US seizes nearly 400 domains used for illegal World Cup streams

Federal agents seized nearly 400 internet domains used to illegally stream 2026 FIFA World Cup matches in an operation the Justice Department called Operation Offsides. The seizure warrant was filed in the Eastern District of Virginia, and officials said the domains were used for unauthorized live streaming of matches in violation of U.S. copyright law.

The Justice Department said the domains were identified with help from FIFA, beIN Media Group, NBCUniversal, the Motion Picture Association’s Alliance for Creativity and Entertainment, the Ultimate Fighting Championship and Warner Bros. Officials also said the streams exposed viewers to malware and insecure connections that could compromise personal and financial data, tying the enforcement action to both copyright theft and cybersecurity risk.

The sweep extended well beyond U.S. borders. Officials said servers and domains tied to the illicit streaming were targeted in Peru and Bulgaria, with additional disruptions in Croatia, Romania, Poland and Colombia, a sign that the network behind the streams was distributed across several countries rather than centered in one market.

The seizure came during a tournament running from June 11 to July 19 across the United States, Canada and Mexico, with 104 matches spread across 16 host cities. FIFA said 281,223 fans attended matches on June 16, setting a single-day attendance record, and that cumulative attendance reached 1,309,652 after six days. Gianni Infantino and FIFA have pointed to those numbers as evidence of the competition’s global draw and its path toward the 3.5 million cumulative attendance record set at the 1994 World Cup.

The case also landed amid a wider crackdown on sports streaming piracy. Europol’s Operation KRATOS 2 removed more than 27,000 illegal streaming URLs, led to 29 arrests, identified 86 suspects and dismantled nine organized crime groups across 13 countries. The FBI separately warned on May 27 that actors were spoofing FIFA websites to steal personal information and sell fake tickets and hospitality products, underscoring how quickly fraud, piracy and cybercrime now overlap around major live events.