US seizes more than 1,000 domains used to illegally stream World Cup 2026 matches

The US Department of Justice announced on July 20, 2026 that federal authorities had seized more than 1,000 internet domains used to stream FIFA World Cup 2026 matches without authorization. The effort, called Operation Offsides, ran in stages throughout the tournament, which was co-hosted by the United States, Canada and Mexico.

The announcement is one of the largest publicly reported actions against World Cup illegal streaming, and against piracy around any single sporting event. It also shows where enforcement is focused: the websites and infrastructure that make unauthorized live sport easy to find, rather than individual viewers.

What the Justice Department announced

According to the Justice Department's press release, the seizures happened in several separate actions during the tournament. Nearly 400 sites had been seized by the end of June, and later rounds pushed the total past 1,000.

The operation was led by the Homeland Security Investigations (HSI) Washington Field Office, part of US Immigration and Customs Enforcement, together with the National Intellectual Property Rights Coordination Center (IPR Center). The department listed rights holders and industry groups that supported the effort, including:

• FIFA
• beIN Media Group
• NBCUniversal
• The Alliance for Creativity and Entertainment (ACE), the anti-piracy coalition associated with the Motion Picture Association
• The Ultimate Fighting Championship (UFC)
• Warner Bros.

The announcement also described coordination with authorities in Latin America under the name Operation Red Card, and coordination with Europol in Europe.

Why the World Cup drew so much attention

The 2026 FIFA World Cup, held in the United States, Canada and Mexico from mid-June to mid-July, was the first edition expanded to 48 teams, with more matches than any previous tournament. Large global audiences and match times spread across many time zones create strong demand for live streams, both legitimate and unauthorized. Major sports tournaments have repeatedly been a focus for anti-piracy operations for that reason.

How a domain seizure works

A domain seizure does not delete a website's files or arrest the people behind it. It moves control of the web address to the government under a court-authorized seizure warrant. Visitors who type the address or follow an old link usually see a seizure banner instead of the streaming page.

That makes seizures fast and visible, but it also explains why they are rarely the end of the story. Operators of unauthorized streaming sites often register new domains, and many run lists of "mirror" addresses. The scale of Operation Offsides, with repeated waves through the tournament, reflects that cat-and-mouse pattern.

The legal basis, in general terms

US authorities have used domain seizures against intellectual property crime for many years. Federal law allows property used to commit or facilitate certain IP offences to be seized and forfeited, including, in appropriate cases, domain names. Seizures require court authorization. The US government has run domain seizure campaigns against counterfeit and piracy sites since at least 2010, when US Immigration and Customs Enforcement began an initiative known as Operation In Our Sites.

A seizure is an enforcement step, not a conviction. Operators may contest seizures in court, and criminal charges, if any, follow their own process.

What seizure banners look like

Visitors to seized domains generally see an official notice identifying the agencies involved and stating that the domain has been seized. If you see such a notice where a stream used to be, the site has been the subject of law enforcement action. It isn't a technical fault.

Why authorities framed it as a consumer-safety issue

Officials stressed security risks to viewers as well as copyright. In the release, HSI Deputy Executive Associate Director Matthew Millhollin warned that unauthorized streaming sites "open your devices to unknown risks."

The release specifically mentioned malicious software and stolen payment information. That matches long-running warnings from security researchers and consumer agencies. Sites that make money from unauthorized streams often rely on aggressive advertising, fake "player update" downloads and pop-ups. We cover those risks in more detail in our analysis of malware and fraud risks in illegal IPTV.

How sites make money from unauthorized streams

Understanding the business model explains the security risks. Unauthorized sports streaming sites typically earn money from:

• Aggressive advertising, including pop-ups and redirects, often from networks with weak controls
• Fake downloads, such as "update your player" prompts that install unwanted software
• Data collection, through sign-up forms and fake account verification
• Subscriptions to "premium" access, sometimes linked to unlicensed IPTV services

The Justice Department's warning about malware and payment theft reflects these practices.

