Sites hosting AI-generated non-consensual imagery identified: 88 (Source: Morgan, Farid and Nightingale, Journal of Online Trust and Safety (September 30, 2026))
A website is a stack of rented parts. One company sells the domain. Another hosts the files. A third speeds up delivery. Each layer is a vendor's business decision. A new study asks what happens when that stack serves sites that publish AI-made sexual images of real people, made without their consent.
In this sample, the harm rests on ordinary supply chains. The sites did not need a hidden corner of the internet. They used parts that anyone can rent.
What the researchers found
The study appeared in the Journal of Online Trust and Safety, a peer-reviewed Stanford publication. Its authors are Sarah Morgan, Sophie Nightingale and Hany Farid, from Lancaster University and Dartmouth College. They looked at AI-generated non-consensual intimate imagery, which the authors note is illegal in several countries.
They identified 88 publicly available sites that host it. Of these, 38 focus entirely on synthetic imagery. A majority of the 88 sites use Cloudflare for web hosting. The authors also report that a Google search can surface most of the sites.
How the team mapped the stack
The team collected 400 URLs over six weeks in February and March. They used keyword searches and Google Alerts. They then narrowed the list to 88 sites that were actively hosting such imagery.
Next, they used open-source tools to see which vendors each site relied on. One of them, WHOIS, is a public lookup that shows who registered a domain.
Five providers stood out, each at a different layer.
Cloudflare supplied hosting, content delivery, domain-name server services and analytics tools. Namecheap was the main domain registrar. Proton ran the mail servers. WordPress supplied the content management software for most of the sites.
Google played two roles on most of the sites studied. It issued the certificates that let browsers make encrypted connections. It also sold the ad space.
404 Media reports that the images mostly showed women in the public eye. Examples include actresses, singers, K-pop idols and women in politics or activism. These are real people whose likenesses are being manufactured and spread.
What the providers said
404 Media reports that each of these providers forbids illegal use of its services. The study notes that their terms often prohibit illegal and harmful content. The authors argue the companies should revise their policies. They also call for regulation that holds companies responsible for illegal content they let spread.
Three of the named companies gave 404 Media no reply when asked about the findings. They are Cloudflare, Proton and Namecheap.
Google did reply. It said it could not investigate without the specific domains from the report. It said its policies cover AI-generated material across its products. It added that its ad platform bans monetizing or promoting this content. It said offending sites can lose ads and advertiser accounts can be suspended. It also said people can ask Search to remove such images.
What the study does not show
The 88 sites come from keyword and alert-based searching in one six-week window. They are a sample, not a count of all such sites. The provider figures describe those 88 sites only.
The material reviewed here does not show that any provider was told about a specific site and declined to act. Google's reply turns on that point. The call for policy change and regulation is the authors' position.
Why executives should care
The authors say advances in generative AI have driven a sharp rise in this imagery. Infrastructure is what lets it be published and found. The cost falls first on the people pictured.
It also raises a question for any company that buys from these same layers. A vendor's terms may ban illegal use. The study asks how that ban works in practice.
Questions to put to your team
Ask procurement whether vendor contracts say how abuse reports are handled, and how fast. Ask legal whether you have a documented way to report harmful content to your own providers. Ask the same about content on your own platforms.
If your company sells hosting, ads or domains, ask who reviews reports and what evidence they need. Google's reply shows that specific domain names matter.
If you buy online advertising, ask your agency where placements appear and how they are screened.
Think of a landlord whose lease bans illegal activity. Sooner or later, someone asks what checks the building actually has. The same question now reaches the companies that host, route, certify and monetize the internet.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Stanford Journal of Online Trust and Safety.
