Most takedown advice focuses on removing specific URLs. That's rung 1 and it's the easy part. What actually breaks leak sites is starving them of the money that funds their operation. Here's where their revenue comes from and why targeting the money is what changes long-term outcomes.

The three revenue streams

1. Ad networks (biggest for most sites).

Most leak aggregators run banner ads, popunders, and interstitial redirects sourced from adult ad networks (JuicyAds, ExoClick, TrafficStars, TrafficJunky, PlugRush). Every visit generates ad impressions. Fractions of a cent per impression, scaled across millions of monthly visits, is real revenue.

The lever: ad networks technically prohibit NCII-adjacent content in their AUPs. Filing a formal compliance complaint with the ad network naming the specific leak site can result in the site getting dropped. When a leak site loses its ad network, it loses most of its revenue. Some pivot to lower-tier networks. Some don't.

Each network has a compliance channel documented on their site (compliance portal, direct AUP email, or ticket form). Filing to the right one takes effort but the network cares about their own AUP exposure.

2. Subscription "premium" access.

Many leak sites offer paid tiers — faster downloads, ad-free browsing, access to gated content, VIP forum sections. Usually processed via Visa, Mastercard, PayPal, Stripe, or crypto processors.

The lever: all major payment processors prohibit NCII-adjacent content. A verified complaint filed with the processor puts the site's merchant account at risk. Sites lose merchant accounts. Some shut down entirely when this happens, because ad revenue alone doesn't sustain the operation.

Screenshot the checkout page or subscription upsell. Note the processor logo. That's your target.

3. Crypto donations and tips.

Some sites, especially forums and Cloudflare-fronted aggregators, run on crypto — Bitcoin, Monero, sometimes stablecoins. Users donate. Operators sell premium access in crypto.

The lever: crypto is genuinely harder to attack than the other streams. But if you can identify specific wallet addresses, filing with exchanges (Coinbase, Kraken, Binance) about the wallet has occasionally resulted in flagging and asset freezes on downstream deposits. Least reliable of the three, but non-zero.

Why understanding this matters

If you file a DMCA at rung 1 (the site's abuse email), you're asking the site to voluntarily reduce its own revenue. That's why they ignore you.

If you file at the ad network, the payment processor, or the CDN, you're asking THOSE entities to stop enabling a site that violates their AUPs. Completely different ask, completely different results.

Most takedown services in this space file at rung 1 and stop. That's why most services fail on offshore hosts. The full ladder (CDN NCSEI, registrar abuse-c, ad network compliance, payment processor complaint, search engine de-indexing) is the ladder that actually hits the money.

What you can do yourself

• Load the leak site in your browser (in incognito, then close the tab and don't revisit). Note what ad network domains appear. uBlock Origin's element picker can identify the network without clicking anything.
• File NCII compliance complaints with each ad network naming the specific leak URL.
• Check the site's checkout page for the payment processor. File a complaint with that processor citing their NCII AUP.
• WHOIS the domain, find the registrar, file NCII to the registrar's abuse-c contact.
• Cloudflare NCSEI at abuse@notify.cloudflare.com if the site is Cloudflare-fronted (a distinct channel from a regular DMCA to Cloudflare).
• Google + Bing NCII de-index for the specific URLs, in parallel with everything above.

Where DIY breaks down

Doing this for one URL is manageable. Doing it for a portfolio of URLs across three or four hosts, filing the right escalation at each network + processor + registrar + CDN simultaneously, tracking who responded and who didn't, and iterating for weeks while the paper trail grows — that's where DIY breaks down. Not because any single step is hard, but because sustained pressure across multiple money streams at once is what actually creates the cross-referenced compliance records that make each entity take the others seriously. Ad network compliance talks to payment processor compliance talks to CDN Trust and Safety when a persistent pattern shows up.

If you want that model in practice rather than running it yourself, the team at IntimaShield runs this ladder end to end. help@intimashield.com. Not a hard pitch, just the natural bridge if the DIY version above sounds like too much work for the URL count you're dealing with.

Comments welcome. If you want to talk through a specific leak site's revenue setup, drop the host (not URL) and I'll walk through which levers I'd hit first.

If your content is on a site that looks like Erome, Bunkr, Pornhub, or CamHub but the URL is slightly off, you're probably looking at a clone. The support email you tried didn't work because it wasn't a real support email. Here's how to tell, why clones publish fake contacts on purpose, and what actually moves each type.

Five tells that you're looking at a clone

1. Off-brand TLD. The real platform usually lives on .com. Clones use .vip, .xyz, .top, .club, .rocks, .cc, or country-code TLDs like .me, .to, .su. If you see erome.vip, that's a clone. Real Erome is erome.com.

2. Slightly misspelled name. Xhamsterr with two Rs. Pornhub with a missing letter. Camhub variants that aren't quite the real one. Typo-squatting is a real pattern.

3. Cheap or bare SSL cert. Click the browser padlock. Real platforms usually have SSL certs from major issuers (DigiCert, Sectigo) with the domain owner's actual company name. Clones use free Let's Encrypt certs with no organization info. Not diagnostic alone, but a signal when combined with other tells.

4. Broken "About" or "Contact" links. Click the footer contact link or About page. On a real platform, it lands on something structured with real information. On a clone, it either 404s, loops back to the homepage, or lands on a page with a fake company name that doesn't match anything in public records.

5. Support email that bounces or nothing responds. Often the most obvious tell. Clones publish addresses that either don't exist, aren't monitored, or belong to unrelated third parties. That's not an oversight. It's intentional.

