Collateral Damage of IP-Based Blocking During LALIGA Football Streaming in Spain: Evidence from OONI Measurements | OONI

Collateral Damage of IP-Based Blocking During LALIGA Football Streaming in Spain: Evidence from OONI Measurements<br>Arturo Filastò (OONI), Maria Xynou (OONI), Mehul Gulati (OONI)<br>2026-06-30<br>Since February 2025, Internet Service Providers (ISPs) in Spain have reportedly begun blocking specific IP addresses associated with alleged piracy streaming services during LALIGA football match broadcasts. These blocking actions are implemented during live matches and are tied to court-authorized enforcement measures requested in relation to copyright infringement.<br>Because much of today’s internet relies on shared hosting and content delivery infrastructure, blocking specific IP addresses can result in unintended collateral impact on unrelated services hosted on the same infrastructure.<br>This report shares OONI data collected from Spain documenting these blocking events and their observed impact on the accessibility of legitimate websites.

Key Findings<br>Our analysis of OONI data collected from Spain, as well as our DNS scans against 9.2 million of the internet&rsquo;s most popular domains, revealed that the specific IP blocks associated with alleged piracy streaming services during LALIGA football match broadcasts resulted in widespread collateral damage, affecting hundreds of thousands of domains, including legitimate and widely used websites.<br>Key findings include:<br>At least 5.8% of the internet&rsquo;s most popular domains were found to be blocked in Spain, as the blocking of a small number of IP addresses caused collateral damage affecting more than 500,000 domains over the course of the league. During most LALIGA broadcasts on multiple Spanish networks, blocking only 4–20 IP addresses in a 1-hour window led to significant collateral damage, affecting over 400,000 unique domains through shared hosting and infrastructure dependencies. Out of 9.2 million domains tested, we found at least 554,510 domains blocked at some point in time in Spain during the LALIGA football match broadcasts.<br>Affected domains include benign and important websites. The blocked domains include a wide range of legitimate, unrelated-to-football websites. Some of these are benign, while others are of public interest and defend human rights. Examples of blocked domains include:Human rights websites, such as Amnesty International (amnesty.ie, amnestynews.de, amnesty.org.au) and a Venezuelan digital rights group (vesinfiltro.org).<br>Environmental websites, such as Greenpeace Argentina (greenpeace.org.ar), Cool Earth (www.coolearth.org), The Climate Reality Project (www.climaterealityproject.org), and Orangutan Outreach (redapes.org).<br>Governmental websites, such as the Australian Senate (senate.gov.au) and the Bergamo Court in Italy (tribunale.bergamo.it).<br>Political websites, such as the Catalan Referendum (referendum.cat).<br>News media websites, such as La Patilla, a Venezuelan news media website (lapatilla.com), and the Ukrainian Crisis Media Center (uacrisis.org).<br>Messaging platforms, such as the IM+ (plus.im), WeChat (www.wechat.com), and Session (getsession.org) messaging apps.<br>Humanitarian websites, such as Caritas Argentina (caritas.org.ar), the official social and humanitarian arm of the Catholic Church in Argentina.

At least 36 infrastructure and hosting providers were implicated in the IP-level blocking observed during LALIGA match broadcasts. OONI data collected from Spain reveals the blocking of 7,441 unique IP addresses belonging to 36 organizations, including Amazon, Cloudflare, Alibaba Cloud, Akamai, Meta, and Microsoft. Because many of these IP addresses were shared by multiple services and websites, the blocking extended far beyond the intended targets, affecting organizations ranging from major technology companies to universities such as Harvard University, the University of Washington, and the University of Tsukuba.

TLS Man-in-the-Middle (MitM) attacks on Digi Mobil (AS57269). OONI data collected from Digi Mobil (AS57269) in Spain reveals that a total of 7,334 unique IPs in 14 ASNs, hosting a total of 10,759 domain names, were affected by TLS MitM attacks. The highest number of affected IP addresses are associated with Amazon Web Services (AWS), followed by Cloudflare and Alibaba Cloud.

Blocking implementation varies across ISPs, with Telefonica found as one of the most consistently compliant operators. OONI data from Spain shows that enforcement of the blocking measures differed in both consistency and intensity across providers, with Telefonica (AS3352) among those applying the blocks most reliably during LALIGA match broadcasts over the analysis period.

Blocking by most ISPs is largely confined to match time windows, with minimal evidence of spillover outside broadcast periods. OONI data indicates that the timing of IP blocking correlates with LALIGA match broadcasts, with blocking events beginning shortly...