Movistar and O2 block legal sites via Cloudflare IP filtering

Movistar and O2 block thousands of legal websites by filtering Cloudflare IPs

Blocking an IP to take down a pirate site is easy. The problem arises when that IP is shared by hundreds of legal domains. For approximately one month, customers of Movistar and O2—and also DIGI, which rents Telefónica’s network—have seen dozens of pages unrelated to football fail to load. The pattern repeats: all use Cloudflare as a CDN or DNS manager. The court order targeted a specific domain. The result has been a cascading block affecting law firms, engineers, and work mobile apps that only function via VPN.

The immediate cause is a shared IP. Cloudflare assigns the same address to hundreds of domains, so when one is ordered blocked, all those sharing that address go down. The underlying cause is more uncomfortable: Telefónica is both plaintiff and defendant, selling football rights and executing the block. It does not prioritize surgical precision.

What is Cloudflare and why does blocking it drag down thousands of sites?

Cloudflare is not a pirate site. It is infrastructure. It functions as an anti-blocking shield and DNS manager for millions of sites: shops, media outlets, banks, professional firms, and even the secure DNS Firefox uses by default. Each of its IP addresses serves several hundred distinct domains. When a judicial ruling orders the blocking of a specific IP, the collateral damage is mathematical: the pirate domain falls, but so do the other two or three hundred behind it.

The mechanism is not the classic DNS filtering used by small operators. Here, blocking occurs at the IP level, making it harder to bypass and broader in scope. The result is that Movistar or O2 users cannot access services unrelated to streaming, while customers of other operators can. This asymmetry proves the issue is not technical, but one of execution.

Who is behind the block: El futbol español, a judge, and Telefónica

El futbol español (Spain's top football league) has driven complaints against pirate IPTV services. The body chaired by Javier Tebas has publicly celebrated the blocks and pointed to Google and Cloudflare as next targets, according to a message circulated on social media. The order is signed by a judge, not the Government, though execution falls on telecom operators. Telefónica appears in an awkward position: it is a complainant because it sells football rights and a party obligated to execute the block.

This dual role explains why the filtering has not been done with surgical precision. Some argue the operator merely complies with the court order and shifts responsibility to El futbol español. Others point out that the proportionality required by law is not being respected: blocking half of Cloudflare to take down one domain is not proportional and affects essential daily work services.

DIGI also affected: rented network inherits the block

DIGI, which deploys its own fiber network in many areas but rents Telefónica’s where its own doesn’t reach, has joined the blocks. Its customers have reported the same access issues to sites hosted on Cloudflare. This detail matters because it disproves the theory that only direct Movistar customers are affected: any operator riding on Telefónica’s infrastructure inherits the filtering.

The list of affected parties grows. Professional mobile apps, download platforms, forums, and series websites have stopped working over Wi-Fi. Some services only respond through VPNs, adding latency and limiting bandwidth. An SSH tunnel to a cloud server has become the common workaround for those unwilling to rely on commercial VPNs.

The real cost: VPNs, latency, and services that block VPNs

The most repeated solution is hiring a VPN. It is not free: a decent one costs around 100 euros annually. And it doesn’t always work. Many legitimate services block VPN IP addresses to prevent abuse, leaving the user without access twice over. On remote terminals, VPN latency is noticeable. For moving heavy data, estimulante ilegal drops.

The full calculation, including annual VPN costs, performance loss, and hours spent seeking alternatives, yields a bill no one has officially quantified. What is known is that the user pays an operator to avoid interference, and the court order does not cover collateral damage. The law requires proportionality. Blocking an IP shared by hundreds of legal domains is not proportional.

Starlink and the threat of customer churn

The alternative starting to gain traction is Starlink. The satellite constellation already exceeds ten thousand units and serves more than five million people in 125 countries, according to company data. The antenna is small, self-orienting in some models, and independent of Telefónica’s network. Those who subscribe cease to be subject to terrestrial operator filtering.

It is not a cheap solution nor for everyone. Fiber remains cheaper and faster where available. But the underlying argument is different: if the operator blocks legitimate sites, the customer has reason to leave. Migration won’t be massive overnight, but each poorly executed block adds reasons.

The precedent: when filtering becomes censorship

In the UK, some operators censor up to 15% of websites, with huge variability between companies. Some block certain sites, others different ones. It depends on court orders and calls from peers inviting them to censor. The Spanish precedent points in the same direction: first block an IP, then block VPNs, then demand ID cards to connect.

Comparisons with China or Russia are circulating. It is not bar-room exaggeration: the technique is the same, only the scale differs. The difference here is that the block comes not from a censorship authority, but from a judicial ruling executed by a company competing in the very market it harms. In terms of corporate governance, that has a name.

---

It remains to be seen if courts correct the scope of the block or if Telefónica shareholders take action. The law requires proportionality, and collateral damage is already documented. If nothing changes, the prediction is simple: more VPNs, more Starlink, and more customers looking for another operator. The ball is in the judicial court.