A Year Hidden in Plain Site

Dozens of sites. One hidden operator. Thousands of albums of real children's photos on a single shared backbone. Here's the whole machine mapped, and exactly how to help take it down.

A Year Hidden in Plain Site

A years long infiltration into the worlds largest clear-net pedophile advocacy network and how we can take it down.


"Even little girls are very critical of my pictures of them." A man wrote that about his own family, on a forum with thousands of members just like him. I spent the last year reading nearly 2.5 million posts like it, writing hundreds of dossiers, and reporting dozens of men like him. Mixed into the same threads: an FBI Ten Most Wanted fugitive who ran one of the board's own servers while on the run, a Congressional candidate who starved himself to death in federal custody, a voice you've heard on TV a thousand times. The only thing they have in common is a sexual appetite for children.

IF YOU'D LIKE TO HELP TO REPORT THESE SITES WITHOUT VIEWING THE ARTICLE CLICK HERE

They Call This Part a Cold Open


perfectrealitylover — one of Don Baker's two handles — on a real child he watched at a roadside deli.

Don Baker Jr, who posts as truerealitylover and perfectrealitylover, is a US Navy veteran turned Pacific aquaculture contractor turned Malaysia construction worker, now a long-term expat in the Philippines. Married three times. Raising a child with his current wife, who he says supports his attraction. His family back home disowned him, which is part of why he left — the Philippines is one of the worst countries on earth for child sexual exploitation. UNICEF counted two million Filipino children subjected to online sexual abuse and exploitation in 2021 alone.

He told the boards about his opinions on CSAM (Child Sexual Abuse Material)

"would I allow my [Little Girlfriend], or even my young daughter, the right to indulge into [CSAM] if she wanted to do it and understood the long term nature of her performances... I have no objections... My experience with taking regular beach side pictures of my family nieces and cousins brought me to realize that even little girls are very critical of my pictures of them. They asked for me to take better pictures as they didn't like what I took of them." Don baker aka TrueRealityLover
The same man stating his age of attraction: "girls that are but only 6 to 8 years of age."

He also made this easy. A Pinterest account tied to his real name, complete with a folder labeled "LG." (Little Girls). He also used the Same password (his street number, his son's name, his son's birthday) reused across multiple pedophile advocacy sites (found in public data breaches). Anonymous forum poster to real person, real address, took less than a couple clicks. (Using the free breach data/email search tool emailosint.com, [email protected])

Don Baker's public Pinterest, under his real name — including a board labeled "LG 1" ("little girl").

That's what most of these users are like. Although extremely tech savvy predators very much exist, a majority of these predators are just like Don. In public these sites pretend to be a sort of peer support group for people who struggle with pedophilia. In reality, it's a place to network, educate and sexualize children in "private". These predators try and pretend that pedophilia is a sexual orientation like homosexuality, when in reality there's no actual feelings involved, it's 100% about sexual gratification. In fact, the more an adult self-reports feeling "emotionally close to" or "on the level of" children, the more it correlates with actual offending. So what's going on in an ecosystem that promotes Pedophilia and the sexual attraction to kids?

The Hidden Backbone That Connects Everything


For some this is the most interesting part and for some this is the most indecipherable, choose which adventure you'd like.

One operator's backbone: the DNS, mail, and controller that dozens of "separate" sites all run through.

Every site in this piece presents itself as its own thing its own domain name, its own founders, its own rules. Behind them, most aren't independent at all. One operator runs the shared plumbing underneath nearly all of them: the DNS "switchboard" that decides where your browser actually lands, the one mail room sitting behind twenty-plus "separate" domains, and the hidden controller tying the whole database together. That's why banning any single board changes nothing for long — the operator just re-points the address and the same community reopens under a new name within days. You're not looking at a coalition. You're looking at one landlord and a row of storefronts.

▸ For a complete and total technical breakdown: the one machine name that runs the whole cluster, isp-cx-miami.net
20
pro-pedophile domains served DNS by one nameserver set
3
nameservers, all named al-ns#.isp-cx-miami.net
~178
domains across ~100 servers in the wider monitored ecosystem

DNS is the network's nervous system, and one operator owns it

Forget the hosting for a second. The most important name in this whole cluster is isp-cx-miami.net, because it doesn't just host sites. It runs their DNS. DNS is the internet's address book: it's what turns boymoment.com into a server you can actually reach. Whoever controls a domain's DNS controls where it points, its mail, its very reachability.

