U.S. Seizes More Pirate Sports Streaming Domains, But Iranian Fallbacks Remain * TorrentFreak

U.S. Seizes More Pirate Sports Streaming Domains, But Iranian Fallbacks Remain

With the FIFA World Cup nearing its conclusion this week, the crackdown on sports streaming sites continued this weekend.

As part of the "Operation Offsides" enforcement action, led by U.S. authorities, more than 100 domain names were seized over the past days.

These new seizures came more than two weeks after the U.S. Department of Justice officially announced the action. While no new announcement was released, the recent seizures in part target fallback domains that pirate sites switched to following the initial crackdown.

For example, when the buffstreams.plus domain name was seized, ibuffstreams.app took its place, pointing to the same server infrastructure. This backup domain did not go unnoticed and was subsequently seized, pointing to the now-familiar banner.

The seizure banner

These secondary domain seizures also targeted many other domains and brands, including sportsurge.ws, footybite.app, totalsportekz.app, and istreameast.app. A longer list with more examples is available below.

Iranian Fallback

As long as the people running these sites are not caught, they will often launch new domain names. This is not new, but a recent series of domains caught our eye, as it is using seemingly more resilient fallback: Iran’s .ir country-code top-level domain.

OSINT data gathered by TorrentFreak found that buffstreams.ir, sportsurge.ir, and footybite.ir are all active and operational. These domains resolve to the same Ukrainian IP-address, which was previously used by the now seized buffstreams.plus, ibuffstreams.app, and sportsurge.ws domains.

The Iranian domains are paired with Iranian nameservers, ns1.pars.cloud and ns2.pars.cloud, which are also new as the earlier domains relied on Cloudflare nameservers. This suggests that the operators are intentionally moving away from American infrastructure.

Three Years in the Making

Iranian WHOIS data doesn’t reveal when the domains were registered, but SSL certificate logs tell us these .ir domains are not recent emergency registrations.

Both buffstreams.ir and sportsurge.ir received their first SSL certificates on September 22, 2023, within six minutes of each other. Their certificate chains have been renewed without interruption every 90 days since.

In other words, the .ir domains were set up nearly three years before Operation Offsides was announced. All this time they were presumably kept in reserve as a fallback and following the recent seizure actions they were brought to the fore.

The same certificate information also shows that, a few days ago, these .ir domains moved away from the Google SSL certificates they have been using for years. Instead, they switched to certificates from Let’s Encrypt.

More Iranian Links

The three domains on pars.cloud are not the only pirate streaming brands using .ir. Our investigation identified at least 20 additional streaming-related .ir domains spread across several operator clusters.

This includes Totalsportek, nflbite, and nflstreams branded sites with .ir domains, which are all share the same Cloudflare nameserver pair, indicating that they are run from the same account. There is also a separate .ir-linked mlb66 and nhl66 operation, which has been in use for a while.

These .ir domains are not necessarily a response to the recent U.S. domain seizures, as they’ve been around for much longer, but they show that more operators have discovered the .ir ccTLD.

In fact, we have also seen a cluster of Iranian sports streaming domains that are registered, but are not serving any content. These include nbabite.ir, nbastreams.ir, nhlbite.ir, mmastreams.ir, nflstream.ir, stream2watch.ir, and streameastt.ir. These may be waiting to be deployed at a later moment.

Political Tensions

Iran’s .ir country-code TLD is managed by IRNIC, which is part of the Institute for Research in Fundamental Sciences, an academic institution based in Tehran. This makes it essentially unreachable for U.S. law enforcement.

Because of American sanctions, U.S. domain registrars are not allowed to resell .ir domain names. At the same time, given the current state of U.S.-Iran relations it is unlikely that IRNIC will voluntarily cooperate with U.S. authorities to target these domain names.

For pirate sites operators, .ir domains are also appealing due to a revision of IRNIC’s WHOIS policy in 2023. As a result, public queries no longer return registration dates, registrant names, or other contact information. For outsiders, these domains are essentially anonymous.

Notably, Iran’s copyright laws do not cover works from outside Iran, as the country is not a signatory to the Berne Convention, the WIPO Copyright Treaty, or a member of the WTO. This further complicates enforcement actions.

Of course, there are plenty of downsides to using .ir domain names. The...