Case study: Viral marketing sites

Viral marketing ‘Invite’ scheme used to spread child sexual abuse

People are being lured into seeing some of the worst types of sexual abuse happening to the youngest children through the use of a viral marketing technique.

In July 2022, we identified a new way in which child sexual abuse material was being distributed online. This method uses viral marketing techniques, similar to that of a pyramid scheme, where people are incentivised to share links to child sexual abuse sites far and wide in a 'scattergun' approach. Those people are then ‘rewarded’ when others click on the links and ultimately download or watch the criminal material. In the process, more people are ‘recruited’ to share the links and encourage new viewers to click and watch.  

We call these sorts of child sexual abuse websites “invite child abuse pyramid” sites, or ICAP sites for short. 

This technique has continued into 2023. Since then, we’ve provided training and briefing sessions to partners who are able to help support the disruption of these types of criminal enterprises which put children and ordinary people at risk.  

As the UK’s only body to report child sexual abuse material to, our reporting service has been heavily used during 2023 to report these kinds of sites. Stumbling upon child sexual abuse material is a shocking and frightening occurrence for many people.  

Nearly all our reports of ICAP sites (and sites which contain links to ICAP sites) originate from the public who have stumbled across them, as opposed to us proactively finding them.  

ICAP sites often contain videos of babies, toddlers and young children up to six years old. They also almost always contain category A content, the most severe category in UK law.  

This means people are unsuspectingly seeing very young children being penetrated, involved in sexual activities with animals or being tortured for someone’s sexual pleasure. 

Here we take a deeper look at what is going on. 

 

 

Background

In 2023, we saw a rise in non-commercial websites being used as a gateway to commercially-dedicated child sexual abuse material (CSAM). For example text stores, chat sites, image boards, multiple social media platforms, blogs, forums, video channels, websites and even cyberlockers (file downloads) have been found to contain an ICAP link. 

We define non-commercial websites as websites that offer free hosting services. In other words, the site was free to create; the person(s) who set the site up, or the person who is adding posts and threads on the site, did not pay for web hosting. However, the lines between non-commercial and commercial often become blurred, as very likely payment will be required at some point to view child sexual abuse material.   

Invite Child Abuse Pyramid (ICAP) sites are commercial websites. They are dedicated to advertising and selling child sexual abuse material. A user can contact the seller via a very well-known end-to-end encrypted messaging service to purchase access. Additionally, numerous invite links can be posted online, usually in innocuous places such as popular social media platforms. The invite links are often re-posted onto the page several times. The user clicks the link which loads a page containing a preview video of a child being sexually abused. The user can register and see more preview videos like this but is also encouraged to spam invite links onto popular social media platforms. The more widespread the invite links are, the greater the original poster is rewarded, enabling them to gain access to further videos featuring child sexual abuse. It is essentially a pyramid scheme, but this one where the ‘commodity’ is imagery showing the sexual abuse of children.  

These types of links are remarkable because they are frequently posted in online spaces that are predominantly non-commercial. An example of this is when these ICAP links appear on social media platforms or in live chatrooms, where the main purpose is to connect people and allow for conversations. 

We are monitoring a general increase in links to websites selling child sexual abuse material being posted in these general, non-commercial spaces. 

ICAP links tend to be fleeting – they appear and often come down quicky – but they are fast spreading. These links have become a prolific source for distributing this criminal content and, disturbingly, they are being posted in highly public places online. This means that the public is vulnerable to being exposed to child sexual abuse material. 

 

 

Data Collection

Given that reports of webpages containing ICAP links were frequently occurring, we decided to carry out a snapshot study to examine this problem. Over a 5-day period, every report sent to the IWF was checked to identify whether an ICAP link could be found on that reported page. This included hyperlinks, text links, broken links, and redirectors (redirectors automatically redirect to a website without having to click on the page at all). Below is some of the key data recorded: 

  • Processed date (the date that we assessed the report)
  • Site type
  • The number of ICAP links found on the page
  • Report origin (public / proactively found by IWF analysts)
  • Hosting country (where in the world the website is hosted) 
  • Whether the ICAP links were still live (publicly available) at the time of assessment 

 

Results

Number of reported webpages containing an ICAP link, over the course of five days

  • 44 reports were identified to contain at least one ICAP link on the sites that were reported. 
  • 171 ICAP links were found on those reported pages in total.  

Below is a chart and a graph outlining how many reports were processed where the reported page contained an ICAP link and additionally how many ICAP links were found each day. It is important to note that if the ICAP link was duplicated on the page, which they often are, it was not counted again. Therefore, the number of ICAP links posted is much greater. 

Processed date 

Reports where ICAP links were identified  

Unique links to ICAP sites on page 

Day 1 Fri 

14 

53 

Day 2 Mon 

4 

10 

Day 3 Tue 

6 

7 

Day 4 Wed 

7 

48 

Day 5 Thurs 

13 

53 

Grand Total 

44 

171 

 

Correlation between reports and ICAP links

Rotate your device

  • 41 of the 44 reports came from the public. 

