How game publishers take down private servers, cheat sellers and pirated APKs

Game publishers report a private server, a cheat shop or a pirated APK site piece by piece, to each service that carries it: the host (through Cloudflare's abuse form if the site uses Cloudflare, which forwards copyright complaints to the host and gives you the host's contact details), the code repository, the Discord or Telegram community, the video and streaming channels, the app store, search engines and the payment processor. Registrars of generic domains such as .com must investigate abuse reports but are obliged to mitigate only DNS abuse such as phishing and malware, so for piracy the registrar decides, and a UDRP complaint, filed through counsel, reaches only look-alike domains. Discord's policy covers cheats that bypass anti-cheat software, Google Play bars game cheating apps that affect other apps, and GitHub and Google take circumvention claims. Each service decides on every report, so file accurate, complete notices and record every outcome.

Before you report: map the operation from public sources

Every route below works from exact links, and most ask for your rights and authority. Build the map from public sources only, by lawful means, and collect:

• Domains and networks. Each domain the operation uses, including look-alikes. ICANN's lookup tool shows current registration data for a domain, an IP network or an ASN,¹ and the RIPE Database's policy requires each network registered in it to have an abuse contact, set on the network or on the block above it, for reports of abuse from that network.²
• Files. Each download link for the modified client, launcher, cheat, bot or Android APK, and where the file is hosted.
• Promotion and community. The exact link to each video, stream, Discord message, Telegram channel, forum thread and listing site, in the format each platform asks for.^3,4
• Money. The donation or shop page and its payment options. Stripe asks for evidence that the business currently uses Stripe, because references to Stripe can stay in a site's source code after a business leaves Stripe.⁵
• Rights and authority. What is copied (client or server files, art, music or text), and your trademark registration numbers and countries, which Kick, for one, asks for.⁶ If a licensee or agent files, keep the rights owner's written authorisation.
• Dated evidence and a log. Save screenshots and recordings before you file (Twitch reminds complainants that they must preserve evidence),⁴ and log each link's report, reference and outcome.

Where to report, route by route

Hosting providers, and sites behind Cloudflare

A hosting provider may be able to remove particular content from a website; services that only pass it through generally can't.⁷ OVHcloud's abuse form has a category for infringement of intellectual property rights and has you confirm each report with an ID it emails you,⁸ and Hetzner's asks for the type of violation, your evidence and your contact details.⁹

If the site's records show Cloudflare, it most likely uses Cloudflare's pass-through security and CDN services, and Cloudflare doesn't host content through them.⁷ Use Cloudflare's abuse form, under Copyright Infringement & DMCA Violations, Trademark Infringement or General; Cloudflare is generally unable to process complaints sent by email.^10,11 It forwards the complaint to the website operator and the host, and gives copyright complainants the host's contact details so they can follow up; for some categories you can ask it not to forward your complaint to the operator.^7,12 Copyright reports must contain everything section 512(c) of the US DMCA requires, and to have content removed from its cache, Cloudflare asks for a court order or evidence that the host has removed it.¹⁰ The point of contact on its EU Digital Services Act page is only for EU authorities; others in the EU report illegal content through the same abuse reporting.¹³

Registrars, and look-alike domains

Registrars can act only on entire domains.⁷ Under their agreements with ICANN, registrars of generic domains such as .com must keep an abuse contact, confirm receipt of reports, and take reasonable and prompt steps to investigate and respond appropriately. Since 2024, a registrar with actionable evidence that a domain is used for DNS abuse (malware, botnets, phishing, pharming and spam that delivers them) must promptly take appropriate mitigation action.¹⁴ A private server isn't on that list, so report it with evidence and expect the registrar to decide. A registrar that fails to investigate and respond to an abuse report can be reported to ICANN Contractual Compliance through its Abuse/DNS Abuse (Registrar) complaint form. ICANN has no contractual authority over country-code domains such as .eu, so for those, contact the domain's ccTLD manager, listed in IANA's root zone database.¹⁵

