This report covers both identified Telegram distribution entities and the associated X/Twitter recruitment network.
Covered Telegram entities
| Group | Channel ID | Type | Size |
|---|---|---|---|
| Group 1 — Supergroup | 3368344320 | private_supergroup | 24 members |
| Group 2 — Broadcast Channel | 3461376041 | broadcast_channel | 478 subscribers |
Primary suspect — @MRFOLDER1
buy here HA
@MRFOLDER1 · Telegram User ID: 5928355498
Primary seller and operator of both distribution channels
| Platform | Telegram | User ID | 5928355498 |
| Username | @MRFOLDER1 | Access hash | -4823191102937417705 |
| Display name | buy here HA | Account type | Human (not bot) |
X/Twitter recruitment account — @kellyjessie23
This account may be operated by @MRFOLDER1 or may be a separate accomplice/scapegoat used as a public-facing recruitment funnel. The bio links directly to @MRFOLDER1's Telegram group.
Honestlygoat
@kellyjessie23 · X/Twitter User ID: 1960710163859484672
Bio: "fam welcome https://t.me/+2RWWx1E9GssxMzM0"
| Followers | 6,278 | Following | 24 |
| Tweets | 304 | Media posts | 35 |
| Likes | 597 | Listed | 0 |
All 7 accounts in this network show Mozambique as their X/Twitter IP-derived location. This is not a user-entered text field — it is derived from the IP address used at login. The probability of 7 independently operated accounts all routing through the same Mozambique VPN exit node is negligible. This strongly indicates a single operator created and manages the entire network from one device/session using the same VPN configuration.
Combined with Cluster A (3 accounts in 1h52m) and Cluster B (3 accounts in 4h44m) creation timing, plus English-language communications, Stripe/USD payment infrastructure, and Apple Pay acceptance, the operator is assessed as a single US-based individual using a Mozambique VPN.
Click any row to expand detailed OSINT. All accounts geolocate to Mozambique.
- Cluster A (Aug 27, 2025): 3 accounts created within 1h52m — all Mozambique
- Cluster B (Mar 16, 2026): 3 accounts created within 4h44m — all Mozambique
- @graciebon0G: independent amplifier (Jul 21, 2025) with separate TG link — also Mozambique
7/7 accounts → Mozambique IP geolocation = single VPN, single operator
Content catalog & estimated volume
Two automated Telegram sales bots presented categorized content folders for purchase. Product listings, MEGA.nz storage infrastructure, and seller-stated volume claims are documented below.
Source: ChatExport_2026-04-06 (2), message ID 69 — captured 2026-04-06 21:19:59 UTC. Bot: @Onlynsfw_packs_bot (User ID 8085969392).
| # | Price | Folder title (verbatim from bot) |
|---|---|---|
| 1 | $25 | Group Vip |
| 2 | $30 | LIZZY AND BRO |
| 3 | $30 | IZZY AND DOG |
| 4 | $30 | DESIRE GARCIA |
| 5 | $30 | MONKEY APP |
| 6 | $30 | DARKZADIE FOLDER |
| 7 | $30 | Emmi Sellers |
| 8 | $35 | MOM AND SON |
| 9 | $35 | AMELIA BLONDE |
| 10 | $35 | TEENS AND DOG |
| 11 | $35 | FATHER AND DAUGHTER |
| 12 | $40 | NEW STUFF PYT |
| 13 | $40 | HIGH SCHOOL THOTS |
| 14 | $40 | REAL INCEST |
| 15 | $40 | TEENS HIGH SCHOOL |
| 16 | $40 | BLACK TEENS |
| 17 | $40 | YOUNGs AND ZOo (Dog) |
| 18 | $40 | Hidden Cam Folders |
| 19 | $45 | ENGLISH TEEN |
| 20 | $45 | BIG INCEST |
| 21 | $50 | BLACKMAIIL FULL |
| 22 | $50 | BR0TH3R AND SISTER |
| 23 | $60 | SNAPGOD FULL EDITION |
| 24 | $85 | ALL TEENS COLLECTION |
| 25 | $250 | 1TB Folder — ALL CONTENTS |
The top-tier item (#25) explicitly advertises a 1 TB mega-bundle containing all content consolidated into a single archive for $250.
| Source | Stated volume | Stated file count |
|---|---|---|
| OnlyNsfw Bot (top tier at $250) | 1 TB | Not specified |
| HotHub Bot (welcome message) | 6.0 TB | 200,000+ |
| Observed metric | Count |
|---|---|
| Named content categories (OnlyNsfw bot) | 24 |
| Named packs (HotHub bot) + 10 bonus groups | 6 + 10 |
| MEGA.nz folder links shared | 5 |
| MEGA subfolders visible in screen recording | 11+ (still scrolling) |
| Files in one folder (CP Gay) | 115 |
| Price range per category | $25 — $250 |
| Scenario | Storage | Files |
|---|---|---|
| Conservative (seller exaggeration 20–50%) | 500 GB — 1 TB | 50K — 100K |
| At face value (seller claims) | 1 TB — 6 TB | 200,000+ |
| Upper bound (HotHub 6TB + ongoing additions) | 6+ TB | 200,000+ |
The $250 / 1TB "ALL CONTENTS" tier is the most reliable anchor — it is a priced product with commercial incentive for accuracy. The HotHub 6TB figure may include duplicates or inflation but even at 50–80% discount represents 1.2–3 TB minimum. Five separate MEGA.nz links support multi-terabyte storage (MEGA free tier = 20 GB/account).
Executive summary — digital evidence documentation
Classification: For law enforcement and authorized agencies. This index is redacted. It contains no media files, no illegal content, and no unverified accusations of guilt against named individuals.
Purpose
This package documents methodology, integrity verification (cryptographic hashes), and high-level findings related to:
- A Telegram private supergroup export (chat identifier recorded in forensic manifests).
- Telegram API-derived membership snapshots on the Membership page: numeric user IDs, @usernames (when set), display names, and account flags as returned by the API export. Telephone numbers are not published here.
- Open-source and API-assisted profile metadata for accounts referenced in promotional material.
- A separate X (Twitter) account tied via a biography link to a Telegram invite URL. Metadata and counts are summarized without hosting video or image evidence on this site.
Intended recipients
Agencies including the FBI, DOJ, NCMEC (National Center for Missing & Exploited Children), and platform trust and safety teams may use this index to understand what was collected, how integrity was preserved, and where full forensic copies reside (offline, with custodians).
This site is not a substitute for authenticated forensic copies, chain-of-custody originals, or legal process to platforms.
What this site does not do
- It does not publish media (videos, images, or Telegram HTML exports).
- It does not assert that any listed person has committed a crime; due process belongs to law enforcement and the courts.
- It does not publish telephone numbers or government-issued ID numbers in this index.
- It does not encourage harassment or vigilantism. It documents technical artifacts for authorized review.
Integrity verification
Forensic manifests use MD5 and SHA-256 per file. A master collection hash ties together Telegram exports, report artifacts, and (where applicable) redacted summaries. Examiners should re-hash originals and compare to manifests stored with the evidence package.
Reporting
Suspected child sexual exploitation should be reported to:
- NCMEC CyberTipline: https://www.cybertipline.org/
- FBI: https://tips.fbi.gov/
- Local law enforcement where appropriate.
Technical note on X (Twitter)
Public posting of allegations or evidence must follow X’s rules and applicable law. Law-enforcement requests for subscriber information follow X’s law-enforcement guidelines.
Prepared as a documentation aid. This is not legal advice.