The Open Observatory of Network Interference (OONI) Foundation has documented the technical scope of IP address blocks implemented in Spain during LaLiga matches. Their report concludes that 554,507 domains were affected at some point between January and June 2026, despite the measures targeting specific services related to unauthorized sports broadcasts. The issue is not only the volume but also the method: blocking a shared IP can take thousands of legitimate websites offline that have no connection to piracy.
The key points of LaLiga blocking in 30 seconds
- OONI identified 554,507 affected domains within a sample of 9.2 million.
- Blocking between 4 and 20 IPs for one hour rendered more than 400,000 domains unusable.
- The measures impacted 7,441 IP addresses from 36 infrastructure providers.
- Cloudflare accounted for over 501,000 affected domains due to extensive use of shared IPs.
- OONI also detected TLS interceptions on Digi’s network across thousands of addresses and domains.
Protecting audiovisual rights is a legitimate interest. Piracy harms operators, clubs, platforms, and license holders. However, the technical design of the measures is as important as their purpose. When actions targeted at a few illegal streams end up affecting media outlets, humanitarian organizations, universities, cloud services, and development tools, the problem shifts from a specific dispute to issues of architecture, proportionality, and network security.
The experience accumulated by various digital publishers in Spain confirms that the harm is real. Sites like diariodelamancha.com, noticias.madrid and noticias.ai have experienced outages coinciding with blocking windows, despite not hosting sports broadcasts or content related to piracy. In some cases, the site functioned from one provider but was inaccessible from another, a situation that’s difficult for users, administrators, and providers to diagnose.
Blocking an IP no longer equals blocking a website
IP address blocking is based on an idea that suited the internet of years past: one server, one IP, one service. That relationship no longer reflects how much of the web functions today.
Content delivery networks, reverse proxies, serverless platforms, and shared hosting services allow thousands of domains to use the same IP address. The server distinguishes each request with information such as the domain name included in the TLS connection or HTTP header.
When an operator blocks that entire address, it doesn’t just interrupt the targeted service. It also cuts off access for all other clients sharing the same entry point.
OONI analyzed connectivity measurements collected in Spain from January 1 to June 1, 2026, along with DNS scans of 9.2 million domains. The researchers compared accessibility from Spanish networks with a control point in Frankfurt and classified an IP as blocked when it showed a high failure rate within Spain while responding normally from outside.
The study identified 7,441 blocked IPs belonging to 36 providers and autonomous systems. Notable affected organizations include Cloudflare, Amazon Web Services, Akamai, Alibaba Cloud, Microsoft, and Meta.
The distribution is particularly revealing. Cloudflare accounted for 501,305 affected domains, representing 90.4% of the total, spread across 2,218 IPs. Squarespace had 18,592 domains behind a single address. Amazon’s pattern was the opposite: 11,647 domains spread over 4,286 IPs.
This difference reflects two infrastructure models. Cloudflare and Squarespace host many domains behind a small set of shared IPs. Amazon distributes a larger portion of its services across load balancers, distributions, and independent IPs. Therefore, blocking a Cloudflare IP can cause far-reaching disruption compared to blocking a dedicated address assigned to a specific resource.
Just a few hours of restriction—between 4 and 20 IPs—were enough to impact over 400,000 domains. Telefónica reported segments with up to 478,052 affected domains, while Orange saw up to 477,965.
The impact reached media outlets, universities, and development services
OONI didn’t just count IPs. The report examined which domains resolved to blocked addresses and found a list far removed from illegal streaming sites.
Included among the affected are pages of Amnesty International, Greenpeace, Transparency International, UNICEF, UNHCR, Cáritas, and Mercy Corps. Also impacted are pages from the Australian Senate, public agencies, media outlets, universities, and academic publications.
The technical infrastructure was also affected. OONI identified impacts on Amazon S3 access points, Terraform registry, Linux Mint, Qubes OS, and a Debian mirror. For a developer or tech company, such blocking can prevent dependency downloads, code deployment, static resource access, or automated integrations.