The cluster's authoritative nameservers are branded aldns.org, but look at what those nameservers are actually called:

ns1.aldns.org= al-ns1.isp-cx-miami.netAmsterdam
ns2.aldns.org= al-ns2.isp-cx-miami.netMiami
ns3.aldns.org= al-ns3.isp-cx-miami.netIrvine, CA

Spread across three countries for resilience, but all three carry the same fingerprint: isp-cx-miami. That's not a hosting company with many unrelated customers. It's one operator's DNS, dressed in a neutral name.

20 separate "independent" sites, one address book

Every one of these registered domains, presented publicly as its own project, with its own moderators and sometimes its own funding, resolves through that single isp-cx-miami nameserver set:

boymoment.com
boymoment.net
boy-moment.com
yesmap.net
map-union.org
newgon.net
mapforum.org
nambla.org
fstube.net
annabelleigh.net
agetaboo.org
alentogroup.org
allykotetsu.com
nextpointfromnothing.com
brianribbon.com
robinsharpe.ca
robinsharpe.org
mhamic.org
cblf.org
glgarden.org

Pull the NS records for any of them yourself: dig NS boymoment.com +short → ns1/2/3.aldns.org. Same answer down the list.

And that's only half of it. The Free Spirits side of the cluster runs on a sibling nameserver set, fscodns.net, on the same backbone: another ~13 domains including boychat.org, boy.chat, lifeline.chat, freespirits.org/info, boywiki.org, boylinks.net/org, legarcon.net and jungsforum.net. Two namesets, one operator, ~33 domains between them.

And the servers underneath: same fleet

The boxes those domains actually live on sit inside one autonomous system, FranTech Solutions / AS53667 (a.k.a. BuyVM), and on reverse-lookup they answer to the same naming family: brian., anna., tom., robin., kubiak., baxter. … .isp-cx-miami.net. A single server routinely carries several boards at once, for example 198.251.88.251 hosts lifeline.chat + freespirits.org + freespirits.info together; 198.251.84.12 carries boychat.org + boy.chat. Different storefronts, one machine.

The mail backbone: one inbox behind two "separate" movements

DNS isn't the only shared organ. roman.isp-cx-miami.net, a Mail-in-a-Box install at 185.250.106.93 (Hosterion SRL, Romania), publicly branded box.isp-email.net, handles email for both sides of the cluster at once: boychat.org, boy.chat, lifeline.chat, freespirits.org/info, jungsforum.net, legarcon.net on the Free Spirits side; map-union.org, yesmap.net, nambla.org, brianribbon.com on the MAP Union side: 20+ domains, one mailbox server. A Mail-in-a-Box install isn't something a hosting company sets up for you automatically; every domain on it was added by hand, by someone who administers both "movements" at once.

Every named box we've found: 25 of them, one at a time

This isn't a guess from one PTR record. It's a fleet, individually fingerprinted: port scans, TLS certs, admin-panel banners, the lot. Here's what's actually sitting behind the name:

romanHosterion ROPrimary mail: box.isp-email.net, Mail-in-a-Box, Webmin :10000
masteraFranTechAll ports filtered. Internal-only. Likely master DB/cluster controller.
fstvidarchFranTech, Las Vegasfstube.net's video archive backend. All ports filtered.
idlersHetzner DEMyIdlers, a self-hosted VPS inventory/billing dashboard. The operator's own private map of every server they rent, in one place, with a public login page.
ruslanUFO Hosting, MoscowISPmanager 6 control panel on :1500, ProFTPD, SSH
uslaCyprus TelecomWindows box: myRDPCloud RDP-over-web gateway + Microsoft SQL Server 2019 on :1433
timmyDedikuoti, LithuaniaOld mail box (2016–18), now repurposed as shared LiteSpeed hosting for a paying, unrelated tenant, a real commercial-hosting side business running on the same fleet
wynwoodFranTech, ZürichTraefik reverse proxy, hosted brianribbon.com until it was re-provisioned May 2026
alphaDA International, BulgariaOld mail box, now a SOCKS proxy on :1080, an egress point
francisFranTech, Las VegasThe legacy Mail-in-a-Box, Webmin :16001
vasyaForpsi, PragueNo web content, but three separate operator email addresses trace back to this one IP
luxFranTech, Zürich403 everywhere, fresh cert, Webmin :16001, an internal service, deliberately access-walled
sionHetzner, FalkensteinSSH + Webmin :10000, no public web face at all
fs-ns1 / fs-ns3Buffalo NY / Constanța ROThe "hidden" shadow nameservers for boychat.org, real corporate hosting accounts, not anonymous boxes
robinFranTechNamed after Robin Sharpe, convicted in 2002 and 2004, his own sites still resolve here
…plus tom, yannick, brian, anna, angelos, support, baxter, billy, box, email, kubiak, rc, apnscp: most dark, all named in the same convention, all rented under the same fleet.

