When Does Website Blocking Actually Work?

Abstract

This study systematically evaluates website blocking as both an anti-piracy enforcement mechanism and a cybersecurity control, analyzing its effectiveness in reducing piracy across four Southeast Asian jurisdictions with distinct legal frameworks, assessing blocking speed, procedural barriers, and circumvention tactics, providing new empirical insights for policymakers and cybersecurity practitioners. Using a quasi-experimental design during the COVID-19 pandemic, this research examines the impact of website blocking measures in Indonesia, Vietnam, Malaysia, and Singapore. For the first time, the findings reveal that swift, systematic website blocking—exemplified by Indonesia—serves as an effective cybersecurity control, significantly reducing access to infringing content while redirecting traffic toward legitimate platforms. Jurisdictions with procedural delays and inconsistent enforcement, however, demonstrate limited efficacy, highlighting the need for dynamic responses to evolving threats such as domain hopping and proxy servers. The findings inform broader cybersecurity applications like network segmentation, access control, and threat intelligence. This work links traditional copyright enforcement to proactive incident detection and response strategies, providing insights into broader applications for cybersecurity, such as network segmentation, access control, and threat intelligence.

1. Introduction

The rapid proliferation of digital technologies and the internet has dramatically transformed the global content creation, distribution, and consumption landscape. These technological advances have democratized access to information and entertainment, empowering creators and audiences alike. However, they have also facilitated the rise of pervasive online copyright infringement, presenting a formidable challenge for governments, rights holders, and law enforcement agencies worldwide (Danaher et al. 2024). This dual-edged nature of digital transformation underscores the urgent need for effective, adaptive strategies to combat online piracy, particularly in regions like Southeast Asia, where the digital ecosystem is evolving rapidly, and cybersecurity risks are growing as a result of piracy (Watters 2023). In addition to reducing access to infringing content, an increasingly important policy objective of website blocking is to redirect users toward legitimate content platforms. This shift supports the broader development of sustainable digital markets and enhances incentives for lawful content distribution.

Website blocking has emerged as one of the most prominent tools in the fight against online piracy (Danaher et al. 2016). At its core, website blocking seeks to restrict access to infringing content by targeting websites that facilitate copyright violations (Ververis et al. 2024). Implemented at the network level, this approach enables internet service providers (ISPs) to prevent users from accessing specific URLs or domains associated with piracy (Snyder et al. 2020). This mechanism, while conceptually straightforward, is rooted in complex legal, technological, and procedural frameworks that vary significantly across jurisdictions (Carstairs 2021). Southeast Asia presents a compelling case study for evaluating website blocking measures, given the region’s diverse legal systems, varied enforcement mechanisms, and rapidly growing digital economies (Han 2022).

Despite its increasing adoption, website blocking as a strategy is not without controversy. Advocates highlight its potential to reduce piracy traffic, redirect users toward legitimate content platforms, and disrupt the financial incentives that drive piracy networks (Blakeney 2023). However, critics point to concerns over the potential for overblocking, where legitimate websites are inadvertently targeted, and the circumvention tactics employed by piracy operators, such as domain hopping and proxy servers, which can undermine blocking efforts (Sinpeng 2020). These challenges raise critical questions about the effectiveness and sustainability of website blocking as an anti-piracy measure (Ong 2021).

Moreover, the global COVID-19 pandemic further complicated the online piracy landscape and the role of blocking (Chang et al. 2022). Lockdowns and social distancing measures prompted a dramatic surge in digital content consumption, creating new opportunities for both legal platforms and piracy operators—and new cyber threats (Watters 2021). The closure of cinemas, live entertainment venues, and other traditional content distribution channels drove audiences online, amplifying the demand for digital content (Okumuş 2022). While this shift benefited streaming services and legal content providers, it also expanded the market for infringing content, highlighting the urgent need for robust anti-piracy strategies. This unique context provides a valuable natural experiment for evaluating the effectiveness of website blocking measures under extraordinary societal conditions1.

1.1. Website Blocking in the Southeast Asian Context

Southeast Asia is a particularly relevant region for studying the implementation and impact of website blocking. The region’s rapid digital transformation has positioned it as a hotspot for both legitimate and pirated content consumption. According to industry reports, Southeast Asia is home to some of the world’s most active internet users, with a significant portion of digital activity centered around media consumption. However, this digital growth has also made the region a focal point for piracy networks, which exploit the region’s fragmented regulatory landscape to distribute infringing content.

The legal and enforcement frameworks governing website blocking in Southeast Asia vary significantly between countries, reflecting differences in political priorities, institutional capacities, and levels of stakeholder engagement. Indonesia and Vietnam, for instance, have adopted administrative-based approaches to website blocking, allowing government agencies to swiftly issue blocking orders without requiring judicial oversight. In contrast, Malaysia and Singapore rely on more formalized legal procedures, emphasizing judicial review and due process. These distinctions provide a unique opportunity to analyze how different legal frameworks influence the effectiveness of website blocking measures.

Furthermore, the socio-cultural context of Southeast Asia adds another layer of complexity. The region’s diverse linguistic and cultural landscape influences content preferences and piracy behavior, with local and regional piracy networks catering to specific market segments. This diversity underscores the need for tailored anti-piracy strategies that account for local nuances while addressing the broader challenges of digital piracy.

