1,300 pedophiles exchange child pornography on TikTok: this is their coded language

"100 x 100", "Código Postal" or "Café con Pan": the codewords pedophiles use to access child pornography and identify one another

When pedophiles leave comments on videos of minors in order to buy, sell, or exchange child sexual abuse material, they do so using coded language that can go unnoticed by the average user, but is easily recognizable to their peers.

The more than 1,000 users identified by Maldita.es commonly leave comments like "100 x 100", "50 x 50", or "200 x 200" on videos. According to Javier Sanz, a criminologist specialising in cybercrime and behavioral analysis in cyberspace, this functions as a kind of negotiation protocol: "A user with 200 files wants to signal to others, 'I have at least 200 files — if you want to trade but you only have 30, don't bother.' It's also a way of indicating each user's capacity and reputation," he adds.

This coded language also functions as a password between them. When Maldita.es messaged a user who had commented on one of the videos with "100 x 100" and we asked what it meant, the user stopped responding, realising we did not share the same codes.

100x100 is a code, but it is also what these users write to signal that they have child pornography without naming it outright. "They know that other users with the same interest will see it and understand the coded language ('cp', 'pizza', '100x100'), while for most people, it goes completely unnoticed," Luis Santos Diz, a criminologist specialised in criminal analysis, applied research, and crime prevention affirms. He adds that, in this way, "the codes help them evade automatic moderation systems." 

Other wordplays they frequently use derive from the initials of 'Child Pornography'. These include words such as: Caldo de Pollo (chicken broth), Código Postal (postal code), Café con Pan (coffee with bread), Ce Puede (a homophone of 'se puede', meaning 'it's possible'), or CP, among others. These words go unnoticed by other users and by the platform itself.

Sometimes we can see diminutive variations of these words, such as the one used by a user we spoke with through TikTok's Direct Messaging function: "I have videos of “caldito” (the diminutive of broth, related to the chicken broth wordplay). Up to 2,000 videos of all kinds. I'll trade them for a Steam card or games." "Whoever understands what 'caldo de pollo' means," adds expert Javier Sanz, "is already showing that they know the code and are therefore part of the circle. And whoever doesn't understand it simply sees a nonsensical comment and moves on. That is why coded language not only conceals the activity, but also builds group identity," he concludes. 

Our analysis also captured comments referencing pizza, either written out or using the 🍕 emoji. Various organisations working in the protection of minors in digital environments have warned about the use of this term to offer explicit images of minors. Cheese Pizza in English carries the initials of Child Pornography. In fact, its use has been linked to the Pizzagate conspiracy theory, which went viral during the 2016 US elections: an alleged pedophilia network operating out of the basement of a Washington DC pizzeria, which, according to conspiracy theorists, involved Hillary Clinton herself and her campaign team.

During our investigation, we identified that several of the profiles we registered as potential pedophiles were using this coded language in their bios and in the videos they uploaded.

These words are often accompanied by a reference to the messaging platform through which they want to be contacted, along with their username or number, in the case of Zangi.

The exchange of content between users is the most commonly observed trend, although some users can also be seen selling it. "The motivations behind this type of behavior can vary, though they tend to fall mainly into two categories: on one hand, a sexual attraction toward minors; and on the other, financial incentives derived from the commercialization of this type of material," the National Cybersecurity Institute (INCIBE) told Maldita.es.

This is the pedophile dictionary on TikTok

❮ ❯

From commenting on videos of minors on TikTok to private messaging platforms

TikTok acts as a meeting point for individuals who may be thousands of miles apart, but who share the same goal: obtaining CSAM, usually of girls, whether through swapping and sharing material or purchasing from those who supply images in exchange for payment. The strategy is always the same. First, these users leave a comment on a video of a minor indicating how to be contacted on a private messaging platform such as Zangi, Telegram, or Signal, where the exchange or sale of the material will take place.

'The video of a minor acts as a meeting point,' criminologist Luis Santos Diz tells Maldita.es.