This impact is particularly problematic in distributed systems. A website may load the main HTML correctly but fail to load images, scripts, fonts, or APIs hosted on other IPs. From the user’s perspective, the site appears broken. From the provider’s view, the server remains operational with no overall outage.
Partial failures also occur. OONI distinguishes between fully blocked domains—when all their IPs are restricted—and partially blocked ones, where only some are. The latter doesn’t necessarily mean the service is still available; it may simply be that measurements weren’t sufficient on the remaining addresses.
The study’s methodology tends to underestimate the scope. OONI’s measurements depend on volunteer users, don’t cover all networks or IPs, and the 9.2 million domains are only a subset of internet content. Researchers consider the 554,507 affected domains as a lower bound.
TLS interception on Digi introduces a security issue
The most sensitive finding is not TCP blocking but the detection of signs consistent with TLS Man-in-the-Middle interception in Digi Mobil.
TLS is the protocol that secures HTTPS connections. During session establishment, the server presents a certificate to verify its identity. OONI detected a self-signed certificate in Digi’s network that did not match the requested sites and included generic references like core1.netops.test.
This pattern affected 7,334 IPs across 14 autonomous systems, associated with 10,759 domains. Unlike TCP failure analysis, a single presence of an injected certificate is enough to confirm an intermediary alteration of the connection.
This does not necessarily mean the operator can read encrypted traffic. A modern browser should reject the invalid certificate and display a security warning. Still, the connection was intercepted and replaced with another response, raising technical and legal concerns.
The difference is significant. Conventional blocking prevents access to an address. TLS interception intervenes during server authentication, compromising a core trust mechanism on the internet. Even when used to block content, it introduces a fundamental security risk.
OONI also noted variable implementation across providers. Telefónica was among the most consistent blockers, while other networks showed intermittent activity. In most cases, restrictions started shortly before matches and were lifted afterward.
This temporary link reduces collateral damage outside of broadcasts but does not address the underlying problem. Legitimate services sharing infrastructure remain affected during each window.
Anti-piracy measures need to be more precise
IP blocking can be effective against services that change domains, operate without a public name, or use non-cooperative providers. It’s also a simple technique to implement at the access network level.
Its main weakness is the lack of precision when the address belongs to shared infrastructure. European documents on live event piracy have warned of this risk, recommending exclusion of shared hosting ranges, limiting measure duration, and avoiding unnecessary broad restrictions.
The Spanish case shows that limiting blocking to match times is insufficient. Such measures can be temporary but still disproportionate considering the number and nature of affected services.
Operational transparency is also lacking. Web administrators often don’t know who ordered the restriction, which IPs were blocked, for how long, or how to request review. As a result, they must investigate whether their site is down due to a DNS issue, a CDN problem, or a restriction by an operator.
A more precise system should include updated inventories of shared infrastructure, pre-authorization of targets, quick complaint channels, and independent audits. It should also separate judicial orders from their technical enforcement—authorizing the denial of infringing resources should not automatically legitimize any method used to enforce it.
Protecting intellectual property and maintaining accessible internet are compatible goals. The challenge lies in employing techniques capable of distinguishing the targeted service from the thousands of domains sharing the same provider, network, or IP address. OONI’s data indicates that this distinction is not currently being made with sufficient accuracy.
Frequently Asked Questions
How many domains were affected by the blocks?
OONI identified 554,507 affected domains at some point between January and June 2026, within a sample of 9.2 million.
Why can a single IP block thousands of websites?
Because providers like Cloudflare, Squarespace, and some cloud platforms host many domains behind a single address. The server distinguishes them based on the domain name included in the connection.
What did OONI find on Digi’s network?
The report detected a self-signed TLS certificate injected into connections to 7,334 IPs across 10,759 domains. OONI considers this confirmation of an interception of the connection.
Were the blocks active all the time?
No. In most networks, restrictions were activated shortly before matches started and removed afterward, although during those times, impact on legitimate services was significant.
