The U.S. continues to crack down on sports streaming sites, seizing well over a hundred additional domain names this weekend. While these enforcement actions sorted effect, several of the targeted domains now use fallback domains on Iran's .ir country-code TLD, which might be harder to reach for American law enforcement.
With the FIFA World Cup nearing its conclusion this week, the crackdown on sports streaming sites continued this weekend.
As part of the “Operation Offsides” enforcement action, led by U.S. authorities, more than 100 domain names were seized over the past days.
These new seizures came more than two weeks after the U.S. Department of Justice officially announced the action. While no new announcement was released, the recent seizures in part target fallback domains that pirate sites switched to following the initial crackdown.
For example, when the buffstreams.plus domain name was seized, ibuffstreams.app took its place, pointing to the same server infrastructure. This backup domain did not go unnoticed and was subsequently seized, pointing to the now-familiar banner.
These secondary domain seizures also targeted many other domains and brands, including sportsurge.ws, footybite.app, totalsportekz.app, and istreameast.app. A longer list with more examples is available below.
As long as the people running these sites are not caught, they will often launch new domain names. This is not new, but a recent series of domains caught our eye, as it is using seemingly more resilient fallback: Iran’s .ir country-code top-level domain.
OSINT data gathered by TorrentFreak found that buffstreams.ir, sportsurge.ir, and footybite.ir are all active and operational. These domains resolve to the same Ukrainian IP-address, which was previously used by the now seized buffstreams.plus, ibuffstreams.app, and sportsurge.ws domains.
The Iranian domains are paired with Iranian nameservers, ns1.pars.cloud and ns2.pars.cloud, which are also new as the earlier domains relied on Cloudflare nameservers. This suggests that the operators are intentionally moving away from American infrastructure.
Iranian WHOIS data doesn’t reveal when the domains were registered, but SSL certificate logs tell us these .ir domains are not recent emergency registrations.
Both buffstreams.ir and sportsurge.ir received their first SSL certificates on September 22, 2023, within six minutes of each other. Their certificate chains have been renewed without interruption every 90 days since.
In other words, the .ir domains were set up nearly three years before Operation Offsides was announced. All this time they were presumably kept in reserve as a fallback and following the recent seizure actions they were brought to the fore.
The same certificate information also shows that, a few days ago, these .ir domains moved away from the Google SSL certificates they have been using for years. Instead, they switched to certificates from Let’s Encrypt.
The three domains on pars.cloud are not the only pirate streaming brands using .ir. Our investigation identified at least 20 additional streaming-related .ir domains spread across several operator clusters.
This includes Totalsportek, nflbite, and nflstreams branded sites with .ir domains, which are all share the same Cloudflare nameserver pair, indicating that they are run from the same account. There is also a separate .ir-linked mlb66 and nhl66 operation, which has been in use for a while.
These .ir domains are not necessarily a response to the recent U.S. domain seizures, as they’ve been around for much longer, but they show that more operators have discovered the .ir ccTLD.
In fact, we have also seen a cluster of Iranian sports streaming domains that are registered, but are not serving any content. These include nbabite.ir, nbastreams.ir, nhlbite.ir, mmastreams.ir, nflstream.ir, stream2watch.ir, and streameastt.ir. These may be waiting to be deployed at a later moment.
Iran’s .ir country-code TLD is managed by IRNIC, which is part of the Institute for Research in Fundamental Sciences, an academic institution based in Tehran. This makes it essentially unreachable for U.S. law enforcement.
Because of American sanctions, U.S. domain registrars are not allowed to resell .ir domain names. At the same time, given the current state of U.S.-Iran relations it is unlikely that IRNIC will voluntarily cooperate with U.S. authorities to target these domain names.
For pirate sites operators, .ir domains are also appealing due to a revision of IRNIC’s WHOIS policy in 2023. As a result, public queries no longer return registration dates, registrant names, or other contact information. For outsiders, these domains are essentially anonymous.
Notably, Iran’s copyright laws do not cover works from outside Iran, as the country is not a signatory to the Berne Convention, the WIPO Copyright Treaty, or a member of the WTO. This further complicates enforcement actions.
Of course, there are plenty of downsides to using .ir domain names. The international sanctions will make it challenging to monetize these domains, while Iranian domains are more complicated to register, and may also seem less trustworthy to the broader public.
Also, if an Iranian domain name gets millions of monthly visits, including a large American audience, the U.S. authorities may try to target these operations from alternative angles.