'Uploading explicit material carries an extremely high risk of an immediate ban and police tracking. However, leaving a comment on a viral video of a minor allows them to 'fish' for other interested users by taking advantage of that video's organic traffic, operating in the shadows of a post that the platform considers 'safe',' Álex Buitrago, associate professor and researcher at the University of Valladolid specializing in media literacy and social media, tells us. He adds that 'this language allows them to recognize each other without triggering alerts from the authorities or the platform's artificial intelligence, which is often not updated with the latest neologisms of these subcultures'.

Zangi: the unknown app that requires no identification from users

Using a profile created for this investigation, Maldita.es selected and contacted 60 profiles from the more than 1,300 potential pedophiles detected on TikTok. Of these, 12 admitted to possessing child pornography or sent it to us directly.

Only two were using Zangi to exchange this material. However, both sent us CSAM as soon as we messaged them.

Although Zangi is an obscure platform used by only 7% of the more than 1,300 potential pedophiles identified by Maldita.es, it is gaining increasing prominence for its use in carrying out criminal activities. 'This is because it requires no phone number or email, meaning the user is not linked to any real identifying information,' criminologist Javier Sanz explains. 

This Armenian-founded app based in Silicon Valley (United States), used by criminal organisations such as drug traffickers, also has the characteristic that 'there is no central server through which everything passes, there are no intermediary servers from any company — it is all encrypted messaging between users with military-grade encryption,' Sanz adds. The platform itself explains on its website that 'Zangi has refused to collect or have access' to user data, 'thus eliminating the possibility of monitoring, intruder entry, or backdoors' that would allow access to personal data. This means that 'not only does nobody know what is happening, but no database can be seized either. If the National Police requests data from WhatsApp or Telegram, there is always something to hand over, but with Zangi there is nothing because nothing is stored outside the device.' The expert therefore concludes that 'it is a completely dark application'.

In Spain there are already precedents for the use of this app for the purpose of CSAM: in 2024, a 22-year-old man was arrested in Murcia for using this platform while posing as a minor in order to obtain intimate images of children.

The private messaging platform most used by these users, however for now, remains Telegram, mentioned in 37% of the comments analyzed by Maldita.es corresponding to the more than 1,300 potential pedophiles analyzed. It was also used by eight of the 12 users we interacted with. Other messaging apps such as Signal appear to a lesser extent, among others.

In total, of the 12 users we spoke with who admitted to possessing child pornography, five proved it by sending us files or photos, confirming they had CSAM in the span of a few hours and without any prompting on our part. We reported on this in the first part of our investigation, 'Predators on TikTok: a Goldmine for Pedophiles'.

Maldita.es contacted TikTok, Telegram and Zangi. At the time of publication, only Telegram had responded, stating that “Telegram has a zero-tolerance policy against child sexual abuse material (CSAM), which is explicitly prohibited by its terms of service” and that “so far this year, more than 211,000 channels and groups containing CSAM have been removed.”

Most of the users we interacted with are from Latin America, but that does not exempt them from complying with the law

As we reported in Predators on TikTok: a Goldmine for Pedophiles, both the users who share content and those who produce or acquire it are committing a crime, as Ernest Abelló, a judicial expert in data protection and Maldita.es contributor, reminds us. All of this is covered under Article 189 of the Spanish Penal Code. 'It makes no difference whether it is a private channel or a closed group,' the expert notes.

The users Maldita.es spoke with are from different countries, including Argentina, Kazakhstan, Guatemala, Brazil, Uruguay, Thailand, Ecuador, and Chile, as we were able to verify using a tool provided by My OSINT Tools that geolocates the videos on users' profiles. 

But 'being outside Spain does not guarantee impunity. If someone sells or exchanges child pornography from another country, they can still be prosecuted in several scenarios, such as when the content is offered, distributed, or can be accessed from Spain,' Rahul Uttamchandani, a lawyer specializing in technology and privacy, explained in the first sequel of this investigation. 

'If the victim is a minor residing in Spain, or if part of the harm occurs in the country, the authorities can open an investigation,' criminologist Luis Santos Diz notes. He adds that 'these crimes are investigated through international cooperation: Europol, Interpol, the Budapest Convention, etc. Spain can identify profiles, gather evidence, and send it to the authorities of the country where the perpetrator is located. The effectiveness depends on that country's legislation and level of cooperation, but real capacity for intervention does exist.' 

