Fatima ‘Teema’ Mahmud uploaded a short clip on her Telegram Status that morning; it showed a leaked intimate video involving individuals in northern Nigeria. The time was 8:13 a.m.; minutes later, she uploaded another one and another. By midday, she had uploaded dozens of similar pieces of content. By evening, there were hundreds.
Some of the updates advertised leaked, non-consensual intimate videos that had circulated across social media timelines in the region days earlier. Others promoted sex work services, paid erotic video calls, and private VIP groups featuring explicit videos of women, particularly northern actresses. Among them, and pinned prominently at the top of Fatima’s Telegram profile, were screen records of what she claimed were sexual and nude videos of children, advertised under paid access tiers.
The next morning, the cycle began again.
This reporting was never supposed to become an investigation into child sexual abuse material. It began with a simpler question: where do the leaked intimate videos that circulate on northern Nigerian social media end up?
Every few weeks, another such video appears. The names change, but the outrage follows a familiar script: WhatsApp groups begin asking for links, X users post screenshots before directing followers to Telegram, and Facebook pages recycle the same clips. For a day or two, timelines become courtrooms. Then attention shifts elsewhere, and the people at the centre of those scandals disappear from public conversation, but the links do not.
One such link appeared in May. An X account, now suspended, promoting what it described as a leaked intimate video involving a woman, instructed followers to continue on Telegram. Instead of downloading the material, HumAngle followed the trail, using a pseudonymous account to trace the same path thousands of other users take whenever another intimate video erupts across northern Nigerian social media.
For three months, HumAngle watched what that trail led to: an ecosystem that had evolved to survive platform bans, rebuild audiences almost overnight, and transform some of women’s most private moments into commercial products. Within that ecosystem, children appeared to have become one of its most valuable commodities.
Following the trail
It started with “Teematv” on X. HumAngle stumbled on the account promoting a teaser video following a scandal involving a Kaduna-based woman, whom HumAngle will not name to avoid re-victimising her. The X account claimed to have the “full video” and encouraged followers to access it on Telegram.
We created a pseudonymous account and followed the trail.
The first Telegram channel, “Teematv” (@teematv9), which is the main feeder channel and had over 40,000 subscribers before it got suspended in June, looked much as expected: pornography, leaked videos, and VIP subscriptions. But the longer the investigation continued, the less it resembled another anonymous pornography page. The channel did not exist in isolation. Every video and image posted linked to something else, and subscribers were encouraged to save the phone numbers provided by the administrators. “Add my contact,” she often tells subscribers.
Once saved, these numbers unlocked Telegram Status updates, which promoted private VIP groups, which led to new administrators, who promoted replacement channels. When one account disappeared, another had already taken its place.
It felt less like browsing social media and more like walking through a marketplace where every stall owner knew the next. The journey was remarkably consistent, and the pattern held across every operator HumAngle traced; the public channels attracted attention, Telegram Status sustained it, and private conversations completed the sale. Each platform served a different purpose within the same business. X functioned as a storefront, where explicit clips and provocative teasers attracted attention and encouraged users to click through. Telegram became the marketplace itself, while WhatsApp and private Telegram conversations handled the transactions.
Looking closer, the structure reflected an operation built specifically to survive the content moderation it was navigating.
The pattern started with what appeared, and what did not appear, on X. Operators such as Teema used their X accounts to post pornographic clips into X’s video feed, content that the platform’s moderation has grown relatively permissive toward, and whose recommendation algorithm readily surfaces more of it once a user engages with it repeatedly. At no point during our three months of monitoring did HumAngle observe child sexual abuse material posted directly on X.
Whether by experience or deliberate caution, the operators appeared to understand the distinction: ordinary pornography might slip through a platform that has relaxed many of its guardrails around adult content, but material involving children almost certainly would not survive there. The Telegram link attached to those X posts was, in turn, rarely the final destination. It served as an additional layer of security, requiring users to either save a phone number or send a private inquiry before anything further was revealed.
Only after that number was saved did the next stage begin, through Telegram Status. There, too, the same caution applied. Rather than posting material involving children directly, operators uploaded blurred collages or screenshots, with titles and scenes presented as proof that a fuller collection existed, along with a caption advertising group access and a price, directing interested buyers into a private conversation. Nothing that could be mistaken for the material itself appeared in a space Telegram or outside observers could easily flag; the proof of possession and the point of sale were kept one careful step apart. HumAngle observed screenshots of children naked and being abused.
The advertisements rarely remained online for long. Telegram Status updates disappear automatically after 24 hours, and the administrators appeared to exploit that feature deliberately, because the posts remain accessible on the profile itself to anyone who has saved their contact. On some days, one operator uploaded close to 200 Status updates, rotating through advertisements, teaser clips, and promotional graphics before repeating the process the following morning.
