Behind the Disguise: Investigating 3D Boys and the Normalization of Fictional Abuse

This report documents an investigation into a hidden service known as “3D Boys”, discovered via StealthMole’s Darkweb Tracker. While the platform publicly presents itself as a digital art and storytelling forum, the investigation uncovered significant indicators of deeper misuse involving the creation and exchange of synthetic content centered around fictional youth.

Through infrastructure mapping and content analysis, the platform is revealed to be a case study in how anonymized networks and generative technologies are being adapted for ethically concerning purposes. The findings outlined in this report highlight how simulated media is being operationalized in dark web environments and expose the technical and behavioral patterns surrounding its distribution.

This case contributes to a growing body of intelligence on the abuse of emerging tools for illicit content generation and the use of legal ambiguity to mask harmful intent.

Incident Trigger & Initial Investigation

The investigation into the platform began unintentionally during the profiling of a separate dark web case using StealthMole. While cross-referencing infrastructure indicators, an .onion domain stood out due to its unusual name and metadata associations:

• 3d****************************************************d.onion

Upon loading the address, the domain resolved to a site called “3D Boys – Home to Boys and Art.” The site presented itself as a digital art and storytelling community focused on fictional youth characters rendered in 3D. Its homepage included a prominently displayed disclaimer indicating that no illegal material was allowed or hosted.

Despite this, the structure and tag system on the homepage immediately raised concerns. Among the most active tags were terms that, while not illegal on their own, are widely associated with simulated exploitation content. Categories such as “M-b,” “b-b,” “T*********n,” “Sl*****y,” and “Hu********n” appeared across the tag cloud and in post counts. The mixture of these themes, combined with the “artistic” positioning of the platform, suggested a potential attempt to conceal or reframe content that would otherwise attract scrutiny.

This contradiction between the public disclaimer and the site’s internal categorization prompted a deeper investigation. Using StealthMole’s platform tools, the domain was profiled across multiple data points. The platform’s infrastructure was examined for associated email addresses, crypto wallets, IP connections, and related domains. Further, using StealthMole’s indexing capabilities, the platform’s internal content including posts, image galleries, downloadable documents, and metadata, was directly retrieved and analyzed.

These initial steps confirmed that the platform was not operating as a harmless artistic community, but rather as a well-structured and anonymized environment for sharing AI-generated and 3D-rendered images of minor-like characters in sexualized or abusive scenarios, as well as fictional stories describing similar themes. The level of organization, consistency of content, and use of generative tools like AI image creation strongly indicated deliberate intent. This prompted a full profiling effort to document the platform’s structure, content distribution, and associated threat indicators.

The nature, organization, and delivery of this material, paired with the surrounding infrastructure, indicated that the platform was not simply an art forum, but a structured and anonymized hub for sharing highly inappropriate synthetic content. This led to the decision to escalate the investigation and document its findings in full.

Platform Content and Behavior Analysis

The internal structure of the 3D Boys platform reveals a tightly organized community designed to facilitate the ongoing creation and sharing of fictional content centered around minor-like characters. The forum layout mimics that of legitimate digital art platforms, with sections dedicated to image posts, story submissions, and community interaction. However, the thematic direction of the shared material is clearly focused on simulated exploitation, particularly through the use of digital tools to create lifelike depictions of minors in inappropriate scenarios.

A central component of the platform is its tag-based categorization system, which enables efficient navigation and content discovery for users seeking specific themes. Prominent tags include terms such as “M-*” (commonly interpreted as “M**-***”), “b-b” (b**-b**), “T*******n,” “N*****n,” “Sl*****y,” “Di****r,” and “H*********n.” These are not general artistic categories, but instead reflect a deliberate focus on fictional narratives and imagery that involve domination, infantilization, or abuse-related themes. The prevalence of such tags, along with the volume of associated content, indicates consistent and ongoing activity from contributors.

Much of the platform’s visual material is described by users as 3D rendered, created using tools like D** S******, P*****, and B*******. These images are notably realistic in appearance, often resembling photographs in terms of lighting, anatomy, and detail. Although the platform itself does not reference AI generation, some of the images appear to exhibit qualities often associated with modern generative processes, such as pattern repetition and photorealistic styling. However, all content reviewed is framed within the community as 3D artwork or fictional renderings.

In addition to the image-based content, the platform hosts a collection of PDF documents, 28 found through StealthMole’s Darkweb Tracker, each presented as part of an ongoing fictional series. These documents are structured by chapter and often include introductory notes or warnings referencing violent and exploitative themes. One story, titled "W***** the M*** S****** G****", contains a prelude describing scenes of abduction, torture, and death. These texts are not isolated works; rather, they are part of a larger collaborative environment in which writers, proofreaders, and artists contribute to building ongoing narratives. Contributors such as “In*********,” “B*******,” “X*****,” and “N****_Z****_V***” are credited by name in prefaces or metadata.

