When Blocking Isn’t Enough: Following the Networks Behind Online Abuse
Blocking a website can make it harder to access, but it does not necessarily reveal what happens to the people operating, using or distributing illicit content through it. For Deep Web Konek (DWK), that distinction has become increasingly important after more than a year of monitoring online forums and websites linked to suspected abuse.
DWK began systematically monitoring these platforms in 2025, before the recent Senate hearings on online sexual abuse and exploitation of children (OSAEC), and has continued tracking them as government attention to online safety has intensified.
The team's monitoring has identified 53 forums and websites worldwide with indicators involving the victimization of Filipino children. Of these, eight remain active despite being blocked by Philippine telecommunications providers, while nine have gone offline following reports and requests made by DWK to their hosting providers.
The figures collected provide an idea of an ecosystem that can extend well beyond the major social-media platforms often at the center of public discussion.
One forum monitored by DWK illustrates the scale that these communities can reach. Its own statistics showed 29,333 registered members, 218 threads and 1,039,938 posts. Among the sections visible during the monitoring were:
Girls Videos: 310,722 posts across 48 threads
Girls Pictures: 228,372 posts across 61 threads
Teen Couples: 210,344 posts across 29 threads
Spycam Videos: 61,426 posts across 27 threads
Professional Camgirls: 13,912 posts across seven threads
https://iili.io/n70eTuV.png
https://iili.io/n70ezyQ.png
Those sections alone represented at least 824,776 posts.
DWK subsequently reported the forum to its hosting provider and requested that the infrastructure be taken down because of the illicit material and indicators associated with OSAEC. The forum is now offline. The response demonstrated the importance of cooperation from hosting providers and commended the provider for its swift action.
The case also illustrates why identifying and documenting these communities before intervention can matter. The objective is not simply to have a URL disappear. Monitoring can establish the scale and structure of a community, preserve relevant information for reporting and help identify infrastructure that may otherwise remain unknown.
A recent Rappler investigation into another forum provides another example of how online communities can develop outside mainstream platforms. Rappler reported that the forum had more than 430,000 registered members and nearly nine million posts and comments, and that it emerged after adult material was blocked on a well known tech forum. The investigation also documented how activity could move between websites and other online services.
The significance for investigators is straightforward: removing one platform does not necessarily remove the network.
This is where DWK's monitoring raises a broader concern about the growing use of blanket blocking as a response to online abuse.
There is a legitimate need to block access to websites hosting child sexual abuse material. Philippine law itself requires internet intermediaries and ISPs to block or remove identified CSAEM/OSAEC material within specified periods after receiving sufficiently detailed notice. At the same time, the law also provides for preservation of subscriber, traffic and content data for investigations and requires relevant evidence to be identified and preserved.
The concern is not whether illegal material should be removed. It should.
The concern is what happens when authorities block an entire platform without sufficiently understanding the actors, infrastructure and movements behind the activity.
DWK's monitoring suggests that some actors involved in these communities are already familiar with platform restrictions. They can move between websites, create replacement communities, use alternative services or otherwise find ways to maintain their activities after a domain or account disappears.
In that environment, a block can become a disruption rather than a conclusion. A platform can disappear from an ISP's network while the administrators and users simply relocate.
For investigators, that can create an information gap. If authorities do not first understand where the activity is taking place, who is operating it and where the participants are likely to move, an immediate blanket ban may remove a visible source of information without necessarily dismantling the underlying network.
That is why DWK's approach has been to monitor, document, identify indicators, coordinate with infrastructure providers and preserve relevant information before seeking intervention where appropriate.
The nine forums that subsequently went offline following DWK's reports demonstrate one possible model: identify the infrastructure, establish why it requires intervention, report it to the appropriate provider and then continue monitoring for migration.
This does not mean every platform should remain accessible for the sake of investigation. Nor does it absolve platforms of responsibility. Mainstream platforms must still detect, remove and report illegal activity, while authorities must investigate perpetrators and protect victims.
But accountability should be directed at the activity and the actors behind it, not reduced to the assumption that blocking an entire platform ends the problem.
The people operating these communities are not necessarily newcomers who stop when a website is blocked. If they already understand how to migrate, a ban can simply push activity toward smaller, private or less visible spaces—precisely the environments where authorities may have fewer opportunities to observe what happens next.
For DWK, the lesson from more than a year of monitoring is therefore simple: follow the network before assuming the network has disappeared.
Blocking can be one tool. It should not be mistaken for the investigation itself.
