Stop chasing piracy domains. Target the infrastructure behind them.

Three providers, 75% of the problem

Most conversations about live-piracy enforcement default to the same framing: find the infringing domain, take it down, watch it come back somewhere else, take that one down too. It's treated as an inherently unwinnable numbers game, more domains than any team can chase.

Looking at the infrastructure underneath the domains changes that picture.

What we found behind 153 domains

During monitoring for a major mixed martial arts main event, we tracked 153 unique domains hosting infringing streams across the pre-event and event-day windows. Individually, that's a large, unwieldy list. But when we looked at the hosting and CDN infrastructure behind those domains, the picture concentrated fast: roughly 75% of the traffic ran through just three providers.

That's not a coincidence, and it's not a small detail. It means the actual footprint of the problem, at the infrastructure level, is far smaller than the domain count suggests. A rights holder or protection partner doesn't need 153 separate enforcement relationships. They need three.

Why domain-level enforcement runs in circles

Domain-level takedowns treat every URL as an independent problem, because that's how they present themselves. But most piracy operations at any real scale don't run on independent infrastructure. They run on shared hosting, shared CDNs, and shared distribution rails, because that's what's fast, cheap, and reliable to stand up quickly.

That's also why the mirror-resurfacing pattern we saw during this event, 100% of tracked domains already had backup subdomains deployed before any takedown request went out, is possible in the first place. Standing up a mirror on the same infrastructure a domain is already using takes minutes, not days. Taking down a domain without addressing the infrastructure behind it removes one entry point while leaving the redundant capacity in place.

Enforcement aimed only at domains is, structurally, always going to be a step behind. The domain is the visible symptom. The infrastructure is the actual capacity being reused every time a takedown happens.

What infrastructure-level enforcement changes

Shifting the target from domains to infrastructure providers changes the math in a few concrete ways:

• Fewer relationships, more leverage. Instead of managing takedown requests against an open-ended and constantly changing list of domains, a protection program can build a working relationship with a small number of hosting and CDN providers who carry a disproportionate share of the traffic.
• Faster response to resurfacing. If a provider is already a known point of contact, requesting action against a new subdomain from the same account is a faster process than starting cold with a domain no one has dealt with before.
• Pattern recognition across events. Once you know which providers show up repeatedly across multiple live events, that becomes a standing part of the monitoring and response plan for the next one, instead of starting from zero each time.
• A concentrated target instead of an unbounded one.The framing shifts from “there are always more domains” to “there are a small, trackable number of infrastructure providers we need a real relationship with.”

What this requires from a monitoring program

Getting to this view requires monitoring that goes past the domain layer and identifies the hosting and CDN infrastructure behind each detected stream, not just the URL itself. That's part of what a Cyclops deployment maps for every event: not just where infringing content is showing up, but what's actually carrying it, so the response can be aimed at the point with the most leverage instead of the point that happens to be visible first.

None of this replaces the value of taking individual infringing streams down. It changes where the strategic effort goes. Fast, automated response at the domain level still matters in the moment. But the medium-term leverage, the thing that actually reduces how often this happens at the next event, sits one layer down, at the infrastructure that keeps making resurfacing fast and cheap.

That leverage matters even more once broadcast rights move direct-to-consumer, where every one of those resurfacing streams is a subscriber who never converts — see Direct-to-Consumer Streaming Turns Piracy Into a Subscriber Problem.