Researchers Name the Infrastructure Firms Powering AI Deepfake Pornography Sites

A new peer-reviewed study has, for the first time, mapped and named the technological infrastructure that keeps online sites hosting AI-generated non-consensual intimate imagery running. The research, led by Sarah Morgan of Lancaster University with co-authors Dr Sophie Nightingale, also of Lancaster University, and Professor Hany Farid of Dartmouth College, was published in the Journal of Online Trust and Safety under the title ‘The Backbone of Abuse’. Rather than focusing solely on the perpetrators who create fake sexual imagery, the team turned their attention to the often-invisible layer of the internet that allows the offending sites to exist at all: the hosting companies, domain name servers and content delivery networks that sit beneath them.

The scale of the problem the researchers document is stark. In 2023, estimates suggested that around 500,000 AI-generated non-consensual intimate videos existed online. By 2025, that figure had grown to an estimated 8 million, with the overwhelming majority of targets being women and girls. The ease with which such content can now be generated from a single photograph, and then distributed through websites, social media platforms and private messaging services, many of them protected by end-to-end encryption, has allowed the volume of material to multiply at a pace that far outstrips current responses.

The harms associated with this form of digital abuse are increasingly well documented. Sarah Morgan noted that anyone with a single photo available online can be quickly and easily targeted in content that falsely depicts them in sexual or intimate contexts of any nature, without their consent, and that emerging evidence demonstrates the wide-ranging and persistent harms of this abuse. A 2024 investigation by Channel 4 News found that almost four thousand famous people were listed across five of the most visited deepfake pornography websites, including female actors, journalists, musicians, television stars and YouTubers whose faces had been superimposed onto pornographic material using artificial intelligence. Industry analysis cited in the study further indicated that 40 of the most visited deepfake pornography sites had accumulated more than four billion views.

To understand how these sites survive online, the research team examined the technical architecture that underpins them. Infrastructure, in this context, refers to the technologies and systems, such as website hosting, domain name servers and content delivery networks, that enable a website to deliver content to users. Without these services, a site cannot successfully function, no matter where in the world its operators are based. This dependency creates a potential point of leverage: if infrastructure providers refuse to serve sites hosting abusive content, those sites become dramatically harder to reach.

The study is the first systematic attempt to identify and name the key players, whether knowingly or unknowingly, facilitating the technological infrastructure supporting sites that host AI-generated non-consensual intimate imagery. The researchers identified 88 sites hosting such content, of which 38 exclusively hosted it. In capturing contextual data relating to each site, they found that some hosted hundreds of thousands of videos. The content primarily targeted Hollywood and Hindi-film stars, K-pop idols, and well-known feminists and activists, with nearly all of the material featuring females.

Among the findings, five key players emerged as the dominant infrastructure providers enabling the sites to function, with Cloudflare identified as the most recurring name. The team also assessed how easily the sites could be found through ordinary web searches, revealing that 93 percent of them were readily discoverable via Google Search. This discoverability matters because it means that victims, and indeed anyone curious, can stumble upon the abusive material with minimal effort, amplifying the reach and impact of the original violation.

Legislative responses are beginning to emerge in several jurisdictions. England and Wales, among other countries, have moved to criminalise the sharing, creating or soliciting of AI-generated non-consensual intimate imagery. However, Morgan argues that legislation alone is not enough. Such laws will offer some deterrence, she said, but further steps are needed to prevent the abuse from occurring in the first place. She posed the question of whether the distribution supply can be cut, arguing that this abuse needs to be prevented and that putting pressure on the technology platforms which distribute such content to the public may be the most optimal chance of reducing what she described as the wildfire spread of AI-generated sexual abuse.

The researchers issued specific technical recommendations for infrastructure providers. They call on the companies facilitating AI-NCII-hosting sites to take a firm stance on the abusive content: providers should block sites that exclusively host AI-generated non-consensual intimate imagery, and suspend services for sites that host such content within a larger offering until good-faith efforts are made to remove the abuse. They also recommend deploying preventative safeguards, such as utilising perceptual hashing to extract digital signatures of confirmed abusive content and stop its redistribution. Perceptual hashing is a technique that generates a fingerprint of an image or video based on its visual characteristics, allowing identical or near-identical copies to be detected and blocked even if file names or metadata are changed, a method already used against child sexual abuse material and terrorist content on major platforms.

Dr Sophie Nightingale added that it is also time to stop blaming the targets of this abuse. All too often, she said, the victims of abuse that is sexual in nature are attributed responsibility, and there is an urgent need to change this. Blame, she argued, should be assigned to the perpetrators who create, distribute and facilitate the sharing of fake content that has the potential to ruin lives. This reframing shifts the focus from questions about what victims did or did not share online to the conduct of those who manufacture the imagery and the companies whose services make its distribution possible.

The Lancaster University team is continuing to examine the impacts and harms of non-consensual intimate imagery more broadly, and has opened a confidential survey inviting people to share their views on how this abuse could be tackled or to describe their own experiences. As the volume of AI-generated sexual abuse material continues to climb, the study’s central message is that the responsibility cannot rest with victims or with criminal law alone. The companies that provide the hosting, domain and delivery services forming the backbone of the web now face a direct, evidence-based call to action: identify the abuse on your network, cut off the sites built on it, and deploy the technical tools that already exist to stop the spread.

Subject of Research: Infrastructure providers enabling AI-generated non-consensual intimate imagery websites

Article Title: Call for technology providers to take action on AI non-consensual ‘deepfake pornography’

Article References: Call for technology providers to take action on AI non-consensual ‘deepfake pornography’. (n.d.). Original publication

Image Credits: AI Generated

DOI: Not provided

Keywords: deepfake pornography, AI-NCII, Cloudflare, infrastructure, perceptual hashing, Lancaster University, Journal of Online Trust and Safety, content delivery networks, non-consensual intimate imagery, online abuse, digital harms, platform regulation