Independent investigative initiative
Investigating
the unseen.
We research the networks behind online child exploitation and organised cybercrime. We use lawful sources and publish only what the evidence supports.
You can report without giving your name. You do not need to be certain.
Independent and currently unincorporated. Not a law enforcement agency or an emergency service.
~14 TB
of CSAM infrastructure taken down.
Hosting, storage and distribution infrastructure for child sexual abuse material, identified and documented by Greywatch and taken offline.
Where reports are forwarded
Credible reports and documented findings are forwarded to the authorities able to act on them, including:
- 01
FBI
Federal Bureau of Investigation, United States
- 02
INTERPOL
International Criminal Police Organization
- 03
Europol
European Union Agency for Law Enforcement Cooperation
- 04
IC3
Internet Crime Complaint Center, operated by the FBI
- 05
Local police departments
The police force responsible where a victim or offender is located
- 06
Other competent authorities
National hotlines, child protection agencies and platform safety teams
Forwarding a report does not mean Greywatch is affiliated with, endorsed by or acting on behalf of any of these organisations.
You do not need to be certain to report.
Most reports we receive begin with someone who simply noticed something that did not sit right. That is enough. Tell us what you saw and where. We will review it.
Start a report- 01
You can stay anonymous. No name, no email, no account. A description of what you saw is enough for us to begin.
- 02
Two minutes is enough. You do not need technical knowledge, screenshots or proof. Tell us what concerned you and where you saw it.
- 03
Do not send abuse material. Never download, forward or store it. Describe what you encountered. That is all we ask for.
If a child is in immediate danger, contact your local emergency services first.
An independent initiative, built on evidence.
Greywatch researches how exploitation and organised crime operate on the open internet: the networks, marketplaces and technical infrastructure that allow harmful activity to persist at scale.
Our work sits between technical analysis and public-interest research. It is lawful, documented and deliberately narrow: we study what can be observed openly, we verify before we assert, and we stop where a child's safety or a live investigation would be placed at risk.
We are not a government body, an agency or a representative of any institution, and we are currently unincorporated, without legal personality, registration or formal affiliation. We state this plainly, because trust in this field depends on not overstating what an organisation is.
Greywatch does not conduct enforcement, does not act as a hotline and does not replace the work of competent authorities. What it does is research: collecting openly available signals, corroborating them, and documenting findings in a form that others can scrutinise and act upon.
What we are
- Independent and self-directed
- Evidence-led, and documented
- Bounded by a published ethical framework
- Explicit about the limits of what we know
What we are not
- A law enforcement agency
- An emergency or crisis service
- A registered organisation (currently unincorporated)
- Affiliated with, endorsed by, or acting for any institution
Four research tracks. One standard of proof.
Each track is approached the same way: define the scope, collect lawfully, corroborate independently, and describe findings with their uncertainty intact.
Online child exploitation
Distribution networks for sexually abusive material, grooming and approach behaviour, sextortion, and the financial exploitation of minors, studied as systems rather than isolated incidents.
- Abuse material networks
- Grooming & sextortion
- Platform enablement
- Financial harm
Organised cybercrime
Fraud and social-engineering infrastructure, ransomware ecosystems and the services that support them, cash-out and money-laundering networks, and the marketplaces that coordinate activity.
- Fraud infrastructure
- Ransomware ecosystems
- Money laundering
- Criminal marketplaces
Open-source intelligence
Structured collection, corroboration and analytic tradecraft: establishing how an operation is connected, who may be behind it, and precisely where a claim of attribution should stop.
- Collection discipline
- Corroboration
- Infrastructure mapping
- Attribution limits
Digital threat intelligence
Threat-actor tracking and pattern analysis that supports practitioners in child protection and financial crime prevention, with early-warning assessment rather than speculation.
- Threat-actor tracking
- Pattern analysis
- Early warning
- Practitioner support
Boundary
Greywatch does not seek out, download, store or redistribute material depicting abuse. All work is based on lawful, publicly available or responsibly supplied information and on the principle that documenting harm must never add to it.
A discipline of evidence, not of access.
Six stages take a report from first contact to a documented finding. Each stage is recorded so the work can be checked and reviewed.
- 01
Intake & triage
Every report is read and classified before any research begins. Where a child may be at immediate risk, the matter is referred to the appropriate authority without delay and without further analysis.
- 02
Open-source collection
Only lawfully accessible, publicly available information is collected, within a documented scope, using methods that leave no trace on the systems observed.
