New research into AI-generated non-consensual intimate imagery is drawing attention to an often-overlooked area of internet infrastructure used by websites hosting harmful content.
Researchers from Lancaster University and Dartmouth College identified 88 publicly accessible websites hosting AI-generated non-consensual intimate imagery during a six-week study period. Thirty-eight were dedicated entirely to this type of material, while some individual sites hosted hundreds of thousands of videos. Nearly all of the people depicted were women.
The research is important not only because it documents the scale of the problem, but also because it identifies the technology behind it. These sites rely on hosting services, domain registrars, search engines, content delivery networks, security certificates, and other mainstream infrastructure to function.
The researchers found that a relatively small group of major technology companies appeared repeatedly across those services. Cloudflare was the most frequently identified provider in the study, while Google, Namecheap, WordPress, and Proton appeared across different parts of the infrastructure examined. Around 93% of the sites identified by researchers were also discoverable through Google Search.
This does not mean that those companies created the material, endorsed it, or even knowingly supported the websites involved. Infrastructure providers operate at massive scale, and appearing somewhere in a website's technical stack is not the same as controlling its content.
But the findings do raise a much bigger question for the technology industry—when a service exists primarily to distribute abusive material, how far should responsibility extend beyond the person who created or uploaded it?
Moving beyond individual takedowns
For people targeted by non-consensual intimate imagery, the burden of responding has often fallen heavily on the person being targeted.
Content appears. It is reported. A platform removes it. Copies appear somewhere else. Generative AI makes that cycle much harder to contain.
Convincing sexual images can now be created quickly and at scale without an authentic intimate image ever having existed. Once produced, they can move between websites, social media platforms, messaging services, and private communities, often faster than the person depicted can respond.
The painful reality is that harm does not become less serious because an image is synthetic; it can have devastating consequences. A convincing deepfake can still be seen by friends, family, colleagues, employers, or strangers. It can damage someone's reputation, relationships, and mental wellbeing, while creating a lasting sense that control over their identity has been taken away.
Cybersmile's own research shows how seriously people already view these risks. In our Digital Wellbeing 2026 study of 1,000 U.S. adults, 73% said they were concerned about AI deepfakes, while 65% were concerned about AI-related harassment and abuse.
Those findings reflect how quickly synthetic media has moved from a niche technology issue into a mainstream online-safety concern. They also help explain why the conversation around abuse is beginning to move beyond whether individual posts can be removed after they appear.
Researchers behind the new study argue that companies operating further up the digital supply chain could play a greater role in disrupting websites dedicated to AI-generated non-consensual intimate imagery. That could include withdrawing infrastructure services from sites built around abusive content and making it harder for those services to remain discoverable or repeatedly reappear. Recent enforcement activity suggests that thinking is starting to gain traction.
In September, the Manhattan District Attorney's Office seized the domains of 12 websites allegedly used to distribute and sell AI-generated sexual imagery depicting around 1,200 real people without their consent.
In the UK, measures under the Online Safety Act are also pushing services toward more proactive responses. From September 30, Ofcom began expecting relevant platforms to use hash-matching technology, or similarly effective systems, to help prevent known non-consensual intimate imagery and explicit deepfakes from being uploaded repeatedly.
Different approaches are emerging, but they point in the same direction: online abuse is increasingly being treated as an ecosystem problem rather than a series of isolated uploads.
The systems used by abusive sites
Online harm is still often discussed as if it begins and ends with social media. Someone posts abusive material, somebody reports it, and attention turns to whether the platform responded quickly enough.
However, the systems used for harmful activity are much broader than that. Websites need hosting and domains. They need protection from cyberattacks. They need search visibility. Some rely on payment providers, advertising systems, email services, and other tools that allow them to operate like any other online business.
When those same services are used by websites built around abusive content, questions about responsibility become more complicated. No serious solution involves treating every infrastructure provider as automatically responsible for everything its customers do. There are important questions around evidence, due process, proportionality, and the risk of legitimate services being wrongly removed.
There is also a huge difference between infrastructure being used in connection with one piece of harmful content and continuing to provide essential services to a website whose central purpose is distributing abusive material.
Women are disproportionately targeted
Non-consensual intimate imagery can affect anyone, but women and girls remain disproportionately targeted by many forms of sexualized online abuse. Generative AI has intensified that problem by removing one of the barriers that once existed: the need for an authentic intimate photograph.
A single public image can now be manipulated into sexual content without the subject's knowledge or consent. Public figures may be especially visible targets, but the same tools can be used against classmates, colleagues, former partners, or strangers.
Our Help Center provides practical guidance for people affected by non-consensual intimate imagery and related forms of image-based abuse.
People who experience online abuse should not have to spend their lives chasing harmful content from one website to another. Technology companies across the internet ecosystem have an opportunity to make abuse harder to distribute in the first place. Education and support will always be important, but meaningful online safety also depends on preventing predictable harms through better systems, stronger cooperation, and responsible design.
Scott Freeman, CEO, The Cybersmile Foundation
Cybersmile has seen that pattern through years of work tackling harassment, abuse, and discrimination in digital spaces. Through our No Room for Abuse campaign with Sky Broadband and Guild Esports, we highlighted the sexist abuse experienced by women in gaming while helping people recognize harmful behavior, report it effectively, and become better allies.
No Room for Abuse reached more than 65 million people and was supported by practical resources focused on personal safety, reporting, and creating healthier online communities. It remains important work because people need the knowledge and confidence to respond when abuse occurs. But in reality, education, reporting tools, and individual resilience can only go so far in solving a problem when it is even partly structural.
Responsibility now extends beyond platforms
The most important shift is not just technological. It is also about where responsibility sits.
For years, much of the burden of online safety has been placed on individuals to protect their accounts, block abusive users, report content, save evidence, and ask for help. Those steps are still important, but they should not be the entire safety system.
If abusive websites rely on a predictable network of mainstream technologies to operate online, there is a growing case for looking further upstream and asking what role those services can play in disrupting harm before victims are forced to respond to it repeatedly.
This does not remove responsibility from offenders or social media platforms, nor does it mean that every company in the internet supply chain should become a content moderator. It means recognizing that online abuse is rarely sustained by one actor alone. The same systems that make the internet fast, searchable, and scalable can also make abuse fast, searchable, and scalable.
As AI makes harmful content easier to create, the next phase of online safety may depend increasingly on whether the wider technology ecosystem is willing to make that content harder to distribute.
For people targeted by online abuse, that would represent an important shift away from a model that asks victims to keep chasing harm after it appears and toward one that expects the digital ecosystem to do more to stop that harm from spreading in the first place.