1

"We give priority to direct footage. Even if police try to trace us or physically seize our servers, we've built our security system so that member information can never be exposed. Feel free to use our service with confidence."

Even as the government pushes forward with sweeping measures against illegal filming and other digital sex crimes, related crime is not shrinking — it's growing more sophisticated. It has been confirmed that operators are evading government blocking measures and neutralizing police investigations by rotating users' IP addresses at set intervals. Some sites are even actively trading footage from the "Nth Room" case, along with hidden-camera footage of acquaintances and videos evoking sexual crimes. As criminal methods stay well ahead of government countermeasures, victims continue to suffer.

According to AsiaToday's reporting on the 3rd, police received a report in April on Site A, where more than 2,400 pieces of illegal footage were being traded, and have been tracking the operator, but have made little progress so far. The site has been running normally for five months since March this year, and has continued strengthening its security measures while expanding in scale. Police have currently assigned the case to a jurisdictional station and requested cooperation from foreign investigative agencies.

Site A operates as a paid membership service using the cryptocurrency Tether (USDT) as payment. Buyers pay by topping up crypto wallets through indirect channels, while sellers produce and sell illegal footage. The operator profits from transaction fees, proxy crypto top-ups, and various gambling-style events. The site even awards points for uploading personal videos or leaving review comments — a structure similar to "AVMOV," a site whose operators police recently arrested some of through an earlier investigation.

The site has also compiled and is selling, for around 100,000 won, footage from the 2019 "Nth Room" case, a large-scale sexual exploitation case involving minors. The exact number of users is unknown, but views on that footage alone exceed 21,000. Even though all the ringleaders of the Nth Room case were arrested, the harm continues to repeat. The site also openly sells videos targeting minors — labeled by birth years such as "'08-born" and "'09-born" — as well as footage connected to sexual crimes such as rape and drug use. Numerous videos of the kind that caused the biggest controversy on the earlier AVMOV site — depicting acquaintances, family members, and romantic partners in degrading footage — were also confirmed. As of last month, individual sellers were earning up to 40 million won per month.

The site's operators have continued systematically upgrading their security to evade police investigation. They periodically delete IP addresses that could identify user locations, and generate a single-use unique address for each payment. They also give users detailed instructions on using virtual private networks (VPNs) and specific browsers that cannot be traced externally. The site is in fact designed so posts cannot even be viewed without a VPN activated. Physical servers are also distributed across multiple countries. The operators stated, "Even if police physically seize some servers, all they'll get is the site's source code."

A domestic security expert commented that the site's evasion likely stems not so much from advanced security technology as from having built in many workarounds that allow it to keep dodging detection, adding that while there is some exaggeration involved, the structure is genuinely difficult to crack.

The government first moved to block the site to protect victims. The Korea Communications Standards Commission decided to block the site on May 18 and notified domestic telecom carriers, which serve as network operators. In addition, the Korea Communications Commission requested that Cloudflare, a content delivery network (CDN) provider, also block the illegal content. This follows a measure the government implemented starting in May of last year requiring not only telecom carriers but also CDN providers to block illegal content. CDNs are services that rapidly deliver overseas content without geographic restrictions. While blocking a conventional domain (address) allows access to resume simply by changing the address, blocking through a CDN cuts off domestic access to the server itself, requiring the site to be rebuilt entirely from scratch.

However, Site A neutralized even this measure. Cloudflare did accept the government's request and blocked access to the site on May 26. But the site reappeared just two days later, on the 28th. According to a notice posted by the operators, they continuously rotate the IP addresses registered with Cloudflare every three to four hours. They have also distributed servers across multiple locations, so that when Cloudflare blocks the IP on one server, they simply register a pre-prepared IP on another server, allowing the site to resume operation immediately while preserving existing users and posted data. They also claimed to use multiple layers of server access and to keep encryption keys for stored data hosted externally.

With both investigation and blocking efforts rendered ineffective, further countermeasures are expected to be discussed at the cross-ministry Integrated Support Group for Digital Sex Crimes, launched in May by the Ministry of Gender Equality and Family, the National Police Agency, and the Korea Communications Commission. A police official said, "We plan to broadly track not just the operators but also key sellers and new users," adding, "We are pursuing a wide range of investigative methods, from undercover investigations to international cooperation, but given the nature of digital spaces, it is genuinely difficult to apprehend suspects quickly."

                                                                                                         Kim Hong-chan