1.2. The Broader Role of Website Blocking in Cybersecurity

While website blocking is traditionally viewed as an anti-piracy tool, this study situates it within the broader context of cybersecurity. At its core, website blocking shares fundamental principles with cybersecurity measures designed to restrict access to malicious or harmful online content (Špaček et al. 2019). Similar to how firewalls and network filters prevent unauthorized access to sensitive systems, website blocking seeks to disrupt access to infringing content, thereby mitigating the harm caused by piracy (Bakioǧlu 2016).

This alignment with cybersecurity principles is particularly relevant in an era defined by the convergence of cybersecurity, artificial intelligence (AI), and IoT technologies (Olla et al. 2024). As digital ecosystems become increasingly interconnected, the lines between content protection, data security, and network integrity are blurring. Website blocking, when integrated with advanced cybersecurity technologies such as AI-driven threat detection and real-time monitoring, has the potential to evolve into a more dynamic and adaptive control mechanism (Amjad et al. 2023). This expanded perspective opens new avenues for leveraging website blocking beyond copyright enforcement, addressing broader challenges such as phishing, malware distribution, and other forms of cybercrime, where AI is proving to be effective in incident response and deterrence (Sengar et al. 2024).

1.3. Research Significance and Objectives

This study aims to contribute to the ongoing discourse on the effectiveness of website blocking by providing an empirical analysis of its implementation in four Southeast Asian countries: Indonesia, Vietnam, Malaysia, and Singapore. These countries were selected based on their distinct legal frameworks, enforcement practices, and representativeness of the broader region. By examining the impact of website blocking across these diverse jurisdictions, this research seeks to address three critical questions:

• How do legal frameworks and practical implementations of website blocking measures influence their effectiveness in reducing online copyright infringement?
• To what extent are website blocking measures effective, and what factors contribute to their success or limitations?
• To assess the extent to which website blocking measures contribute to redirecting users toward legal content platforms, and to evaluate the conditions under which this objective can be achieved.

This study uniquely contributes to both cybersecurity and legal scholarship by providing an empirical evaluation of how different enforcement models impact website blocking effectiveness. While past studies have analyzed blocking in individual jurisdictions, no research has systematically compared administrative vs. judicial approaches across multiple countries using real-world enforcement data. Our findings inform cybersecurity strategy by demonstrating that blocking can be an effective incident response mechanism when integrated with proactive domain monitoring and enforcement automation.

Ultimately, this research aims to provide actionable insights for policymakers, rights holders, and cybersecurity professionals seeking to develop more effective and sustainable strategies for combating online piracy and enhancing digital resilience. By bridging the gap between traditional copyright enforcement and modern cybersecurity practices, this study contributes to a more integrated approach to addressing the challenges of the digital age.

2. Materials and Methods

This study employs a quasi-experimental design to evaluate the effectiveness of website blocking as a cybersecurity measure against online piracy. The COVID-19 pandemic created a unique natural experiment setting, characterized by unprecedented changes in internet usage patterns, enforcement priorities, and content consumption behaviors. These factors allow for a detailed and opportunistic analysis of the implementation and impact of website blocking measures in four Southeast Asian jurisdictions: Indonesia, Vietnam, Malaysia, and Singapore.

2.1. Study Design

To assess the effectiveness of website blocking, this study compares piracy traffic patterns and enforcement outcomes in these jurisdictions with two control territories, Thailand and the Philippines, where no comprehensive website blocking measures were implemented during the study period. The inclusion of control territories enables the isolation of blocking measures’ impact from broader trends in digital content consumption, providing a robust basis for comparison.

The design includes two main phases:

• Comparative Analysis: Evaluates differences in piracy levels, implementation efficiency, and legal frameworks across the four target jurisdictions
• Empirical Measurement: Assesses the quantitative impact of website blocking on piracy traffic and legal content consumption using statistical methods, including raw data analysis, normalized comparisons, and regression modeling.

2.2. Grouping and Selection of Jurisdictions

The selection of Indonesia, Vietnam, Malaysia, and Singapore as the focus of this study reflects the diversity of legal frameworks and practical approaches to website blocking in Southeast Asia. These jurisdictions represent distinct enforcement paradigms, ranging from administrative-based processes to judicially intensive frameworks. They are grouped as follows:

• Group 1: Indonesia and Vietnam

• Characterized by administrative approaches to website blocking.
• Implementations occur rapidly, often within 24 h (Indonesia) or a few days (Vietnam).
• Judicial oversight is minimal or absent, allowing for streamlined decision-making.

• Group 2: Malaysia and Singapore

• Defined by formal legal procedures, emphasizing judicial or quasi-judicial reviews.
• Implementation timelines are longer, ranging from 48 h (Malaysia) to several months (Singapore).
• Blocking orders require extensive documentation and legal scrutiny.

• Control Territories

Thailand and the Philippines serve as baselines, as they did not implement systematic website blocking during the study period. These territories provide essential benchmarks for understanding piracy trends in the absence of blocking measures.

