Google Deindexes ‘Pirate’ IP Addresses When Used to Circumvent Blocking

When people use search engines to find pirate sites or pirated content, the results they receive today represent a massively edited subset of what is actually out there.

In response to DMCA notices sent by rightsholders, billions of URLs have already been removed from Google’s search results. Every week, millions of new URLs are processed by Google and when individual domains are considered especially infringing, Google takes that as a downranking signal.

Rightsholders in many jurisdictions can obtain ISP blocking injunctions against substantially infringing sites but, in most cases at least, these have no direct effect on search results. Just over a year ago, everything changed.

As previously reported, these injunctions can now be presented to Google for recognition. The end result is voluntary deindexing, meaning that the targeted sites will completely disappear from search results for the specified region.

New Domains Switched For IP Addresses

For years pirate sites have deployed new domains to defeat ISP blocking. At least in the beginning, the tactic helped to keep the sites accessible, but switching domains today often provokes a swift response by rightsholders to have the new domains blocked.

New domains are also used to mitigate Google’s downranking measures, but whether that remains effective for long is doubtful. A more recent trend in some regions has seen pirate sites dump domains entirely and rely on IP addresses instead.

That may sound like a trip back to the Stone Age (and it is), but short-term benefits do exist.

IP Address ‘Domains’ Reappeared in Google Search

The Lithuanian Radio and Television Commission (LRTK) has responsibility for blocking actions in Lithuania. Court orders are required to block pirate sites and over the years, dozens have been blocked by ISPs in Lithuania (list.txt).

When pirates attempt to circumvent blocking with new domains, these are handled under an administrative process and then added to the existing ISP blocking list. Since LRTK has a court order, these are sent to Google and the referenced domains are deindexed from search results.

However, it appears that the administrators of more than a dozen previously blocked and deindexed sites managed to reappear in Google search.

“It should be noted that the domain names of the aforementioned 13 websites were removed from the Google search system earlier by the order of the LRTK, but the administrators of these websites, trying to avoid the restrictions applied to them, made it possible for users to connect to the websites using only IP addresses without domain names,” LTRK explains.

“[This month] Google representatives informed us that the URLs containing IP addresses reported by the Lithuanian Radio and Television Commission, that allow access to illegally publicly published copyrighted content, have been removed from the Google search system.”

LRTK says that it considers the removal of domain names and corresponding IP addresses from Google search “an extremely effective means of preventing access to illegally published copyrighted content.”

Using IP addresses instead of domain names has another potential upside too.

IP Addresses Thwart DNS Blocking

When sites use human-readable domain names, those domains need to be converted to an IP address so that sites can be accessed. That’s achieved by using the Domain Name System (DNS), which usually works extremely well.

However, when pirate sites are blocked by court orders or administrative processes, ISPs are required to poison DNS records so that domain names no longer resolve to the resource they’re supposed to. By doing away with domain names altogether, DNS becomes surplus to requirements. This means that poisoned records are never accessed, and DNS-only site-blocking measures are instantly defeated.

Due to the many downsides, direct IP address access to pirate sites seems unlikely to become the next big thing, but it is happening. One example relates to Indonesian piracy giant Indoxxi, which reportedly shut down in December 2019 but lives on through an endless supply of clones and copies.

Blocking is carried out by Kominfo, the government communications ministry responsible for general internet censorship in Indonesia. In 2022 it was reported that 3,500 pirate sites had been blocked by local ISPs but only in more recent months has the prospect of IP-address blocking emerged following requests from rightsholders.

Around 200 sites have been blocked thus far in 2023, ostensibly on copyright grounds (factors other than copyright may also be required) but no specifics related to IP address-only blocking are detailed.

The darker side of encouraging Indonesia to develop its blocking arsenal is that the last thing the government needs is encouragement; it already abuses internet blocking measures to silence critics and the public (pdf). More technical ability to block is almost guaranteed to be abused.