—
Below is a list pirate sports streaming domains that were seized this past weekend. This is addition to the domain names that were seized earlier.
– 247sports1.live
– 4kstream.online
– 808score.net
– acrli.org
– alamalkoora.info
– alphastreams1.online
– arkooora.live
– articletech.info
– asyallakora.live
– bally-sports.click
– bintv.net
– bracupgi.org
– buffstreams.app
– coollkoora.live
– cupshots.live
– daddylive.org
– daysports.online
– deporte-libre.live
– deporte-libre.online
– dingdongsport.org
– dosenow.net
– dotsport.online
– embedhd.org
– exorbitantprivilege.net
– extremesportstv.online
– falconstreams.org
– firstrowsports.org
– foorja.live
– footfytv.live
– footstreams.link
– footy100.net
– footybite.app
– footybitez.app
– fotoklikk.live
– funteam.info
– futbollibre.gratis
– goal-koora.live
– goal2.live
– goto-matchat.live
– halastream.net
– ibuffstreams.app
– kkooora4live.net
– knatech.info
– kooora4live.online
– kooora4lives.net
– koora-yallashoot.live
– kooraiive.info
– koorastar.org
– kora24.online
– kora999live.org
– korahnet.live
– koralives.mov
– koralivetv.online
– korallive.online
– koratcity.info
– koratonline.net
– korats.net
– korax90.net
– korralive.info
– livehd7.online
– livehd7s.info
– livesoccers.live
– livesyria.info
– livevss.net
– livevstv.net
– mjumbo.dad
– movish.net
– okkora.live
– onesportsworld.online
– onionstream.live
– openphacts.org
– pelotalibreargentina.org
– pirlotvs.app
– powerstreams.online
– qiuke.app
– qiuyou.live
– ripplenetwork.forum
– rojadirectahd1.club
– rojadirectatvenvivo.click
– score-808.net
– shahid-koora.live
– shazysport.click
– shazysport.live
– shd247.info
– shd247.live
– shstream.live
– sigmastreamer4th.online
– siir-tv.live
– smartcric.click
– sportplus.live
– sports-x.net
– sportsfeed24.org
– sportsonline.click
– sportsonlline.click
– sportssonline.click
– sporttsonline.click
– streamcenter.live
– streamcorner.fyi
– streamcraft.click
– streameast.mov
– streamfree.link
– streamiz.click
– streamninja.online
– streams.center
– streamsports99.fun
– streamthunder.org
– stremonsport.net
– strm01.app
– syria-live.net
– syria2011.net
– syria2012.net
– syrlive.net
– tarjetarojaonline.net
– tarjetarojatv.click
– tarjetarojatvenvivo.click
– techbugs.info
– techiguides.info
– the-tv.app
– therealone.online
– thetvapp.link
– transitionnorthfield.org
– trendgola.org
– tvsportslive.org
– ukdaddy.online
– us-cap.org
– vipbox-tv.live
– yalla-play.net
– yalla4.live
– yallagoolz.net
– yallaksa.live
– yallalive.fun
– yallashoot.fun
– yallashot.life
– yallasnap.net
link to .ir sites.