The criminologist encourages any user with evidence to report it 'by providing screenshots, links, or account identifiers,' adding that 'even if the perpetrator cannot always be apprehended immediately, the report serves to block accounts, track networks, and generate international alerts'.

Almost 42% of the accounts Maldita.es spoke with had been active for more than a year.  

Of the 12 accounts Maldita.es spoke with that admitted to having CSAM and even sent evidence, five had been active for more than a year, two of them for around five years and one for four years, without TikTok having taken any action. 

Maldita.es contributor and criminologist Luis Santos Diz considers it 'very important' that platforms like TikTok, Telegram, and other social media have specialized internal units dedicated to detecting sexual crimes against minors. 'I am not talking only about general moderators, but about teams specifically trained in areas such as child pornography, grooming, recruitment, and risk pattern analysis,' he states.

'These companies,' he adds, 'handle millions of data points and have more than enough resources to invest in safety and prevention. If they make so much money thanks to their users, they should also take on a share of the responsibility for protecting the minors on their platforms.' 

For Diz, the solution lies in 'a specialized team that could detect the codes earlier' such as 'cp', 'pizza', and others, 'identify fake profiles posing as minors, analyse grooming patterns, and collaborate directly with law enforcement when necessary.' This, he concludes, 'would not only help curb the spread of illegal material, but would also serve to prevent cases before they occur'.

As users, how can we report this on platforms?

If you are wondering what you can do when you come across any of these coded words in a TikTok video of a minor, the answer is to report the user who writes the comment and the one who responds to it by offering their contact on a private messaging platform such as Telegram, Zangi, or others to carry out the exchange.

• On TikTok: go to the user's profile and tap the arrow in the top right corner, tap 'report account' and a dropdown menu will appear with different options. Tap Something else > Violence, abuse and criminal exploitation > Exploitation and abuse of people under 18 and hit the send button.

  

• In the case of Telegram, the process depends on whether the conversation is public or private. The app allows any user to report content they consider illegal that they have found in a channel on the app itself, but if these conversations take place in private chats or group chats, this option is not available. The platform confirmed to Maldita.es that in cases involving private chats, reports can be made directly to the abuse team at [email protected]. Another option is to request the automatic removal of illicit content via [email protected], though for private conversations, direct links to the chat are not available. Because of this, we are limited to sending only the user's information, such as their name or number. However, the app advises to 'please make sure to include links (like t.me/... or @...) to the content on Telegram which you think needs attention from our moderators,' when sending requests by email. 

• On Zangi, open the conversation with the user and tap the three dots in the top right corner, then tap the 'Report' button. Once tapped, a window will open where you can report the user. The platform itself states that the user will not be notified of the report, and that it should be noted that 'messages and user history are NOT stored on the servers'.

Outside of the app, we can report an illegal message sent to us by a user to the police or in court. Samuel Parra, a lawyer specializing in digital law, emphasizes that it is very important to report it directly to the relevant national police force in the country you are based in. 

Important: we should not download, screenshot, or photograph the content, as judicial expert in crimes against minors on social media Pablo Duchement indicates.  If reporting through an online form, the specialist recommends attaching the URL links to the material, noting the date and time at which we found it.

In the case of Telegram, Parra suggests sharing 'some element that identifies that account or chat,' such as a username or phone number. 'I would only use screenshots if they do not contain child pornography,' the lawyer adds. 'What we must not do is forward the content to other people or keep a copy of those images, as we could be committing an offense of distributing or possessing child pornography,' the lawyer concludes. The same would apply to Zangi.

The following Maldita.es contributors lent their expertise to this article: Javier Sanz, criminologist specializing in cybercrime and behavioral analysis in cyberspace; Luis Santos Diz, criminologist specializing in criminal analysis, applied research, and crime prevention; and Ernest Abelló, judicial expert in data protection.

Thanks to your superpowers, knowledge, and experience, we can fight harder and better against lies. The Maldita.es community is essential to stopping misinformation. Help us in this battle: send us any hoaxes you come across to our WhatsApp service, lend us your superpowers, spread our debunkings, and become an Ambassador.