2.3. Data Collection

The study draws on three primary datasets:

• Website Traffic Data: Collected from Alexa Top Sites, which aggregates information on the 10,000 most visited websites in each country. Metrics such as “Reach Per Million” (RPM) provide insights into website popularity and user engagement. In addition to Alexa data, we validated our results using Zvelo’s URL categorization and website traffic estimates from CAP enforcement records. While Alexa’s ranking methodology was widely adopted at the time of data collection (2020–2022), future studies should consider alternatives such as Cloudflare Radar and SimilarWeb for sustained tracking of piracy website traffic.
• Site Categorization Data: Obtained from Zvelo, a commercial URL categorization service. Zvelo’s algorithms classify websites based on content type, enabling the identification of piracy-related domains
• Blocking Records: Provided by the Coalition Against Piracy (CAP), detailing the number of sites blocked, implementation timelines, and enforcement procedures for each jurisdiction

Several limitations of the datasets should be noted at the outset. Alexa’s traffic rankings are based on a rolling three-month average, which may introduce latency in detecting rapid changes in piracy activity. Zvelo’s categorisation algorithms, while highly accurate, may not capture newly emerging infringing domains. Additionally, variations in internet penetration and digital behaviour across countries can affect traffic metrics. These limitations are addressed in the analysis and revisited in the conclusions, but they should be considered when interpreting the findings.

2.4. Sampling Method

Data was collected fortnightly between April 2020 and April 2022, capturing the dynamic nature of piracy trends and enforcement efforts. The study focuses on:

• Top 10,000 Websites: Traffic metrics for the most popular sites in each jurisdiction.
• Infringing Websites: Identified based on criteria such as the presence of copyrighted material and intent to facilitate infringement.
• Legal Content Platforms: Includes legitimate streaming services, OTT platforms, and user-generated content sites.

The time frame encompasses the height of pandemic-induced lockdowns and the subsequent easing of restrictions, providing insights into the short- and long-term effects of website blocking.

2.5. Classification of Websites

Websites were categorized into three main groups:

• Piracy Websites: Identified based on keywords (e.g., “movie download,” “free streaming”) and manual verification of infringing content.
• Legal Platforms: Includes licensed streaming services, content distributors, and platforms that comply with copyright laws.
• Neutral/Other Websites: Sites unrelated to piracy or legal content, serving as contextual benchmarks for internet traffic analysis.

Zvelo’s machine learning algorithms were supplemented with manual verification to ensure accuracy. Redirected domains (indicative of domain hopping) were automatically classified as piracy sites.

2.6. Metrics for Effectiveness

The study assesses website blocking effectiveness using three core metrics:

• Traffic Reduction to Blocked Sites: Measures the decline in visits to targeted piracy websites post-blocking.
• Overall Piracy Levels: Examines changes in aggregate traffic to all identified piracy websites, accounting for displacement effects.
• Sustained Impact: Evaluates the long-term effects of blocking measures, including the emergence of new infringing sites and shifts in user behavior.

2.7. Statistical Analysis

The study employs a combination of descriptive and inferential statistical methods to analyze the data.

• Raw Data Analysis: Provides an initial overview of piracy traffic levels across jurisdictions, highlighting absolute changes over time.
• Normalized Analysis: Adjusts for differences in internet penetration and traffic volumes between countries, enabling fair cross-jurisdiction comparisons.
• Regression Modeling: Explores the relationship between piracy traffic and legal content consumption, quantifying the impact of blocking measures, as well as T-tests and Mann–Whitney U (compare pre/post-blocking piracy levels) and ANOVA (analyze variance between blocking speed and piracy reduction).

To ensure comparability across jurisdictions, all key metrics were normalised before analysis. Mean and median levels of infringement are expressed as proportions of total web traffic within the top 10,000 sites in each jurisdiction, rather than as absolute numbers. This approach removes distortions caused by differences in population size or internet penetration rates and allows for meaningful cross-country comparison. In other words, the reported figures reflect the relative prominence of piracy sites within each country’s digital ecosystem.

2.8. Comparative Analysis

The analysis compares the effectiveness of blocking measures in Group 1 (Indonesia and Vietnam) and Group 2 (Malaysia and Singapore), with the control territories (Thailand and the Philippines) providing a baseline. Key variables include:

• Blocking Speed: Time taken to implement a blocking order.
• Blocking Volume: Number of sites blocked during the study period.
• Legal Oversight: Degree of judicial or administrative involvement.

2.9. Contextual Considerations

The COVID-19 pandemic significantly influenced internet usage and piracy behavior, necessitating careful contextualization of the findings. Key pandemic-related factors include:

• Increased Online Activity: Lockdowns drove a surge in internet usage, amplifying both legitimate and infringing content consumption.
• Shifts in Enforcement Priorities: Resources were reallocated to pandemic-related issues, deprioritizing anti-piracy efforts in some jurisdictions.
• Changes in Content Access: The closure of cinemas and live events shifted demand toward digital platforms, impacting piracy trends.

By accounting for these factors, the study isolates the impact of website blocking from broader pandemic-driven changes.

2.10. Displacement Effects and Adaptive Tactics

The analysis considers the displacement effects of blocking measures, where users migrate to unblocked piracy sites or employ circumvention tools such as VPNs and proxies. These adaptive behaviors are a critical limitation of traditional blocking strategies and are addressed through supplementary metrics and qualitative observations.

3. Results

This study’s findings provide valuable insights into the effectiveness of website blocking as an anti-piracy measure and its broader implications within the cybersecurity ecosystem. By comparing the impact of blocking measures across Indonesia, Vietnam, Malaysia, and Singapore, the research highlights critical factors influencing the success and limitations of these interventions. It also identifies trends in user behavior, enforcement practices, and adaptive piracy tactics that shape the overall effectiveness of website blocking.

All results presented in this section are based on normalized measures of web traffic, which express piracy activity as a proportion of total traffic within the top 10,000 websites. This ensures that the findings are not biased by differences in country size or internet usage.