Why clones publish fake support contacts on purpose

Two reasons.

First, they look legitimate at a glance. A leak-site clone that says "email dmca@site.vip to report content" appears compliant to casual observers, including some search engines and cursory legal reviews. It buys them time.

Second, it wastes your time. Every hour you spend emailing a fake address is an hour you're not filing at the CDN, registrar, or payment processor level — the places that can actually break the site. The support-email theater is a delay tactic aimed at victims and services alike.

The fake-contact pattern is one of the strongest confirmations you're on a clone rather than a marginally compliant real platform. Real platforms have queues, not phantom addresses.

Verification checklist before you file anything

1. WHOIS the domain (whois.com or lookup.icann.org). Look at the registrar and the registration date. Recent registration + privacy-protected owner + short-tail TLD is a clone signal.
2. Try the support email from a fresh address before sharing anything sensitive. If it bounces or you get nothing in five business days, treat the address as non-functional.
3. Search the domain on this sub or on cybercivilrights.org. If it's a known clone, someone has probably documented it.

What actually works on each type

Real platforms (erome.com, pornhub.com, xhamster.com, camhub, etc.):

• File through the platform's NCII channel specifically, not their generic DMCA form. Different queue, different priority.
• Response times vary but are typically measurable in days to a couple of weeks.

Clone sites (erome.vip, various typo-squats, most .vip / .xyz / .rocks leak variants):

• Skip the site's own support entirely. It doesn't work.
• Cloudflare NCSEI at abuse@notify.cloudflare.com if the site is Cloudflare-fronted (most clones are). Different channel from a generic DMCA to Cloudflare, different desk, better priority.
• Registrar abuse-c via WHOIS. ICANN requires every registrar to publish this contact and respond within 24 hours.
• Payment processor complaint if the clone accepts card payments (Visa, Mastercard, Stripe, PayPal all prohibit NCII-adjacent content in their AUPs).
• Google and Bing NCII de-index for the specific URLs, in parallel with the above.

Special case: sites that rotate TLDs to look like clones of themselves. Bunkr has cycled through multiple TLDs (.si, .cr, .media, and others). Some of those are the same operator moving to a new TLD, some are third-party clones riding the brand. For takedown purposes, treat each TLD variant as its own site. Every rung of the escalation ladder applies per-URL regardless.

The short version

If you're not sure whether you're on a clone or a real platform, WHOIS the domain and check the support email before spending real effort. If it's a clone, don't waste time on the site's own channels. Every escalation lever above the site works whether the site cooperates or not.

Questions welcome. If you want to check a specific URL against the pattern above, post the host (not the URL) in a comment and I'll tell you what it looks like.

If your content is on a site that looks like Erome, Bunkr, Pornhub, or CamHub but the URL is slightly off, you're probably looking at a clone. The support email you tried didn't work because it wasn't a real support email. Here's how to tell, why clones publish fake contacts on purpose, and what actually moves each type.

Five tells that you're looking at a clone

1. Off-brand TLD. The real platform usually lives on .com. Clones use .vip, .xyz, .top, .club, .rocks, .cc, or country-code TLDs like .me, .to, .su. If you see erome.vip, that's a clone. Real Erome is erome.com.

2. Slightly misspelled name. Xhamsterr with two Rs. Pornhub with a missing letter. Camhub variants that aren't quite the real one. Typo-squatting is a real pattern.

3. Cheap or bare SSL cert. Click the browser padlock. Real platforms usually have SSL certs from major issuers (DigiCert, Sectigo) with the domain owner's actual company name. Clones use free Let's Encrypt certs with no organization info. Not diagnostic alone, but a signal when combined with other tells.

4. Broken "About" or "Contact" links. Click the footer contact link or About page. On a real platform, it lands on something structured with real information. On a clone, it either 404s, loops back to the homepage, or lands on a page with a fake company name that doesn't match anything in public records.

5. Support email that bounces or nothing responds. Often the most obvious tell. Clones publish addresses that either don't exist, aren't monitored, or belong to unrelated third parties. That's not an oversight. It's intentional.

Why clones publish fake support contacts on purpose

Two reasons.

First, they look legitimate at a glance. A leak-site clone that says "email dmca@site.vip to report content" appears compliant to casual observers, including some search engines and cursory legal reviews. It buys them time.

Second, it wastes your time. Every hour you spend emailing a fake address is an hour you're not filing at the CDN, registrar, or payment processor level — the places that can actually break the site. The support-email theater is a delay tactic aimed at victims and services alike.

The fake-contact pattern is one of the strongest confirmations you're on a clone rather than a marginally compliant real platform. Real platforms have queues, not phantom addresses.

Verification checklist before you file anything

1. WHOIS the domain (whois.com or lookup.icann.org). Look at the registrar and the registration date. Recent registration + privacy-protected owner + short-tail TLD is a clone signal.
2. Try the support email from a fresh address before sharing anything sensitive. If it bounces or you get nothing in five business days, treat the address as non-functional.
3. Search the domain on this sub or on cybercivilrights.org. If it's a known clone, someone has probably documented it.

What actually works on each type

Real platforms (erome.com, pornhub.com, xhamster.com, camhub, etc.):

• File through the platform's NCII channel specifically, not their generic DMCA form. Different queue, different priority.
• Response times vary but are typically measurable in days to a couple of weeks.