We can see the control panels they log into

Every one of these is a live, fingerprinted admin interface, not an inference: ISPmanager 6 on ruslan, ApisCP on a dedicated node, a full Mail-in-a-Box stack on roman and francis, Webmin/MiniServ exposed on five separate boxes (roman, francis, vasya, sion, lux), a myRDPCloud Windows RDP gateway sitting in front of a live Microsoft SQL Server 2019 instance, and a personal SOCKS proxy for routing their own traffic out. That's not "a guy who pays for hosting." That's one administrator running the exact same toolchain a small managed-hosting business would run, because that's functionally what this is. Free Spirits and MAP Union aren't peers in a coalition. They're tenants.

Nineteen years, one registrant

aldns.org, the domain behind the nameservers that run half this network, was registered September 28, 2007, before privacy protection ever went on it. isp-cx-miami.net followed three years later, November 2010. Same administrator, continuously, for nineteen years and counting: not a rotating cast, not a collective, one person's infrastructure the whole time.

Not one person. At least two.

Everything above reads like the work of a single administrator, and for the scaffolding itself (the DNS, the mail server, the hosting fleet) that's probably right. But keeping an operation like this alive also means renewing twenty-plus domains on schedule, funding registrar and hosting accounts, and managing whatever revenue moves through donation pages and subscription tiers elsewhere in this cluster. That's a different skill set from configuring nameservers, and the trail it leaves doesn't match the sysadmin's fingerprint.

We've identified two separate people behind this cluster: one matching the sysadmin role described throughout this section, and a second matching an accountant or bookkeeping role tied to the money side. We have names for both. We aren't publishing them in this piece, but they're documented, dated, and on file, held to the same standard as everything else here.

Even their own side projects aren't clean

Two domains that have nothing to do with pedophile advocacy sit as the sole co-tenants on two of the otherwise-dark boxes above, meaning whoever owns these personally rents that specific server. One, on the same node that's otherwise completely dark, briefly showed a real company name in its first WHOIS snapshot in 2021, before the operator switched privacy protection on a few weeks later and it's stayed hidden since. The other has sat parked on a dark FranTech box for six years, renewed every year, never once resolving to an actual website. We're not naming either yet. The identity behind them isn't confirmed to our standard, but they're catalogued, dated, and waiting.

What's changed since last year

Three things, all found this year, all on the same backbone above. This isn't a static piece of infrastructure someone built once and abandoned, though not every corner of it got the same attention.

mastera.isp-cx-miami.net
Every port filtered, reachable from nowhere outside the operator's own hosting account. Named in the same convention as everything else on this backbone, and the naming pattern says this one isn't a website. It's the machine sitting behind the websites. Most likely reading: the master database or cluster controller for the whole operation.
The backup nameservers have real addresses
The shadow DNS that keeps boychat.org reachable if the primary nameservers ever go down traces to real hosting accounts under real corporate names in Buffalo, New York, and Constanța, Romania: not anonymous infrastructure, an actual paper trail.
philia.ws
A leftover mail domain from the operator's previous naming era. This year it slipped off their own infrastructure entirely: the domain now sits on a shared parking IP that also answers for thousands of unrelated .ws domains, with no mail server actually listening on it anymore. Its MX record was quietly repointed to a third-party relay on generic DigitalOcean and Hetzner cloud servers, not FranTech, not isp-cx-miami. Whether that's abandonment or just outsourcing, it's the one piece of this backbone that's drifted.