Summary results are provided below, before an in-depth examination and interpretation of the results for each country.

3.1. The Impact of Legal Frameworks and Implementation Approaches

The legal and procedural frameworks governing website blocking play a decisive role in determining its effectiveness. The comparison between Group 1 (Indonesia and Vietnam) and Group 2 (Malaysia and Singapore) underscores how differences in legal structures and enforcement mechanisms influence outcomes.

The grouping of control jurisdictions follows methodological and contextual logic. The Philippines was paired with Malaysia and Singapore (Group 2) because, despite not implementing comprehensive website blocking during the study period, it shares similar legal traditions and judicially oriented governance structures. Conversely, Thailand was grouped with Indonesia and Vietnam (Group 1) due to comparable administrative structures and regulatory approaches. These pairings enable a more meaningful comparative analysis of blocking effectiveness within similar legal and institutional contexts.

Figure 1 illustrates the cumulative reach of piracy websites as a proportion of the total traffic within the Top 10K sites for Group 1. The data highlights significant variations across studied regions, revealing trends in the accessibility and impact of piracy websites relative to legitimate high-traffic domains. The raw data analysis reveals that Indonesia, which implemented blocking measures, has the lowest mean and median levels of infringement among the three countries in Group 1. Indonesia’s mean and median are 0.0076 and 0.0071, respectively, indicating a significant reduction in copyright infringement compared to Vietnam and Thailand.

Thailand, serving as a control territory with minimal anti-piracy interventions, exhibits the highest mean and median levels of infringement in Group 1. Thailand’s mean and median are 0.0357 and 0.0347, respectively. The higher infringement levels in Thailand highlight the importance of implementing targeted anti-piracy measures to combat online copyright infringement effectively. Without such measures, countries may face significant challenges in reducing piracy activities and protecting the rights of content creators and owners.

In Group 2, Singapore, which implemented blocking measures, demonstrates lower mean and median levels of infringement compared to Malaysia, as shown in Figure 2. Singapore’s mean and median are 0.0247 and 0.0232, respectively, suggesting that its blocking measures have been more effective in reducing copyright infringement than Malaysia’s efforts. Singapore’s success could be attributed to a more targeted approach in blocking infringing sites or a more responsive system for addressing new sources of pirated content. Malaysia, which implemented blocking measures, shows slightly higher mean and median levels of infringement (0.0272 and 0.0256, respectively) compared to Singapore. Interestingly, this is despite Malaysia having a higher frequency and quantity of blocking actions than Singapore.

The Philippines, serving as a control territory with minimal anti-piracy interventions, exhibits mean and median levels of infringement (0.0255 and 0.0235) that are higher than Singapore’s but lower than Malaysia’s. This underscores the complexity of the issue and suggests that while anti-piracy measures can be effective, their impact may vary based on a wide range of factors specific to each jurisdiction.

Figure 3 compares the normalised levels of infringement across Indonesia, Vietnam, and Thailand, highlighting the effectiveness of anti-piracy measures. Indonesia achieved the lowest levels of infringement, with normalized mean and median values of 0.217 and 0.213 respectively, due to proactive and consistent website blocking efforts, while Vietnam showed moderate reductions in infringement but faced challenges in maintaining a robust blocking strategy, as evidenced by its higher normalized values of 0.866 and 0.838.

Figure 4 compares the effectiveness of website blocking measures among Singapore, Malaysia, and the Philippines, highlighting their varying impacts on reducing online piracy. Singapore demonstrates slightly greater success than Malaysia in lowering infringement levels, while the Philippines, serving as a control territory with minimal anti-piracy interventions, shows the highest levels of piracy, underscoring the necessity of proactive measures.

3.1.1. Indonesia (Administrative Model—High Effectiveness)

Indonesia’s administrative-based approach, characterized by rapid implementation and streamlined processes, achieved the most significant reductions in piracy traffic. The study revealed a 58.8% reduction in piracy traffic during the study period, with traffic declining steadily after each blocking event. Key factors contributing to Indonesia’s success include:

• Speed of Implementation: Blocking orders were executed within 24 h, minimizing the window for users to access infringing content.
• Continuous Monitoring: The government agency Kominfo conducted regular surveillance of piracy websites, promptly identifying and blocking new domains.
• Collaboration with ISPs: Strong partnerships between the government, ISPs, and rights holders ensured seamless execution of blocking measures.

While Indonesia’s approach demonstrated clear effectiveness, concerns about the lack of judicial oversight were noted. The absence of formal review processes raised the potential for overblocking, with anecdotal reports of legitimate websites being mistakenly targeted.

3.1.2. Vietnam (Administrative Model—Moderate Effectiveness)

Vietnam’s administrative framework also facilitated relatively swift blocking actions, but its impact was less pronounced than Indonesia’s. Piracy traffic declined by 49.6% during the study period, with noticeable fluctuations in effectiveness. Contributing factors to this moderate success include:

• Resource Constraints: Vietnam’s enforcement agencies faced limited budgets and personnel, hindering their capacity to monitor and block infringing sites comprehensively.
• Inconsistent Enforcement: Periodic lapses in blocking activity allowed piracy websites to regain traffic, undermining the long-term effectiveness of interventions.
• User Adaptation: The study observed higher instances of displacement effects in Vietnam, where users shifted to alternative unblocked piracy sites.