Where a domain imitates your game's name, the Uniform Domain Name Dispute Resolution Policy (UDRP) may help: it applies to all generic top-level domains such as .com, and many country-code domains use it or a variant.¹⁶ You must show that the domain is identical or confusingly similar to your trademark, that the registrant has no rights or legitimate interests in it, and that it was registered and is being used in bad faith; the remedies are limited to cancellation or transfer.¹⁷ A panel that finds a complaint was brought in bad faith, for example in an attempt at reverse domain name hijacking or mainly to harass the domain's holder, declares it an abuse of the proceeding, and that finding is published.¹⁸ File through independent counsel.

GitHub: leaked code, cracked clients and circumvention tools

GitHub takes DMCA notices through its Copyright claims form or by email to copyright@github.com, in plain text. Identify your work, the infringing files or lines, what the user must change and your contact details, include the two statements it requires, one confirming that you have taken fair use into consideration, and sign the notice.¹⁹ If the notice says the whole repository infringes, GitHub disables it; otherwise the user gets about one business day to make changes. Forks aren't disabled automatically, so name each fork you have checked; if a whole repository is being actively forked and your notice identifies all its existing forks, GitHub would process a valid claim against every fork in the network.²⁰ GitHub also notes that copyright protects only code's expressive elements, not its functional parts, so check what a server emulator actually copies.¹⁹

For cheats and cracks, a circumvention claim must describe what the technical measures are, how they control access to the copyrighted material and how the project is designed to circumvent them.²⁰ Whether an anti-cheat system is such a measure depends on what it protects, so take that question to independent counsel.^21,22 Technical and legal experts review such a claim, GitHub tries to contact the repository owner before disabling anything, and if it can't tell whether a claim is valid, it errs on the side of the developer and leaves the content up. Claims about key generators and tools that bypass licence-key checks usually skip that review, as breaches of its Acceptable Use Policy, but GitHub applies it where such a claim isn't straightforward, for example for jailbreaks. GitHub publishes notices, with personal information removed.²⁰

Discord and Telegram

Discord takes copyright notices through its DMCA form or at copyright@discord.com, with the usual DMCA elements and the material's location, "including identifiers like message links or other IDs".²³ Its location guide gives the link formats, such as discordapp.com/channels/server-ID/channel-ID/message-ID for a message.³ Trademark complaints have their own form, and the user gets 7 days to respond.²³

Discord's Unauthorized Copyright Access policy covers sharing tools designed to bypass copyright protections, including game exploits ("cheats" or "hacks") when they bypass anti-cheat software or illegally modify game code or files; any Discord user or affected person can report a violation to copyright@discordapp.com or through Discord's form.²⁴ Discord may delete or disable content alleged to infringe, and terminates repeat infringers. It warns against duplicate reports and against asking groups of users to report the same content, so don't ask players to mass-report.²³

For Telegram, the copyright owner or an authorised agent emails dmca@telegram.org about public content, such as a channel, bot or sticker set; Telegram says it doesn't process requests about private groups and chats, and asks that email takedown requests include links to the content, such as t.me links.²⁵ Our guide to removing pirated content from Telegram covers the details.

YouTube, Twitch and Kick

YouTube takes copyright removal requests from owners or authorised representatives, in YouTube Studio (under Content detection) or at copyright@youtube.com, with a direct link to each item. You can schedule a removal to take effect in 7 days, giving the uploader time to act, and, in YouTube Studio, choose an option to "prevent future copies". It shares certain information with the uploader.²⁶ Trademark complaints, about your game's name or logo for example, are forwarded to the uploader, and YouTube removes content in clear cases of infringement after a limited review.²⁷

Twitch takes notices through its webform or at dmca-notifications@twitch.tv: give a live stream's channel URL, marked "Ongoing" if it is still live, or links and timestamps for recordings. Twitch generally passes your name and email to the streamer, and treats a user with three copyright strikes as a repeat infringer.⁴ Kick takes DMCA notices at dmca@kick.com and may remove the content or, in appropriate circumstances, terminate accounts; trademark complaints go to the same address with registration numbers, countries and certificates.⁶