The result was a constantly changing catalogue. One day, the focus might be leaked intimate videos. The next, sex work services. Then paid video calls. Then another newly emerging leaked-video scandal that had just begun trending elsewhere on social media. The operators appeared to respond quickly to public attention: whenever an intimate video began circulating widely online, it often appeared inside the network within hours, repackaged as a commercial product, a short preview posted publicly with the full video available, administrators claimed, after payment. The scandals that dominated social media for a day or two became inventory.
Identifying the operators
There was one problem with Telegram usernames: they rarely lasted. By the time HumAngle finished documenting one account, another had often appeared. The usernames, invitations, and even profile photographs changed. But the people behind them did not.
To understand who was operating the network, our investigation moved beyond monitoring channels and focused instead on the digital traces the administrators had left behind, rather than the material they were advertising. The approach was deliberate: HumAngle had already decided it would not purchase access to private VIP groups or attempt to obtain any material advertised as involving children.
Beyond the obvious ethical concerns, doing so could expose journalists to illegal content and compromise the investigation itself. Instead, we focused on the operators’ own mistakes, and the first was surprisingly ordinary: money.
Like any online business, the administrators eventually needed customers to pay. Across multiple Telegram channels and Status updates, Teema repeatedly instructed interested buyers to save a phone number before making enquiries or completing payments. Unlike her usernames, the number rarely changed. It became the first real-world lead.
A search through Truecaller, a popular caller identification service, returned the name “Fatima Mahmud”. One result was not enough, so the same number was cross-checked against Nigerian online banking applications, including OPay and PalmPay, both of which use registered phone numbers as account identifiers and display the associated account name before a transfer is completed. Both returned the same name. For the first time, the investigation had connected one of the network’s most active operators to a real-world name, confirmed through two independent verification methods.
Finding the person behind that name proved harder. Searching “Fatima Mahmud” and “Teema” on social media produced dozens of unrelated results, and many of the accounts connected to the investigation had already been suspended or had disappeared before they could be examined. So HumAngle changed direction, following relationships rather than names: Telegram usernames led to older accounts, older accounts led to replacement accounts, and replacement accounts led to suspended X profiles, each revealing another fragment of the same digital footprint.
The same process and the same dual verification through Truecaller and banking app records identified a second recurring figure in the network who used several online identities: Deejah, Nanadady, and Deharjah. Once again, the payment trail pointed to one name: Khadija Adamu.
Despite the frequent account suspensions and identity changes, traces of her activity remained visible. As recently as July 17, Khadija remained active. In a Telegram Status update, she told followers her phone had been damaged and appealed for financial support to replace it, posting her Union Bank account details. The account name she provided, Khadija Adamu Abubakar, was confirmed through a mobile banking application search, adding a third independent verification to the identity already established through Truecaller and her OPay and PalmPay records. Fatima’s administrator account was also active at the time of publication.
Khadija’s operation mirrored Teema’s in structure, but she operated across a considerably wider segment of the online sex trade, advertising leaked intimate videos, homosexual pornography, sex work, paid sexual video chats, sex toys, sexual stimulants, and VIP groups promoted as containing child sexual abuse material. Of that range, child sexual abuse material appeared to be one of her primary products, and her pricing across the board was consistently higher than Teema’s, with VIP access advertised at between ₦50,000 and ₦100,000. From what HumAngle observed, she made no attempt to obscure or apologise for any of it.
A further question remained: were the photographs attached to their profiles genuine? At first glance, they appeared convincing: young Hausa women in casual portraits and self-portraits, but reverse-image searches using Google Lens and facial-recognition software found that several did not belong to the account holders at all. Instead, they matched publicly available photographs of Hausa actresses and other individuals whose images had been lifted from elsewhere online. The people running the accounts had carefully concealed their own identities behind someone else’s faces.
Fatima addressed this directly in the description of her main feeder channel, Teematv (@teematv9), which had more than 40,000 subscribers before it was suspended on June 12. “I post pretty Hausa girls on my page. If you see your picture here, then know [that] you are pretty,” she wrote. “Some of you are complaining. I just leave compliments as the caption. I mean no harm. [It] is just for fun.”
A final search, this time relying on Facebook’s “People You May Know” recommendation feature after the administrators’ phone numbers were saved as contacts, surfaced a profile that strongly matched the identity already established for Khadija. Fatima’s case proved less conclusive; several profiles appeared, but none could be verified with sufficient confidence. The search stopped there. We do not possess the legal powers available to law enforcement agencies, but what the reporting established was enough: two operators had been identified through the payment infrastructure they themselves had created, and neither appeared to be working alone.
The product
The advertisements followed a consistent commercial logic, and the same pricing structure recurred across all operators and channels documented in this investigation.
