# When your automation's boundary is the network itself | Auspex > Spanish ISPs block IPs during football broadcasts, taking unrelated domains down with the pirates. The effect on webhooks, payments and ingest, and how to check. Source: https://auspex.company/en/blog/when-the-network-is-the-limit/ [Blog](/en/blog/) / Field Notes # When the boundary of your automation runs below the API By: Andrew Maryasov · Sep 8, 2026 · 5 min read The last vendor in the chain is the one you have no contract with. It's the network. When an integration stops delivering, the list of suspects usually has your code, the contractor's code and the platform's API on it; the ISP isn't on that list, because nobody signed an SLA — a service level agreement — with it. Spain's experience in 2025–2026 shows exactly how this layer breaks traffic between systems (machine-to-machine) — and why your metrics stay green while it does. ## What exactly gets blocked in Spain On 18 December 2024, Commercial Court No. 6 of Barcelona upheld a claim brought by LaLiga and Telefónica Audiovisual Digital against Spanish ISPs (ruling SJM B 309/2024): while matches are being broadcast, ISPs block the IP addresses that pirate streams come from. According to OONI, such blocks have been observed since February 2025. The blocking is by IP, not by domain and not by SNI. A single Cloudflare edge address serves tens of thousands of unrelated domains, so all the neighbors go down along with the pirates. The court rejected the attempts by Cloudflare and RootedCON to have the ruling annulled; LaLiga announced this on 26 March 2025, stressing that the decision cannot be appealed. ## How big this collateral damage is OONI measured the scale. Of 9.2 million domains tested, more than 554,000 were unreachable from Spain at least once between 1 January and 1 June 2026. Cloudflare accounts for 501,305 of those — 90.4% of all the damage — and it comes from just 2,218 addresses. To take more than 400,000 domains down for an hour, it is enough to switch off between four and twenty IPs. The authors themselves call these numbers a lower bound. ## Why it breaks the payment, not the website For a business, the consequence is not “a customer couldn't open the site.” The Spanish agency WAM, together with Interactiv4, broke down a case in which callbacks from the Redsys payment gateway to stores on Adobe Commerce got caught in the block: the payment went through, but the notification about it never arrived, so orders weren't marked as paid, invoices weren't issued and failed orders weren't canceled. After the notification receiver was moved to a subdomain outside Cloudflare, the share of failed confirmations fell from 48.88% to 1.62%. In OONI's list of what was blocked, s3.amazonaws.com and registry.terraform.io sit next to websites, and in spring 2026 docker pull stopped working across Spain. What breaks is machine-to-machine — the layer where nobody is around to complain. The telltale sign: the failures come in the evenings and on weekends, last an hour or two and go away on their own, and all your metrics stay green the whole time, because they only measure your side of the boundary. ## How to check your own exposure The check takes an hour. Look at which addresses your domain resolves to, and do the same for the domains that third-party integrations call you from: if both the clients and the webhook receiver sit behind the same edge provider, they go down together. Then lay your ingest failures — ingest being the intake of incoming data — from the past few months over the tournament calendar. In August 2026 our own production service was unreachable from Spain several evenings in a row because of exactly this kind of blocking, while all of its metrics stayed green. ## What to do about it - Move the receiver for machine notifications — webhooks, payment callbacks, ingest — to a separate subdomain with a separate route, not behind the edge address it shares with the website. - Keep your own event log on your side and a periodic reconciliation alongside the webhooks: whatever didn't arrive during a block is exactly what the reconciliation will pick up. - If you have clients or contractors in Spain, check the tournament schedule as part of your release calendar — it's cheaper than picking an incident apart after the fact. This boundary is a special case of a broader rule: automation built on top of someone else's platform inherits its points of failure along with it. The full list of commitments your vendor never took on is covered in a companion note, linked below. Read next - [Where your automation ends: what the vendor never promised you](/en/blog/automation-vendor-single-point/) - [CRM and automation audit](/en/services/crm-audit/) ## Sources - [OONI — Collateral Damage of IP-Based Blocking During LALIGA Football Streaming in Spain, 30 June 2026](https://ooni.org/post/2026-laliga-collateral/) - [WAM / Interactiv4 — IP blocking and Redsys IPN failures in Adobe Commerce](https://wam.global/es/wam-room/bloqueo-ip-cloudflare-redsys-laliga/) Andrew Maryasov Founder, Auspex Founder of Auspex. Implementing CRM and automating business processes since 2015 — 1,500+ projects for 1,200+ companies. [amaryasov.expert →](https://amaryasov.expert) ## Frequently asked How do you tell a network block from a bug in the integration? By three signs together: the failures come in windows of an hour or two, mostly in the evening and on weekends; they go away on their own, without you doing anything; and your own metrics stay green throughout. A bug in the code doesn't behave like that: it is either reproducible or it correlates with a release. Will moving to another hosting provider help? Not by itself. What gets blocked is an address, not a company, so the provider's name is not the point. What matters is whether your receiver for machine notifications sits behind the same address as thousands of unrelated domains. A dedicated route for webhook traffic helps more than swapping one brand name for another. Does this only concern Spain? The mechanics don't. IP blocking is used in other jurisdictions too, and the consequence is the same everywhere: neighbors on the same address get caught in it. The Spanish case is valuable because its scale was measured independently, and the figures can be checked. What should you do if your clients are in Spain and your team isn't? Lay your ingest failures from the past few months over the tournament calendar and see whether the windows match. If they do, the first step is moving the notification receiver to a separate route; the second is a reconciliation that picks up the lost events. ## Business automation digest 2–3 emails a month — what actually works in CRM and automation. No spam. Unsubscribe in one click. [Free CRM audit →](/en/contact/) ↳ FREE AUDIT 30 min · free · ↓ ## Ready to Get Your Sales Under Control? Free process audit — 30 minutes, and you'll receive: 1,200+ companies since 2015 · 30-day median go-live 01 A map of where you're losing leads 02 Priorities: what to automate first 03 An implementation plan for 2-4 weeks We'll call within 24 hours. The plan is yours, even if we don't work together.