DOJ Seizes Bulgarian Piracy Domains as Italy’s Operation Switch Off Targets Illegal IPTV Networks
The U.S. Department of Justice announced the seizure of three U.S.-registered domains used by Bulgaria-based piracy sites—zamunda.net, arenabg.com, and zelka.org—alleged to have distributed thousands of pirated movies, TV shows, video games, and other copyrighted works. Authorities said the sites drew tens of millions of visits annually (with at least one frequently ranking among Bulgaria’s top 10 most-visited domains), generated significant advertising revenue, and enabled millions of illegal downloads with an estimated retail value in the millions of dollars. The domains now display seizure banners warning that copyright infringement is a crime; the investigation involved U.S. agencies alongside Bulgarian law enforcement and Europol support.
In parallel, European law enforcement actions highlighted a broader, coordinated crackdown on piracy infrastructure. Italy-led Operation “Switch Off”—coordinated with Europol, Eurojust, and Interpol—reported the seizure of infrastructure supporting industrial-scale illegal IPTV services that allegedly redistributed content from major broadcasters and streaming platforms (including Sky, DAZN, Mediaset, Amazon Prime, Netflix, Paramount, and Disney+) to millions of end users. Italian authorities said they identified 31 suspects tied to a transnational organized crime group and noted the use of anonymization and financial obfuscation tactics such as cryptocurrency payments and shell companies; industry group ACE publicly named seized services including IPTVItalia, migliorIPTV, and DarkTV.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
5 events from the most recent confirmed update back to the earliest known activity.
Seizure banners replace Bulgarian piracy websites
Following the U.S. action, the seized domains began displaying law-enforcement banners warning that copyright infringement is a crime. The investigation involved U.S. agencies working with Bulgarian law enforcement and Europol as part of broader international anti-piracy enforcement.
U.S. seizes domains for Bulgarian piracy sites
The U.S. Department of Justice seized the U.S.-registered domains zamunda.net, arenabg.com, and zelka.org, which were allegedly used by Bulgaria-based websites to distribute pirated movies, TV shows, video games, software, and other media. The domains were described as highly popular in Bulgaria, drawing tens of millions of visits annually and generating significant advertising revenue.
Investigators identify 31 suspects tied to transnational piracy group
Italian authorities said evidence linked 31 people to a transnational organized criminal group behind the IPTV operation, with additional suspects identified in several European countries. Investigators alleged the group used cryptocurrency payments, shell companies, and anonymization techniques to conceal proceeds and operations.
Authorities dismantle IPTVItalia, migliorIPTV, and DarkTV infrastructure
As part of Operation Switch Off, law enforcement seized three major illegal IPTV services identified by ACE as IPTVItalia, migliorIPTV, and DarkTV. Italian police said the network served millions of users, involved at least 250 resellers and 100,000 subscribers in Italy, and included servers dismantled in Romania and one located in Africa.
Italian police launch Operation Switch Off against illegal IPTV networks
Italian authorities led a coordinated international anti-piracy operation, supported by Europol, Eurojust, and Interpol, targeting industrial-scale illegal IPTV services and related infrastructure across 11 cities and 14 countries. The action was prioritized in part because of the upcoming Milan Winter Olympics and the risk of illegal sports broadcasts.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
3 references tracked. Mallory keeps watching after this page renders.
Department of Justice seizes domains for Bulgarian piracy sites | The Record from Recorded Future News
therecord.media
Open sourceDOJ seizes piracy sites, Italian police dismantle illegal IPTV operation | CyberScoop
cyberscoop.com
Open sourceOperation Switch Off dismantles major pirate TV streaming services
bleepingcomputer.com
Open sourceSee the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Operation KRATOS 2 Dismantles Nine Illegal Streaming Crime Networks
European and international law enforcement agencies dismantled **nine organized crime groups** and arrested **29 suspects** in **Operation KRATOS 2**, a seven-month crackdown on illegal IPTV and unauthorized streaming services coordinated by Bulgaria with Europol support. The operation ran from September 2025 to April 2026 and involved authorities from **13 countries**, targeting not only piracy websites but also the wider criminal and technical infrastructure used to host, manage, and conceal the services across borders. Investigators identified more than **18,000 IP addresses**, **4,370 piracy-linked domains**, nearly **400,000 URLs** flagged for suspension or removal, and over **126,000 infringing objects**, while taking down more than **27,000 illegal streaming URLs**. The action also led to **148 house searches**, **59 judicial referrals**, **72 additional criminal investigations**, and the identification of **86 suspects**. Europol said the operation focused on the broader ecosystem behind piracy services and warned that users of illegal streaming platforms also face cybersecurity risks including **malware**, **spyware**, and **data theft**.
Jun 5, 2026
Operation Lightning Takedown of SocksEscort Residential Proxy Botnet
An international law-enforcement operation dubbed **Operation Lightning** disrupted **SocksEscort**, a paid “residential proxy” service that routed criminal traffic through compromised home/small-business routers and IoT devices to provide anonymity for fraud and other cybercrime. Authorities from the US and multiple European countries (including Austria, France, and the Netherlands), supported by **Europol** and **Eurojust** and assisted by private-sector partners **Lumen’s Black Lotus Labs** and the **Shadowserver Foundation**, reported the botnet had leveraged exploited vulnerabilities in edge devices and was powered by **AVRecon** (Linux) malware. Officials said SocksEscort advertised access to roughly **369,000 IP addresses** since 2020, with Europol stating the infrastructure compromised **369,000+** routers/IoT devices across **163 countries** and offered customers tens of thousands of proxies; reporting also noted that, as of February 2026, the service listed about **8,000 infected routers**, including roughly **2,500 in the United States**. During the coordinated action, authorities **seized 34 domains and 23 servers** across **seven countries**, replaced the service’s website with a seizure notice, and the US froze approximately **$3.5 million in cryptocurrency** tied to the operation; officials also cited the service’s payment platform receiving about **$5.8 million** from customers. SocksEscort was described as enabling a wide range of downstream criminal activity—including large-scale fraud, account takeovers, identity theft, business email compromise, password spraying, and, per Europol, facilitation of **ransomware**, **DDoS**, and distribution of **CSAM**—with US reporting citing specific victim losses (including a **$1M** cryptocurrency theft and additional six-figure fraud impacts). Investigators indicated the seized infrastructure and customer data (reported as roughly **124,000 users**) will be used to pursue follow-on investigations into both operators and customers of the proxy service.
Mar 24, 2026
European Law Enforcement Takedowns of Phishing and Investment-Fraud Networks
European law enforcement reported multiple cyber-enabled fraud disruptions, including a Eurojust-supported operation that dismantled a **fraudulent call-centre network** operating from three offices in Dnipro. Authorities from Latvia, Lithuania, and Ukraine arrested **11 suspects**, seized **more than €400,000** in cash, and collected electronic evidence (computers, SIM cards, documents) during searches at **32 locations**. The group allegedly ran a fake cryptocurrency investment platform and used **remote access software** to gain access to victims’ online banking and move funds to accounts and crypto wallets under their control. Separately, Poland’s Central Bureau for Combating Cybercrime (CBZC) dismantled an organized group operating in Poland and Germany that used **phishing** to hijack Facebook accounts and extract **BLIK** payment codes. Investigators identified **11 group members**, placed **six** in pretrial detention, and seized **over 100,000** stolen Facebook credentials; prosecutors filed **400+ charges** including unauthorized access, online fraud, and money laundering. A South Korean case involving the breach of Seoul’s bike-hire service *Ttareungyi* (4.62 million users affected) is a distinct incident and not part of the European takedown actions described above.
Mar 21, 2026