The Department of Justice closed out its World Cup piracy enforcement on July 20, 2026, with a cumulative seizure figure that more than doubled the count reported a month earlier. Colombian authorities blocked more sites than the United States seized.

The Department of Justice announced on Monday, July 20, 2026, the seizure of more than 1,000 internet domains engaged in unauthorized streaming of matches from the 2026 FIFA World Cup Finals, according to a press release issued by the Office of Public Affairs. The seizures occurred across three separate actions during the tournament, a sequence that included the nearly 400 sites seized by the end of the previous month.

The announcement arrived one day after the tournament final at MetLife Stadium and carried press release number 26-808.

Investigation supporting the seizures came from U.S. Immigration and Customs Enforcement Homeland Security Investigations, specifically the HSI Washington Field Office, working with the National Intellectual Property Rights Coordination Center. The enforcement campaign operates under the name Operation Offsides.

For advertisers, agencies, and publishers, the numbers describe a supply-side problem that federal seizure addresses only partially. Domain seizure removes an address. It does not remove the economic incentive that produced the address, nor does it recover budget already delivered against inventory on those pages.

The scale of the enforcement action

The 1,000-domain figure represents a cumulative total rather than a single action. According to the Justice Department, the seizures were spread over three distinct enforcement events across the duration of the tournament, which ran from June to the July 19 final.

Legal authority came through a seizure warrant filed in the U.S. District Court for the Eastern District of Virginia. According to an affidavit filed in support of that warrant, the seized domains were used to illegally offer users copyright-protected content in the form of real-time streams of 2026 World Cup matches as they were being played and first broadcast.

That framing is narrower than it might appear. The affidavit describes live streams of matches during first broadcast, not archived footage, not highlights, not clip redistribution. HSI special agents confirmed that the seized domains were actively broadcasting World Cup matches without authorization, according to the department. Verification was contemporaneous with the infringement.

Identification of the domains came through private sector cooperation. The seized domains were identified with assistance of FIFA, with further supporting information provided by beIN Media Group, NBC Universal, the Motion Picture Association's Alliance for Creativity and Entertainment, Ultimate Fighting Championship, and Warner Brothers, according to the Justice Department. FIFA holds the exclusive rights to sanction and stage the 2026 tournament, hosted across cities in the United States, Canada, and Mexico.

Assistant Attorney General A. Tysen Duva of the Justice Department's Criminal Division framed the operation in terms of two objectives. "The sustained effort to seize more than a thousand domains dedicated to illegally streaming the World Cup confirms the administration's commitment to intellectual property rights and to the success of the 2026 FIFA World Cup," Duva said, according to the press release. "Operation Offsides is part of the Department's ongoing effort to protect copyright while reducing the risk to American consumers from the malicious software embedded in many illicit streaming services."

Director Ivan J. Arvelo of the National Intellectual Property Rights Coordination Center connected the streaming activity to organized criminal financing. "The unauthorized broadcast of World Cup matches violates intellectual property rights and fuels criminal organizations," Arvelo said. "Through Operation Offsides and strong partnerships with law enforcement and the private sector, we identified and seized hundreds of domains, disrupting those who steal and distribute copyrighted content."

Deputy Executive Associate Director Matthew Millhollin of HSI addressed the consumer-facing risk. "Streaming content from illicit websites opens your devices to unknown risks," Millhollin said. "Criminals operating these unauthorized platforms are already willing to break the law when they stream copyrighted World Cup games, they might also be planning to inject malware or steal your payment information."

That last point identifies a specific category of harm. A site running unauthorized streams alongside programmatic advertising is not merely diverting revenue. It may also be serving as a malware distribution vector to the same audience an advertiser is paying to reach.

Colombia blocked more sites than the United States seized

The larger enforcement numbers came from outside the United States.

Law enforcement authorities across the Western Hemisphere, coordinating with the Justice Department's International Computer Hacking and Intellectual Property programme, carried out actions under the separate name Operation Red Card. According to the department, these coordinated actions resulted in the blocking of hundreds of illegal streaming sites: 14 in Argentina, 223 in Ecuador, 28 in Peru, 309 in Brazil, 256 in the Dominican Republic, and 1,140 in Colombia.

Colombia alone blocked more sites than the United States seized across all three of its actions. The combined regional figure across those six countries reaches 1,970 sites.

