If you run a website in Spain and some Saturday your clients told you it "won't load", "takes forever" or shows up without images, it is quite likely not your fault, nor your server's, nor your provider's. It is football. During LaLiga matches, Spanish internet providers block IP addresses shared by hundreds of thousands of legitimate websites in order to chase pirate streams. And nobody tells you.

At MuseDock we have lived through it, measured it and built a solution. Here is the full story, with our own data and sources, starting with the independent observatory OONI.

What happened to us: "nobody's fault… and everybody's"

For months, some clients told us they could not open their websites. On picalias.com, an AI image platform hosted on MuseDock, pages loaded, but without images: no avatars, no photos. We checked the server, the certificates, the configuration… everything was fine. We even thought Cloudflare was the problem and nearly switched providers.

It was not Cloudflare's fault. Picalias images are served from its own subdomain through Cloudflare, and that IP was among the ones blocked during matches. The website, which goes straight to the server, loaded. The images did not. Had we moved to another CDN, the same would have happened: the blocks reach other providers too, as you will see below.

Luckily, picalias is still in beta, in its testing phase, and has not launched yet. Imagine this happening in the middle of a launch campaign: paid ads sending people to a site that, from Spain, loads without images every time there is a match. Its case is also the hardest, because the images come from Cloudflare storage (R2) that cannot be taken off the proxy, so we are preparing a more professional solution for it.

The worst part is not the block, it is the helplessness. Nobody warns you. It shows up in no dashboard. Your client thinks your site is broken, and the webmaster goes mad looking for a fault that does not exist.

What exactly is going on

Many websites use a CDN such as Cloudflare to be faster and protected from attacks. These services do not give each website its own IP: thousands of websites share the same addresses. Some pirate sites hide behind these services too.

Since almost everything is encrypted today (HTTPS), the provider cannot tell which specific website is being visited inside a shared IP. So it blocks the whole IP, and every legitimate website sharing it goes down with it: shops, media, festivals, schools, companies, blogs. From Spain, visitors see a connection error (ERR_CONNECTION_TIMED_OUT); from abroad, the same site works perfectly.

Who decides what gets blocked

  • The legal basis: ruling 310/2024 of Barcelona Commercial Court No. 6 (18 December 2024), which allows LaLiga and Telefónica to ask providers to block IPs during matches.
  • Who picks the IPs: LaLiga, at its own discretion about which addresses stream its matches without permission.
  • Who blocks: the providers (Movistar, Orange, Vodafone, Digi, ONO, Euskaltel…), bound by the ruling.
  • Who is not involved: the CNMC, Spain's telecoms regulator. And the judge granted a general authorisation but does not review each IP blocked on each matchday.

Cloudflare, RootedCON and other organisations appealed, and in March 2025 the court rejected their requests. Cloudflare then took the case to Spain's Constitutional Court. The authorisation covers three seasons: 2026/27 is the last one under this ruling.

It is not just Cloudflare

According to OONI, between 1 January and 1 June 2026, 7,441 IP addresses from 36 infrastructure and hosting providers were blocked. Cloudflare is the most visible case, but Vercel, GitHub Pages, BunnyCDN, Akamai and Amazon AWS (including S3 storage endpoints) have also been affected. BunnyCDN even restricted its Spanish nodes to enterprise customers, partly because of these blocks.

And it is not only "the website" that goes down. Anything served from a blocked IP does: images, videos, scripts, fonts, APIs. A site can load halfway, without images or partly broken, which is even more confusing for visitors.

The figures: hundreds of thousands of legitimate sites

  • 554,507 domains blocked at some point between January and June 2026, about 5.8% of the 9.2 million analysed (OONI).
  • In a single hour, blocking between 4 and 20 IPs took down over 400,000 domains (OONI).
  • Over 90% of affected domains were behind Cloudflare, precisely because it shares few IPs among a huge number of websites (OONI).