Individual leaked Hausa intimate videos, after a short teaser had been posted publicly, typically sold for between ₦2,000 and ₦5,000. Buyers seeking larger collections were encouraged to pay for VIP memberships instead, which administrators claimed offered hundreds of additional videos. The advertisements suggested a tiered business: casual customers bought individual videos, regular customers subscribed, and those willing to spend more were offered access to increasingly exclusive groups.
At the top of the pricing structure were advertisements for group access explicitly involving children. Unlike the adult-content advertisements, which typically promoted individual clips, these posts promised something larger: a collection, membership, exclusivity. They were usually brief: a blurred collage or screen record, a short caption, sometimes only a few words, followed by a price. Most commonly, that price was ₦50,000, though some operators, like Khadija, advertised memberships as high as ₦100,000. The wording varied slightly from one administrator to another, but the sales strategy did not, and the same pattern appeared consistently across multiple Status updates, different administrators, and different channels over the three months of monitoring.
At first, HumAngle questioned whether the advertisements were genuine; exaggerated claims to lure paying customers are common online. But the consistency, repeated across unrelated administrators using nearly identical language, made coincidence difficult to sustain as an explanation.
Teema’s advertisements illustrated how the claims were built up over time. In a sequence of Status updates viewed chronologically, she claimed her VIP collection had grown from around 600 videos to more than 800, and eventually to over 1,200. HumAngle could not independently verify those figures, but documented them as part of the marketing strategy: growth itself had become a product, with a larger claimed catalogue used to strengthen the sales pitch.
The operators appeared to understand a basic principle of online commerce: that people rarely arrive intending to make their largest purchase but are guided towards it. Every stage encouraged the next. The channels resembled a subscription business more than an ordinary social media page. Only the product was different, and its advertisements did not appear hidden in obscure corners of the internet. They appeared alongside the same promotional posts advertising leaked intimate videos, prostitution, and paid video calls. Children were not presented as something separate. They were presented as another product category, another premium tier.
HumAngle also decided not to attempt to identify the children referenced in the advertisements. INTERPOL’s International Child Sexual Exploitation database, the tool specialist law enforcement units use to identify victims and offenders worldwide, treats abusive images and videos as evidence tied to real children, real locations, and real offenders, material to be handled by trained victim-identification specialists rather than pursued independently. Attempting to trace the children through the material risked compounding the harm the investigation was seeking to expose.
The network
For much of the investigation, Teema and Khadija appeared to be running separate operations: different Telegram channels, different X usernames, different pricing. It was easy to assume they were competitors. Then one Status update changed that.
While reviewing Teema’s Telegram Status one afternoon, HumAngle noticed she was no longer advertising her own channel, but Khadija’s. Only days earlier, one of Khadija’s Telegram accounts had disappeared or been removed before we could complete the documentation of its activity. The replacement account appeared almost immediately, and Teema introduced it to thousands of followers. Over the following days, the same promotion resurfaced repeatedly across dozens of Status updates before disappearing after 24 hours, only to return.
Tracing the followers who interacted with those promotions on X uncovered dozens of accounts exhibiting remarkably similar behaviour. When one profile disappeared, another announced its replacement. When Telegram removed a channel, fresh invitation links circulated through WhatsApp Status updates and newer Telegram accounts. The audience rarely needed to search; the network guided them. Investigators documented several accounts operating under different versions of Teema’s identity, including @teematv2 and @teematv3, with Khadija running parallel replacements under her own aliases.
Around them was a wider ecosystem. Channels such as AREWA GIDAN DADI, Arewagidanharkazallah, and Sadearharka surfaced repeatedly throughout the investigation.
HumAngle found no evidence that these accounts were all controlled by the same individual, nor could we establish that every operator knew every other one personally. What our investigation does establish is narrower but significant: the accounts consistently promoted one another, shared audiences, and directed followers towards replacement channels, forming a distribution network that platform bans repeatedly failed to disrupt.
The blind spot
The most surprising thing about the network was not that it existed, but that it appeared to operate in plain sight. The operators behaved less like people trying to disappear than people confident they would not be noticed. That raises a broader question: why did a network operating so openly prove so resilient?
Part of the answer may lie in language. Almost every account documented in this investigation communicated primarily in Hausa, and the cities referenced in conversations, such as Kano, Kaduna, Maiduguri, Katsina, Sokoto, and Abuja, pointed overwhelmingly to audiences in northern Nigeria. This was not simply a Nigerian online marketplace; it was a Hausa-speaking one.
Researchers have increasingly warned that many widely spoken African languages remain “low-resource” from the perspective of artificial intelligence and automated content moderation. While Hausa is spoken by tens of millions of people across West Africa, there are comparatively fewer linguistic datasets and moderation tools to help technology companies automatically identify harmful content in the language, meaning abusive or exploitative content can be harder to detect at scale than equivalent content in English.