User interaction within the forum reflects a participatory structure. Members provide detailed feedback, request specific themes, and engage with serialized content across multiple threads. This dynamic promotes a cycle of production and refinement that supports persistent content development aligned with the platform’s thematic focus.

Overall, 3D Boys functions less as a passive archive and more as a closed-loop creative ecosystem. Its combination of structured categorization, high-volume image production, serialized storytelling, and engaged user participation forms a self-sustaining space that facilitates the continued creation and exchange of exploitative fictional content: all while framing itself as artistic expression.

Infrastructure and Actor Indicators

Further investigation through StealthMole’s infrastructure mapping tools revealed several key digital assets linked to the 3D Boys platform. These include cryptocurrency wallets, anonymized email addresses, network-level indicators, and a possible clearnet-linked social media account. Together, these artifacts provide insight into the operational model and potential attribution trails of the platform’s administrators or core contributors.

A total of three cryptocurrency wallets were identified:

Bitcoin address:

• 1Z*****************************Q

Monero addresses:

• 43P***************************************************************************ng
• 42R***************************************************************************8

The presence of Monero wallets suggests an emphasis on privacy and untraceable transactions: a common practice on dark web platforms seeking to obscure donor identities or service payments. These wallets were directly associated with the domain during domain-level queries in StealthMole’s Darkweb Tracker.

Three email addresses were also surfaced in relation to the domain.

• l************6@protonmail.com
• A******e.A******e@b*********e.**
• A**************te@cocaine.****a

One is a ProtonMail account (l*********6@protonmail.com), a provider widely used for anonymous communication. The others point toward decentralized or niche communication platforms, which are often favored by threat actors due to their resistance to monitoring and takedown. The use of @cocaine.ninja in particular indicates possible crossover with other dark web forums or illegal service providers.

In addition to wallet and communication data, a set of six IP addresses were uncovered during infrastructure analysis.

• *.*0.*.**9 - China
• *.1*.0.* - United States
• 4.*5.*.* - United States
• *.**.0.2 - United States
• 4.1*.0.* - United States
• *.*0.1.*1 - United States

One IP (*.*0.*.**9) was specifically flagged with a child-related URL label, indicating a possible history of abuse content hosting or access. The remaining IPs were also associated with this domain and may represent backend infrastructure, mirrors, or routing nodes.

A potential clearnet connection was also observed through a linked Twitter account: https://twitter.com/M********D. While not confirmed as directly operated by the site’s administrators, the handle was listed in StealthMole’s correlation results for this domain and may represent an operational mistake, an alias crossover, a member or just a disinformation tactic.

Conclusion

The 3D Boys platform represents a concerning example of how online communities are adapting digital tools to facilitate the production and distribution of harmful fictional content, while exploiting the legal ambiguity that surrounds simulated media. Though presented as a creative forum for 3D-rendered artwork and storytelling, the site's structure, thematic focus, and contributor activity clearly indicate intent to normalize and circulate material that simulates the abuse of minors in both visual and narrative form.

The use of lifelike 3D rendering software, combined with the platform's categorization system and serialized documents, points to a deliberate effort to replicate abusive scenarios in a controlled, yet high-fidelity digital format. While the content avoids direct violations of current CSAM laws in many jurisdictions by relying on fictional representations, it nonetheless serves the same behavioral and psychological ecosystem: one that desensitizes users, encourages harmful ideation, and potentially acts as a gateway toward more serious offenses.

The surrounding infrastructure further confirms the operational maturity of the platform. The integration of privacy-focused crypto wallets, anonymized email services, and evasive communication platforms demonstrates a clear intent to remain hidden from enforcement and scrutiny.

This case reinforces the growing challenge posed by simulated abuse material and the use of generative technologies in dark web spaces. As access to digital content creation tools continues to evolve, similar platforms are likely to proliferate, leveraging 3D rendering, anonymity networks, and decentralized payment systems to distribute content that, while fictional, is clearly designed to exploit a vulnerable thematic space.

Editorial Note

Attribution in cases involving fictional exploitation is uniquely complex. Platforms like 3D Boys operate in the space between legality and intent, where no real-world victims may be present, yet the content and community behavior are clearly aligned with abusive ideologies. By framing their material as art or fantasy, such platforms exploit legal loopholes while cultivating persistent, high-engagement environments that normalize harmful narratives.

This investigation was made possible through StealthMole’s capacity to index and correlate across deep content layers and anonymized infrastructure, surfacing connections between domain activity, contributor behavior, and platform-linked assets. In an era where simulated abuse can be digitally created and distributed at scale, tools like StealthMole are essential for exposing how these communities operate and for recognizing the real-world risks embedded in what may appear, on the surface, as fiction.

To access the unmasked report or full details, please reach out to us separately.
Contact us: support@stealthmole.com