October 18, 2026. Spain's football piracy-blocking dispute is also a practical reliability problem for developers. A website may respond normally from a German server yet fail for visitors using Spanish ISPs. The distinction matters: the origin can be healthy while access to a shared CDN address is restricted. This guide combines the legal timeline with a reproducible diagnostic workflow and a case study from Screen Art S.L. and its MuseDock team.

From the December 2024 court ruling to the Constitutional Court challenge

On December 18, 2024, Barcelona Commercial Court No. 6 issued judgment 310/2024 in proceedings brought by LaLiga and Telefónica Audiovisual Digital concerning the blocking of IP addresses used for unauthorised football broadcasts. The measures allow dynamic identification of addresses rather than requiring a fresh judgment for each one. This is not the same as a blanket legal permission to block unrelated legitimate services.

Cloudflare and the cybersecurity association RootedCON challenged the proceedings. The court dismissed the annulment requests in March 2025. LaLiga welcomed the decision, arguing that its anti-piracy measures were lawful and proportionate. RootedCON publicly announced a constitutional amparo appeal on May 16, 2025, raising concerns about effective judicial protection and freedom of information. It would be inaccurate to say that Cloudflare itself filed that particular constitutional appeal without separate evidence.

The wider dispute continued in 2026. Spanish reporting described a criminal investigation involving Cloudflare and its CEO following a complaint by LaLiga and Telefónica; being investigated is not a finding of guilt. A separate March 18, 2026 decision in Paris concerned measures against unauthorised streaming in France, under French law and with different parties and remedies. Neither procedure should be conflated with the Barcelona judgment.

The precise endpoint of the Spanish order should be checked against the judgment and any subsequent rulings before claiming that the 2026/27 season is definitively its last. For a developer, the immediate question remains whether an individual site is reachable from the networks that matter to its users.

Why shared CDN IP blocking has collateral effects

CDNs and reverse proxies commonly host many unrelated domains behind shared addresses. A network-level restriction targeting one address can prevent access to other hostnames on the same endpoint. HTTPS makes it harder for an ISP to replace an encrypted response with a helpful explanation. Users may see a timeout rather than a blocking notice.

The Open Observatory of Network Interference (OONI) has published independent research into the collateral effects of LaLiga-related IP blocking. Cloudflare's transparency report also criticises overblocking, while LaLiga maintains that it targets piracy infrastructure rather than indiscriminately blocking legitimate websites. These are competing positions; actual network measurements are needed to assess individual incidents.

A measured incident: October 17, 2026

According to Screen Art's internal measurements, the first manual confirmation of access failures came at 15:47 CEST (13:47 UTC). Continuous monitoring started at 16:27:33 CEST with failures already present. Orange recovered at 20:50:13 CEST; ONO/Vodafone became stable around 21:18 CEST after intermittent responses. The exact starting time remains unknown.

The team resolved a Tranco top-one-million list against four Cloudflare IPs and found 179,161 hostnames representing 102,059 domains after grouping www variants. This is an IP-association count, not evidence that 102,059 websites were individually inaccessible. Individual examples were checked from two Spanish networks and a German reference point, with secondary hostnames excluded when the actual destination website still worked. The full dataset is held privately and relevant evidence can be requested from [email protected]. The original MuseDock investigation provides further context.

Step 1: record the exact hostname and redirect destination

Do not assume example.com and www.example.com use the same infrastructure. A secondary address may time out while the main website loads normally. Capture the complete URL, HTTP scheme, timestamp and redirect chain before making a public claim.

curl -IL --connect-timeout 8 --max-time 25 https://www.example.com/
curl -IL --connect-timeout 8 --max-time 25 https://example.com/

Step 2: compare DNS answers from different networks

dig +short A www.example.com
dig @1.1.1.1 +short A www.example.com
dig @8.8.8.8 +short A www.example.com

Run these from the affected Spanish network and from a reference host abroad. Geo-aware DNS can return different IPs. Identical DNS answers do not rule out an IP-level connection restriction, and differing answers do not by themselves prove censorship.

Step 3: test one IP while preserving TLS hostname verification

curl -I --connect-timeout 8 --max-time 20 \
  --resolve www.example.com:443:203.0.113.10 \
  https://www.example.com/

203.0.113.10 is a documentation-only address; replace it with an IP legitimately resolved for the target. --resolve preserves the hostname used for TLS and HTTP while connecting to the selected IP. Repeat the same test from independent networks, and avoid aggressive scanning. A curl status of 000 only means no valid HTTP response was received; inspect the connection error before assigning a cause. An HTTP 403 means a server responded, even if it rejected your request.

Step 4: design a cautious failover, not a magic unblock button

MuseDock CMS and MuseDock Panel implement monitored Cloudflare proxy switching. A probe checks connectivity through Spanish operators, validates that the origin has working HTTPS and, in automatic mode, temporarily removes the Cloudflare proxy from affected DNS records. Recovery requires a stability period; the products coordinate ownership so two controllers do not change the same record.

Screen Art reports that after the October 17 incident, the CMS restored 34 DNS names and the Panel restored 26, with the original proxy configuration reinstated. These are operator-reported results, not an external audit. Switching to direct origin exposure removes some CDN protections. Firewalls, TLS, monitoring and fail2ban help mitigate particular threats, but fail2ban does not stop large volumetric DDoS attacks.

Object storage requires a different fallback

For the beta image application Picalias, the team built a separate delivery gateway backed by Cloudflare R2. A server-side cache can fetch objects through R2's API and serve them over a direct alternative hostname when the usual public media route fails. Two consecutive failed reports trigger fallback only when the alternate route works; five minutes of healthy reports are required to return. A watchdog alerts administrators if the probe stops reporting. This implementation is specific to Picalias, not a feature of MuseDock CMS or Panel.

What this does not prove

The techniques described here cannot identify the legal requester behind each individual IP restriction. They do not guarantee availability on every ISP, and the current MuseDock implementation has not been validated for Akamai, Bunny CDN, Vercel or other providers. A generic adapter architecture is conceivable, but provider-specific APIs, routing and safety checks must be tested first.

Primary sources and further reading