Google Play, and APK sites

Google Play's Device and Network Abuse policy lists "game cheating apps that affect the gameplay of other apps", and apps that help "circumvent security protections", among its common violations.²⁸ You can report an app that breaks Play's developer policies, or that violates your rights or the law, from Google Play's help page.²⁹ For a pirated copy on Play, Google says it responds to clear copyright notices, and encourages trademark owners to contact the developer before using its trademark form.³⁰ A modified APK of your Android game on another site goes to that site's takedown contact, then to its host or Cloudflare, and to search engines.

Google, Bing and Yandex

Requests through Google's copyright removal form for Search³¹ take about six hours on average, Google says; it accepts URLs not yet in its index, may decline URLs that lack information, shares qualifying notices with the Lumen database, and lets site owners counter-notify.³² For a site offering a circumvention product or service, such as a key generator, the rights holder, an authorised representative or a licensed vendor can file a circumvention request (Google Search, then Legal Reasons to Report Content, Intellectual Property and Circumvention).³³

Bing's Notice of Infringement form covers its algorithmic (non-paid) results and its image and video indexes, takes submissions only from copyright owners or their authorised agents, and asks for one notice per work and page-specific URLs; its list of types of work includes video games and software.³⁴

Yandex takes copyright notices for its web, image and video search through the online form on its Copyright Notice Policy page, or by email, without attachments, to its copyright agent at copyright-complaint@support.yandex.com. It asks for a link to an authorised copy of your work (or a note that it isn't online), the URL of each infringing page and two statements like a DMCA notice's, and says it may disclose notices to the alleged infringer and to the public. The policy covers yandex.com; for services on Yandex's other domains, it points to the instructions there.³⁵ Yandex's transparency report adds that it removes links through a register that copyright holders keep updated under a memorandum it signed in 2018, and removes links to sites in Roskomnadzor's register of prohibited websites automatically.³⁶

PayPal and Stripe

PayPal asks rights owners to complete its Infringement Report and email it to infringementreport@paypal.com; its policy is to take appropriate action where necessary to remove material claimed to be infringing from its services, or disallow their use with it.³⁷ Its Acceptable Use Policy bars transactions involving items that infringe copyright, trademark or other proprietary rights.³⁸

Stripe bars the sale or distribution of software or other licensed materials without authorisation.³⁹ Its IP Notice process asks you to use the business's own IP process first, if it has one, then to send Stripe's form with evidence that the business uses Stripe; successful test purchases are encouraged but not required, and card details must not be included (agree any test purchase with counsel). Stripe may share your notice with the business, and says it cannot "take down" any offering: it decides only whether to keep serving the business, so the result may not be visible. The process isn't for other breaches of Stripe's rules,⁵ such as its restriction on selling in-game currency or items by anyone other than the operator of the virtual world.³⁹

Where to report private servers, cheats and pirated APKs (checked 16 October 2026):

Writing a notice that holds up

Cloudflare, Discord, YouTube, Twitch, Kick and GitHub ask for the elements of a US DMCA takedown notice.^{4,6,10,19,23,26} The statute says a notice must substantially include:⁴⁰

1. A physical or electronic signature of a person authorised to act for the owner of an exclusive right that is allegedly infringed.
2. Identification of the copyrighted work, or a representative list if one notice covers several works at one site.
3. Identification of the infringing material, with information reasonably sufficient to locate it.
4. Contact details reasonably sufficient to reach you, such as your address, telephone number and, if available, email.
5. A statement of good-faith belief that the use is not authorised by the copyright owner, its agent or the law.
6. A statement that the notice is accurate and, under penalty of perjury, that you are authorised to act for the owner of an exclusive right that is allegedly infringed.