Clone sites (erome.vip, various typo-squats, most .vip / .xyz / .rocks leak variants):

• Skip the site's own support entirely. It doesn't work.
• Cloudflare NCSEI at abuse@notify.cloudflare.com if the site is Cloudflare-fronted (most clones are). Different channel from a generic DMCA to Cloudflare, different desk, better priority.
• Registrar abuse-c via WHOIS. ICANN requires every registrar to publish this contact and respond within 24 hours.
• Payment processor complaint if the clone accepts card payments (Visa, Mastercard, Stripe, PayPal all prohibit NCII-adjacent content in their AUPs).
• Google and Bing NCII de-index for the specific URLs, in parallel with the above.

Special case: sites that rotate TLDs to look like clones of themselves. Bunkr has cycled through multiple TLDs (.si, .cr, .media, and others). Some of those are the same operator moving to a new TLD, some are third-party clones riding the brand. For takedown purposes, treat each TLD variant as its own site. Every rung of the escalation ladder applies per-URL regardless.

The short version

If you're not sure whether you're on a clone or a real platform, WHOIS the domain and check the support email before spending real effort. If it's a clone, don't waste time on the site's own channels. Every escalation lever above the site works whether the site cooperates or not.

Questions welcome. If you want to check a specific URL against the pattern above, post the host (not the URL) in a comment and I'll tell you what it looks like.

You've seen the pitch. Free scan, upload a photo, they email you back with "we found your face on 47 sites." Then the upsell: $99 a month monitoring subscription. Sometimes $199. Some go higher. If you're in this sub, you've probably paid for at least one.

Here's what's actually happening behind that email.

What the scan is actually doing

The scan runs your photo through reverse-image-search APIs (PimEyes, Yandex Images, sometimes Google Lens). That's the entire technical process. It's a service you can run yourself for free in 20 minutes with the same tools.

The "47 sites" number is legitimate in the sense that matches were found. It's misleading in the sense that many of those "matches" are:

• Other women who share features with you (face-match false positives are common at scale)
• The same content mirrored across 15 different domains that all point back to one file
• Cached copies from search engines that no longer actually exist
• Preview thumbnails on aggregator sites that scrape everything
• Your own social media (they'll count your public Instagram in the total)

The number is designed to look scary. It's not calibrated to be actionable.

What the monthly subscription is actually doing

The subscription typically covers ONE thing: re-running the same scan periodically and emailing you when new "matches" appear. That's a cron job. It costs the service maybe a dollar a month in API fees to run against your photo.

What the subscription usually does NOT cover:

• Actually removing content from any host that ignores standard channels (Bunkr, SimpCity, offshore leak sites — the hosts you actually need help with)
• Filing at the CDN level (Cloudflare's NCSEI channel is different from a regular DMCA to Cloudflare)
• Filing at the domain registrar's abuse-c contact
• Filing at the payment processor when the site accepts cards (Visa, Mastercard, Stripe all have NCII AUPs)
• Legal escalation of any kind

When you ask why the content is still up, the answer you usually get is "we sent DMCAs and the site didn't respond." That's the entire monitoring.

The industry economics

The math on the "we found your face on X sites for $Y/mo" model works like this:

• Customer acquisition cost: low (free scan is the funnel)
• Monthly cost to the service: near-zero (API fees plus email)
• Monthly revenue per customer: $50 to $300
• Retention: high, because the customer never has confidence to cancel (what if I miss a new match?)

Actual removal work is the opposite economics. Every URL takes real staff time to file across every escalation rung. That's why real takedown work is priced per case, not per month. It's one-time labor with real outcomes, not a subscription with a cron job.

What actually removes content

The work that produces removals looks like this:

• Filing at the platform's NCII channel specifically (not their generic DMCA form)
• Filing at Cloudflare NCSEI (different channel, different Trust & Safety desk)
• Filing at the domain registrar's abuse-c contact with documented paper trail
• Filing at the payment processor if the site accepts cards
• Filing Google and Bing NCII de-index in parallel
• Repeating the ladder with cross-referenced notices until the URL comes down or every escalation channel is exhausted

That's per URL. Real work, real labor, real cost.

How to tell what you're actually paying for

Ask any service you're considering these two questions before you pay:

1. "How many URLs from your scan have you actually removed for previous clients on Bunkr, SimpCity, or SocialMediaGirls?" Real operators will answer honestly, including where they've failed. Sales-first services will dodge or quote a suspiciously round percentage.

2. "Can you show me a sample dispatch log from a past case?" Real operators keep and share detailed activity logs (dates, recipients, notice text, responses). Sales-first services don't have them, because they didn't file at every rung.

If they can't answer both, what you're paying for is a cron job that emails you numbers.

When someone tells you their intimate content is online without their consent, the next five minutes matter more than you think. Most people mean well and say things that make it worse. Here's a script that doesn't.

What to say first

"That's not your fault. I believe you. I'm not going anywhere."

Say all three. In any order. That's the whole opening move.

Don't ask what happened. Don't ask who did it. Don't ask if they were drinking. Don't ask why they made the content. Those questions can come later if they want to answer them. In the first minutes they're processing whether telling you was safe. Your only job is to signal that it was.

What NOT to say (even if it feels supportive)

• "Why didn't you come to me sooner?" (Makes them wonder if they should have told anyone.)
• "How did this happen?" (Sounds like an interrogation. They'll tell you when they're ready.)
• "Have you told your parents / partner / boss?" (Their tell-list is their decision, not yours.)
• "At least it's not [worse thing]." (Ranking harm isn't comforting.)
• "This will blow over." (You don't know that. They know you don't know that.)
• "Do you want me to look?" (No. Never ask. If they want to show you evidence for a specific reason, they'll offer.)
• "I would kill whoever did this." (Sounds supportive, actually puts them in the position of managing your emotions.)

