Constructing Offender Typologies From Judicial Data: A Clustering Analysis of Sextortion Cases

A peer-reviewed study published in Sexual Abuse: A Journal of Research and Treatment in March 2026 applied clustering analysis to judicial data to construct offender typologies in sextortion cases. Researchers identified four distinct subtypes: adult-focused financial sextortion; minor-focused CSAM-related sextortion; technologically sophisticated coercion of minors, sometimes resulting in fatal outcomes; and adult-focused hybrid sextortion that escalates from online manipulation to in-person exploitation. The subtypes differ in motivation, technical capacity, victim profiles and sentencing outcomes, with the most technologically advanced group paradoxically receiving more lenient sentences. The study identified that offenders targeting minors were more likely to pressure victims into producing initial sexual images, demand additional images, threaten victims for periods exceeding six months, and urge victims to harm themselves, and that requesting to meet in person was associated with elevated victim risk.

Pattern recognition across the escalation arc that the research documents is the operational requirement prosecutors and platforms currently lack. The four sextortion typologies the study identifies, particularly technologically sophisticated coercion and the progression from image demand to prolonged threats and requests for self-harm, describe behavioural sequences rather than static content, and each sequence is detectable in direct-message exchanges before the harm reaches its most serious stage. The anti-sextortion detection module within Guardii, backed by Startmate, is designed to surface precisely these patterns: sustained targeting, escalating demands, coercive language and the shift from flattery to threat that characterises both minor-focused CSAM sextortion and hybrid cases. Guardii operates across Instagram, Snapchat, Discord, Roblox and other platforms, flagging conversations that match the documented risk typologies and blocking contact or alerting a parent, school or authority in real time, enabling intervention during the grooming or early coercion phase rather than after a child has been driven to self-harm or an offender has secured material for ongoing blackmail.