Operation Offsides: domain seizure vs site blocking

On 20 July 2026 the Justice Department announced that Operation Offsides had seized more than 1,000 domains streaming FIFA World Cup matches — three separate actions, including the nearly 400 sites taken by the end of June. The investigation ran through the HSI Washington Field Office and the National Intellectual Property Rights Coordination Center; the affidavit supporting the seizure warrant was filed in the U.S. District Court for the Eastern District of Virginia. The release does not name the statute, but seizures of this kind run on the criminal IP forfeiture provision, 18 U.S.C. § 2323. FIFA identified the domains; beIN Media Group, NBCUniversal, the MPA’s Alliance for Creativity and Entertainment, UFC and Warner Bros. supplied supporting information. A parallel track, Operation Red Card, blocked sites across Latin America — 1,140 in Colombia, 309 in Brazil, 256 in the Dominican Republic, 223 in Ecuador, 28 in Peru, 14 in Argentina — and produced the only arrests announced: eleven in Colombia over counterfeit apparel, plus four members of the group Los Ciberinfiltrados.

Eleven days later MPA chairman and CEO Charles Rivkin and IPR Center director Ivan J. Arvelo co-signed an op-ed in RealClearMarkets conceding that a takedown interrupts access for a moment but “does not dismantle the business behind it”, and asking Congress for judicial site blocking — a tool they count in nearly 60 countries. Their figures: 156 million visits to the seized sites in July, $28.3 billion in annual sports piracy losses. TorrentFreak, checking the aftermath, found the major brands already back on Iranian .ir and Soviet-legacy .su fallbacks, with one of them drawing more July traffic on its own than the MPA attributed to every seized domain combined. The legislative vehicle does not exist yet: the House IP subcommittee held its hearing on 30 June, and no unified bill has been introduced.

Why it matters

The newsworthy part is not the seizure, it is who conceded its limits. The director of the agency that ran the largest sports-piracy action in U.S. history put his name to the argument that seizing the domain does not reach the business. That is the enforcement reality brand owners meet at a smaller scale every week, now stated by the people holding the warrants.

Counsel’s note

Ihor Makushinsky · senior counsel

A domain is the cheapest and most replaceable asset an infringing operator owns. Seizing it buys three real things — a hard stop on the traffic that existed at that moment, a banner that shapes user perception, and a preserved evidentiary record — and it does not touch hosting, payment rails, ad relationships or the audience list. When the operator’s next domain is pre-registered and their Telegram channel pushes it out the same hour, you have converted a business problem into a redirect.

The .ir and .su migration is the part worth internalising. Registry choice is a jurisdictional choice, and operators are making it deliberately: a registry outside reach of U.S. process converts your fastest remedy into your slowest. Price that before you build a programme around domain-level action.

For our clients the practical gap is sharper still. A private brand cannot obtain a criminal seizure warrant — that lever belongs to HSI and the Department of Justice, and it was unlocked here by FIFA’s evidence and five rights-holder companies feeding the file. What a brand owner actually controls is the layer beneath: registrar abuse process and UDRP/URS for the name, the real host behind the CDN for the content, and search de-indexation so the replacement domain does not inherit the rankings and backlinks the seized one earned. Sequence those so the takedown is not the whole programme, and keep the monitoring running afterwards — the fallback appears within hours, not weeks.

If U.S. judicial site blocking does arrive, it will be built for studios and leagues first. Whether a mid-size iGaming or broker brand can realistically meet its evidentiary threshold is the question to ask while the bill is still being drafted, not after.

What this means for you

Treat a domain takedown as one step in a chain, not the outcome: capture the infrastructure evidence before you file, and pair the takedown with de-indexation so the clone’s successor starts from zero. Our guides on taking down a casino clone and finding the real host behind Cloudflare cover the groundwork, and our operators page sets out how we run the monitoring that catches the fallback domain.