On October 22, DNS resolver Quad9 announced that it will stop serving users in France, after a Paris court ordered it to block pirate tennis streams or pay a daily penalty.
The underlying order, which beIN Sports obtained in May, initially listed six domains. That number has since grown considerably, with the latest additions coming in late October.
To take a closer look at the evolution of this blocklist, we compiled it from the notices that Google files with the Lumen database when it receives a blocking order. Today, 118 domains are listed under this order.
From 6 to 118 Domains
The pirate site blocklist, which is one of many in France, expanded in batches. The first update, reported by Google on June 15, added 22 domains. Three more updates followed on September 21, October 16 and October 26, each adding exactly 30.
| Reported to Lumen | Domains added | Running total | Blocked by Google DNS in France (Oct 28) | Blocked by Cloudflare DNS in France (Oct 28) |
|---|---|---|---|---|
| May 13 (court order) | 6 | 6 | 6 | 0 |
| June 15 | 22 | 28 | 22 | 0 |
| September 21 | 30 | 58 | 30 | 0 |
| October 16 | 30 | 88 | 30 | 0 |
| October 26 | 30 | 118 | 3 | 0 |
Nothing appears to have been taken off the list. The notices only add domains, and the ones that no longer work were still blocked when we checked. The blocking measures remain in effect until November 14, when the WTA tennis season ends.
Transparency is limited and it’s hard for the public to see what is blocked and on what grounds. Arcom doesn’t publish blocking updates. Google’s Lumen notices are the only public record we found, and they take some digging. The later notices don’t mention the case number, so a search for the order only turns up the first few, and the full domain lists are only shown to people who request access from Lumen.
This example shows the value of the Lumen Database when governments or courts don’t provide transparency.
Quad9 didn’t block any of the domains before the court ruled on the penalty on October 21, according to the ruling, which records the foundation’s statement to that effect and beIN’s objections to it.
Expired Domains, Seized Site
ISPs, online intermediaries, lawmakers and rightsholders all have different views on the effectiveness and proportionality of site blocking. However, logically speaking, all should agree that there is no need to block a domain that no longer links to anything infringing. That’s not necessarily what happens.
We checked all 118 domains on October 28, from the Netherlands and through a French server. Most still resolve to an IP address. However, the exceptions are more interesting.
Four domain names no longer resolve at all. Two of these, predb.click and line.golden-iptv.in, aren’t registered anymore; the latter was one of the six domains in the original court order. Meanwhile, 4kib.xyz has been suspended by its registrar, and fermin37.com stopped working after we first checked it on October 23.
Another domain, fr4.sportplus.live, now loads a page titled “THIS DOMAIN HAS BEEN SEIZED”. Its main domain was among the pirate sports domains that U.S. authorities seized in July.
The mgntv-nexon.xyz domain, meanwhile, points to an IP address that belongs to domain marketplace Sedo.
In France, none of this makes a difference. Google’s DNS resolver blocks 91 of the 118 domains and NordVPN’s DNS blocks 89, dead names and all. The domains that aren’t blocked yet mostly come from the latest batch; only three of those 30 were blocked on October 28, two days after Google reported them. The exception is Cloudflare, whose 1.1.1.1 resolver blocks nothing. Cloudflare applies French blocking orders through its CDN instead, which a Paris court accepted as a reasonable effort in September.
We know all this because we looked at the DNS responses directly. Users that try to access these sites through a browser have no idea what is going on. They simply see an error message noting that the site can’t be reached. That also applies to rktv.top, which TorrentFreak owns today.
Under New Ownership
On October 23, two names on the list were free to register for anyone, as they had expired. These are rktv.top, which was added to the blocklist in June, and ap-live.top, one of the six domains in the court order itself.
We registered both domains and put up a short page on each, stating that TorrentFreak owns the domain for research and that it doesn’t offer, link to, or promote any streaming service. That’s all.
From the Netherlands, this page loads as expected. In France, however, Google refuses to resolve rktv.top. “The requested domain is subject to a judicial injunction or other governmental blocking order for FR,” its DNS response reads. The response carries extended error code 16, which the DNS standard labels “Censored”.
Some French ISP resolvers go a step further and redirect the DNS response. When we queried rktv.top through Bouygues Telecom and Free, the answer wasn’t a refusal but a different IP address, 54.246.190.12, which serves offrelegalesports.fr, a page that links visitors to licensed sports broadcasts. Completel, a business provider that belongs to SFR, gave the same answer. Orange’s resolvers, meanwhile, answered with 127.0.0.1, the address of the user’s own computer, or reported that the domain doesn’t exist.
In other words, a visitor who types in a domain that TorrentFreak owns, and that hosts a plain research notice, lands on an anti-piracy page instead.
The two research domains have been in place for two weeks and it seems that nobody noticed. We are not aware of an official appeal process for domain owners, as there apparently is no direct route to complain.
