The prevalence of child sexual abuse material (CSAM) distribution online continues to outpace resources and technologies to combat. Steps need to be taken to better understand the characteristics of websites distributing CSAM to improve combat efforts. Specifically, how is CSAM distributed, where is CSAM located on a website, and what measures are taken to hide content

Using snowball sampling, 104 websites hosting and/or displaying 15,790 known CSA images were examined. Results suggest a degree to specialization among CSAM websites, with only 20.19% both hosting and displaying content. Neither feared repercussions, operating freely with their intent and purpose. Of displaying websites, 62.70% of CSA images were located in the home directory, while only 3.26% were located in at least a 4th-level sub-folder. Websites were most focused on organizing their CSAM, with 67.53% of hosted CSA images and 27.52% of displayed CSA images being found in folders formatted month/year. Qualitatively, websites hosting CSAM were more likely to use misleading folder and file names to conceal content, while websites displaying CSAM were overt.   

Findings from this research suggest additional criteria for identifying CSAM websites as well as more effective strategies for removing content being distributed.