Why it matters

A cheap shared host could be coincidence. Shared DNS cannot: it means one person can move, hide, or resurrect any of these twenty-plus domains at will, and it's why deplatforming one board never touches the others. The operator just re-points the address book and the site reappears elsewhere. isp-cx-miami is the "someone on top." The individual forums are storefronts; this is the landlord who holds every key. And a year later, the landlord is still renovating.

All of the above is live and re-checkable with public dig / whois / reverse-DNS lookups: no leaked data. Figures from continuous monitoring of ~178 domains and ~100 IPs.

What even is pedophile advocacy?


The community has a few goals, the major one being the normalization of pedophilia. They run disinformation campaigns as well as trying to change the vernacular used by the public at large.

The number one version of this is the term "MAP" or minor attracted person in place of the word pedophile. It was, in their words, "first successfully coined in 2007 as a neologism by two online activists with differing attractions to minors (pedophilic and nonpedophilic)". The "activists" in question are Brian Ribbon and Jim Burton (aliases), the same two men running the forum Map Union today. Ribbon is the pedophilic one. Burton is the one who calls himself an "adult-attracted gay man". Brian is largely loud yet insignificant figure in the community, but Jim has been organizing these predators in the background for years now.

Their wiki then explains, plainly, what the word is for: "Its wide adoption also effectively signals to the public that a movement does exist, and the topic is in play." That is the entire function. Not accuracy, nor need for a change. Its allowing pedophiles to create something that distances themselves from their sexual obsessions. By 2023 they were counting "over 600 mentions in Google Scholar," plus state-funded research projects, a theatre performance, a parliamentary petition, and law-enforcement operations. They note it is now "used frequently and casually on social media... by young people," and that "Social Services and Criminal Justice professionals have attested to its casual use by young people.". You will notice I don't use the made up term.

THEY WANT YOU TO USE THE TERM "MAP"

Every time anyone uses the term they prefer, especially in academia or in news coverage you are unknowingly complicit in their attempts to normalize pedophilia. If you see someone use it correct them immediately. It's pedophile, full stop.

Jim also ran a slightly successful disinformation campaign on twitter. Burton ran Twitter accounts under Jamal Ross, Andy Parkinson, Zara Degeneres, Analese Flangler, and Alfred Vincent. On multiple occasions his fake twitter accounts actually made the news.

One of the sock account Jim used in an attempted Twitter disinformation campaign

Jamal Ross — NewgonWiki (a pedophilic wikipedia) brags they invented him as the fake "CEO" of a fictitious "Geartwt" network to bait "antis": "Newgon-supported users convinced Antis that the Gear emoji was code for a 'Geartwt' network whose 'CEO' was a black Swedish sociologist named Jamal Ross." (archive, archive) The Ross/Parkinson UK legal-community stunt (April 2022) was even covered by the Scottish Daily Express: "Top QC slams online accounts".

Zara Degeneres — ran a "San Francisco teacher" persona whose viral thread claiming adult-child sex "is not intrinsically harmful" (Feb 2023) got picked up as real by four outlets, none aware it was a sock: Florida Jolt, Townhall/Guy Benson, Twitchy, Canada Free Press (dead link, Wayback only).

Both men also ran infrastructure for PCMA or the "Pro-Contact MAP Alliance," a members-only chat network its own people call "the biggest MAP activist group to exist in the world today." Burton hosted a PCMA server himself for two years; one internal export of the network's chat rooms turned up nearly 2,900 distinct accounts. Although mostly defunct after a rift about politics, there's a surprising number of pedophile neo-nazi's, there's still small clusters of active members. But besides activism, these forums and organizations also claim to be there to help those pedophiles who are struggling.

I Guess This is "Supporting"


On two different boards the question "Do you ever feel guilty" was asked.

BoyLandOnline member on why he doesn't feel guilty.