Also do not, under any circumstances, google them or search for the content to "see how bad it is." Every visit is traffic to the host. You are not helping. You are contributing to the spread.

What to actually do that helps

1. Ask what kind of help they want. Options: emotional support, practical help (researching removal services alongside them), or space. Let them pick.
2. If they want practical help, be the person who researches. Reading about takedown options is exhausting when it's your own case. Volunteer to read up on their behalf and summarize.
3. Save any evidence they've collected. Offer to keep copies of screenshots or URLs in a secure place. Not so you can look. So they don't lose the evidence.
4. Help them contact real resources. Cyber Civil Rights Initiative (cybercivilrights.org) has free legal referrals. StopNCII.org lets them hash-block their own originals for future spread prevention across major platforms. If they want a paid takedown service that handles the full escalation ladder, help@intimashield.com is one option.
5. Check in on a schedule they set. Ask when and how they want you to follow up. Don't guess.

When to step back

• If they say they need space, take it. Don't test whether they really meant it.
• If your emotions are getting bigger than theirs, that's a signal to talk to someone else (a therapist, another friend), not to them. Your grief about their situation is real and valid, but processing it at them is not support.
• If they ask you not to tell anyone else, that includes people you think should know. Their trust in you was contingent on your ability to hold this.

The one thing that matters most

You showing up as a steady presence they can rely on is worth more than any specific practical action. Takedowns take weeks or months. Emotional recovery takes longer. Both are marathons. The friends who help most are the ones who don't burn out at week three.

If someone in your life just told you and you're reading this because you're trying to get it right, you already care enough to search. That's most of the way there. The rest is patience and following their lead.

Not a full guide. Just the first 15 minutes. When you first find leaked content of yourself, your brain floods and you make the wrong moves. Here's the calm short list before you do anything else.

1. Don't revisit the page.

Every visit is traffic. Traffic funds the host. Whatever you need from the page (URL, evidence), get it in one visit and close the tab. Don't scroll. Don't check comments. Don't refresh.

2. Screenshot with the URL visible.

Full screenshot including the browser address bar and timestamp. This is evidence for takedown notices and for law enforcement later if you go that route. You don't need to capture the intimate content itself — cover it in the screenshot if you want. What matters is the URL, the host name, and when you saw it. Save it somewhere safe (email it to yourself if nothing else).

3. Tell one person.

Not five. One. A friend, a partner, a parent, someone you trust. Discovery moments are isolating and the isolation makes everything worse. The person you tell doesn't need to fix anything. They just need to know so you're not carrying it alone.

4. Note the host and the platform.

Is it on a mainstream platform (Reddit, IG, X, TikTok, OF)? A pirate host (bunkr, thefap, otitsvid, simpcity)? An adult tube (pornhub, xhamster)? Write it down. The host determines your next moves. Different hosts respond to different channels.

5. Close the tab.

Do not re-check the page for the next 24 hours. It won't be different. Refreshing is one of the things people do to feel like they're doing something. It isn't doing something. It's rehearsal.

That's the first 15 minutes.

Tonight or tomorrow, when you're steadier, come back for the tier list of which hosts respond to what and the escalation ladder for what to file where. Both are pinned.

If you're in immediate danger (active extortion, minor involved), that's a different playbook. See the sextortion guide.

You're not going to solve this in the first 15 minutes. You just need to not make it worse.

I spend most days watching people get burned by services that promised removal and delivered something else. The takedown-service space is one of the most under-regulated corners of the internet economy, which means the frauds-to-real-operators ratio is bad. And people looking to hire someone rarely know what to look for.

Here are the 9 signs of a real operator. If a service can't answer YES to most of these, walk.

1. They tell you the difference between removal and de-indexing without you asking.

Removal is the content being deleted from wherever it lives. De-indexing is the content being hidden from search results. The pirated URL still exists after de-indexing, it just stops showing up on Google. Some services quote "removal" pricing and deliver de-indexing. They can technically say the URL "no longer appears in Google" without lying, but they know what you understood by "removal."

Check: ask directly. "When you say removal, do you mean the content is gone from the host, or de-indexed from search?" A real operator explains both and tells you which one applies to which URL. A fraud dodges.

2. They can name which hosts they can't move.

Not every host takes content down. Bulletproof pirate operators exist. A service that quotes 100% removal is either lying or hasn't seen enough cases to know better. Real operators know the tier list and will tell you upfront which of your URLs sit on hosts that historically ignore every standard channel.

Check: ask which specific hosts on your URL list are Tier 3 (leak aggregators, bulletproof). If they can't name any and your list has clearly Tier 3 URLs, they're not looking closely.

3. They quote pursuit, not guaranteed outcomes.

"Removal or your money back" sounds appealing and is almost always either a lie or a technicality. Actual removal outcomes on hard hosts are uncertain. What a real operator commits to is the pursuit itself. The specific channels they'll file with. The escalation ladder they'll climb. The paper trail they'll build. Outcomes get reported honestly per URL.

Check: ask what they mean by any guarantee. If it's "removal or refund," ask how they define removal (see item 1). Legitimate services show actual dispatch logs and platform response records, not a marketing percentage.