Coordination ran through the ICHIP for Internet-Based Fraud and Public Health and ICHIP São Paulo, spanning Argentina, Brazil, Chile, Colombia, the Dominican Republic, Ecuador, Paraguay, and Peru. A two-day intergovernmental meeting took place in Bogotá on July 1 and 2 with the Colombian Attorney General's Cybercrime Unit, the Specialized Directorate Against Organized Crime, and HSI Attaché offices.

Blocking and seizure are not the same remedy. A seizure transfers control of the domain name to the government, which is why visitors to seized addresses encounter a banner stating the site has been seized. Blocking typically operates at the network or resolver level within a jurisdiction and leaves the underlying infrastructure intact for users outside that jurisdiction. The distinction matters for anyone assessing whether a flagged domain remains reachable in a given market.

Arrests and physical goods enforcement

Operation Red Card also produced arrests, which the domain figures do not capture.

A first phase on June 17 targeted counterfeit sports apparel in Colombia. Phase II launched on July 10 with simultaneous operations in Colombia including in Bogotá, Soacha, Maríalabaja, Manatí, and Sincerín. According to the Justice Department, an ICHIP-mentored cybercrime prosecutorial team from the Colombian Attorney General's Office arrested four members of the cybercriminal group Los Ciberinfiltrados.

The group's alleged methods describe a supply chain rather than a single point of theft. Since 2024, according to the department, Los Ciberinfiltrados had illegally accessed telecommunication systems and sold pirated streaming content, including World Cup matches, via fraudulent credentials, VPNs, interception of security codes, and manipulation of corporate system profiles. The stream was not scraped from a public feed. It was extracted through compromised corporate access.

Colombian authorities separately conducted 13 nationwide search-and-seizure operations targeting the manufacture and distribution of counterfeit sports apparel, leading to 11 arrests and convictions. ICHIP Bucharest coordinated with Europol and foreign counterparts on illegal streaming activity in Europe during the tournament.

What seizure does not address

The domain count sits alongside a parallel figure produced by the advertising industry itself.

TAG demonetised 1,376 digital piracy sites streaming or hosting stolen World Cup content, distributing the domain list to supply chain intermediaries so advertisers, agencies, and platforms could automatically exclude the sites from programmatic campaigns. The nonprofit announced that action on June 30, 2026, and identified a further 176 domains already on its exclusion list as trafficking in stolen tournament material.

The two totals are not additive. Some overlap in sourcing is acknowledged, and the mechanisms differ in what they accomplish. Seizure removes the address. Demonetisation removes the revenue but leaves a technically reachable stream in place until the domain itself is acted upon. Neither approach reaches a site that has already collected its advertising revenue and moved to a new address.

The economics behind that persistence are documented. Free access to live sports-related copyright-protected content attracts heavy viewing traffic, which makes websites offering such content a potentially lucrative way to serve advertisements. That observation appeared in the affidavit supporting a 2022 seizure action against 55 domains streaming the Qatar tournament, and the underlying logic did not change across four years.

For media buyers, this creates an exposure window that runs ahead of enforcement. A domain seized on July 20 may have carried programmatic inventory throughout June. Retroactive seizure does not produce a make-good.

Traffic quality data from the same period

Measurement data collected during the tournament suggests that low-quality inventory did not recede as seasonal patterns predicted.

Invalid traffic ran roughly 30% above forecast during the World Cup period, according to Integral Ad Science research published July 10, 2026. The rate averaged 1.203% globally before kickoff and fell to 1.134% once matches began. Historical summer patterns had led the firm's analysts to project a drop to 0.876%. The gap between actual and expected, rather than the surface decline, formed the substance of the finding.

That data point and the seizure figures describe the same underlying condition from different angles. Demand surges hold low-quality supply active. Enforcement operates on a slower cycle than the auctions it is trying to protect.

Why the commercial stakes rose this cycle

The 2026 tournament was the largest in the competition's history at 48 teams and 104 matches across three host nations, expanded from 32 teams and 64 matches in prior editions. That expansion increased both the volume of legitimate inventory and the volume of content available to intercept.

Pre-tournament research quantified the audience. Video Advertising Bureau analysis of MRI-Simmons data found 63.9 million U.S. adults planned to watch, representing roughly 24% of the adult population aged 18 and over, with viewership skewing toward adults aged 35 to 44.

New inventory categories were created specifically for the event. FIFA approved commercial advertising during three-minute water breaks across all 104 matches in a decision confirmed in March 2026, generating an in-game format layered on top of standard broadcast advertising. Separate LoopMe research found 73% of U.S. consumers expected to notice tournament advertising even though only 30% planned to watch matches themselves.

