectatvenvivo.click
– score-808.net
– shahid-koora.live
– shazysport.click
– shazysport.live
– shd247.info
– shd247.live
– shstream.live
– sigmastreamer4th.online
– siir-tv.live
– smartcric.click
– sportplus.live
– sports-x.net
– sportsfeed24.org
– sportsonline.click
– sportsonlline.click
– sportssonline.click
– sporttsonline.click
– streamcenter.live
– streamcorner.fyi
– streamcraft.click
– streameast.mov
– streamfree.link
– streamiz.click
– streamninja.online
– streams.center
– streamsports99.fun
– streamthunder.org
– stremonsport.net
– strm01.app
– syria-live.net
– syria2011.net
– syria2012.net
– syrlive.net
– tarjetarojaonline.net
– tarjetarojatv.click
– tarjetarojatvenvivo.click
– techbugs.info
– techiguides.info
– the-tv.app
– therealone.online
– thetvapp.link
– transitionnorthfield.org
– trendgola.org
– tvsportslive.org
– ukdaddy.online
– us-cap.org
– vipbox-tv.live
– yalla-play.net
– yalla4.live
– yallagoolz.net
– yallaksa.live
– yallalive.fun
– yallashoot.fun
– yallashot.life
– yallasnap.net
link to .ir sites.
(buffstreams.ir and sportsurge.ir resolve to 45.12.1.108, as do/did uffstreams.plus, ibuffstreams.app, the-tv.app, sportsurge.ws)
cluster 1 infra to evade US seizures
iran interesting choice as it’s not likely to voluntarily cooperate with US authorities considering recent tensions
more examples, not necessarily reactive /// “24All” and “66” brands already had .ir domains for years
We can expect more seizure action as the World Cup comes ot its end,
Pirate Sports Streaming Operation Switches to Iranian Domains as U.S. Seizures Continue
U.S. Domain Seizures of Sports Streaming Sites Continue with an Iranian Twist
buffstreams.app Jul 12, 2026
footybite.app Jul 12, 2026
footybitez.app Jul 12, 2026
ibuffstreams.app Jul 12, 2026
pirlotvs.app Jul 12, 2026
qiuke.app Jul 12, 2026
strm01.app Jul 12, 2026
the-tv.app Jul 12, 2026
mjumbo.dad Jul 12, 2026
koralives.mov Jul 12, 2026
streameast.mov Jul 12, 2026
808score.net Jul 12, 2026
bintv.net Jul 12, 2026
dosenow.net Jul 12, 2026
exorbitantprivilege.net Jul 12, 2026
footy100.net Jul 12, 2026
halastream.net Jul 12, 2026
kkooora4live.net Jul 12, 2026
kooora4lives.net Jul 12, 2026
koratonline.net Jul 12, 2026
korats.net Jul 12, 2026
korax90.net Jul 12, 2026
livevss.net Jul 12, 2026
livevstv.net Jul 12, 2026
movish.net Jul 12, 2026
score-808.net Jul 12, 2026
sports-x.net Jul 12, 2026
stremonsport.net Jul 12, 2026
syria-live.net Jul 12, 2026
syria2011.net Jul 12, 2026
syria2012.net Jul 12, 2026
syrlive.net Jul 12, 2026
tarjetarojaonline.net Jul 12, 2026
yalla-play.net Jul 12, 2026
yallagoolz.net Jul 12, 2026
yallasnap.net Jul 12, 2026
streams.center Jul 11, 2026
rojadirectahd1.club Jul 11, 2026
bally-sports.click Jul 11, 2026
rojadirectatvenvivo.click Jul 11, 2026
shazysport.click Jul 11, 2026
smartcric.click Jul 11, 2026
sportsonline.click Jul 11, 2026
sportsonlline.click Jul 11, 2026
sportssonline.click Jul 11, 2026
sporttsonline.click Jul 11, 2026
streamcraft.click Jul 11, 2026
streamiz.click Jul 11, 2026
tarjetarojatv.click Jul 11, 2026
tarjetarojatvenvivo.click Jul 11, 2026
ripplenetwork.forum Jul 11, 2026
streamsports99.fun Jul 11, 2026
yallalive.fun Jul 11, 2026
yallashoot.fun Jul 11, 2026
streamcorner.fyi Jul 11, 2026
futbollibre.gratis Jul 11, 2026
alamalkoora.info Jul 11, 2026
articletech.info Jul 11, 2026
funteam.info Jul 11, 2026
knatech.info Jul 11, 2026
kooraiive.info Jul 11, 2026
koratcity.info Jul 11, 2026
korralive.info Jul 11, 2026
livehd7s.info Jul 11, 2026
livesyria.info Jul 11, 2026
shd247.info Jul 11, 2026
techbugs.info Jul 11, 2026
techiguides.info Jul 11, 2026
yallashot.life Jul 11, 2026
footstreams.link Jul 11, 2026
streamfree.link Jul 11, 2026
thetvapp.link Jul 11, 2026
247sports1.live Jul 11, 2026
arkooora.live Jul 11, 2026
asyallakora.live Jul 11, 2026
coollkoora.live Jul 11, 2026
cupshots.live Jul 11, 2026
deporte-libre.live Jul 11, 2026
foorja.live Jul 11, 2026
footfytv.live Jul 11, 2026
fotoklikk.live Jul 11, 2026
goal-koora.live Jul 11, 2026
goal2.live Jul 11, 2026
goto-matchat.live Jul 11, 2026
koora-yallashoot.live Jul 11, 2026
korahnet.live Jul 11, 2026
livesoccers.live Jul 11, 2026
okkora.live Jul 11, 2026
onionstream.live Jul 11, 2026
qiuyou.live Jul 11, 2026
shahid-koora.live Jul 11, 2026
shazysport.live Jul 11, 2026
shd247.live Jul 11, 2026
shstream.live Jul 11, 2026
siir-tv.live Jul 11, 2026
sportplus.live
streamcenter.live
vipbox-tv.live
yalla4.live
yallaksa.live
ukdaddy.online
therealone.online
streamninja.online
sigmastreamer4th.online
powerstreams.online
onesportsworld.online
livehd7.online
korallive.online
koralivetv.online
kora24.online
kooora4live.online
extremesportstv.online
dotsport.online
deporte-libre.online
daysports.online
alphastreams1.online
4kstream.online
us-cap.org
tvsportslive.org
trendgola.org
transitionnorthfield.org
streamthunder.org
sportsfeed24.org
pelotalibreargentina.org
openphacts.org
kora999live.org
koorastar.org
firstrowsports.org
falconstreams.org
embedhd.org
dingdongsport.org
daddylive.org
bracupgi.org
acrli.org
futbollibre.gratis
streamcorner.fyi
yallashoot.fun
yallalive.fun
streamsports99.fun
ripplenetwork.forum
tarjetarojatvenvivo.click
tarjetarojatv.click
streamiz.click
streamcraft.click
sporttsonline.click
sportssonline.click
sportsonlline.click
sportsonline.click
smartcric.click
shazysport.click
rojadirectatvenvivo.click
bally-sports.click
rojadirectahd1.club
streams.center
Source: 
TorrentFreak.com
Be the first to comment