Just in Plain Sight: Unveiling CSAM Distribution Campaigns on the Clear Web

2025-11-05

AI Summary

This study presents the first systematic empirical investigation of the large-scale dissemination ecosystem of Child Sexual Abuse Material (CSAM) on the clearweb. Addressing the longstanding research bias toward the dark web and consequent neglect of clearweb risks, we deploy a multi-source web crawler, bot account detection, social behavior modeling, and cross-platform traffic tracking to conduct large-scale data collection and relational analysis across publicly accessible web pages. Our analysis identifies at least 1,026 active CSAM-distributing webpages linked to 738,286 registered users, fully mapping content distribution pathways, platform abuse mechanisms—including coordinated bot-driven dissemination on social media—and user interaction dynamics. The core contribution is a paradigm shift in research scope: we establish the first empirically grounded framework characterizing CSAM propagation organizational patterns and user network structures on the clearweb. This provides critical data infrastructure and methodological foundations for platform governance, content moderation, and law enforcement response.

Technology Category

• Application Domains: Humanities & Computational Social Science
• Data Mining & Knowledge Management: Web
• Search and Optimization: Distributed Search

Application Category

• Web Mining and Content Analysis: Web data visualization
• Responsible Web: Measurement, analysis, and circumvention of Web censorship
• Security and Privacy: Data transparency and provenance

Abstract

Child sexual abuse is among the most hideous crimes, yet, after the COVID-19 pandemic, there is a huge surge in the distribution of child sexual abuse material (CSAM). Traditionally, the exchange of such material is performed on the dark web, as it provides many privacy guarantees that facilitate illicit trades. However, the introduction of end-to-end encryption platforms has brought it to the deep web. In this work, we report our findings for a campaign of spreading child sexual abuse material on the clear web. The campaign utilized at least 1,026 web pages for at least 738,286 registered users. Our analysis details the operation of such a campaign, showcasing how social networks are abused and the role of bots, but also the bypasses that are used. Going a step further and exploiting operational faults in the campaign, we gain insight into the demand for such content, as well as the dynamics of the user network that supports it.

Problem

• Investigating CSAM distribution campaigns on the clear web platforms
• Analyzing how social networks and bots facilitate illicit content sharing
• Understanding user network dynamics and demand for abusive material

Innovation

• Analyzed clear web CSAM distribution campaigns
• Identified social network abuse and bot roles
• Exploited operational faults to study user dynamics