The commercial results were visible in broadcaster earnings. Comcast reported domestic advertising revenue of $2.16 billion, up 55%, on the World Cup and NBA playoffs, with Peacock recording its first quarterly profit at $189 million. Every dollar of that legitimate revenue depends on the exclusivity that unauthorized streams erode.

Ad-funded piracy is not a new mechanism in this ecosystem. HUMAN's Satori team documented the Camu operation, in which piracy gateway sites used domain cloaking to present benign blog content to direct visitors while showing pirated material surrounded by advertising to users arriving through piracy referrals. Bid request volume on Camu-associated domains fell from 2.5 billion to approximately 100 million per day after mitigations, but the operation remained active. Cloaking of that kind means that delivery confirmation and audit reports may not reveal the true nature of an ad placement.

The prosecution record behind the numbers

The Justice Department's Computer Crime and Intellectual Property Section is assisting Operation Offsides. Assistant U.S. Attorney Jacob Mercer for the Eastern District of Virginia, Senior Counsel Brian Mund, Assistant Deputy Chief Adrienne Rose, and Acting Deputy Chief Christopher Merriam are named as assisting.

Since 2020, according to the department, CCIPS has secured the conviction of over 180 cybercriminals and intellectual property criminals, along with court orders for the return of over $350 million in victim funds. That figure covers six years and the full range of cybercrime and IP prosecution, not streaming piracy alone.

The ICHIP programme, which coordinated the regional actions, is jointly administered by the Criminal Division's Office of Overseas Prosecutorial Development, Assistance and Training and CCIPS through a partnership with the State Department's Bureau of International Narcotics and Law Enforcement Affairs.

Operation Offsides is led by the National Intellectual Property Rights Coordination Center and conducted in coordination with HSI Washington, D.C., HSI Attaché offices, and private sector and law enforcement partners globally.

What the figures establish and what they leave open

The Justice Department's announcement quantifies enforcement activity. It does not quantify the piracy that enforcement addressed.

No figure appears in the announcement for how many viewers reached the seized domains, how much advertising revenue those domains collected, or what share of total unauthorized streaming the 1,000 seized domains represented. The 1,970 sites blocked across six Latin American countries, the 1,376 demonetised through industry action, and the 1,000 seized in the United States overlap to an unknown degree.

The consistent element across four years and two tournaments is the mechanism. Advertising revenue funds unauthorized streams; unauthorized streams attract audiences that advertisers pay to reach; and the enforcement cycle closes after the matches have finished. The 2022 affidavit and the 2026 affidavit describe the same commercial logic.

What changed between the two cycles is the number of actors intervening. Federal seizure, regional blocking, arrests targeting the credential theft upstream of the stream, and an industry exclusion list operating on the money rather than the address all ran in parallel during a single tournament. Whether that combination alters the underlying economics before the next competition is not established by any figure released on July 20.

Timeline

Summary

Who: The U.S. Department of Justice, U.S. Immigration and Customs Enforcement Homeland Security Investigations, and the National Intellectual Property Rights Coordination Center, with domain identification assistance from FIFA, beIN Media Group, NBC Universal, the Motion Picture Association's Alliance for Creativity and Entertainment, Ultimate Fighting Championship, and Warner Brothers. Named officials include Assistant Attorney General A. Tysen Duva, Director Ivan J. Arvelo, and Deputy Executive Associate Director Matthew Millhollin.

What: The cumulative seizure of more than 1,000 internet domains used for unauthorized live streaming of 2026 FIFA World Cup matches, carried out across three separate actions under Operation Offsides, alongside the blocking of 1,970 sites across six Latin American countries under Operation Red Card and the arrest of four members of the cybercriminal group Los Ciberinfiltrados.

When: The Justice Department published the announcement on Monday, July 20, 2026, one day after the tournament final. The seizures accumulated across the tournament period, including nearly 400 sites seized by the end of June 2026.

Where: Seizure authority came from the U.S. District Court for the Eastern District of Virginia. Blocking actions covered Argentina, Brazil, Chile, Colombia, the Dominican Republic, Ecuador, Paraguay, and Peru, with Colombian operations in Bogotá, Soacha, Maríalabaja, Manatí, and Sincerín. The tournament itself was hosted across the United States, Canada, and Mexico.

Why: Unauthorized streaming sites monetise stolen live broadcast content through advertising, diverting revenue from rights holders while exposing audiences to malware and payment fraud risk. For the advertising industry, the seizures quantify a supply-side problem that operates on a slower cycle than programmatic buying, meaning budget can reach infringing inventory months before enforcement removes the address.