The best example of their facade of "counseling" is a man named Gary Gibson. Gary was accused of rape by his daughter when she was a child. Gary denied the accusation but also took this time to admit publicly to being a pedophile. The case never went to trial but Dr. Phil had them on his show to have his daughter accuse him again live on air. He now runs an organization called ASAP International (Association for Sexual Abuse Prevention) which claims to be "A nonprofit organization dedicated to the primary prevention of child sexual abuse... brings together mental health professionals and individuals who are sexually attracted to children... provides public health education, while members provide support for non-offending minor attracted persons (MAPs) who want to avoid acting on their attraction to children.". If you want more information on Gary, I worked with the YouTuber, Slyboy on a deep dive into his life.

Here's an example of his advice to an offending pedophile. He wrote this to an actual mental health professional to gauge if she would report this blatant sexual assault of this anonymous users own daughter or if she'd choose to victimize the abuser.

A father assaulted his 6 year old during a shower, Gary's advice was to change the timing of her shower so he's not tempted to assault her further,

The TLDR; here is that a father assaulted his 6 year old during a shower, Gary's advice was to change the timing of her shower so he's not tempted to assault her further, and even attempted to blame the 6 year old for "Unzipping his pants 3 times".

This is admitted sexual assault and incest, yet Gary was much more worried about the pedophile than his victim. The actual professional had this to say.

Her response being that Gary is probably minimizing the level of abuse the man admitted to and that it seemed he cared more about the offender than the victim.

As you can imagine, her worry about the child and her stance against the sexual assault of a 6 year old girl by her father did not sit over well with the community on Virped (A forum run by pedophiles that's supposed to be for counseling non offending pedophiles). Because once again, it's about sexual gratification, not the child's safety and emotion.

Now, this is just a taste of the mental gymnastics most of these predators go through to make their urges seem less criminal and abusive. The excuse of "I didn't chose this!" is about as shallow an argument that exists. Mental health disorders aren't your fault, but they are your responsibility. The difference is that their sexual appetite is what drives their disorder, making impulse control something that can flip in an instant for those that don't get help.

What kind of material is on these sites?


These forums don't post pictures and videos of children in the way I believe a lot of you assume. I have never seen any images of a nude child or a child being physically harmed. These predators use that framing to say these are "legal" photos and videos. The illegality has nothing to do with these factors. In the major jurisdictions (US/EU/UK) Child sexual exploitation material (CSEM) does not require nudity, penetration, or violence for material to count as CSAM/CSEM, they define it by what the media was created for.

One of the biggest tells that these images are illegal in most jurisdictions is, on Visions of Alice (the largest "girl love" forum on the clearnet) to get access to the photo gallery you have to be a member for at least 9 months and also have atleast 100 posts, which promotes you to "Active" rank. Making the galleries vetted helps keep the reports down. If you'd like to help me report these galleries, If you'd like to help me report these galleries, there's some email templates at the bottom of this article you can use.

What Weird Stuff Did You Find?


The logo for the now defunct World Unity Radio

There's obviously a lot to talk about here, but a great example of the infighting and one of the weirder sides of this ecosystem is pedophile radio and magazines. I'm going to tell you a story of 2 convicted sex offenders who ran a radio station and magazine together and their split. If you can't trust a pedophile, who can you trust?

This was one of the weirder sides to this investigation: this ecosystem has a radio network, and magazines. Named stations (World Unity Radio, WIRED-PM, AliceFM) bundled under an umbrella they call the "MAP Radio Network," with a program schedule, a DJ roster, station IDs between segments, and back-catalogs of recorded shows going back to 2016. And glossy periodicals to match (Modern BL Magazine, Ethos, Imagine) with issues, cover art, and bylines. It's a small media company. The only thing that marks it out from any other hobbyist broadcaster is who it's for and who runs it. There's tips on grooming, computer security and anonymity, and even an attempts at actual think pieces.

audio-thumbnail
BL Talk EP27
0:00
/60.016327

Lets meet DJ RyanJames

On Visions of Alice he's the fourth administrator and a writer for its now defunct in-house magazine. On World Unity Radio he's DJ Ryan James. But Ryan's real name is Kenneth Haggerty, born 1981. He registered the network's own domains ethosmagazine.net, modernblhost.com with the email [email protected], and a quick search on the free public breach site pentester.com shows he used this email for a personal account. Haggerty is a registered sex offender: in 2005, in Pinellas County, Florida, he was convicted on nine counts of possession of child sexual abuse material. The detail that tells you how little that slowed him down being that the first issue of his Modern BL Magazine went out in July 2006 or about six months into his supervision as a newly convicted offender. More alarming knowing this about Kenneth, is on top of the magazine, his host at modernblhost.com ran a full torrent client, ruTorrent, parked right there at /rutorrent alongside a directory he'd bluntly named /secret, complete with its own tucked-away web interface. What a man with nine CSAM counts is seeding over BitTorrent and filing under "secret" on a boylover host isn't a question I'd want to be answering to a probation officer.