Vietnam’s experience highlights the importance of sustained enforcement and adequate resourcing in maximizing the impact of blocking measures

3.1.3. Malaysia (Judicial-Administrative Model—Mixed Results)

Malaysia adopted a hybrid approach, combining judicial oversight with administrative execution. While this framework ensured procedural fairness, it introduced delays that limited the efficacy of blocking measures. During the study period, piracy traffic in Malaysia declined by 53.6%, but this reduction was uneven and plateaued over time. Key observations include:

• Longer Implementation Timelines: Blocking orders took an average of 48–96 h to execute, providing users with sufficient time to shift to unblocked domains.
• High Blocking Volume: Malaysia blocked 410 sites across 14 events, demonstrating significant enforcement activity. However, the effectiveness of these efforts was undermined by a lack of dynamic follow-up to address new infringing sites.
• Procedural Safeguards: Judicial review processes minimized overblocking but added bureaucratic hurdles, limiting the agility of enforcement actions.

Malaysia’s findings suggest that balancing procedural fairness with enforcement efficiency is critical to achieving sustained reductions in piracy traffic.

3.1.4. Singapore (Judicial Model—Low Effectiveness)

Singapore’s judiciary-led blocking framework emphasized due process and legal rigor but achieved minimal practical impact. Piracy traffic declined by only 9.5% during the study period, with some blocked sites regaining traffic within weeks. This figure refers to the aggregate reduction in piracy traffic across all identified infringing websites, rather than the drop in traffic to individual sites following blocking orders. Key factors limiting Singapore’s effectiveness include:

• Prolonged Legal Processes: Obtaining a blocking order involved extensive documentation, multiple notifications, and judicial hearings, often taking several months to complete.
• Low Blocking Frequency: Singapore executed only four major blocking events, targeting 243 sites. This low frequency allowed piracy networks to adapt and evolve.
• Lack of Real-Time Monitoring: The absence of proactive surveillance mechanisms limited Singapore’s ability to address emerging piracy threats.

While Singapore’s framework provided robust legal safeguards, its rigidity and slow execution hindered its ability to disrupt piracy networks effectively. The spike observed in Singapore’s data in April 2022 coincides with the lifting of pandemic-related social restrictions, which caused a temporary surge in digital media consumption—including access to infringing content. This context helps explain the short-term anomaly observed in Figure 2 and Figure 4.

3.2. Overall Effectiveness of Website Blocking Measures

The study’s empirical analysis revealed significant variability in the overall effectiveness of website blocking across jurisdictions. Three key dimensions were examined, as described below, and summarised in

Table 1. Summary of website blocking characteristics, enforcement approaches, and effectiveness across four Southeast Asian jurisdictions. The table presents key operational metrics—including implementation timelines, enforcement models, blocking volume, and observed impacts—to enable comparative analysis of policy effectiveness and outcomes.

Country	Model	Average Implementation Time	Sites Blocked	Traffic Reduction to Blocked Sites	Overall Piracy Reduction
Indonesia	Administrative	<24 h	520	72%	58.8%
Vietnam	Administrative	2–5 days	380	55%	49.6%
Malaysia	Judicial–Administrative	48–96 h	410	60%	53.6%
Singapore	Judicial	Several months	243	38%	9.5%

. It is important to distinguish between two related but distinct metrics used in this study: (1) the traffic reduction to individual blocked sites, which measures the immediate effect of enforcement on targeted domains, and (2) the aggregate reduction in piracy levels, which captures the overall change in piracy traffic across all infringing sites. Both measures are reported below, and together they provide a comprehensive picture of blocking effectiveness.

3.2.1. Traffic Reduction to Blocked Sites

Blocked websites experienced significant declines in traffic immediately following enforcement actions. Indonesia demonstrated the most substantial impact, with traffic to blocked sites decreasing by 72% on average within the first month of blocking. Vietnam and Malaysia achieved declines of 55% and 60%, respectively, while Singapore reported a more modest decline of 38%.

The analysis also identified a correlation between blocking speed and traffic reduction. Jurisdictions with faster implementation timelines (Indonesia and Malaysia) observed more pronounced traffic declines, emphasizing the importance of agility in enforcement.

3.2.2. Overall Reduction in Piracy Levels

While blocking individual sites reduced their traffic, the study also examined aggregate piracy levels across all infringing sites. Indonesia achieved the most substantial overall reduction, with piracy traffic declining by 58.8%, followed by Malaysia (53.6%) and Vietnam (49.6%). Singapore’s aggregate reduction was limited to 9.5%, reflecting the challenges posed by its procedural delays and low blocking frequency.

The findings underscore the displacement effect, where users migrate to unblocked piracy sites. This phenomenon was most pronounced in Vietnam and Singapore, highlighting the need for comprehensive enforcement strategies that target entire piracy ecosystems rather than isolated domains.

3.2.3. Sustained Impact over Time

The sustainability of blocking measures emerged as a critical factor. Indonesia’s proactive updates to its blocking list enabled it to maintain a downward trajectory in piracy traffic throughout the study period. In contrast, Malaysia and Vietnam observed plateauing reductions, as enforcement failed to keep pace with the emergence of new piracy sites. Singapore experienced a reversal in some cases, with traffic to certain blocked sites recovering due to prolonged delays in enforcement.

The analysis revealed that sustained impact depends on three key elements:

• Dynamic Monitoring: Regular surveillance to identify and block new infringing sites.
• Rapid Response Mechanisms: Minimizing delays between identifying infringing content and executing blocks.
• Comprehensive Ecosystem Targeting: Addressing not only websites but also supporting infrastructure, such as hosting services and payment gateways.

3.2.4. Displacement Effects and Adaptive User Behavior

Displacement effects, where users adapt to blocking measures by seeking alternative sources of infringing content, were observed across all jurisdictions. These effects were most prominent in Vietnam and Malaysia, where partial enforcement allowed piracy networks to regroup and redirect traffic. Key observations include:

• Domain Hopping: Blocked piracy websites frequently shifted to new domains, evading enforcement efforts. Indonesia’s monitoring system was most effective in addressing this tactic, while Vietnam struggled to keep pace.
• Use of Proxies and VPNs: A growing number of users employed circumvention tools to access blocked sites. This trend highlights the limitations of static blocking measures and the need for technological countermeasures.
• Emergence of Alternative Platforms: In some cases, blocking established piracy websites led to the rapid rise of alternative platforms, creating a “whack-a-mole” dynamic.

The study highlights the importance of integrating website blocking with complementary strategies, such as public awareness campaigns and the promotion of affordable legal content alternatives, to reduce user reliance on piracy

3.2.5. Legal Content Consumption as a Secondary Outcome

An important secondary outcome of website blocking is its potential to redirect users toward legitimate content platforms. The study observed modest increases in legal content consumption in Indonesia and Malaysia, where blocking measures were most effective. For example:

• Indonesia reported a 15% increase in traffic to legal OTT platforms during the study period.
• Malaysia observed a smaller but significant 8% increase, primarily driven by public awareness campaigns.

However, Vietnam and Singapore reported negligible changes in legal traffic, suggesting that blocking alone is insufficient to drive users toward legal alternatives. These findings underscore the need for integrated strategies that combine enforcement with the promotion of legitimate content

3.2.6. Lessons for Cybersecurity Integration

The findings demonstrate the potential for website blocking to serve as a broader cybersecurity control. By disrupting access to malicious domains, the principles of website blocking can be applied to combat threats such as phishing, malware distribution, and ransomware. Key lessons include:

• Real-Time Monitoring: AI-driven surveillance tools can enhance blocking effectiveness by identifying threats as they emerge.
• Stakeholder Collaboration: Coordinated efforts between ISPs, rights holders, and cybersecurity agencies are essential for addressing cross-border threats.
• Dynamic Enforcement: Adopting adaptive strategies can improve resilience against evolving tactics.

3.3. Regression Modeling

To further investigate the relationship between the reach of legitimate websites and piracy sites, regression modeling was used. By focusing on data from April 2020 to April 2022, the regression analysis provides a comprehensive assessment of how reducing piracy levels influences legitimate internet traffic in Indonesia, Vietnam, Malaysia, and Singapore.

The datasets for each country were filtered to include records spanning from April 2020 to April 2022. Relevant columns extracted included:

• Cumulative Piracy Sites’ Reach: The total reach of all identified piracy websites.
• Cumulative Legal Reach: The total reach of identified legitimate content websites.
• Top 10k Cumulative Reach: The total reach of the top 10,000 websites in each country.

To account for variations in overall internet usage between countries, the piracy sites’ reach and legal reach were adjusted as proportions of the Top 10k Cumulative Reach. These adjustments were calculated as follows:

• Adjusted Piracy Reach = Cumulative Piracy Sites’ Reach/Top 10k Cumulative Reach
• Adjusted Legal Reach = Cumulative Legal Reach/Top 10k Cumulative Reach

This normalization ensured that differences in internet traffic volumes across countries did not skew the analysis. For instance, countries with larger internet-using populations might naturally exhibit higher raw numbers for both piracy and legal reach. By expressing these metrics as proportions of the overall top 10k reach, meaningful comparisons could be made between countries with varying levels of internet usage. This approach allowed for the analysis of the relative prevalence of piracy and legal content consumption within each country’s internet ecosystem, avoiding distortions from raw numbers influenced by population size or internet penetration rates.

A linear regression model was employed to examine the association between the cumulative reach of piracy sites and the cumulative reach of legal content websites. The model is defined as follows:

Cumulative Legal Reach = β₀ + β₁ (Cumulative Piracy Sites Reach) + ϵ

where

• β₀ represents the intercept, indicating the expected value of the cumulative legal reach when the cumulative piracy sites’ reach is zero
• β₁ denotes the coefficient that quantifies the change in the cumulative legal reach associated with a one-unit change in the cumulative piracy sites’ reach
• ϵ is the error term, accounting for the variation in the cumulative legal reach that is not explained by the cumulative piracy sites’ reach

The regression analysis for Indonesia revealed β₁ = −2.3862, β₀ = 3.5395, with R² = 0.318, p < 0.001. The R² of 0.318 implies that 31.8% of the variance in legal reach can be explained by the piracy reach. This indicates a significant explanatory power of the model, suggesting that while piracy reach is an important factor influencing legal reach, other variables not included in the model also play a significant role.

The regression model results indicate that while targeting piracy sites may have some effect on driving traffic toward legitimate content, policymakers must also focus on additional strategies, such as improving accessibility, affordability, and awareness of legal content options, to effectively enhance legal content consumption. This highlights the importance of a multifaceted approach to combating online piracy and promoting legitimate alternatives.

