Sudan’s open market of abuse – How Telegram promotes child pornography and other illicit content

11 June 2026

“We have new elite scandals, raping women and children videos. We have two videos of famous singers – all for the low price of 10,000 Sudanese pounds ($2.30). We have a discount – 8,000 Sudanese Pounds ($1.86) for the first five subscribers.”

The horrific text above, advertising content as if selling everyday items, is not being promoted on the dark web or another sinister, cryptic network but openly via a common public platform. Telegram, a cloud-based, cross-platform instant messaging service, openly shares the post as an advertisement. 

This particular group boasts of having hundreds of subscribers, including a “luxury channel” that includes “1,200 videos of kids, 1,000 harassment videos, 13,000 spying videos, and 1,600 videos of rape, all for 20,000 Sudanese Pounds ($4.60).”

It is not alone.

An Ayin investigation has revealed a mass network selling pornography, including content involving minors and other content involving rape – all available through Telegram. These networks are expanding and are now posting more than ever.

This ecosystem includes at least 100 Telegram networks. Dozens of ‘X’ (formerly “Twitter”) identities promote these hubs, guiding traffic and recruiting new users into private groups that monetise explicit content. ‘Visible’ is just a fragment. Ayin believes these 100+ channels make up fewer than 10% of the networks due to recurrent patterns, replicated structure, and constant revenue methods.

The networks

The public networks distribute carefully selected “sample” content – short clips, images, and previews – that are designed to showcase the type and volume of material available. Behind these shopfronts lie private, subscription-based groups. Access to these groups is tightly controlled. Prospective subscribers are instructed to contact the administrators directly, often using a single keyword: “Subscribe.” In response, administrators provide payment instructions and grant access once payment is confirmed.

Subscription fees vary widely, typically ranging from 10,000 to 100,000 Sudanese pounds (roughly $2.50 to $30), but some networks charge up to $300 USD. In some cases, prices are quoted in US dollars, particularly when targeting users outside Sudan. Higher prices are associated with claims of exclusivity, especially when the content features individuals who are perceived as recognisable or socially prominent.  

Payments are processed through a flexible, hybrid financial system that blends local and international tools. Sudanese mobile banking applications, such as Bankak, are available, as are platforms like PayPal and Apple Pay. This dual structure enables the networks to operate across jurisdictions while embedding themselves within everyday financial systems, making detection more difficult. 

While the open sale of this illicit content continues, the administrators and purveyors of these networks remain hidden. According to Dr David Holmes, a criminal psychologist, many of these perpetrators have criminal backgrounds and are part of organised criminal gangs. These same individuals, Dr Holmes says, often have a high level of psychopathic traits, enabling their brutality.

The content

The content itself is sourced through multiple channels. Administrators buy, sell, and exchange material among themselves, creating an internal circulation economy. In several groups, Ayin observed administrators soliciting additional material, offering to purchase or exchange content and directing contributors to contact them privately. 

In some cases, the platforms promote themselves by selling “exclusive content” – compromising photos and clips – of individuals from prominent families or those with celebrity status. 

While some of the content appears to emanate from wealthy, prominent Sudanese backgrounds, much of it, says Dr David Holmes, comes from poor and easily exploitable communities. “Victims tend to be from poor areas with little familial or legal protection. Dr Holmes told Ayin that this pattern is particularly true in Sudan, where child prostitution is prevalent and prosecution is almost nonexistent. “Consumers are wealthy by comparison, and they include a mix of individuals with a sexual preference for children and those who are also sexually aroused by power and control, making them more likely to engage in such activities.”

The most alarming were the open advertisements for pornography involving children and others selling rape videos. One post even advertised child rape. After a data analysis using three separate platforms (see below), Ayin identified over 90 pieces of content involving children over a seven-month period along with two rape videos. In one case, the content claimed that members of the paramilitary group, the Rapid Support Forces, were involved in the rape.