DJ DragonLover

DJ Dragonlover is program director of WIRED-PM Radio, co-owner of Ethos, and under a clean clearnet alias "Jim Shaunessy", the station manager of a perfectly ordinary, non-pedophile oldies station he runs on the side. Dragon lover advertised this email on his website, [email protected]. Once again using free breach data I found he also used this email for a personal account under Jamie Wray, born November 1969, living in Rome, Georgia. Jamie Laird Wray was convicted of rape in Pennsylvania in 1999. It fits what he'd already told the boards himself: he described his conviction as "aggravated indecent assault and many related charges to one alleged incident," involving an 11-year-old boy in his professional care while he trained as a psychiatric nurse.

For years these two ran the thing together. In 2016 the station and Ethos started on a board called Enchanted Island; when its founder died, Dragonlover inherited both. By September 2020 his WIRED-PM had moved onto Haggerty's server "we are now on a server shared with Ryan James' Station, WURN" and for the next several years the whole operation streamed off Haggerty's infrastructure and I assume the hosting bill as well.

Then, in 2025, the others built their own. Dragonlover was handed the admin seat at Visions of Alice's station and announced he now ran the "MAP Radio Network." That October a third station launched as "the newest member of the MAP Radio Network family" — AliceFM, WIRED-PM, the new one. Haggerty's World Unity Radio wasn't on the list. The man who'd hosted everyone for five years had been quietly cut out of the network built on top of his own servers.

He did not take it gracefully. World Unity Radio is now a single page of plain text:

What you now see on the homepage of world unity

I don't think Kenny is wrong here. Even I have received mutiple emails from members of the boards doxing predators they don't like. Although the boards are full of what seem like nerdy losers in their moms basement, they are also full of master manipulators who have offended and will offend again. A user named Lawrence Rupp who goes by Judah15, posts dozens of times daily on multiple boards. He's also in his late 80's and has this to say about his numerous victims.

This is the crux of their argument. "We have platonic relationships with kids! It's not all about sex!" making the absolutely wrong assumption that a child can ever consent to an adult relationship. Some of these predators also use the fact that they keep a relationship with their victims after they "age out" of their age of attraction as a sign that it's true love, when in reality, a predator doesn't stay in the victim's life out of affection. The relationship is the control. The grown-up survivor is the single biggest risk of exposure, and the bond the abuser manufactured in childhood is what keeps that risk contained. Research describes trauma bonding not as a passive reaction but as "an attachment actively manufactured by perpetrators through grooming, trauma-sharing and manipulation, a strategy of control," built on a power imbalance and cycles of affection and punishment until the victim "confuses fear and harm with love and care." It works: a close relationship with the abuser is one of the strongest predictors of delayed or non-disclosure — over 70% of CSA victims don't tell within five years and roughly 1 in 5 never do. Keeping the "friendship" alive into adulthood is how the offender keeps the clock stopped.

This investigation has taken a lot more time out of my life than I thought it would. There's still more to do but to those who have reached out to help, thank you. To the pedophiles emailing me to threaten me, thank you too.

What Can We Do?


We can do what's been done before, pressure the higher ups. Frantech, their provider, has proven time and time again to ignore these reports, so lets go over their heads. I don't get paid for clicks or page views or anything, please share the bottom of this article to anyone you think will help!

What you can do

Report it

Every host, registrar, and network below has an abuse process obligated to act on reports like these. Pick a target, expand it, and either copy the email as-is or edit it first — either works. Each one is addressed to the party with the most direct leverage: the company that can actually pull the server, suspend the domain, or cut the transit — not a general contact form. The first one is the big lever: it targets the single operator's shared backbone, not one board.