Nothing in HumAngle’s investigation suggests the operators tried to hide the language they used; on the contrary, their marketing relied on local expressions and reflected the culture of Arewa social media. The same characteristics that made the network accessible to its intended audience may also have made it less visible to moderation systems built primarily around better-resourced languages.
This is not a uniquely Nigerian, or even uniquely Hausa-language, problem. Investigations in other parts of the world have documented strikingly similar patterns, in which mainstream platforms funnel users toward Telegram-based child sexual abuse material (CSAM) marketplaces that survive enforcement through rapid replacement.
A BBC Eye investigation published in July found that Instagram’s advertising system in India was itself directing a test account toward paid child sexual abuse material sold through Telegram channels, with material advertised for as little as the naira equivalent of one US dollar; Meta’s own moderation team initially cleared one flagged advertisement as compliant with its policies, and only acted once BBC journalists sought formal comment.
A separate investigation by Sudan’s Ayin Network documented Telegram channels operating an almost identical structure to the one described here: administrators charging roughly $30 for VIP access to material described as exclusive, channels going dark after reports only to be quickly recreated with subscribers migrated across, and content sourced from economically vulnerable communities with little legal recourse.
Malaysiakini’s Kini News Lab has separately described Telegram as functioning as a “dark mall” for this kind of material, in which promotional content on more visible platforms consistently routes interested users toward Telegram, where moderation is comparatively lighter.
Another investigation, conducted by the Brazilian outlet Núcleo with the Pulitzer Centre’s AI Accountability Network, found dozens of Telegram bots capable of generating AI-manipulated child sexual abuse imagery, most operating despite Telegram’s own public commitments on child safety.
These investigations point to a recurring global pattern. Broader research suggests the problem extends far beyond the networks examined in any single investigation. Research conducted by UNICEF Innocenti, ECPAT International, and INTERPOL across 13 countries in Africa and Southeast Asia found that, depending on the country, up to one in five internet-using children aged 12 to 17 had experienced online sexual abuse within a single year. Social media platforms were among the environments where children most frequently encountered the abuse.
Nigeria was not included among the countries studied, leaving no comparable national estimate of how many Nigerian children may be affected. UNICEF and the WeProtect Global Alliance have warned that online child sexual exploitation is becoming increasingly complex as offenders adapt quickly to new technologies, encrypted platforms, and gaps in national responses, arguing that effective responses require cooperation between technology companies, law enforcement, child-protection organisations, and governments, rather than isolated moderation decisions by individual platforms. UNICEF Nigeria has separately noted that violence against children increasingly occurs in both physical and digital spaces, while support for victims remains limited.
As we identified the operators of these accounts, an obvious question emerged: if journalists could trace those digital footprints using publicly available tools, what prevented authorities from doing the same?
Nigeria does not lack the relevant laws. The Cybercrimes (Prohibition, Prevention, etc.) Act criminalises the production, distribution, and possession of child sexual abuse material, alongside offences relating to the use of digital platforms to facilitate unlawful activities, including the non-consensual distribution of intimate images.
The Violence Against Persons (Prohibition) Act recognises image-based sexual abuse, and children receive further protection under the Child Rights Act and the Trafficking in Persons (Prohibition) Enforcement and Administration Act.
The activity documented in this investigation appears to fall squarely within conduct already prohibited under Nigerian law. Over three months of monitoring, HumAngle found no public record of investigations or prosecutions specifically targeting the Hausa-language Telegram ecosystem documented in this reporting, even as channels disappeared, replacement channels emerged, subscribers migrated, and the marketplace continued operating.
The threat was not entirely new to Nigerian authorities. In 2023, the National Agency for the Prohibition of Trafficking in Persons (NAPTIP) said it had observed increasing cases involving child sexual abuse material, sextortion, and revenge pornography, and had established a Cybersecurity Response Team, in partnership with organisations including Meta and the United States National Centre for Missing and Exploited Children (NCMEC). That year, the agency said it was investigating six cyber-tip reports involving online child exploitation and sextortion, drawing on NCMEC’s CyberTipline, the centralised reporting system through which tech companies and the public flag suspected child exploitation to law enforcement worldwide. What remains unclear is whether the Hausa-language network HumAngle documented had ever entered that reporting system.
The network appeared to exploit precisely the jurisdictional and institutional gaps that researchers have long warned about: Telegram channels directed users toward WhatsApp, WhatsApp conversations led back to Telegram, and X attracted new audiences, with each platform seeing only one part of the picture while the operators appeared to see the whole. Platform enforcement removed accounts. Law enforcement, at least publicly, appeared largely absent, aside from the small number of cases NAPTIP said it was already investigating.
What follows
Before publication, HumAngle shared its findings with Telegram and NAPTIP, seeking answers about the network, its operators, and the apparent gaps that allowed it to persist. The advertisements, the Telegram links, the payment instructions, and the phone numbers had all been public. The operators had made no effort to hide them.