For a game, say what is copied: client or server files, art, music or text. Your game's name, if you hold a trademark in it, belongs in a trademark complaint instead: as GitHub notes, words and short phrases are generally not protected by copyright.¹⁹ Before including fan guides, reviews, commentary or gameplay videos, check them against copyright's exceptions, as YouTube, Twitch and GitHub ask you to consider fair use or similar exceptions,^4,19,26 and against any permission you give players, such as a video, streaming or server-hosting policy: a US notice must state a good-faith belief that the use isn't authorised by the copyright owner, its agent or the law, and anyone who knowingly materially misrepresents that material is infringing is liable for the resulting damages.⁴⁰ Expect your notice to travel: GitHub publishes notices, Google shares qualifying ones with Lumen, Yandex may disclose them to the alleged infringer and the public, Twitch passes your name and email to the streamer, and Stripe may share yours with the business, so file from a dedicated mailbox or through an authorised agent.^{4,5,20,26,32,35}

The law, briefly

How the law applies depends on the facts and the country, so take legal steps through independent counsel.

• Game software. India's Copyright Act, 1957 counts computer programmes as literary works, and EU law protects computer programs by copyright as literary works and requires remedies against anyone who circulates a copy they know, or have reason to believe, is infringing.^21,41
• United States. 17 U.S.C. § 1201 provides that "No person shall circumvent a technological measure that effectively controls access to a work protected under this title", and bars trafficking in technology primarily designed to do so, with exceptions, such as one for making an independently created program interoperable.²² Every three years the Librarian of Congress also exempts some uses from the ban on circumventing, though not from the trafficking ban. The exemptions in force since 28 October 2024 include restoring personal, local play (not play through an online service) of a lawfully acquired game whose copyright owner has stopped providing the authentication server it needs, and, without commercial purpose, preserving such games in playable form at eligible libraries, archives and museums, on their premises.^22,42
• European Union. Article 6 of the InfoSoc Directive requires protection against circumventing effective technological measures, and against devices and services marketed or primarily designed for circumvention; for measures protecting computer programs, the Software Directive instead covers any means whose sole intended purpose is to facilitate their unauthorised removal or circumvention.^41,43 Which rule fits a game client is a question for counsel.
• India. Section 65A of the Copyright Act makes circumventing an effective technological measure applied to protect rights conferred by the Act, with the intention of infringing those rights, punishable with up to two years' imprisonment and a fine, and permits circumvention for purposes the Act doesn't expressly prohibit.²¹

When reports aren't enough

The server moves to a new host or domain

Report each new host and domain, and link it in your records to the one it replaces. Courts can go further. In film-piracy suits (CS(COMM) 724/2017 and connected suits), the Delhi High Court's final judgment of 10 April 2019 granted injunctions against the infringing websites, directed internet service providers to block them, and let the rights holders add mirror, redirect and alphanumeric versions later, on an affidavit with evidence, for the Joint Registrar to direct providers to block in India.⁴⁴ Google may also remove URLs that a court order identifies as unlawful.³³ Whether such an order suits a game server, and where, is a question for independent counsel.

A host, registrar or platform doesn't act

Read the reason given. If your notice was incomplete, supply what was missing and re-file; if the service decided the material doesn't infringe, don't send the same claim again, and take the question to independent counsel. If the operator counter-notifies under a DMCA-style process, the service may restore the material 10 to 14 business days later unless you first tell it you have filed an action seeking a court order, a step to take only through independent counsel; Discord and GitHub give similar windows.^19,23,40

You need to know who runs the server

That is a matter for formal requests and legal process. ICANN's Registration Data Request Service lets intellectual property professionals and others with a legitimate interest request non-public registration data for generic top-level domains from participating registrars.⁴⁵ In the US, a copyright owner can ask the clerk of a district court to issue a subpoena to a service provider to identify an alleged infringer, with a sworn declaration that the information will be used only to protect its rights under US copyright law, and Cloudflare provides information in response to valid DMCA subpoenas.^12,40 Take these steps through independent counsel.

Doing this at scale

For a publisher or licensee with several titles and regions, where servers, shops and channels move or reappear, the work becomes a cycle: map, file, follow up and re-check.

