Today LaLiga took down my classroom

The 2026/27 season started today. Alavés v Getafe at 19:30. At 19:26 the box in the living room went orange: external_slow, a thirty-second timeout, row after row. aula.sergiocomeron.com. meet.sergiocomeron.com. portal. This site.

The origin was fine on the LAN: 200, 302, 303. Apache up. Mac mini up. Moodle up. What failed was Spain.

This is not an outage. It is a football match.

What is actually happening #

Since February 2025, every matchday, Spanish ISPs —Movistar, MasOrange, Vodafone, DIGI and their sibling brands— have been blocking IP addresses because LaLiga and Telefónica Audiovisual asked them to, with a December 2024 order from Commercial Court No. 6 in Barcelona. The stated goal: take down pirate streams.

The method: black-hole whole IPs at Cloudflare, Amazon, Akamai, Alibaba and whoever else is in the way. During the match. Sometimes a bit before. Sometimes a bit after.

A Cloudflare IP is not “a pirate website”. It is an anycast door shared by thousands of sites that have nothing to do with football. Blocking it is padlocking the building because one tenant is scalping tickets. Everyone else is locked out and told it is for their own good.

The EUIPO itself, in a 2023 paper on live-event piracy, warned about this: IP blocking only holds if you exclude shared hosting and you limit it to the event. Spain picked the opposite. Shared hosting is the target because it is shared. It hurts more. It is cheaper. And the collateral damage is sold as a footnote.

It is not a footnote. It is the design.

This is not a vibe. It is half a million domains #

OONI —the outfit that measures network censorship worldwide, not a Twitter thread— published the last season’s tally in June. Outside Spain, the same IPs answered. Inside, they did not.

Numbers, not anger:

• 554,507 domains hit at some point. 5.8% of a 9.2 million list of the internet’s most-used names.
• In a single hour, blocking 4 to 20 IPs was enough to take down more than 400,000 domains.
• 7,441 IPs across 36 providers. Cloudflare accounts for 90.4% of the affected domains, sitting on a little over two thousand addresses.
• On the list: Amnesty chapters, Caritas, Greenpeace, the Australian Senate, a court in Bergamo, newsrooms, universities, the Terraform registry, Debian mirrors. And yes, the pirate streams too. The method cannot tell them apart. That is the point, and that is the disgrace.

On Digi, OONI also documented a TLS man-in-the-middle: the operator was not just dropping the packet. It was intercepting the connection and planting a self-signed certificate. That is not “fighting piracy”. That is stepping into an encrypted conversation because a match is on.

I do not need the report tonight. I have the log. Thirty seconds to the public origin, instant answers on localhost, at kick-off. I built the monitor so I would not have to argue this from memory.

A classroom is not a pirate stream #

This site lives on a Mac mini, at home. So do the Moodle classroom and Jitsi. I put Cloudflare in front so I would not open a single port, and so a power cut would not take the site down with me. I wrote that Cloudflare was the piece that made home self-hosting hold.

Today that same piece is what a judge and a football league use to stop a student on Movistar from opening the classroom while three points are being played in Mendizorroza.

The server is not down. The tunnel is not down. What is down is the path between a Spanish living room and a shared IP. It does not matter if what sits behind it is an exam, a tutorial, a hospital, an NGO or a shop. Share a door number with someone LaLiga pointed at, and you are in the raid.

This is not a blog going slow. It is a classroom. It is a video call. It is infrastructure run by people who do not take a euro from the ball and who still pay for the match with their connectivity.

What I am not defending #

Football piracy is real. Rights are paid for. I have no sympathy for anyone who stands up a playlist and then plays the victim. That is not the argument, and using it as a shield is the oldest trick: protest the method and you get sat next to the person sneaking the game.

Cloudflare is not a charity either. It has abuse channels. You can make it use them. You can take a specific site to court. What you cannot —what you should not be able to— is turn half of the Spanish internet into friendly fire every Saturday because a league’s business model cannot aim.

There are ways to go after an illegal stream that do not take down Amnesty, a classroom and another country’s senate. Anyone who says otherwise is lying or has not looked. Anyone who knows those ways and still reaches for the machete has decided the damage is acceptable.

That is what makes me angry. Not football. The acceptability.

Who decided this was fine #

A private league. An operator that also owns the rights. A commercial court. And the other ISPs, which folded. Nobody at that table represents the classroom, the NGO, or the freelancer whose card terminal rides on Cloudflare. The “public interest” being invoked is a pay-TV product. The country’s internet is budgeted collateral.

In February 2026 the perimeter grew: orders against NordVPN and Proton to block sixteen sites from Spain. First they cut the IP. Then they come for the tool you used to leave. The next step writes itself.

RootedCON and Cloudflare have gone to the Constitutional Court. Meanwhile the switch is flipped again every matchday. Today was the first of the season. Nine months to go.

Calling this “anti-piracy” is a euphemism. It is a temporary edit of a country’s routing table in the service of a sports calendar. In any other setting we would use the name it has: a form of network censorship, justified by copyright, executed without precision, renewed every Friday night.

What I take from this #

My server is fine. Spain is the one that cannot get there.

I am not taking Cloudflare off because a league decided my classroom is an acceptable cost. The tunnel is still why this site does not open ports in a living room. The problem is not the orange cloud. The problem is a state that lets a football league rewrite routing when a match is on.

It is the same argument as Chat Control, and it is not a matter of taste: you cannot take down only the pirates. The day the switch points at a shared IP, you turn off everyone who lives behind it. Classrooms included.

A kick-off deciding whether a student can enter class is not a side effect. It is a policy. And it is a disgrace.

Sources: OONI, June 2026, Barcelona Commercial Court No. 6 ruling, LaLiga statement (February 2025), hayahora.futbol, Vercel on the collateral damage.