In some cases, the networks offer more than just pornography; they also provide direct contacts. Administrators openly offer to arrange “intimacy meetings” with girls, including underage individuals. “Friends of Madam Norhan, we can provide you with ladies in Sudan and outside Sudan — in the Gulf and in Egypt — young girls and older women,” one network advertised using a hushed woman’s audio message. “Send me information about your location. My system is well known: I show you who is available, you transfer 100k SDG, I give you the girl’s number so you can arrange things with her directly, and you send me a photo for credibility showing she is with you, and then you pay her whatever amounts you agreed on.” These offers were not hidden or coded; they were presented directly as a part of the services available within the network. 

The geographic scope of these offers extends beyond Sudan. Administrators advertised the ability to arrange meetings in Egypt, Libya, and several Gulf countries, linking customers to Sudanese women and girls for sexual encounters. 

Infiltrating the networks: Network 1 

To understand how these networks function internally, Ayin engaged directly with administrators, posing as potential subscribers. 

In one case, an administrator responded quickly to a subscription inquiry, outlining the terms of entry into a private “VIP” channel. The price was set at $30 — approximately 100,000 Sudanese pounds. The justification was immediate and unapologetic. “Don’t ask why we are expensive; we don’t offer open-source content, only exclusive material from well-known individuals,” the administrator boasted. 

Payment was initially requested through PayPal and other international payment systems, suggesting a preference for international transactions that are less directly traceable within Sudan. However, after negotiation, the administrator agreed to accept the local Sudanese platform, Bankak. The administrator provided payment details, account number 878696 at the Bank of Khartoum, registered under the name Fatima*. Once the payment was completed, access to the “VIP” channel was granted.

Inside, the scale and nature of the content became clear. The channel contained 262 photos and 407 videos, shared among subscribers. A significant portion focused on individuals with public visibility—social media influencers, known figures, and, in some cases, their family members. 

Among the material, Ayin confirmed the presence of tens of children’s videos and pictures, rape videos, and, alongside them, private content involving Sudanese influencers. Some of this material dated back several years and included content produced when individuals were underage. 

One particularly concerning case involved a nudity photoshoot of a 16-year-old taken in 2019. The photographer is publicly linked through his social media presence to residence in the United Arab Emirates (UAE) and is identified as the son of the current Sudanese ambassador to Egypt. This content was leaked in 2019, sparking debates on social media at the time. Now, these networks are revisiting this content.

During the observation period, we documented a significant expansion of the network. The administrator created three additional groups and shared them with subscribers: one dedicated to Arabic content, another functioning as a backup group, and another VIP group for Sudanese content. 

The Arabic group alone contained around 600 videos, including content involving social media influencers, as well as material believed to feature underage individuals. 

The administrator also launched a dedicated website for the network, allowing users to subscribe and make payments online. In addition, the administrator circulated an announcement recruiting marketers to help expand the subscriber base. The post stated that commissions would be paid according to the number of subscribers recruited: 1,000 SDG for every 10 subscribers, 10,000 SDG for every 100 subscribers, and 100,000 SDG for every 1,000 subscribers. 

Efforts to contact victims proved largely unsuccessful. Many had already deleted their social media accounts, effectively removing themselves from public visibility. Others did not respond to outreach attempts. 

Infiltrating the networks: Network 2 

Ayin identified another network operating across both Telegram and X. The structure was similar, but with variations in pricing and scale. 

Administrators offered two subscription tiers, a “normal” channel for 30,000 Sudanese pounds (roughly $7.50) and a “VIP” channel for 50,000 Sudanese pounds (roughly $12). After requesting access to the VIP group, investigators were provided with a different Bank of Khartoum account – number 3262346, registered under the name of Haitham*. Ayin confirmed that this account was created in the city of Atbara, Sudan. 

Following the payment, access was granted to this group containing 661 videos, 15 photos, and 419 subscribers. The material once again included even more Sudanese and non-Sudanese children’s videos and images than the first network, alongside private content involving Sudanese adults.  