- 03
Verification & corroboration
Findings are established by multiple independent indicators. A single observation is treated as a lead, never as a conclusion.
- 04
Infrastructure mapping
Accounts, domains, payment rails and communication channels are mapped to reveal how an operation is structured, and where it intersects with others.
- 05
Attribution, with restraint
We distinguish what the evidence supports from what it merely suggests. Attribution is stated with its confidence level, and left open when it cannot be earned.
- 06
Documentation & referral
Work is documented so that another competent party could retrace it. Where lawful and appropriate, findings are referred and never published in a form that could harm a victim or obstruct an investigation.
Lawful by design
No intrusive access, no unauthorised collection, no purchased data.
Minimum necessary
The smallest amount of data required to answer the question.
Reproducible
Findings recorded so a reviewer can follow the same path.
Documented gaps
What we could not establish is stated as plainly as what we could.
Capability without claims we cannot substantiate.
Our tooling is deliberately modest and mostly open. We describe capability in categories rather than products, because naming a vendor says little about method.
Research integrity depends on the environment around it: reproducible collection, controlled analysis, and documentation that survives review. Greywatch keeps its stack small, auditable and replaceable.
We do not accept sponsored tooling, and we do not present any relationship (commercial, institutional or governmental) that has not been formalised and made public.
- Standards-based open-source collection
- Isolated analysis environments
- Version-controlled documentation
- Encrypted communication and transfer
Partnership register
Verified empty- Formal partnerships
- None announced
- Institutional affiliation
- None
- Government or law-enforcement affiliation
- None
- Commercial sponsorship
- None
- Ethical review
- Internal framework only
Greywatch presents no partnership, endorsement or affiliation it cannot evidence. This register is updated only when an arrangement is formalised and made public.
Published only when it is lawful, verified and safe.
Greywatch has not released any publications. This section will remain a register rather than a showcase: entries appear only when a finding is complete, lawfully shareable and safe to disclose.
Publication register
0 entriesNothing has been published yet.
When Greywatch publishes, each item will appear here with a date, a scope note and a methodology summary and, where relevant, an account of what could not be established.
What will be published
- Threat briefings
- Methodology notes
- Research summaries
- Corrections, published in full
Publication standards
- Nothing that identifies a victim or a witness
- Nothing that re-victimises or re-traumatises
- Nothing that impairs a live investigation
- Redaction by default, reviewed before release
- No claim of attribution beyond the evidence
How to work with us.
We welcome questions, referrals and independent scrutiny. Whether you are a researcher, a practitioner or a member of the public, the reporting channel is the place to start.
Members of the public
If you have encountered something that concerns you, use the reporting channel. You do not need technical knowledge, and you can report without giving your name.
Researchers & practitioners
Methodological critique, peer review and independent corroboration are welcome, including where it challenges our conclusions.
Child-protection organisations
We can receive and responsibly handle referrals of findings relevant to child protection work, within the limits of our lawful, research-only role.
Industry & platforms
Abuse signals, infrastructure observations and coordinated disclosure questions can be raised with us directly through the reporting channel.
Competent authorities
Where information indicates a credible risk of serious harm to a child, it may be referred. We do not act on behalf of any authority and claim no affiliation.
Start here
Open the reporting channelWe make no claim of affiliation with any authority, organisation or funder. Where there is a credible risk of serious harm to a child, information may be referred to a competent authority. We will say so when it is.
The limits are the method.
“Every technique we use is bounded by a single question: does this protect a child without causing further harm?”
Victim-centred
The safety and dignity of the person harmed takes precedence over any finding.
Do no harm
No technique is used if its cost to a child, a witness or a family outweighs its value.
Lawful by design
No intrusive access, no unauthorised collection, no material obtained unlawfully.
Data minimisation
We hold the least information necessary, for the least time necessary.
No vigilantism
We never contact, confront or publicly identify a person of interest.
Transparency about limits
We publish our constraints as openly as our conclusions.
What we will not do
- We do not conduct hacking, intrusive access or unauthorised collection.
- We do not act as law enforcement, nor as an agent of any authority.
- We do not publish identifying information about victims or witnesses.
- We do not name individuals publicly as offenders. That is a matter for competent authorities.
- We do not accept, request or store material depicting abuse.
If you have seen something you cannot explain, it may still matter.
Reports can be made without giving your name. Please do not send material depicting abuse. A description and a location are enough for us to begin.
Not for emergencies. Contact local emergency services.