Only three reports were proactively sourced by IWF analysts.  

In IWF, our analysts proactively identify most child sexual abuse material we assess, as opposed to the public. However, the opposite is true when it comes to ICAP sites, meaning most are reported to us from the general public, after someone has been exposed to this criminal material.

 

 

Where the ICAP links were posted

At IWF we record, on quite a granular level, the ‘type’ of site where child sexual abuse is found. The most frequent site type where an ICAP link was found was an ordinary website (as opposed to a forum, social media page, or chat site for example). These were all on the same website domain, e.g., www.badsite.com. This particular website operates a free service where users can create their own website. The user chooses a website name which always retains the domain name of the parent website in the URL e.g., www.badsite.mypage.com. This space can then be used to post comments and links. Clearly this website has become a popular place to post ICAP links. 

Type of websites where ICAP links were found to be posted

This table shows the number of reports received, and number of unique links to ICAP sites by site type: 

Site Type 

Number of Reports 

How many unique links to ICAP sites  

Blog 

2 

31 

Chat 

6 

48 

Cyberlocker (file download) 

1 

1 

Forum 

2 

2 

Image host 

1 

1 

Redirector 

4 

4 

Text store 

1 

1 

Video channel 

1 

1 

Website 

26 

82 

Grand Total 

44 

171 

 

Live study

We carried out a search in Google, by typing in the name of one of the ICAP sites which had been actioned by IWF analysts. It returned several results. The top result was a publicly accessible account on a well-known social media platform. Clicking on it led to an innocuous-looking video of a young girl playing on loop. She was jumping into a swimming pool whilst on holiday. However, the posts on the account told a very different story.  

Key information: 

  • 23 unique ICAP links had been posted onto the account (there were duplicate links which were not double-counted in the study). Five of them were live at the time of checking.  
  • The account had received 43,434 likes. 
  • 212 different usernames on this social media account were found. 
  • 9 different languages were identified across the posts, these included: Chinese, Spanish, Ukrainian, Japanese, English, Malay, Portuguese, Italian and Russian. This highlights the global scale of the problem. 

Comments
There was six weeks’ worth of chat on the page and only four comments expressed negativity towards the content matter. It is the view of the Hotline team who worked on this study that the purpose of the social media page was to bring together people who shared a sexual interest in children in order to share multiple links to ICAP sites. This appears to be a distribution technique to encourage people to find and purchase child sexual abuse imagery from elsewhere on the internet. All the links to ICAP sites which were shared on this social media page were just posted as plain text, not as hyperlinks. These may have spaces between the words in order to evade detection and removal of the links. 

Emojis
Interestingly, most of the communication was carried out using emojis. Lots of derivatives of the love heart, amazed faces, smiley faces, the fire symbol, clapping hands, hands up, stars, crowns, and trophies were identified, indicating contentment and triumph. In addition, other emojis were used in a more salacious manner – bananas, aubergines and sweat droplets which related to the penis and ejaculate in this context.  

 

Number of live ICAP links

Out of the 171 ICAP links, 65 were live at the point of checking the page. 

The highest amount of unique ICAP links that were live at the time of checking were as follows:  

  • 32 links and 16 (50%) of them were live.  
  • 29 links and 7 (24%) of them were live. 
  • 13 links and 5 (38%) of them were live.  
  • 13 links and 5 (38%) of them were live.  
  • 6 links and 4 (67%) of them were live. 

The remaining 18 reported pages containing at least one live ICAP link had 1 or 2 links left on the page. 

Despite the speed at which ICAP links come down after being posted, for 65 ICAP site links to remain live is a significant number. Each one is offering child sexual abuse material. These sites, and links, multiply fast and increase the risk of ordinary members of the public in stumbling upon them.  

The graph outlines how many ICAP links were found on each day of the data collection and how many were live or offline at the time of checking the page: 

 

ICAP links found each day and how many were live 

Rotate your device

 

Conclusion

In summary: 

  • ICAP links are widespread and fast-spreading. They are being posted across a variety of platforms.  
  • Worryingly, people are stumbling on webpages that contain ICAP links in innocent places, leaving them in greater danger of exposure to child sexual abuse material. 
  • The data collection showed nine different types of sites were used to spread ICAP links over this particular five-day period. The live study identified an additional site type where ICAP links were posted; a social media platform with a publicly-accessible account where numerous ICAP links were being shared.  
  • The live study showed that people all over the world were either posting the ICAP links or clicking on the ICAP links; nine different languages were identified on the account, illustrating the global scale of this problem.  
  • All reported pages where at least one ICAP link was found were on typically non-commercial websites reiterating that non-commercial websites are being used as a pathway to commercial dedicated child sexual abuse material. 
  • Since first discovering this type of viral marketing technique to distribute and profit from child sexual abuse material, IWF has provided training and briefing sessions to partners who are able to help support the disruption of these types of criminal enterprises which put children and ordinary people at risk.