Reviewing the data – three channels

To obtain an overview, Ayin conducted preliminary data analysis to identify broader structural patterns within these networks. Three Sudanese Arabic language Telegram channels were selected for analysis. The analysis uses an open-source Python-based tool that leverages Telegram’s official API and consists of exploratory data analysis (EDA) along with preliminary content and media analysis. 

After reviewing 768 posts, we found that hundreds of users shared, forwarded, and traded intimate images and video content within these Telegram groups. It is unclear whether the subjects featured in this content provided their consent.

Channel 1 experienced the highest percentage (60.2%) of posts containing media per channel compared to text. Most of these had an explicit nature.

Activity analysis revealed a significant spike from July and August 2025, indicating a period of expansion or increased activity. During this time, posting frequency and engagement levels rose noticeably across the observed channels.

These posts frequently contained explicit references. Mentions of children in a sexual context appeared 93 times during the observation period from October 2025 to April 2026 for these channels, while references to rape appeared twice. 

Operating independently from one another and sourcing material from different pipelines, the channels had adopted a resilient model. While the war and the subsequent lawlessness associated with conflict have reduced scrutiny over these networks, what little enforcement that exists remains a futile effort. 

At the same time, several channels and links became inactive or were shut down.

However, these disruptions were temporary. Administrators quickly recreated new channels, often migrating existing subscribers. In one interaction, an administrator said that if someone reported a channel, they would simply create a new one and re-add members.

“It doesn’t usually happen,” the administrator said, referring to enforcement actions.

Telegram

In many ways, Telegram acts as the perfect hub for these ever-expanding channels. Founded by the Russian-born technology entrepreneur Pavel Durov, Telegram has historically operated within a rigid ideological framework that prioritises absolute user privacy and maintains a profound aversion to state-mandated content moderation. For nearly a decade, this operational paradigm positioned Telegram as a vital digital sanctuary for political dissidents, independent journalists, and citizens living beneath authoritarian regimes.

Telegram played a pivotal role, for instance, in Iran’s opposition movement in 2017-2018, serving as a secure organisational tool. Fearing its potential to mobilise the opposition, and with 30 million Iranian users, Tehran’s Friday Prayer imam, Mohammad-Ali Movahedi Kermani, formally declared the use of Telegram “haram” in May 2018, blocking its usage.

However, this same architectural opacity and strong refusal to cooperate with law enforcement also turned the platform into a thriving, borderless ecosystem for illicit activities. Over the years, intelligence agencies and regulatory bodies have observed Telegram evolving into a primary conduit for narcotics trafficking, child pornography, and cybercrime.

So much so that French authorities arrested Durov in August 2024, accusing him of complicity in managing an online platform designed to enable illicit transactions – including child pornography. The trial is ongoing; Durov was released on a €5 million bail during the same month.

A system beyond containment

The networks uncovered by Ayin are not isolated incidents. They represent a structured, evolving system that merges digital exploitation with real-world trafficking. They operate as businesses, attract users through targeted promotion and curated samples, and generate revenue through subscription-based models. 

They sustained the supply through continuous acquisition and exchange of material. They also extend into physical exploitation by facilitating direct sexual contacts. The result is an ecosystem in which abuse is commodified, normalised, and scaled up. 

For victims, the consequences are long-term and often irreversible. Their images and videos circulate without consent, sometimes for years. Some were exploited as minors, with that material continuing to be traded long after the initial abuse. Many withdraw entirely from public life, leaving behind fragmented digital traces. 

For authorities, the challenge is systemic. Disrupting these networks requires more than removing individual channels. It demands coordinated action – targeting financial flows, strengthening platform accountability, and addressing the cross-border nature of trafficking operations. 

What Ayin has documented is not the full extent of the system; it is an entry point, a window into networks that continue to expand, adapt, and operate in the shadows — largely beyond the reach of existing enforcement mechanisms. 

*Only the first name is revealed for security purposes