• Start where the content sits: hosts, GitHub, Discord and app stores, then search engines and payment providers.
• Batch where platforms allow it. Bing takes up to 1,000 URLs per upload, and Google's Trusted Copyright Removal Program offers accurate high-volume submitters bulk uploads, though not for circumvention claims.^34,46
• Stay accurate. Discord and Stripe ask you not to file duplicate reports, and GitHub asks those who outsource takedowns to make sure their agent doesn't use automated bots to submit complaints in bulk.^5,19,23 Misuse has consequences: YouTube says misuse of its processes may result in the termination of your account, Twitch rejects notices that it finds contain false statements or knowing misrepresentations, and Discord says repeated false, malicious or duplicate reports may lead to account warnings or other penalties.^4,23,26 In the EU, the Digital Services Act requires online platforms, other than micro and small enterprises, to suspend for a reasonable period, after a prior warning, the processing of notices from anyone who frequently submits manifestly unfounded ones.⁴⁷
• Protect the game itself. For measures inside the game, see how to protect your game from piracy.

Bytescare offers this cycle to game publishers and their licensees: monitoring on your plan's scan cycle, review of every match before it reaches you, the notices you approve, filed with the hosts, platforms and search engines involved and tracked to a decision, and, if you choose, legal escalation through independent counsel. Each platform decides on removal. Our anti-piracy service page explains how, and our threat intelligence service covers look-alike domains. This guide is general information, not legal advice. Bytescare is not a law firm; for a specific dispute, consult independent counsel.

FAQs

Further reading

• How to remove pirated courses, videos and books from Telegram
• Video Game Piracy Protection: Guarding the Digital Treasures
• Domain Takedown Services

