— And Why “Security Upgrade” Doesn’t Fully Add Up
A Prague conglomerate’s three storefronts went offline together on November 11. The company says it’s patching. The network data says something bigger broke.
Last updated: November 14, 2026, 13:00 UTC
Three adult platforms operated by the same Prague parent company have been unreachable for roughly four days, and the official explanation is doing a lot of work that the evidence doesn’t quite support.
Pornbox.com, Sheer.com and AnalVids.com — all properties of WGCZ Holding, the Czech conglomerate best known as the owner of XVideos — went down in sequence starting around November 11. All three remain down as of this writing. Their support forum is down with them. Users can’t log in, which means creators can’t reach their dashboards, subscribers can’t reach anything they paid for, and pending payouts are stalled.
Sheer’s official X account, which has become the de facto press office for the whole outage, posted a pinned notice: “We’re implementing important security upgrades to protect our systems against potential attacks. During this process, some services may experience temporary interruptions.”
That is a maintenance message. What’s actually happening looks less like maintenance.
The timeline
All times UTC, compiled from public monitoring services and user reports.
- November 11 (approx.) — First failures reported. A thread appears on r/Porn_news titled “Why is the Pornbox website down?” Reddit’s thread ID places its creation at roughly this point; the exact hour is unconfirmed.
- November 12, 20:09 and 22:55 — AnalVids logged as failing consecutive checks.
- November 12, 22:37 — Pornbox logged as failing.
- November 13, 06:22 through 20:19 — Sheer logged as failing on nine consecutive checks. Pornbox and AnalVids continue failing through the day.
- November 14, 06:52 and 12:55 — All three still failing. Reports accumulate from Czechia, Finland, the UK, New Zealand, Canada, Switzerland, Belgium, India and the United States.
By the 13th, Sheer’s replies to users had turned candid. Asked for a restoration estimate: “Unfortunately, we don’t have an estimated time for full restoration yet.” Asked when service would resume: “We don’t know yet.” On payouts: “We will do our very best to ensure pending payouts are processed as soon as possible.”
What the network data shows
Here is where the “scheduled upgrade” story gets thin.
All three domains still resolve. All three still present valid TLS certificates. Then the connection dies — timing out at roughly 3,000 ms on one class of probe and 10,000 ms on another. In other words: DNS is answering, the certificate layer is intact, and the application layer is a black hole. Nothing is serving.
More revealing is where they now point. All three resolve into AS8646, cloudinfrastack s.r.o. — a Prague hosting provider. Meanwhile xvideos.com, the conglomerate’s flagship and the most-visited porn site on earth, resolves through CDN77 and returns a clean HTTP 200. It has stayed up throughout.
Read that again: the parent company’s biggest property is healthy, and the three commerce sites that share its ownership are flatlined. Whatever this is, it is not a company-wide network event and it is not a CDN problem.
There is a second detail worth flagging. A routine security patch is usually applied to a live fleet, in stages, with the site degraded but reachable. These sites are not degraded. They are gone — with free video pages reportedly still rendering in some cases while every login and every paywalled asset fails. That is the signature of an authentication and delivery layer that has been pulled out from under the front end, not of a patch window.
Why the breach question is live
Sheer has been asked directly. Their answer, on November 13: “The security measures we’re implementing are intended to strengthen our systems and protect our community. Please note that these measures do not necessarily indicate a data breach.”
“Not necessarily” is doing heavy lifting. A company confident there was no breach says there was no breach. The hedge invites the question.
Two things sharpen it.
First, this conglomerate has been here before. An earlier Pornbox outage produced a staff post on the site’s own forum stating plainly that “there was an attack that caused some damage and it took us a while to set things back up.” The “attack” framing is the house style, and last time it was an actual intrusion with actual damage. Users in that thread were relieved that no account data had been lost — a relief that implies it was in play.
Second, WGCZ is under concurrent external pressure. The group faces scrutiny from card-payment processors and an investigation by police into the shoot practices at LegalPorno, the studio AnalVids grew out of. Either force can compel infrastructure and compliance changes on short notice — and a rebuilt billing and auth stack is exactly the kind of thing that produces a multi-day, login-first outage.
None of that proves a breach. It does mean the confident version of the official story is not yet earned.
What users are actually experiencing
The practical damage is concentrated and specific. Purchased library items won’t stream or download. Logins fail for both creators and subscribers. One user on a monitoring service’s comment thread reported that trailers in the store still play while nothing owned is reachable — browsing survives, ownership doesn’t.
A mirror was floated as a workaround and dismissed immediately: “The mirror is worthless if we can’t access the library of stuff we paid for.”
That is the real story here. Pornbox sells permanent library access as its core promise — buy the scene, keep the scene. Four days of that promise being unenforceable is a bigger commercial problem than four days of downtime.
What we know, and what we don’t
Confirmed: Three WGCZ properties are down simultaneously and have been for approximately four days. DNS and TLS are healthy; HTTP is dead. The flagship tube site is unaffected. Logins and paywalled content fail globally across multiple countries. Sheer has given no ETA and has hedged on breach. A prior outage at the same company was attributed to an attack.
Unconfirmed: The precise first-failure timestamp. Whether the AS8646 hosting is new infrastructure or long-standing. Whether any WGCZ entity beyond Sheer’s X account has commented. Whether user data, credentials or payment records were exposed. Whether this is intrusion recovery, a forced compliance rebuild, or a catastrophic internal failure.
The bottom line
Four days, no ETA, dead authentication, a silent parent company, and a statement that concedes nothing while its own replies concede plenty.
If this were the scheduled security upgrade the notice describes, the sites would be up by now, or at least limping. They aren’t. Treat the official line as the opening position rather than the answer, and treat anything you have sitting behind that paywall as currently at risk of being inaccessible for a while longer.
Editor’s notes before you publish
- The Nov 11 start date is inferred, not verified. The Reddit thread ID is consistent with that date but I couldn’t load the thread — Reddit blocks the scraper. If you can open it in a browser, grab the timestamp and tighten it.
- Two items need a manual pull: the Reddit thread, and the Pornbox forum’s prior “recent downtime” thread (forum.pornbox.com/viewtopic.php?f=96&t=22482), which times out for automated requests. That thread is the source for the earlier “attack” quote.
- Everything quantitative here is reproducible from the uptime monitors and BGP records linked below, so the piece is defensible if anyone pushes back.
- Consider adding a running timestamp to the headline and refreshing daily while the outage persists — this is a live story and will date fast.
Sources
- Sheer official statement and replies: x.com/SheerForCreator (statement archived at sotwe.com/SheerForCreator)
- Uptime records: isitdownorjustme.net/status/{pornbox-com, sheer-com, analvids-com, xvideos-com}, notopening.com/site/{pornbox.com, analvids.com}
- ASN and routing: bgp.he.net/AS8646, ipinfo.io/AS8646
- Corporate structure: en.wikipedia.org/wiki/WGCZ_Holding; vsquare.org on GTFLIX TV s.r.o. and Stéphane Pacaud
- Prior outage thread: forum.pornbox.com/viewtopic.php?f=96&t=22482
- User discussion: reddit.com/r/Porn_news/comments/1xv2051
