Salva Liberos

Stripe Checkout Evidence — Payment Infrastructure

The saved HTML page below is a forensic capture of the Stripe-powered checkout page used by the operation to process payments for CSAM folders. It was preserved from the live site at time of investigation and is rendered here in a sandboxed iframe.

Telegram export log (investigation)

Redacted excerpts from FINALEVIDENCEPACKAGE/TelegramExport JSON exports. Illicit product labels, full bot handles, user IDs, and full payment session URLs are redacted for this index. Source folders: 06_OnlyNfsw-Suport_personal-chat_23msgs/result.json02_OnlyNsfw-Shop_bot-chat_5msgs/result.json

Support DM (investigation account ↔ operator support)

06_OnlyNfsw-Suport_personal-chat_23msgs

Buyer (undercover)
hey what other packs you have
Buyer (undercover)
how do i pay
Support
Apple Pay Bank Card Crypto
Buyer (undercover)
can i do apple pay
Support
Do you already know which folders you want?
Buyer (undercover)
[REDACTED — buyer named a specific folder tier in the original export]
Support
https://t.me/[REDACTED_SALES_BOT_HANDLE]
Support
You can pay with Apple Pay directly in the bot.
Support
Just select [REDACTED — folder name as shown in bot menu].
Buyer (undercover)
i only see a stripe link when i go to checkout
Support
Yes, pay $45 using this Stripe link; it has Apple Pay.
Buyer (undercover)
i just see card pay enter debit or credit card details
Buyer (undercover)
i don't see a apple pay link
Support
[Video message — screen recording attached in export; no text body]
Support
For me, Apple Pay appears
Buyer (undercover)
i doesn't for me though
Support
If you can pay by card, don't worry, Stripe is reliable.
Support
https://t.me/[REDACTED_ALTERNATE_BOT_HANDLE]
Support
Try paying $45 here.

Automated sales bot (same investigation — checkout handoff)

02_OnlyNsfw-Shop_bot-chat_5msgs

Sales bot
Finish the payment through the link below
Make payment 👉https://checkout.stripe.com/c/pay/cs_live_[SESSION_REDACTED]

Full cs_live_* URL preserved in sealed result.json; this index shows structure only.

Key findings

Payment processorStripe (San Francisco, CA)
Accepted methodsCredit/debit card, Apple Pay, Google Pay
Price range$25 — $250 per folder
Source filesCcatec.htm (548 KB) + Ccatec_files/ (36 assets)
Also capturedstripegateway.jpg — screenshot of the checkout flow
Evidence locationFINALEVIDENCEPACKAGE/PaymentEvidence/

How Telegram leads to this Stripe page

The chain below is reconstructed from the forensic report (Sections 5.2–5.4) and Telegram exports (e.g. ChatExport_2026-04-06 variants). Handles, user IDs, and illicit category labels are redacted on this page; full identifiers remain in sealed case materials.

1. SurfacePublic Telegram channels/groups run promos; some posts point buyers to a human sales or support contact (DM), consistent with group exports that say “DM me” rather than posting a payment URL directly.
2. Support DMA support account discusses payment options (card, Apple Pay, crypto) and, when the buyer picks a product tier, sends a link to an automated sales bot (not the Stripe URL yet).
3. Bot storefrontThe bot presents priced folders via inline menus. On selection it issues a Stripe Checkout session (domain checkout.stripe.com, live session id cs_live_… in exports).
4. This captureThe iframe below is a preserved HTML snapshot of that hosted checkout (files Ccatec.htm / Ccatec_files/), i.e. what the buyer sees after the bot hands off to Stripe.

Redacted excerpts (support chat, payment mechanics only — source: forensic report, Section 5.3):

Support: “Apple Pay / Bank Card / Crypto”

Buyer: “how do i pay”

Support: [link to automated sales bot] “You can pay with Apple Pay directly in the bot.” “Just select [folder tier].”

Buyer: “i only see a stripe link when i go to checkout”

Support: “Yes, pay [amount] using this Stripe link; it has Apple Pay.” (amount on file in case report.)

Mermaid diagram (copy into any Mermaid viewer)
flowchart LR
  subgraph surface["Surface"]
    A[Telegram groups / ads] --> B[DM: sales or support]
  end
  subgraph checkout["Hosted payment"]
    C[Automated sales bot]
    D[checkout.stripe.com]
    E[This page: Ccatec.htm capture]
  end
  B -->|link to bot| C
  C -->|Stripe Checkout session| D
  D -.->|forensic save| E

Captured checkout page

This is a sandboxed rendering of the saved Stripe checkout HTML. No live network requests are made. The page is served from local static files.

Original file: Ccatec.htm · SHA-256 recorded in PACKAGE_MANIFEST · Rendering may differ from original due to sandboxing and missing external resources

Agencies and platforms notified

This matter was reported to the following agencies and platforms: