# Korean Escort Directory Network — Infrastructure Analysis

**Date:** 2026-03-04
**Platform:** "유흥어때" (Yuhung Eottae / "How's the Entertainment")
**Current active domain:** uhere.net

---

## Network Overview

sarmenb.com was one alias domain in a large domain rotation network operating a Korean illegal sex industry directory. The network uses numbered domains, numbered Telegram accounts, and Cloudflare protection to evade takedowns.

---

## All Known Domains

| # | Domain | Status | First Cert | Last Cert | Registrar |
|---|--------|--------|-----------|-----------|-----------|
| - | sarmenb.com | EXPIRED (pendingDelete) | Jul 2018 | Jan 2026 | Namecheap |
| 1 | yhotte01.com | NXDOMAIN | Nov 2024 | Nov 2024 | Namecheap |
| 2 | yhotte02.com | NXDOMAIN | Nov 2024 | Nov 2024 | Namecheap |
| 3 | yhotte03.com | NXDOMAIN | Dec 2024 | Mar 2026 | Namecheap |
| 4 | yhotte04.com | NXDOMAIN | Dec 2024 | Mar 2026 | Namecheap |
| 5 | yhotte05.com | PARKED | Feb 2025 | Feb 2026 | Namecheap |
| 6 | yhotte06.com | PARKED | Feb 2025 | Feb 2026 | Namecheap |
| 7 | yhotte07.com | PARKED | Feb 2025 | Feb 2026 | Namecheap |
| 8 | yhotte08.com | PARKED | Feb 2025 | Feb 2026 | Namecheap |
| 9 | yhotte09.com | PARKED | Feb 2025 | Feb 2026 | Namecheap |
| 10 | yhotte10.com | PARKED | Feb 2025 | Feb 2026 | Namecheap |
| - | newstar03.com | NEVER DEPLOYED | none | none | — |
| - | **uhere.net** | **ACTIVE** | Oct 2023 | Feb 2026 | NameSilo |

All yhotte domains registered through Namecheap.
uhere.net registered through NameSilo with PrivacyGuardian.org WHOIS protection.
All active domains protected by Cloudflare (AS13335).

---

## Telegram Infrastructure

### Business Contact Accounts (1:1 DM)

All 10 confirmed to exist as individual Telegram user accounts:

| Handle | Linked From |
|--------|-------------|
| @YHnori_01 | — |
| @YHnori_02 | — |
| @YHnori_03 | sarmenb.com (Jan 2025 capture) |
| @YHnori_04 | sarmenb.com (Feb 2025), yhotte03.com |
| @YHnori_05 | — |
| @YHnori_06 | — |
| @YHnori_07 | — |
| @YHnori_08 | — |
| @YHnori_09 | — |
| @YHnori_10 | — |

Pattern: "YH" = 유흥 (entertainment), "nori" = 놀이 (play/fun)
The numbered handles mirror the numbered domains.

### Regional Group Chat Invite Links

Found in HTML comments of sarmenb.com source code:

| Invite Link | Region |
|-------------|--------|
| https://t.me/+VbhHBCjcLZNlN2Rl | Employment (구인구직) |
| https://t.me/+E5n8Z1idvgc1OTY1 | Seoul (서울) |
| https://t.me/+qRhfX5HptahhYTg1 | Gyeonggi Province (경기도) |
| https://t.me/+aI0-qObXjig2MDNl | Incheon/Bucheon (인천/부천) |
| https://t.me/+4B_tGBh7gSA4Njll | Chungcheong Province (충청도) |
| https://t.me/+sbWdIGgfL9ZiMGQ1 | Jeolla Province (전라도) |
| https://t.me/+rmE7S8AcTCliOWY1 | Gyeongsang Province (경상도) |
| https://t.me/+8PoMjcSL3_g2M2I9 | Jeju Island (제주도) |

---

## yhotte04.com — Operations Hub

yhotte04.com had the most sophisticated infrastructure of all domains, with **61 certificate entries** and **27 subdomains**:

### Subdomains

| Subdomain | Purpose |
|-----------|---------|
| adminth | Admin panel (Thai variant?) |
| kefu | Customer service (Chinese: 客服) |
| b2b | Business-to-business portal |
| bugtracker | Bug tracking system |
| jira | Atlassian JIRA project management |
| job | Recruitment portal |
| devel | Development environment |
| test1 | Testing environment |
| lab | Experimental/lab |
| app01 | Application server |
| blog | Blog |
| web | Web frontend |
| b | Short alias |
| cube | Unknown |
| global | Global version |
| local | Local version |
| mta | Mail Transfer Agent |
| offers | Promotions |
| tr | Tracking or Turkish |
| uksouth | UK South region (cloud?) |
| unifi | UniFi network management |
| xmlfeed | XML data feed export |

Key observations:
- "kefu" (客服) is Chinese for customer service — suggests Chinese backend operations
- "adminth" suggests Thai admin panel — possible Thai operations too
- "uksouth" suggests UK cloud infrastructure (Azure UK South?)
- JIRA + bugtracker = organized development team with formal processes
- devel + test1 + lab = multi-stage development pipeline

---

## Tech Stack

| Component | Detail |
|-----------|--------|
| CMS | Gnuboard 5 (g5) — Korean open-source PHP BBS |
| Theme Framework | Nariya Builder 1.2.16 |
| Theme | BS4-Basic (Bootstrap 4) |
| jQuery | 3.5.1 (VULNERABLE: CVE-2020-11022, CVE-2020-11023) |
| Font | NEXON Gothic, Font Awesome 4 |
| Carousel | Owl Carousel |
| Effects | jsized.snow (snow animation) |
| Protocol | HTTP (no HTTPS enforcement on sarmenb.com) |
| CDN | Cloudflare |
| Registrar | Namecheap (domains), NameSilo (uhere.net) |
| Certs | Let's Encrypt (auto-renewed) |

---

## Traffic Scale

At time of last capture (Feb 14, 2025):

- 186,116 daily visitors
- 242,287 yesterday visitors
- 360,848 peak daily visitors (all time)
- 5,553,382 total visitors (all time)
- 9,658 registered members
- 724 concurrent users online

---

## Content Categories (Database Tables)

Main listing boards:
  op       — Prostitution venues (OP/Room salons)
  masage   — Massage parlor fronts
  tel      — "Rest-tel" motels
  sw       — Swedish massage (euphemism)
  an       — Traditional massage fronts
  kiss     — Kiss rooms
  chj      — Outcall/escort services
  hanp     — Handjob/fetish services
  jib      — Bar/location listings
  qa       — Sex worker recruitment

Review boards:
  op_h, an_h, hu_h, gun_h, sul_h, chj_h, kiss_h, hanp_h

Community boards:
  _noitce, _event, _joining, _warning, _secretstory, _numor, _daily, _attendance

---

## Medium Account

@uherenet on Medium published 4 SEO articles in January 2024 promoting uhere.net.
This confirms uhere.net = same platform as sarmenb.com/yhotte network.

---

## Domain Rotation Pattern

The operator registers domains in batches:
  Batch 1: yhotte01-02 (Nov 2024)
  Batch 2: yhotte03-04 (Dec 2024), sarmenb.com repurposed
  Batch 3: yhotte05-10 (Feb 2025)

As domains get blocked or expire, the operator rotates to the next batch.
The current active domain (uhere.net) has been running since Oct 2023.

---

## Google Identifiers (shared across network)

Google Site Verification: zrAHfwKs71s3RX4P0P3P57hJbc0CxYfq7m3kp385PwQ
  Found on: sarmenb.com AND yhotte03.com
  Proves: Same Google Search Console account controls both domains

This identifier could be used to discover additional domains in the network
if it appears in any other indexed source.