The internet does not wait politely for kickoff. One day before the FIFA World Cup 2026 begins in Mexico City, an illegal streaming crackdown has taken down more than 27,000 unauthorized streaming URLs and dismantled nine organized criminal networks accused of selling access to premium sports, film and television content across borders.
The operation, called Operation KRATOS 2, targeted illegal IPTV services and streaming platforms that copied legitimate subscription bundles. In practice, that means cheap packages promising live sport and entertainment with none of the boring details, such as rights agreements, security standards or legality.
What did Operation KRATOS 2 remove?
Authorities said the operation targeted the infrastructure behind digital piracy, not just the visible websites.
That distinction matters. Some reports have described the action as the closure of more than 27,000 “sites,” but official accounts refer to illegal streaming URLs. Piracy networks are more fragmented than a single homepage. Domains, redirect links, servers, payment channels and customer portals can all sit in different places and be swapped out quickly.
Operation KRATOS 2 ran from September 2025 to April 2026 and was coordinated by Bulgaria with support from Europol. Authorities said investigators:
- Made 29 arrests
- Identified 86 suspects
- Conducted more than 148 house searches
- Referred 59 cases to judicial authorities
- Left 72 criminal investigations ongoing
So the headline number is large, but the work is not finished. Piracy operations have a talent for reappearing under new names, because apparently one bad website was not enough.
Why is this happening right before the World Cup?
The timing is not subtle. The FIFA World Cup 2026 opens Thursday, June 11, at Mexico City Stadium and runs through July 19. It will be the largest edition of the tournament yet, with 48 teams and 104 matches across host cities in Canada, Mexico and the United States.
That scale creates an enormous broadcast market. It also creates an enormous target for illegal streamers, who know that live sport remains one of the few media events millions of people still want to watch in real time. There is not much point in finding out the score after every group chat, push notification and office screen has already ruined it.
Broadcasters, leagues and law enforcement agencies are bracing for attempts to retransmit matches without permission throughout the five-week tournament. For rights holders, the concern is commercial. For fans, it is also practical: an illegal stream can be unreliable, packed with fake prompts or tied to more direct fraud.
Which countries and groups were involved?
The operation involved law enforcement agencies from Belgium, Bulgaria, Croatia, France, Greece, Ireland, Italy, the Netherlands, Poland, Romania, Spain, the United Kingdom and the United States.
Europol said the coordinated action focused on criminal groups profiting from unauthorized distribution of copyrighted content through sophisticated online platforms. Illegal IPTV services were a central target because they often package pirated sports channels, films and television networks into subscriptions that look close enough to legitimate services to fool, or at least tempt, customers.
Sports and audiovisual rights holders also supported the effort, including UEFA, LaLiga, beIN Media Group, the Audiovisual Anti-Piracy Alliance and Irdeto. Europol also worked with anti-piracy partners such as ACE/MPA and Friend MTS.
Investigators were not only trying to identify the public-facing streams. Investigators also looked for the people operating the platforms, the payment systems moving the money and the technical infrastructure keeping the feeds online.
What did investigators find behind the streams?
The numbers point to an industrial-scale operation rather than a hobby project with a laptop and too much free time.
Investigators reported 169 domains, identified 722,961 infringing objects and mapped thousands of technical indicators linked to piracy activity. LaLiga said cooperation between authorities and private-sector partners helped identify:
- 4,370 new domains linked to piracy
- 18,331 IP addresses associated with illegal services
- 397,384 URLs reported for suspension or removal
LaLiga said KRATOS 2 was designed to go beyond simply removing websites. The league said the operation aimed to identify those responsible for managing, commercializing and technically operating the platforms.
That is the key shift. Blocking a front door is useful only until someone opens a side entrance. Authorities are trying to map the building.
Why are illegal IPTV services such a focus?
Illegal IPTV services have become a favored model for sports piracy because they can look polished and familiar. Users pay for a subscription, receive access through an app or portal, and get channels or live events that resemble a legal streaming bundle.
The difference is that the content is unauthorized, and the operators may be tied to organized crime. LaLiga has argued that these services are not only copyright violations but profitable criminal businesses that can expose users to cybersecurity risks.
Those risks include malware, spyware, data theft and other forms of online exploitation. A cheap stream can become less cheap if it comes with stolen credentials or a compromised device, a pricing model rarely listed in the promotional copy.
The FBI’s Internet Crime Complaint Center has also warned that cybercriminals are spoofing FIFA-related websites ahead of the tournament. The agency said fake domains may be used to collect personal information, payment details or login credentials, and it expects more to appear before and during the competition.
How are football authorities framing the issue?
UEFA said it contributed intelligence and expertise on unlawful broadcasts of its competitions through its content protection program and monitoring technologies. The European football body has argued that protecting media rights revenue is essential to sustaining the sport at multiple levels, from elite competitions to wider development and grassroots investment.
LaLiga has taken a similarly aggressive position, framing piracy as a threat to rights holders and consumers. Its involvement in KRATOS 2 reflects how football organizations now treat content protection as part of event operations, not a side project handled after the damage is done.
Mexican authorities have also signaled a tougher stance before the opening match. The Mexican Institute of Industrial Property has warned that it is monitoring illegal streaming and that commercial retransmission of World Cup matches without authorization can carry penalties. Local reporting has also raised concerns about pirate IPTV platforms being marketed to fans during the tournament.
How does this fit with recent anti-piracy actions?
KRATOS 2 follows several major sports piracy enforcement efforts over the past two years.
In 2024, the first Operation Kratos targeted illegal streaming during major sporting events, including UEFA Euro 2024 and the Paris Olympics. Authorities identified more than 100 suspects and dismantled a network that had reached more than 22 million users worldwide.
In 2025, another high-profile action took down Streameast, which anti-piracy coalition ACE described as the world’s largest illegal live sports streaming operation. Authorities said the network had drawn more than 1.6 billion visits over the previous year and offered unauthorized access to football and major North American sports.
Those actions were significant, but they did not end the problem. Pirate operators can move domains, rely on mirror sites, route traffic through intermediaries and separate the visible website from the servers carrying the content. The result is a constant chase across technical layers and national borders.
What should fans take from this?
For broadcasters and tournament organizers, the stakes are obvious: live sports rights are among the most valuable assets in media, and the World Cup’s global audience makes unauthorized streaming a priority target.
For fans, the issue is not only whether a feed freezes just as a striker shoots. Authorities say illegal streams can also serve as entry points for fraud, malicious software and stolen financial data. The fake sites and too-good-to-be-true subscriptions tend to appear exactly when demand is highest, which is convenient for criminals and less charming for everyone else.
The removal of more than 27,000 illegal streaming URLs is one of the largest recent anti-piracy actions ahead of a major global sporting event. But with dozens of investigations still active and the World Cup running for more than five weeks, enforcement is expected to continue after the opening whistle.
Authorities say the message is simple: the World Cup’s global attention makes it both a celebration of football and a target for streaming pirates and online fraud operations. This crackdown suggests law enforcement, sports bodies and broadcasters are moving from reactive blocking toward coordinated investigations aimed at the machinery behind digital piracy.