Sources

1. ICANN Lookup: registration data lookup tool (About ICANN's Registration Data Lookup Tool; Nonpublic gTLD Registration Data) · ICANN · accessed 2026-10-16
2. Abuse Contact Management in the RIPE Database (ripe-705) · RIPE NCC · accessed 2026-10-16
3. How to Report the Location of Materials for Copyright and Trademark Claims · Discord Support · accessed 2026-10-16
4. Digital Millennium Copyright Act Notification Guidelines · Twitch Legal · accessed 2026-10-16
5. Stripe's Intellectual Property Notice Process (last updated 16 September 2025) · Stripe · accessed 2026-10-16
6. DMCA Policy · Kick · accessed 2026-10-16
7. Our approach to abuse · Cloudflare Trust Hub · accessed 2026-10-16
8. Abuse Form: Report abuse and illegal content · OVHcloud · accessed 2026-10-16
9. Report abuse and illegal content · Hetzner Online GmbH · accessed 2026-10-16
10. Reporting abuse · Cloudflare Trust Hub · accessed 2026-10-16
11. Abuse form: Submit an abuse report · Cloudflare · accessed 2026-10-16
12. Assisting copyright holders · Cloudflare Trust Hub · accessed 2026-10-16
13. EU Digital Services Act (point of contact and legal representative; Report abuse) · Cloudflare Trust Hub · accessed 2026-10-16
14. 2024 Global Amendment to Registrar Accreditation Agreements (effective 5 April 2024; section 3.18) · ICANN · accessed 2026-10-16
15. Submitting a Complaint to ICANN Contractual Compliance (registrar abuse complaints; ccTLDs outside ICANN's scope) · ICANN · accessed 2026-10-16
16. Domain Name Disputes (UDRP and ccTLD complaints) · WIPO Arbitration and Mediation Center · accessed 2026-10-16
17. Uniform Domain Name Dispute Resolution Policy (paragraph 4) · ICANN · accessed 2026-10-16
18. Rules for Uniform Domain Name Dispute Resolution Policy (paragraphs 15(e) and 16(b)) · ICANN · accessed 2026-10-16
19. Guide to Submitting a DMCA Takedown Notice · GitHub Docs · accessed 2026-10-16
20. DMCA Takedown Policy · GitHub Docs · accessed 2026-10-16
21. The Copyright Act, 1957 (IP India consolidated text; sections 2(o) and 65A) · Office of the Controller General of Patents, Designs and Trade Marks (IP India) · accessed 2026-10-16
22. 17 U.S. Code § 1201 - Circumvention of copyright protection systems (subsections (a) and (f)) · Legal Information Institute, Cornell Law School · accessed 2026-10-16
23. Discord's Copyright & IP Policy · Discord Support · accessed 2026-10-16
24. Unauthorized Copyright Access Policy Explainer · Discord Safety Center · accessed 2026-10-16
25. Telegram FAQ ("A bot or channel is infringing on my copyright. What do I do?"; "There's illegal content on Telegram. How do I take it down?") · Telegram · accessed 2026-10-16
26. Submit a copyright removal request · YouTube Help · accessed 2026-10-16
27. Trademark · YouTube Help · accessed 2026-10-16
28. Device and Network Abuse (Google Play Developer Program Policy) · Play Console Help · accessed 2026-10-16
29. Flag an app or review on Google Play (Report an app violating Google Play Developer Policy; Report an app for illegal content) · Google Play Help · accessed 2026-10-16
30. Intellectual Property (Google Play Developer Program Policy) · Play Console Help · accessed 2026-10-16
31. Report content on Google: copyright removal form for Google Search · Google · accessed 2026-10-16
32. Google Search removals due to copyright infringement FAQs · Google Transparency Report Help Center · accessed 2026-10-16
33. Circumvention, counterfeit, and court orders · Google Legal Help · accessed 2026-10-16
34. Notices of Infringement: Report Copyright Infringement · Microsoft Bing · accessed 2026-10-16
35. Copyright Notice Policy (Notice of Copyright Infringement; Other Ways to Submit Notices of Copyright Infringement; Online Form) · Yandex · accessed 2026-10-16
36. Transparency Report (Protecting the interests of copyright holders; Roskomnadzor requests for content removal) · Yandex · accessed 2026-10-16
37. Infringement Report Policy (last updated 6 May 2021) · PayPal · accessed 2026-10-16
38. Acceptable Use Policy (last updated 29 October 2022) · PayPal · accessed 2026-10-16
39. Prohibited and Restricted Businesses (last updated 22 September 2026) · Stripe · accessed 2026-10-16
40. 17 U.S. Code § 512 - Limitations on liability relating to material online (subsections (c)(3), (f), (g) and (h)) · Legal Information Institute, Cornell Law School · accessed 2026-10-16
41. Directive 2009/24/EC of the European Parliament and of the Council of 23 April 2009 on the legal protection of computer programs (Articles 1, 7 and 10) · EUR-Lex, Publications Office of the European Union · accessed 2026-10-16
42. Exemption to Prohibition on Circumvention of Copyright Protection Systems for Access Control Technologies: final rule of 28 October 2024, 89 FR 85437 (37 CFR 201.40(b)(19), video games) · U.S. Copyright Office, Library of Congress, in the Federal Register (govinfo, U.S. Government Publishing Office) · accessed 2026-10-16
43. Directive 2001/29/EC of the European Parliament and of the Council of 22 May 2001 on the harmonisation of certain aspects of copyright and related rights in the information society (Article 6 and recital 50) · EUR-Lex, Publications Office of the European Union · accessed 2026-10-16
44. Judgment of 10 April 2019 in CS(COMM) 724/2017 and connected suits, UTV Software Communication Ltd. and others, plaintiffs (final judgment and decree, paragraphs 94 to 102 and 107) · High Court of Delhi · accessed 2026-10-16
45. Registration Data Request Service (RDRS) · ICANN · accessed 2026-10-16
46. Trusted Copyright Removal Program Guidelines · Google Legal Help · accessed 2026-10-16
47. Regulation (EU) 2022/2065 on a Single Market For Digital Services (Digital Services Act): Articles 19 and 23 · EUR-Lex, Publications Office of the European Union · accessed 2026-10-16