Skip to main content
Skip to main content
PANOPTICON
back

Online Predator Monitoring — Tracking & Response

Tracking categories of online predation, exploitation networks, and trafficking operations — organized by threat risk, regional prevalence, and investigator resources.

8 categories tracked

Child Sexual Exploitation (CSAM) Networks

CRITICAL
Online Predation
Global

Dark-web and encrypted-platform networks involved in the production, distribution, and consumption of child sexual abuse material. Includes Tor hidden-service markets, encrypted messaging groups, and peer-to-peer (P2P) file-sharing rings. Increasing use of cryptocurrency for transactions and AI-generated CSAM.

Indicators
  • · Tor hidden service URLs
  • · End-to-end encrypted channels
  • · Cryptocurrency payment patterns
  • · P2P hash-sharing rings
  • · AI-generated imagery detection
Response Resources
  • · NCMEC CyberTipline
  • · IWF (Internet Watch Foundation)
  • · FBI Innocent Images
  • · Europol EC3
  • · Project VIC

Sextortion Networks

CRITICAL
Financial / Coercive
West AfricaSoutheast AsiaEastern EuropeGlobal

Organized sextortion rings targeting minors and adults through social engineering, compromised accounts, and deepfake content. West Africa (Yahoo Boys), SEA cyberscam centers, and Eastern European groups operate sophisticated pipelines from initial contact to ongoing extortion. Increasingly targeting minors via gaming platforms and social media.

Indicators
  • · Unsolicited friend requests from attractive profiles
  • · Requests to move to WhatsApp/Snapchat
  • · Compromised webcam indications
  • · Threat of image release with screenshots
  • · Demands for cryptocurrency / gift cards
Response Resources
  • · FBI Sextortion Tips
  • · NCMEC Take It Down
  • · StopNCII.org
  • · FBI IC3 Sextortion PSA
  • · Thorn — Safer.io

Human Trafficking — Online Recruitment

CRITICAL
Labor / Sex Trafficking
Southeast AsiaLatin AmericaSub-Saharan AfricaEastern EuropeMiddle East

Trafficking networks using online platforms for recruitment, advertisement, and logistics. Includes cyberscam-center trafficking (SEA golden triangle), forced criminality via social media job ads, and online commercial sex advertising platforms. Cryptocurrency and encrypted messaging used for logistics and payment.

Indicators
  • · Fake job ads on social media
  • · Models / entertainers wanted posts
  • · Hotel booking patterns
  • · Coded language on adult advertising sites
  • · Forced criminality task channels
Response Resources
  • · Polaris Project
  • · UNODC Human Trafficking
  • · Global Slavery Index (Walk Free)
  • · ECPAT
  • · IJM (International Justice Mission)

Live-Streaming Exploitation Enterprises

CRITICAL
Commercial Exploitation
Southeast AsiaSouth AsiaLatin AmericaEastern Europe

Commercial live-streaming operations producing CSAM and exploitation content for paying viewers on encrypted platforms. Victims are often trafficked or coerced. Payment via cryptocurrency and streaming pay-per-view models. Jurisdictional complexity makes prosecution difficult.

Indicators
  • · Pay-per-view encrypted channels
  • · Cryptocurrency micropayment patterns
  • · Stream-on-demand platforms
  • · Hotel / residential rental patterns
  • · Cross-border payment trails
Response Resources
  • · IWF Dark Web Team
  • · EC3 Europol
  • · NCMEC CyberTipline
  • · ECPAT International
  • · INTERLOCAL (INTERPOL)

Online Grooming Ecosystems

HIGH
Social Engineering
Global

Platforms and networks where adults systematically groom minors for exploitation. Operates across gaming platforms (Roblox, Fortnite, Minecraft), social media (Instagram, Snapchat, TikTok), and encrypted chat apps. Groomers use love-bombing, desensitization, and isolation tactics. Increasing use of generative AI to create convincing personas.

Indicators
  • · Age-inappropriate gifts / attention
  • · Requests for secret relationships
  • · Excessive screen time with unknown contacts
  • · New apps installed with hidden chats
  • · Gaming console direct-message contacts
Response Resources
  • · Thorn — Safer.io
  • · NetSmartz Workshop
  • · NCMEC CyberTipline
  • · Internet Matters
  • · UKCEOP (Child Exploitation and Online Protection)

Romance Scam / Sweetheart Swindle Networks

HIGH
Financial Fraud
West AfricaEastern EuropeSoutheast Asia

Organized romance fraud networks operating across dating platforms and social media. Prevalent West African (Yahoo Boys) and Southeast Asian operations use scripted playbooks, fake profiles, and prolonged grooming before soliciting money. Overlaps with money muling and identity theft supply chains.

Indicators
  • · Professed love within days
  • · Excuses to avoid video calls
  • · Requests for travel money / medical bills
  • · Military / offshore worker personas
  • · Requests for cryptocurrency gift cards
Response Resources
  • · FBI IC3 Romance Scam
  • · FTC Romance Scam Alerts
  • · Social Catfish
  • · RomanceScam.com
  • · Action Fraud UK

Revenge Porn / Image-Based Abuse Networks

MEDIUM
Image Exploitation
Global

Networks facilitating non-consensual intimate image distribution, including ex-partner retaliation, hacked cloud storage leaks, and dedicated exposure platforms. Includes "involuntary celibate" forums where intimate images are weaponized. Legal frameworks increasingly criminalizing distribution.

Indicators
  • · Exposure forum posts
  • · Cloud storage account compromises
  • · Intimate image metadata stripping
  • · Deepfake porn generation services
  • · Threat of image leak in arguments
Response Resources
  • · StopNCII.org
  • · Cyber Civil Rights Initiative
  • · EVA (Eliminate Violence Against Women)
  • · NCOSE (National Center on Sexual Exploitation)
  • · Without My Consent

Predator Identification & Monitoring Tools

LOW
Countermeasure Resources
Global

Tools, platforms, and organizations that help identify, track, and report online predators. Includes automated detection systems, hash-sharing databases, OSINT tools for investigator use, and victim assistance platforms.

Indicators
  • · Hash-sharing databases (PhotoDNA, Project VIC)
  • · Bait / decoy account operations
  • · Platform reporting toolchains
  • · Undercover OSINT techniques
  • · Cross-platform account linkage
Response Resources
  • · Thorn — Safer.io
  • · NCMEC CyberTipline
  • · Project VIC
  • · IWF Image Hash List
  • · StopNCII.org