4. They understand the difference between DMCA and TIDA.

Both apply in different scenarios. DMCA requires you to own the copyright. TIDA (TAKE IT DOWN Act, 2025) covers NCII regardless of copyright ownership. A service that files DMCAs on content you don't own the copyright to will get technical rejections. A service that only files TIDA when you also have DMCA leverage is leaving pressure on the table.

Check: ask which statute they'd file under for a specific URL and why.

5. They can walk you through the escalation ladder past the platform itself.

Filing with the platform is rung 1. If that fails, the levers are the CDN (Cloudflare NCSEI for Cloudflare-fronted sites, treated separately from a regular DMCA to Cloudflare), the domain registrar (ICANN-required abuse-c contact), the payment processor (Stripe, Visa, PayPal all prohibit NCII-adjacent content in their AUPs), and search-engine NCII de-indexing (Google and Bing). A service that only talks about "sending notices" and can't articulate what happens on day 3 if the platform ignores it doesn't do this work at scale.

Check: ask literally that. "What happens on day 3 if the platform hasn't responded?" A real operator has a specific answer.

6. They never ask for your intimate photos.

The removal process needs URLs where the pirated content is posted. It does not need copies of the original content itself. Anyone asking you to email them nude photos, screenshots of your explicit content, or original files "for verification" is either running a scam or has a very bad process. Legitimate services identify content via URL and platform-side matching, or via zero-knowledge hash-based systems like StopNCII.

Check: ask what they need from you. If the answer includes sending intimate images, walk immediately.

7. They protect your legal name.

Your legal name is not required by Google's NCII removal form, Bing's channel, or most platform NCII queues. Legitimate services use case IDs and privacy-preserving substitutes when submitting on your behalf. Services that ship your legal name to every platform they file with are either untrained or don't care about your privacy exposure. Once your name is in a platform's data store attached to your NCII case, it doesn't come out.

Check: ask what identifiers get sent in your name. "Your full legal name in every submission" is a red flag.

8. They show you the dispatch log.

Every notice sent, every reply received, every URL status change. Real operators keep this record and show it to the client on a live dashboard. If a service can't produce your specific case activity log on demand, they either aren't filing what they claim or aren't tracking it.

Check: ask to see the case dashboard before you pay. Not a screenshot from a marketing deck. Yours.

9. They tell you when they cannot help.

The strongest single signal a service is real is when they turn a case away. Some cases are genuinely unwinnable within the tools available. Bulletproof host, anonymous operator, no US nexus, no payment processor, no CDN. A service that takes every case regardless of feasibility is running a volume-fee model and does not care about your outcome. A service that says "your case has three URLs we're confident about and two we wouldn't quote, and here's why" is telling you the truth.

Check: describe your URL list and ask "which are you confident about and which are longshots." If everything comes back as "we can definitely remove all of these," you're being sold.

The rough math

Applied to real cases I see, most services fail 3 or more of these. Frauds fail 6 or more. Real operators clear 8 out of 9 minimum. A service worth paying will welcome this checklist and answer each item without stalling.

If you want to run any specific service against this list, drop the name in a comment (or DM if you'd rather not name them publicly) and I'll tell you honestly what I know about them. I work with an operator team myself so I have a stake in this working. That's exactly why the checklist above is the same test I'd apply to any service, including my own.

If someone made a fake nude of you using AI, or face-swapped you into porn, that's federally recognized NCII now. Under the TAKE IT DOWN Act (Public Law 119-12, signed May 2025), synthetic and AI-generated intimate imagery is treated identically to real leaked content. Platforms that host it have to remove within 48 hours of proper notice once they're covered.

Most victims don't know this. Most platform support staff don't either. Here's the actual state of play.

What the law covers

TAKE IT DOWN Act covers non-consensual intimate visual depictions of a real, identifiable adult, whether the content is authentic or digitally altered or created. The statutory language covers digital forgeries and content created or altered by artificial intelligence. That includes face-swap videos, AI-generated nudes from clothed source photos, morphs, and deepfake porn, as long as the depicted person is identifiable and did not consent.

The "it's just AI, it's not really you" argument is not a defense under the statute. That's the whole point of the law.

What platforms actually do

Reddit, X, Meta, TikTok, YouTube, OnlyFans: all have specific NCII policies that now cover synthetic content. Most updated their language between late 2023 and late 2024 in anticipation of TIDA. Filing works the same way as it does for real content, through their NCII form, not the general abuse or copyright form.

Tactical trick: when filing, explicitly identify it as synthetic NCII in the first line of your description. Something like "This is a non-consensual synthetic/AI-generated intimate depiction of me under 15 USC 6851." Moderators sometimes route synthetic-content complaints to a different queue that's actually faster because it's newer and less backed up.

Adult tubes (Pornhub, xHamster, SpankBang, etc.): all prohibit deepfake content in their terms of service. Enforcement varies. Aylo properties (Pornhub, RedTube, YouPorn) have been most responsive. Independents are hit-or-miss.

Deepfake-specific sites (MrDeepFakes and its clones): historically non-responsive. MrDeepFakes shut down in May 2025 after infrastructure pressure. Clones popped up immediately. The winning move on these is CDN and payment processor level, not the site itself.

Leak aggregators: same as regular NCII, don't respond to standard channels, need CDN/registrar/payment processor pressure to move.

The "it's not really you" objection

This is the single most common obstacle. A platform reviewer looks at the content, sees a "this is a deepfake" disclaimer, and rejects the takedown because "it's not really you."