One limitation of static website blocking is its susceptibility to circumvention via VPNs and proxies. While our dataset did not directly track VPN traffic, domain migration trends suggest that piracy networks adapt rapidly to blocking orders. Indonesia’s frequent enforcement updates minimized circumvention, whereas judicially delayed actions in Singapore and Malaysia allowed piracy websites to resurface before enforcement could take effect.

4. Discussion

The findings of this study provide a detailed understanding of the effectiveness of website blocking as a tool to combat online piracy and its broader integration into cybersecurity strategies. By analyzing the outcomes of blocking measures in Indonesia, Vietnam, Malaysia, and Singapore, this discussion explores the implications for legal frameworks, enforcement practices, adaptive piracy behaviors, and the role of website blocking within the broader digital ecosystem.

The study highlights the critical influence of legal frameworks on the success of website blocking measures. Jurisdictions with streamlined administrative processes, such as Indonesia, achieved greater reductions in piracy traffic compared to those with judicially intensive procedures, such as Singapore. This finding underscores the importance of agility and procedural efficiency in addressing the dynamic nature of online piracy.

Indonesia’s administrative framework demonstrated the strongest results, with rapid implementation timelines and continuous updates to the list of blocked sites. By empowering the Ministry of Communication and Informatics (Kominfo) to issue blocking orders without requiring judicial approval, Indonesia ensured that enforcement actions could keep pace with the rapidly evolving piracy landscape. This approach aligns with the principles of Situational Crime Prevention (SCP), as it increases the effort required for users to access infringing content while reducing its attractiveness.

Vietnam, while also employing an administrative model, experienced less success due to inconsistent enforcement and resource limitations. The lack of comprehensive monitoring and follow-up actions allowed piracy networks to exploit gaps in enforcement, leading to higher levels of displacement effects. These findings suggest that administrative frameworks, while effective in theory, require adequate resourcing and coordination to deliver sustained results.

Malaysia and Singapore represent judicially intensive models, characterized by formal legal procedures and extensive safeguards against overblocking. While these frameworks provide robust protections for legitimate websites and uphold principles of due process, they introduce delays that undermine the effectiveness of blocking measures. In Malaysia, the average time to implement a blocking order ranged from 48 to 96 h, while in Singapore, it extended to several months.

These delays allowed piracy websites to adapt, often migrating to new domains before enforcement actions could take effect. Singapore’s particularly low impact (9.5% reduction in piracy traffic) illustrates the limitations of judicially intensive frameworks in addressing time-sensitive challenges like online piracy. This raises important questions about the trade-offs between procedural rigor and enforcement efficiency, particularly in contexts where speed is critical.

While administrative models clearly outperform judicial frameworks in terms of speed and impact, they are not without risks. The potential for overblocking and abuse of authority must be carefully managed through oversight mechanisms and transparency. A hybrid approach that combines the agility of administrative models with the safeguards of judicial frameworks may offer a more balanced solution, ensuring both effectiveness and accountability.

One of the most significant challenges to the effectiveness of website blocking is the adaptive behavior of both piracy operators and users. The study identified several strategies employed by piracy networks to evade blocking measures, as well as patterns of displacement among users seeking alternative sources of infringing content.

Piracy operators frequently employed domain hopping (Cory 2020), shifting their websites to new domains to bypass blocking orders. This tactic was particularly evident in Vietnam and Malaysia, where enforcement agencies struggled to keep up with the rapid emergence of new infringing sites. Indonesia’s continuous monitoring and proactive updates to its blocking list proved more effective in addressing this challenge, but even in this case, domain hopping remained a persistent issue.

The use of proxy servers and virtual private networks (VPNs) further complicated enforcement efforts. These tools allow users to bypass geographic restrictions and access blocked websites, undermining the effectiveness of traditional blocking measures. The increasing prevalence of these tools highlights the need for more sophisticated technological solutions, such as real-time monitoring and automated enforcement.

Future enforcement strategies could benefit from AI-driven, federated learning models that allow ISPs and policymakers to collaborate on piracy detection without centralizing sensitive enforcement data. Such models, which have proven effective in fraud detection and malware blocking, could enhance dynamic response mechanisms against rapidly shifting piracy domains.

The displacement effect, where users migrate to unblocked piracy websites or alternative platforms, was observed across all jurisdictions. In Vietnam and Malaysia, this effect was particularly pronounced, with traffic to lesser-known piracy sites increasing following the blocking of major platforms. This dynamic creates a “whack-a-mole” problem, where enforcement efforts are constantly outpaced by the adaptability of piracy networks.

To counteract these challenges, policymakers and enforcement agencies must adopt more comprehensive and dynamic strategies. These include:

• Real-Time Detection: Leveraging AI-driven tools to identify and block new infringing sites as they emerge.
• Targeting Infrastructure: Disrupting the hosting services, payment systems, and advertising networks that support piracy operations.
• International Collaboration: Coordinating cross-border enforcement efforts to address the global nature of online piracy

An important secondary objective of website blocking is its potential to redirect users toward legitimate content platforms. The study found modest increases in legal content consumption in Indonesia and Malaysia, suggesting that blocking measures, when implemented effectively, can create opportunities for legitimate platforms to capture displaced users. However, this outcome was not universal, with Vietnam and Singapore reporting negligible changes in legal traffic.