A Hong Kong Server
Finally, it is worth pointing out that most of the domains on the list point to Hong Kong. Of the 118 entries, 74 resolve to two IP addresses in a single Hong Kong range, and all of these domains return an “unauthorized” error when we try to load them.
Another 19 domains point to a second Hong Kong IP range. These all show the same page, titled “Service Premium — Online.” Together, that’s 93 of the 118 entries.
| IP range (Hong Kong) | Addresses, anonymized (domains per address) | Domains | What loads |
|---|---|---|---|
| 103.211.100.x | A (13), B (61) | 74 | “unauthorized” error |
| 103.175.129.x | A (3), B (2), C (2), D (2), E, F, G, H, I, J, K, L, M, N | 19 | “Service Premium — Online” |
| All other addresses | 19 addresses | 21 | varies |
| No address | 4 | nothing |
What is hosted on these servers is unknown, as we didn’t try to access them. However, they are likely linked to a pirate streaming service, given beIN’s complaint. If anything, it shows that this blocking effort largely targets one or two streaming operations.
Thus far, the blocking efforts haven’t stopped them, in part because the operators can easily register new domains, as if it were Groundhog Day.
Meanwhile, France is preparing to step up its blocking efforts. In July, the French Parliament adopted a law that allows new domains to be added automatically during live broadcasts, with Arcom reviewing them afterwards. As far as we know, that doesn’t come with a transparency layer.
The current blocking order expires on November 14. Whether the domains on the list, including our two research domains, will be unblocked after that has yet to be seen.
A copy of the Paris Judicial Court’s October 21 ruling (RG 26/11882) is available here (pdf).
Method: DNS checks were carried out on October 28, from a Dutch connection and through a French NordVPN server. Google DNS and Cloudflare DNS were queried over DNS-over-HTTPS, NordVPN’s resolver through the VPN connection. ISP resolvers were tested on November 6 through Globalping probes in French consumer networks and through whatsmydns.net. The figures are a snapshot and will change as blocking continues and resolvers update. Landing pages and open ports were checked from the Netherlands on October 23 and 28. Registration data is from WHOIS lookups on October 23 and 24.
The full list of 118 domains, by the date Google reported them to Lumen:
May 13 (court order), 6 domains: ap-live.top, line.golden-iptv.in, mrctop.net, tennis-open.ru, tennistream.com, thetvapp.to
June 15, 22 domains (19 + 3): 32740-defend.tx-4kott.com, 4kib.xyz, activefrance.net, akkaouiz.xyz, asokax6.com, balentv.xyz, bestp55.xyz, buffnetwork.sbs, djamel.site, dru4.xyz, erw55.xyz, faraka.xyz, fr4.sportplus.live, mgntv-nexon.xyz, neomixtv.xyz, partner.nonamejose.sx, predb.click, premium999.xyz, rktv.top, suphotte.xyz, supralf.xyz, zikotv.cc
September 21, 30 domains: allinone.cx, almaksor.pro, babadedachannel.online, celltvsoftware.com, cherry-tv.net, chrixkl4s2cls234lumopxlwyc234y.com, cleptomania.xyz, cmax.space, eztvclub.live, forstreem.com, ftv-live.win, hosttach.xyz, jtowntv.com, mag1311.net, maguland.xyz, neomspeaks.com, nexus-cdn.xyz, nionni.net, portaltivi.shop, redvisionstreamz.com, s416k.online, seee.info, sehpie.xyz, smartliststg.online, smartott.store, strongbow.online, strongtv.org, tatan.xyz, tvplanetstore.com, waseemiptv.com
October 16, 30 domains: 86862944.cdnmax.pro, 8k-super.xyz, albastrong.top, alveropro.online, bfeplex2.sbs, bilelhosting.info, blackboxiptv.vip, bus8kservice.store, ciptvservices2021.xyz, daso2026.xyz, datedriver.com, discovery8k.org, dramily3.xyz, ewmedia69.org, fermin37.com, higher8k.xyz, invictus667.com, iva-ehe.com, latvroom888.xyz, niko05451.com, ossytv.net, pandoratv4k.site, powerwatchy.com, rachatducredit.com, rachid4k.top, tdigi.store, tudiptv.xyz, unstabletv.xyz, vfmbx.com, yhiuhv.com
October 26, 30 domains: 0213422.eu, 131233.xyz, 159premium.com, angli8k.xyz, beachwavestv.com, cable.directory, chahinplay.com, cw-32.com, dannly.xyz, eliteprovip.com, elitestream.cc, eumatrix.xyz, goldenpro.xyz, goldenyass.com, greentv.xyz, gstatic.top, headbussa423.com, host-strong.sbs, iptv-anas.sbs, kekol235.xyz, new2026.online, opencableco.net, samyx-ott.me, tvgreece.site, tvkudoplayer.de, ukchannels.xyz, v1nland.xyz, vpn.xtreme-gold.ink, xhd1337.xyz, zieiptv.me