The whole network (the backbone) isp-cx-miami.net · hosted on FranTech/BuyVM (AS53667) — reported to its transit, Hurricane Electric & Cogent ▸
To: [email protected] — Hurricane Electric (AS6939), FranTech/BuyVM's primary transit
Cc: [email protected] — Cogent (AS174), secondary transit
Subject: CSEA infrastructure operated across your downstream AS53667 (FranTech/BuyVM) — isp-cx-miami.net
Click the box, Ctrl/Cmd+A to select, Ctrl/Cmd+C to copy.
BoyMoment store.boymoment.com · hosted by FranTech/BuyVM — reported via their upstream ▸
To: [email protected] — Cogent Communications, FranTech/BuyVM's transit provider
Subject: CSEM gallery hosted by your downstream customer — FranTech Solutions/BuyVM (AS53667)
Click the box, Ctrl/Cmd+A to select, Ctrl/Cmd+C to copy.
Visions of Alice visionsofalice.net · registered via Tucows, fronted by Cloudflare ▸
Cc / also file separately: Cloudflare abuse form (abuse.cloudflare.com) — Cloudflare fronts the origin server and has a faster-acting, separate process
Subject: Registered domain hosting a members-only gallery of non-consensually obtained child images — visionsofalice.net
Click the box, Ctrl/Cmd+A to select, Ctrl/Cmd+C to copy.
BoyLandOnline boylandonline.com · hosted & registered via DreamHost ▸
Subject: Members-only forum running a photo-album feature for a pedophilic community — boylandonline.com
Click the box, Ctrl/Cmd+A to select, Ctrl/Cmd+C to copy.

You don't have to stay in it

If this is about you — or about a child

I'm not going to spend a whole piece pulling this network apart and then leave people with nowhere to turn. If you're attracted to minors and you don't want to act on it, there are services run by actual clinicians and child-protection charities — not by the community profiled above — where you can talk anonymously. And if you've found abuse material, or a child is being hurt, here is where that goes.

If you're struggling with the attraction

Confidential. Anonymous. Staffed by trained professionals.

Stop It Now! UK & Ireland · Lucy Faithfull Foundation
A child-protection charity's confidential helpline for anyone worried about their own thoughts or behaviour. You don't have to give your name.
0808 1000 900 · stopitnow.org.uk
Stop It Now! USA · MassKids
US confidential helpline for adults concerned about their own feelings or behaviour toward children. No caller ID.
1-888-773-8368 · stopitnow.org
Help Wanted · Johns Hopkins, Moore Center
A free, anonymous, self-paced online course for people attracted to children who want tools to stay safe. Built by a university prevention center.
helpwantedprevention.org
Troubled Desire · Charité Berlin
A multilingual, anonymous online self-help tool from the clinic behind Germany's Dunkelfeld prevention project. Free, risk-free, no login.
troubled-desire.com
Shore · for teenagers (UK)
If you're young and worried about your own feelings, or a friend's, Shore is built for under-18s. Also run by the Lucy Faithfull Foundation.
shorespace.org.uk

If you need to report abuse

A child being harmed, grooming, or abuse imagery.

NCMEC CyberTipline · United States
The US front line for online child sexual exploitation — abuse imagery, grooming, enticement, trafficking.
report.cybertip.org · 1-800-843-5678
Cybertip.ca · Canada
Canada's tipline for the online sexual exploitation of children, run by the Canadian Centre for Child Protection.
cybertip.ca · 1-866-658-9022
Internet Watch Foundation · UK / global imagery
Report a web page hosting child sexual abuse imagery — including AI-generated — for assessment and takedown. Reports can be anonymous.
report.iwf.org.uk
INHOPE · find your country's hotline
A network of 50+ national hotlines. If you're outside the US/Canada/UK, this routes you to the right reporting line where you live.
inhope.org
Your national police · everywhere
For grooming, contact abuse, or anything happening offline, your local police can act. In the UK you can also report to the NCA's CEOP.
ceop.police.uk (UK)
If a child is in immediate danger, don't wait for a form. Call your emergency number now — 911 (US/Canada), 999 (UK), 112 (EU).

If you have anything that needs to be investigated email me at [email protected] or DM on Instagram at @gpatricksec!

Everything in this article was found using free and publicly available information, no exploitation was conducted.