Several factors influence the extent to which users transition from piracy to legitimate content:

• Affordability: High subscription fees for legal platforms can deter users, particularly in low-income regions.
• Accessibility: Limited availability of local-language content and region-specific offerings reduces the appeal of legitimate platforms.
• User Habits: Longstanding reliance on piracy can create behavioral inertia, making users less likely to adopt legal alternatives

To maximize the impact of website blocking, it must be complemented by initiatives that enhance the attractiveness of legal content:

• Affordable Pricing Models: Implementing tiered pricing or ad-supported options to cater to diverse user segments.
• Content Localization: Expanding the availability of local-language content and culturally relevant programming.
• Public Awareness Campaigns: Educating users about the benefits of legal platforms and the risks associated with piracy.

These strategies align with broader efforts to foster a culture of respect for intellectual property rights, reducing the demand for infringing content.

Beyond its role as an anti-piracy tool, website blocking has broader applications within the cybersecurity ecosystem. The principles underlying blocking measures—restricting access to harmful or unauthorized content—are equally relevant to combating other digital threats, such as phishing, malware distribution, and ransomware attacks.

Website blocking can serve as a critical component of the incident response lifecycle, particularly in the containment phase. By quickly isolating malicious domains, blocking measures can limit the spread of cyberattacks and mitigate their impact. For example, blocking command-and-control servers used in ransomware operations can disrupt the attacker’s ability to coordinate and execute their campaigns.

Integrating website blocking with advanced cybersecurity technologies can enhance its effectiveness. Potential applications include:

• AI-Driven Monitoring: Using machine learning algorithms to detect emerging threats in real-time and automate blocking actions.
• Threat Intelligence Sharing: Collaborating with cybersecurity vendors and government agencies to identify and neutralize high-risk domains.
• Dynamic Filtering: Adopting adaptive filtering systems that adjust blocking parameters based on evolving threat patterns

The findings of this study offer several actionable recommendations for policymakers, rights holders, and enforcement agencies seeking to enhance the effectiveness of website blocking measures:

• Streamline Legal Frameworks: Simplify procedural requirements to enable faster and more agile enforcement, while maintaining safeguards to prevent overblocking.
• Invest in Technology: Leverage AI, machine learning, and automation to improve the speed and accuracy of blocking measures.
• Adopt a Holistic Approach: Combine enforcement actions with efforts to reduce the demand for piracy through education, outreach, and the promotion of affordable legal content.
• Foster International Cooperation: Establish cross-border partnerships to address the global nature of online piracy and share best practices in enforcement.

Our findings also suggest the potential value of hybrid enforcement models that combine the agility of administrative decision-making with the procedural safeguards of judicial oversight. Such an approach could involve streamlined administrative blocking orders that are subject to post hoc judicial review, thereby balancing speed with accountability. Looking forward, the integration of AI-driven detection and federated-learning models could further enhance enforcement efficacy. These technologies can support real-time identification of new piracy domains, automate response actions, and facilitate cross-border information-sharing without compromising data privacy. Exploring these possibilities represents a promising avenue for future research.

Our findings speak directly to long-standing debates within the literature on the so-called ‘whack-a-mole’ problem in online piracy enforcement. Scholars have argued that the inherently adaptive nature of piracy ecosystems renders conventional enforcement largely symbolic, with infringing sites quickly reappearing elsewhere after takedowns or blocks (Bakioǧlu 2016; Cory 2020; Ververis et al. 2024). Our results both support and refine this conventional wisdom. While displacement effects and domain hopping remain significant challenges, we demonstrate that under certain institutional conditions—particularly where blocking orders are implemented swiftly and updated regularly—enforcement measures can achieve sustained reductions in piracy traffic. This suggests that the perceived inevitability of the ‘whack-a-mole’ cycle is not absolute: its impact can be mitigated by proactive, adaptive, and technologically enabled strategies.

5. Conclusions

This study has shown—for the first time—that swift, systematic website blocking—exemplified by Indonesia—serves as an effective cybersecurity control, significantly reducing access to infringing content while redirecting traffic toward legitimate platforms. However, the study has a number of methodological limitations which must be acknowledged. While the study leverages comprehensive datasets, certain limitations exist:

• Alexa’s data relies on a rolling three-month average, potentially introducing delays in detecting traffic shifts.
• Zvelo’s categorization may not capture all infringing sites, particularly emerging domains not yet indexed

Also, Southeast Asia’s diverse legal and technological landscapes pose challenges for standardizing metrics and comparisons. For instance:

• Differences in internet penetration rates influence traffic volumes.
• Cultural attitudes toward piracy vary significantly across jurisdictions

Conventional wisdom is that “whack-a-mole” doesn’t work because you can never respond fast enough to whack new moles that emerge while one’s attention is given to whacking existing moles. However, in colloquial terms, we have shown that under the right set of conditions, suppression of moles by “whacking” is possible, and sustainable. Further research is required to determine how the specific conditions that arose during the unique conditions of this study could lead to a broader understanding of how to optimize incident response and get ahead of the risks posed by “zero day” attacks.

This study demonstrates that under the right conditions, website blocking can serve as an effective cybersecurity measure. While Indonesia’s rapid enforcement model showed sustained piracy reductions, judicial delays in Singapore limited effectiveness. Future research should explore AI-driven detection models and federated learning techniques to enhance enforcement while addressing circumvention challenges. In doing so, this research contributes to and extends existing scholarship on the limitations of blocking, demonstrating that the entrenched ‘whack-a-mole’ dynamic is not immutable but can be weakened by agile enforcement models and adaptive technological interventions.