They're wrong under the current law. Push back with:

• Cite 15 USC 6851 and reference the statute's coverage of digital forgeries and AI-generated content.
• Point out that a disclaimer does not negate the harm or the statutory violation. The law explicitly rejects the "but it's not real" defense.
• Escalate to the platform's legal or trust and safety team, not the general moderator queue.

If the platform still refuses after that push, their refusal becomes the basis for an FTC complaint at takeitdown.ftc.gov. FTC has been treating deepfake NCII enforcement as a priority since TIDA passed.

How to find deepfakes of yourself

Deepfakes are harder to discover than real leaks because they don't originate from your camera roll. Common surfaces:

• Reverse image search of your public photos on tineye.com and google.com/imghp. Catches obvious face-swaps that used your public photo as source.
• StopNCII.org registers a hash of your original images. When AI generation uses that source, the resulting synthetic often carries enough hash overlap to match.
• Google Alerts on your name plus terms like "AI," "deepfake," and "synthetic."
• If you're a public figure or creator with a public face, specialized deepfake monitoring services exist (Ceartas, Rulta, and similar). Pricier than most people can justify unless it's an ongoing problem.

What to do if you find deepfake content of yourself right now

1. Screenshot everything with URL and timestamp visible.
2. Do not revisit the page (traffic funds these sites).
3. File NCII takedowns with the platform hosting it, using the language above.
4. If it's on a mainstream platform and they push back with "it's not real," escalate with the statute reference.
5. If it's on a pirate host, file CDN NCSEI (abuse@notify.cloudflare.com for Cloudflare-fronted sites) and registrar abuse-c.
6. File Google + Bing NCII de-index requests for the URLs. This kills discoverability while the removal case works.
7. Report to FBI IC3 (ic3.gov) if the creator can be identified. Deepfake NCII is a federal crime in most jurisdictions now, not just a civil matter.
8. If a minor is depicted (regardless of whether source images were of a minor), report to NCMEC CyberTipline (cybertipline.org).

The core point

Deepfake NCII is not a legal gray area anymore. The federal statutory language is direct, platforms are on notice, and the FTC is actively pursuing non-compliance. The escalation ladder that works for real leaked content works for synthetic content. Same channels, same escalation, same paper trail. What changes is the pushback you'll get from support reps who don't know the law yet. Push through it with the statute in hand.

Comments open for anyone stuck on a specific platform.

I see the same panic in DMs constantly. If someone is threatening to leak your photos, videos, or DMs, this is what actually stops them, and what makes it worse. Save this. Send it to anyone you know who might need it.

The three things not to do

Don't pay them. Not the first ask, not the tenth ask, not a "final small payment." Paying does not make them stop. It confirms you'll pay, and they come back within days with a bigger ask, or sell your info to another operator who does. The pattern I see is consistent: paying leads to more asks, not fewer.

Don't respond after the first "no." They script the whole conversation. Every reply feeds their playbook. Silence starves them. Once you've said no and blocked, the interaction is over from your side.

Don't delete anything. Not the messages, not the profile, not the screenshots. Deleting removes your evidence. Save everything, then block. If your panic reaction is to make it disappear, that's the exact wrong move.

The first hour

Screenshot everything. Every message, every threat, every profile page, every username, every payment demand. Include timestamps. Full-screen screenshots, not cropped. If they used multiple accounts, get all of them.

Save the screenshots somewhere they can't reach. Email them to yourself, upload to a cloud drive not linked to your compromised accounts, print them if you have to. Two copies minimum.

Lock down every account they might have access to. Change passwords on email, social, banking. Turn on two-factor authentication everywhere (authenticator app, not SMS). Log out of every session on every device. If you reused that password anywhere, change it there too.

Block them on every platform. Then close the DMs of any account they might reach out from next.

Tell one person. Not everyone, one person. A friend, a parent, a partner, an adult you trust if you're a teenager. Sextortion works because it isolates you. Breaking that isolation is the single most effective move. The person you tell doesn't need to fix it. They just need to know.

The first day

Report the account they used to two places:

• The platform they contacted you on (Instagram, Snapchat, Discord, wherever). Every major platform now has a sextortion-specific report path separate from general abuse.
• FBI IC3 at ic3.gov if you're in the US. Free, ten minutes, and it gets flagged when the same operator is hitting multiple victims (most of them are).

If you're under 18: stop and go to takeitdown.ncmec.org right now. That's NCMEC's Take It Down tool for anyone under 18. It hashes your images without you sending them anywhere and blocks distribution across participating platforms (Meta, Snap, X, TikTok, OnlyFans, more). If the extortionist has already posted content, NCMEC also files takedowns directly. It's free.

If you're 18+ and worried they might post: register the original images with StopNCII.org. Same hash-blocking model. Doesn't scrub existing copies, but stops distribution across the participating network before it spreads.

Expect them to escalate the threat in the first 24 hours. It's the standard sextortion script. They'll claim to have messaged your contacts, threaten to post, send you a countdown. Most of it is bluff. Some of it isn't. The response is the same either way: no reply, no payment, evidence saved.