Our own measurements: Saturday 17 October 2026

At MuseDock we set up a probe in an office in Spain that checks every minute, through two different providers (ONO and Orange), whether it can reach the Cloudflare IPs used by our websites and our clients'. This is what we saw:

  • 4 Cloudflare IPs blocked (188.114.96.2, 188.114.96.3, 188.114.97.2 and 188.114.97.3): they failed in 100% of measurements through both providers, minute after minute, while a server in Germany reached them normally.
  • The other 40 Cloudflare IPs of our domains: zero failures. A selective block of specific addresses, not a network problem.
  • 33 websites, ours and our clients', depended on those 4 IPs and could not be opened from Spain.

We then checked those 4 IPs against the Tranco list of the world's top one million domains (list 64VVX). Result: 102,059 domains from the top one million pointed to those 4 addresses at the time (10.2% of the list; 179,161 names counting www variants), and that is only among the world's most popular websites.

These were not shady sites. We checked one by one, from Spain through both providers and from Germany as a control, that these sites would not load from Spain but did from abroad (17 October, between 16:10 and 16:15 UTC):

  • Science and universities: the University of Oregon website (www.uoregon.edu), the bioRxiv preprint server (biorxiv.org), the CORE academic repository (core.ac.uk) and the Federation of American Scientists (www.fas.org).
  • Media and reference: British tech news site The Register (theregister.co.uk), TheFreeDictionary (thefreedictionary.com) and the Glosbe dictionary (glosbe.com).
  • Technology and open source: DreamHost (www.dreamhost.com), FreeType (freetype.org), Doxygen (doxygen.org) and ModSecurity (modsecurity.org).
  • In Spain: IAB Spain (www.iabspain.es), the Atlántida Film Fest (atlantidafilmfest.es), Petitchef (petitchef.es), teinteresa.es, The Olive Press (theolivepress.es), cesevilla.es and iconos8.es.

One in ten of the world's most visited domains went down at the same time because of just four IP addresses.

Is it legal?

Today, yes: providers are complying with a court order, and the EU net neutrality regulation (2015/2120) allows blocking ordered by a court. What is being debated is proportionality: taking down hundreds of thousands of legitimate websites to chase a few pirates, using lists drawn up by a private company that nobody reviews case by case.

Why it is regrettable

  • The innocent are punished. Legitimate websites that pay their taxes and have nothing to do with football become unreachable.
  • No warning and no timely way to complain. You find out when a client tells you the site won't load.
  • It costs money and reputation. A shop loses sales, a festival loses entries, a company loses credibility.
  • It looks like your fault. Visitors think your site is broken, not that their provider blocked it.
  • It wastes professionals' time and money. Webmasters and companies check servers, switch providers or pay for support over a problem that is not on their side.

What you can do

  • Confirm it is the block: open the site on mobile data from another provider or through a VPN, or check hayahora.futbol or BandaAncha's monitor while it fails.
  • Turn off the proxy during the match: setting the domain to "grey cloud" (direct connection) makes it reachable again in Spain, but you lose the CDN's protection and cache, and your server's IP is exposed. Doing it by hand every weekend is not realistic.
  • Dedicated IPs: they greatly reduce the risk, but on CDNs they usually come with very expensive enterprise plans.

What we have done at MuseDock

MuseDock CMS now includes a system that makes that switch automatically, and only when needed. We do not sell it as a shield, because it is not one: turning off the proxy carries a risk. But it is the only way to keep your site reachable in Spain during a block, so we do it carefully:

  • A probe in Spain checks every minute, through one or more providers, whether it can reach your sites' IPs.
  • If an IP gets blocked, and your server answers fine on its own with a valid certificate, the proxy is turned off only on the affected sites.
  • Once the IP answers steadily again, the proxy is turned back on exactly as it was. If you changed something by hand in the meantime, your change is respected.
  • While a site is direct, MuseDock's fail2ban jails protect it, banning anyone guessing passwords or scanning your site.
  • It ships in the MuseDock CMS core, not as a separate module. The probe is a small script anyone can install on a server or mini PC in Spain.

On 17 October, as soon as we switched it to automatic mode, it brought 32 affected websites back in 43 seconds, and the next ones as soon as it detected them. So the probe can report even if your own CMS's IP goes down, we recommend connecting it over WireGuard.

👉 How it works and how to enable it, step by step: Cloudflare blocks (LaLiga): automatic switch to direct connection.

Sources