Note · 11 November 2026

Collateral blocking in Europe

An IP address on a CDN serves thousands of unrelated sites. Block it to stop one of them and you stop all of them. In Europe this is no longer a theoretical risk.

Spain, 2025–2026: football and Cloudflare

A Barcelona court allowed LaLiga to have IP addresses used by pirate streams blocked during matches. Because the streams sit behind shared CDN addresses, so do a lot of other sites. OONI measured the effect between 1 January and 1 June 2026:

• 554,507 domains were blocked at some point during match broadcasts: 5.8% of the 9.2 million popular domains tested.
• 7,441 IP addresses in 36 networks were blocked.
• 90.4% of the affected domains were on Cloudflare (501,305 domains), although Cloudflare addresses were only 30% of the blocked IPs.
• Blocking 4 to 20 addresses for one hour was enough to affect more than 400,000 unrelated domains.
• On Digi, OONI found TLS interception: 7,334 IP addresses hosting 10,759 domains answered with a self-signed certificate (CN=core1.netops.test) instead of the site's own.

Source: A. Filastò, M. Xynou, M. Gulati, OONI, 30 June 2026.

For a site owner, the worst part is the pattern: blocks come on during a match and go away after it. A user complains on Saturday evening, the site is fine on Monday morning, and nothing in your logs explains it. In the countries we have opened (Germany, Poland, Norway), linkspect reports a dropped or reset connection as ip.drop or tcp.reset and a substituted certificate as tls_mitm.substitution. Spain is in testing with linkspect and not open to customers; our checks there cannot yet confirm IP blocks during broadcasts.

Italy, October 2024: Google Drive

Italy's Piracy Shield system gives providers 30 minutes to apply blocking tickets submitted by rights holders. On the evening of Saturday 19 October 2024 a ticket blocked drive.usercontent.google.com, the domain Google Drive uses for downloads. Users across Italy could not download their own files for several hours, until the block was lifted around midnight.

Sources: Techdirt, 21 October 2024; Il Post, 21 October 2024.

Austria, 2022: Cloudflare addresses

In August 2022 Austrian providers implemented a court-backed block of pirate sites that included Cloudflare IP addresses, making many unrelated sites on those addresses unreachable. In August 2023 the telecom regulator TKK ruled that the IP block violated EU net-neutrality rules because of the risk of overblocking, while the DNS blocks were allowed.

Sources: TorrentFreak, 29 August 2022; TorrentFreak, 11 August 2023.

What this means if you are on a CDN

• Your risk depends on your neighbours, which you do not choose and cannot see.
• Blocks can be dynamic: minutes to hours, tied to events.
• They are per operator. One provider applies a ticket within minutes, another later, a third differently.
• The site owner is usually not told. For IP blocks during live events there is often no official list to look yourself up in, as in Spain; Italy's regulator offers a lookup for one address at a time.

The only reliable signal is a measurement from inside each provider's network while the problem is happening. linkspect runs one when you start a check through the API; scheduled checks and alerts are not available yet. Spain is in testing and not open yet; Germany, Poland and Norway are. Countries