What this means for viewers

For people who simply want to watch live sport, the practical takeaways are straightforward:

• Rights are regional. Major tournaments are licensed to specific broadcasters and streaming services in each country. The legitimate way to watch is through the services that hold those rights where you live.
• A seizure banner is a red flag, not a glitch. If a bookmarked stream suddenly shows a government notice, the site was the subject of enforcement action. Don't look for a mirror.
• Free is not the warning sign. Unclear is. Plenty of legal live TV is free, such as over-the-air broadcasts and ad-supported channels. The warning sign is a service that can't tell you who it is, where its rights come from, or how it makes money. Our guide to telling legitimate IPTV services apart goes through the checks.

World Cup illegal streaming and the bigger enforcement picture

Operation Offsides came months after European authorities announced Operation Switch Off, an Italian-led action against several large unauthorized IPTV services. Platforms are also involved: Amazon said in late 2025 that it would start blocking known piracy apps on Fire TV devices, using a list maintained by ACE.

Together, these actions point to coordinated pressure across the whole chain: the sites and apps that list streams, the servers that deliver them, and the devices people use to watch.

How to watch major sport legally

For future tournaments and seasons:

1. Check which broadcasters and streaming services hold rights in your country. Governing bodies and leagues usually publish this.
2. Look for free-to-air coverage, since many tournaments include some matches on free broadcast TV. An antenna may be all you need. See how to watch free over-the-air TV.
3. Compare live TV and sports streaming options using our comparison checklist.
4. Subscribe only for the event or season, and cancel afterwards.

Our analysis of sports streaming fragmentation explains why following sport now often requires more than one service.

Timeline of the announcement

Questions readers ask

Were viewers prosecuted?

The announcement concerned the seizure of domains used to stream matches without authorization. It didn't announce actions against individual viewers. Laws on watching unauthorized streams vary by country, and we can't give legal advice.

Will seized sites come back?

Operators sometimes reappear under new domains. Seizures disrupt them and make them harder to find, but they aren't always the end of a site. That's why enforcement increasingly targets infrastructure and operators as well as domains. See our report on Operation Switch Off.

What should I do if I visited one of these sites?

If you downloaded anything, such as a "player update" or app, from an unauthorized streaming site, run a security scan, remove unfamiliar software and change passwords you may have entered. If you entered payment details, monitor your statements and contact your bank if you see anything suspicious. Our analysis of malware and fraud risks has more detail.

Why do authorities involve rights holders?

Rights holders and their organizations, such as ACE, often identify infringing sites, gather evidence and provide information about the rights involved. The decisions to seek seizure warrants and take enforcement action rest with prosecutors and courts.

Key points

• The US Justice Department announced on July 20, 2026 that more than 1,000 domains used to stream World Cup 2026 matches without authorization had been seized.
• Nearly 400 were seized by the end of June, and later rounds pushed the total past 1,000.
• The operation was led by HSI's Washington Field Office and the IPR Center, with support from rights holders including FIFA and ACE members.
• Officials emphasized risks to viewers, including malware and stolen payment information.
• A domain seizure is an enforcement step, not a conviction.

How we reported this story

This report is based on the US Justice Department's own announcement, with supporting coverage from security and technology publications linked below. Figures, names and quotations come from the official release. We have avoided figures that appeared in some coverage but not in the release itself. If agencies publish more details, such as charges against operators, we will update this article and note the change.

What we don't know yet

The press release does not list every seized domain or say how many visitors the sites had. It also doesn't say whether criminal charges will follow against specific operators. We will update this article if the Justice Department or the agencies involved publish more details.

Sources and further reading

• US Department of Justice: United States seizes more than 1,000 internet domains used to illegally stream World Cup 2026 matches (July 20, 2026)
• BleepingComputer: US seizes hundreds of FIFA World Cup illegal streaming domains
• Help Net Security: US seizes over 1,000 domains used for illegal World Cup 2026 streams