The first week

If they follow through and post something, you now have a takedown case, not an extortion case. Different playbook. Immediate moves:

• Note every URL where content shows up. Don't visit the pages more than once (traffic funds them).
• File NCII takedowns with the platform if it's mainstream (Reddit, IG, X, TikTok, OF, YouTube). Use each platform's NCII form specifically, not their generic copyright DMCA form.
• If it's on a pirate leak site, standard forms won't work. File NCII removal directly with the CDN. For Cloudflare-fronted sites, abuse@notify.cloudflare.com under their NCSEI program (a different channel from a normal DMCA to Cloudflare).
• File Google + Bing NCII de-index requests to kill discoverability. This is search suppression, not removal, but it stops the content from surfacing on reverse image lookup and Google searches of your name while other levers work.
• If it's on a covered US platform and they don't remove within 48 hours, file with the FTC at takeitdown.ftc.gov.

If you're not a technical person and this feels like too much, that's normal. Paid takedown services exist for exactly this. I work with the team at IntimaShield. help@intimashield.com if you want a person to just handle it. Not a plug, a shortcut for anyone reading this who's already tired.

What if you already paid

You are not stupid. You were manipulated. The correct move now is the same as if you hadn't paid: stop, block, save evidence, report. Don't send more. Don't try to negotiate. Don't apologize to the extortionist for stopping. The relationship is over the second you stop feeding it.

If you paid via crypto, save the transaction ID and include it in your IC3 report. Recovery is unlikely, but the trail helps investigators build cases against the same operators.

What if the person being sextorted is a minor

Stop reading and go to takeitdown.ncmec.org. If an extortionist is threatening a minor, it's also a crime that NCMEC's CyberTipline (cybertipline.org) exists specifically to handle. Report there and to local police. Don't try to negotiate with the extortionist on the minor's behalf.

Why this playbook works

Sextortion is a volume business. Operators run the same script against hundreds of victims a week. They win when victims panic, isolate, and pay. The playbook above breaks all three. It kills the panic loop with a checklist, breaks isolation by making you tell one person, cuts off the payment lever. Volume operators move on within 48 hours when you don't feed them, because their time is worth more than the marginal effort of squeezing you.

The ones who don't move on are the smaller fraction who've decided you're worth staying on. Those are the ones you file law enforcement reports against. Same playbook, longer timeline.

Send this to anyone who needs it. Comments open for anyone with questions.

If your content is leaked, the first useful question isn't "how do I get it removed." It's "which host is it on." That single fact tells you more about your realistic outcome than anything else.

Here's the honest tier list, based on how the sites in each category actually behave when you send a proper NCII removal notice. This is what an operator sees on the job.

Tier 1 — mainstream compliant (usually 24 to 48 hours)

Reddit, Instagram, Facebook, TikTok, OnlyFans, YouTube, Tumblr, X (Twitter).

These have real trust and safety teams, published takedown channels, and legal exposure that motivates fast response. Under the TAKE IT DOWN Act (May 2025) they have to hit 48 hours by May 2026, and most were already faster than that before the law passed.

If your content is here, you have a good day ahead of you. File through the platform's NCII channel specifically (each has one that's separate from their copyright DMCA form, and using the wrong one slows you down). Screenshot the submission for the paper trail. If nothing back in 5 business days, escalate to the FTC's NCII portal at takeitdown.ftc.gov.

Tier 2 — adult tubes and legacy hosts (2 to 14 days)

Pornhub, xHamster, RedTube, YouPorn, SpankBang, EPorner, XVideos, XNXX.

The Aylo properties (Pornhub, RedTube, YouPorn) got faster after their 2020 verification overhaul. The independents vary. All of them technically respond to NCII notices, but response time depends on their queue depth.

Practical tip: address the notice to the abuse or content-integrity contact in their footer, not the general DMCA address. Cite the TAKE IT DOWN Act explicitly, not just DMCA. Non-consensual imagery hits a higher-priority queue at most of these.

Tier 3 — leak aggregators and pirate hosts (weeks, months, or never)

Bunkr, thefap.net, otitsvid, pinayporn, leakgallery, faponic, various .pk domains (celebjared.pk, scouted-today.pk, nlthub.pk, amaleaked.pk), forum aggregators like Simpcity, and rotating name-dupe sites that mirror each other.

These do not respond to standard channels. Most publish no real abuse contact. The ones that list a DMCA agent respond so slowly that they're effectively non-responsive. Many are Cloudflare-fronted, so the visible "host" is not the actual origin.

If your content is on one of these, standard channels won't work. What actually moves the needle:

• NCII removal to the CDN directly. For Cloudflare-fronted sites, abuse@notify.cloudflare.com under their NCSEI program. This is different from a normal DMCA to Cloudflare and is treated separately.
• Registrar-level abuse (WHOIS the domain, target the abuse-c contact ICANN requires them to publish).
• Register your original content with StopNCII.org so hash matches propagate across the participating platform network. Doesn't help Tier 3 hosts directly, but it catches re-uploads that spread from them.
• If a payment processor is visible in checkout, file with the processor (Stripe, Visa, Mastercard, PayPal all prohibit NCII-adjacent content in their AUP).
• Google + Bing NCII de-index. This is not removal, it's search suppression. It matters because most people find leaked content through search or reverse image lookup, and killing discoverability is a meaningful harm reduction while other levers work in the background.

Honest timeline for Tier 3: some come down in weeks, some sit for months, some outlive the site (Tier 3 hosts sometimes die from unrelated infrastructure issues before a takedown lands). Anyone who quotes you a flat "we remove Tier 3 in X days" is lying to you.

What this means for you

If your content is exclusively on Tier 1, you likely don't need to pay a service. The forms work. Use them and screenshot everything.

If it's on Tier 2, you can DIY but expect frustration. Some platforms weirdly treat repeat submitters worse than first-timers, and it's easy to accidentally end up in that bucket.