(buffstreams.ir and sportsurge.ir resolve to 45.12.1.108, as do/did uffstreams.plus, ibuffstreams.app, the-tv.app, sportsurge.ws)
cluster 1 infra to avade US seizures
iran interesting choice as it’s not likely to volunrarily cooperate with US authorities considering recent tensions
more examples, not necessarily reactive /// “24All” and “66” brands already had .ir domains for years
We can expect more seizure action as the World Cup comes ot its end,
Pirate Sports Streaming Operation Switches to Iranian Domains as U.S. Seizures Continue
U.S. Domain Seizures of Sports Streaming Sites Continue with an Iranian Twist
buffstreams.appJul 12, 2026
footybite.appJul 12, 2026
footybitez.appJul 12, 2026
ibuffstreams.appJul 12, 2026
pirlotvs.appJul 12, 2026
qiuke.appJul 12, 2026
strm01.appJul 12, 2026
the-tv.appJul 12, 2026
mjumbo.dadJul 12, 2026
koralives.movJul 12, 2026
streameast.movJul 12, 2026
808score.netJul 12, 2026
bintv.netJul 12, 2026
dosenow.netJul 12, 2026
exorbitantprivilege.netJul 12, 2026
footy100.netJul 12, 2026
halastream.netJul 12, 2026
kkooora4live.netJul 12, 2026
kooora4lives.netJul 12, 2026
koratonline.netJul 12, 2026
korats.netJul 12, 2026
korax90.netJul 12, 2026
livevss.netJul 12, 2026
livevstv.netJul 12, 2026
movish.netJul 12, 2026
score-808.netJul 12, 2026
sports-x.netJul 12, 2026
stremonsport.netJul 12, 2026
syria-live.netJul 12, 2026
syria2011.netJul 12, 2026
syria2012.netJul 12, 2026
syrlive.netJul 12, 2026
tarjetarojaonline.netJul 12, 2026
yalla-play.netJul 12, 2026
yallagoolz.netJul 12, 2026
yallasnap.netJul 12, 2026
streams.centerJul 11, 2026
rojadirectahd1.clubJul 11, 2026
bally-sports.clickJul 11, 2026
rojadirectatvenvivo.clickJul 11, 2026
shazysport.clickJul 11, 2026
smartcric.clickJul 11, 2026
sportsonline.clickJul 11, 2026
sportsonlline.clickJul 11, 2026
sportssonline.clickJul 11, 2026
sporttsonline.clickJul 11, 2026
streamcraft.clickJul 11, 2026
streamiz.clickJul 11, 2026
tarjetarojatv.clickJul 11, 2026
tarjetarojatvenvivo.clickJul 11, 2026
ripplenetwork.forumJul 11, 2026
streamsports99.funJul 11, 2026
yallalive.funJul 11, 2026
yallashoot.funJul 11, 2026
streamcorner.fyiJul 11, 2026
futbollibre.gratisJul 11, 2026
alamalkoora.infoJul 11, 2026
articletech.infoJul 11, 2026
funteam.infoJul 11, 2026
knatech.infoJul 11, 2026
kooraiive.infoJul 11, 2026
koratcity.infoJul 11, 2026
korralive.infoJul 11, 2026
livehd7s.infoJul 11, 2026
livesyria.infoJul 11, 2026
shd247.infoJul 11, 2026
techbugs.infoJul 11, 2026
techiguides.infoJul 11, 2026
yallashot.lifeJul 11, 2026
footstreams.linkJul 11, 2026
streamfree.linkJul 11, 2026
thetvapp.linkJul 11, 2026
247sports1.liveJul 11, 2026
arkooora.liveJul 11, 2026
asyallakora.liveJul 11, 2026
coollkoora.liveJul 11, 2026
cupshots.liveJul 11, 2026
deporte-libre.liveJul 11, 2026
foorja.liveJul 11, 2026
footfytv.liveJul 11, 2026
fotoklikk.liveJul 11, 2026
goal-koora.liveJul 11, 2026
goal2.liveJul 11, 2026
goto-matchat.liveJul 11, 2026
koora-yallashoot.liveJul 11, 2026
korahnet.liveJul 11, 2026
livesoccers.liveJul 11, 2026
okkora.liveJul 11, 2026
onionstream.liveJul 11, 2026
qiuyou.liveJul 11, 2026
shahid-koora.liveJul 11, 2026
shazysport.liveJul 11, 2026
shd247.liveJul 11, 2026
shstream.liveJul 11, 2026
siir-tv.liveJul 11, 2026
sportplus.live
streamcenter.live
vipbox-tv.live
yalla4.live
yallaksa.live
ukdaddy.online
therealone.online
streamninja.online
sigmastreamer4th.online
powerstreams.online
onesportsworld.online
livehd7.online
korallive.online
koralivetv.online
kora24.online
kooora4live.online
extremesportstv.online
dotsport.online
deporte-libre.online
daysports.online
alphastreams1.online
4kstream.online
us-cap.org
tvsportslive.org
trendgola.org
transitionnorthfield.org
streamthunder.org
sportsfeed24.org
pelotalibreargentina.org
openphacts.org
kora999live.org
koorastar.org
firstrowsports.org
falconstreams.org
embedhd.org
dingdongsport.org
daddylive.org
bracupgi.org
acrli.org
futbollibre.gratis
streamcorner.fyi
yallashoot.fun
yallalive.fun
streamsports99.fun
ripplenetwork.forum
tarjetarojatvenvivo.click
tarjetarojatv.click
streamiz.click
streamcraft.click
sporttsonline.click
sportssonline.click
sportsonlline.click
sportsonline.click
smartcric.click
shazysport.click
rojadirectatvenvivo.click
bally-sports.click
rojadirectahd1.club
streams.center