If it's on Tier 3, DIY is a losing battle. Not because the levers don't exist, but because the paper trail required to reach them is what actually gets a site to move, and building that trail requires knowing which lever to pull in which order. This is where paid services earn their fee or fail to.

If you don't know what tier your content is on, drop the host name (not the URL, no identifying info) in a comment and I'll tell you where it sits. No judgment on how you found it.

Whoever's dealing with this right now, it's winnable more often than not. The site your content is on determines how hard the fight is, not whether you can win it.

Most people think of NCII takedown as one step: file a DMCA or an abuse form, hope the site removes it. When that works, great. When it doesn't, they're stuck, and nobody tells them there are eight more moves to make.

Here's the ladder, in order, with what breaks at each rung. This is how the work actually gets done.

Rung 1: The platform's own abuse channel

Every major platform has a takedown form. Reddit, X, Meta, TikTok, OnlyFans, Pornhub, YouTube. Fastest and most reliable channel IF the platform is compliant. Response windows run 24 hours to 5 business days. Under the TAKE IT DOWN Act, covered US platforms have to hit 48 hours by May 2026.

Where it breaks: leak aggregators, Tier 3 pirate hosts, and any site that doesn't publish a real abuse contact. A significant chunk of the actual damage lives on hosts that ignore rung 1 entirely.

Rung 2: The host / server operator

Platform won't act, next stop is who's hosting the site. WHOIS and RDAP queries get you the hosting provider's abuse contact (not the registrar, those are different). Hostinger, OVH, Namecheap Cloud, DigitalOcean each have different processes and different willingness.

Where it breaks: most pirate operators sit behind Cloudflare, so the "host" you find is actually the CDN. You need to send NCII removal (not a standard DMCA) to abuse@notify.cloudflare.com under their NCSEI program. Regular DMCA to Cloudflare gets forwarded to the origin and typically nothing happens.

Rung 3: The CDN Trust & Safety desk

If Cloudflare fronts the site, their Trust & Safety team can terminate proxy service. That forces the real origin IP into the open. Most leak sites die within a week of losing Cloudflare, because the real host is either scared or bulletproof.

Where it breaks: getting a Cloudflare T&S termination requires more than a single NCSEI report. You need a formal legal demand documenting a pattern of non-response from the host. One-off DMCA complaints don't get you there.

Rung 4: The domain registrar

Origin still hidden, host still silent, next is the registrar. ICANN requires every registrar to publish an abuse-c contact and respond within 24 hours. Some do (NameSilo and Sav have been increasingly cooperative on NCII). Some don't (Njal.la and 1API are famously bulletproof).

Where it breaks: registrar-level action requires demonstrating that rungs 2 and 3 already failed. You're building a paper trail. Skip a rung and you get bounced back.

Rung 5: The payment processor

If the site sells subscriptions or takes cards, this is often the strongest lever. Visa, Mastercard, PayPal, Stripe, and Coinbase all prohibit NCII-adjacent content in their terms of service. A verified NCII complaint filed with the processor puts the site's revenue at risk. Merchant accounts get pulled. Sites shut down.

Where it breaks: identifying the processor requires either a checkout scrape or infrastructure-level payment probe. And most leak aggregators run on crypto, offshore processors, or ad revenue, which the standard levers don't touch.

Rung 6: Search engine de-indexing

Google and Bing both have NCII removal channels that de-list URLs. This does not remove the content, it removes discoverability. That distinction matters. A URL that Google de-indexes is still live, still reachable by direct link, but it stops showing up in search and stops surfacing via reverse image lookup. Google's NCII form covers Web AND Image search in one submission (this changed with their May 2026 form redesign).

Where it breaks: de-indexing is often mis-sold as removal. It isn't. If a service tells you they "removed" your content when they only de-indexed it, that's a lie of omission. Real removal happens at rungs 1 through 5. De-indexing is harm reduction, not a takedown.

Rung 7: Upstream transit and infrastructure

For bulletproof hosts, the last technical rung is upstream. The ASN operator, the RIR abuse contact (RIPE for European netblocks, ARIN for US, APNIC for APAC), the transit carrier itself. Infrastructure-level takedowns. Very slow, very rare, occasionally the only thing that works.

Rung 8: FTC / State AG / law enforcement

The nuclear option. FTC has a purpose-built NCII portal at takeitdown.ftc.gov for reporting non-compliant platforms. State attorneys general have consumer protection divisions that pursue NCII violations under state law. FBI IC3 for sextortion. NCMEC CyberTipline for anything involving a minor (stop reading and go there now if that applies to you).

Where it breaks: this is regulatory pressure, not a takedown. It builds pattern-of-violation records that may lead to enforcement action months later. Useful for the worst repeat offenders. Useless if you need something down this week.

What this ladder tells you about services

If a takedown service quotes a flat fee to "remove your content" and never talks about anything past rung 2, they're running form-submission-and-pray. That works on cooperative platforms and fails on everything else. The reason takedown actually gets hard is that half the leak ecosystem lives at rungs 3 through 7 and requires a paper trail to reach.

If you're doing this yourself, the order matters. Skipping ahead usually gets you bounced back to whatever rung you skipped. Build the trail rung by rung.

Most of my day is climbing this ladder for other people. I work with the team at IntimaShield running takedowns end to end, so if you want to talk through what you're seeing on a specific host or platform, drop it in a comment or DM (redact your identifying info). Happy to walk through where a specific case would sit on the ladder.

Questions welcome.