How the FBI and France seized domains tied to reported deepfake CSAM sales

That is a concrete action against the web addresses used by the operation. It does not, by itself, establish that investigators found every person involved, disabled every related service, or removed every copy of the material.

The warrant’s scope matters because a website’s address and the files it links to are not necessarily the same thing. CyberScoop reported that the sites said they directed users to unaffiliated file-hosting services rather than storing the material themselves. The available accounts do not say whether those hosts removed files after the domain seizure.

What material did the sites offer?

The Justice Department said NudeLeaksTeens advertised and sold sexually explicit images and videos that included CSAM. It also said some people depicted in the material had been identified as minors when the images were made. Those are law-enforcement findings described in an announcement, not findings at trial.

CyberScoop reported that AI-generated deepfakes appeared among the sites’ content, alongside non-consensual intimate images. But the public accounts do not break down the material by type or origin. They do not say what share was synthetic, what share showed real people, or how much involved people who were minors.

The Justice Department said the site advertised a collection it described as containing 6,200 files. That number reflects the site’s own description as reported by the department; it is not an independently verified total in the available material. RTL, citing French investigators, separately reported that more than 17,000 women had been catalogued by the platform, including some minors. That figure is a reported tally of people, not a count of AI-generated images or a measure of the wider problem.

The figures describe different things and come from different accounts. They cannot be added together or treated as a reliable count of confirmed victims, files, or deepfakes.

Why do reports differ on the arrests and sites?

The Justice Department said French law enforcement arrested an unnamed 25-year-old suspected of being NudeLeaksTeens’ main administrator. RTL reported that two brothers, ages 21 and 25, were arrested and that three associated sites—nlthub.pk, nltvids.com and nudeleaksteens.com—were shut down.

Those accounts do not reconcile. The U.S. announcement describes two websites and one arrest; RTL reports three sites and two arrests. The available reporting does not explain whether the accounts refer to different parts of the operation, or whether one includes additional details not in the other.

The suspects remain suspects in these accounts. Neither establishes guilt, and the material reviewed does not report charges or a court outcome in this case.

Does a domain seizure remove the material?

A domain seizure is not the same as removing every copy of an image from the internet. The warrant targets two named web addresses. CyberScoop’s account that the sites linked to outside file hosts makes the distinction especially relevant: taking control of a domain does not show whether those hosts were also ordered to act or whether files were copied elsewhere.

A separate legal mechanism addresses removal requests. The TAKE IT DOWN Act requires covered platforms to provide a way to report qualifying intimate images and to remove them, along with known identical copies, within 48 hours of a valid request. The Federal Trade Commission says its enforcement of those platform obligations began May 19, 2026. That process is distinct from the warrant used to seize the NudeLeaksTeens domains.

The Justice Department directed people whose intimate images appeared on NudeLeaksTeens or elsewhere online to report the matter to the FBI. RTL reported that French authorities also invited affected people to contact the national cyber unit. The accounts do not include direct comments from affected people or report how many have contacted authorities.

What does the case establish about enforcement?

The operation shows that U.S. and French authorities can coordinate a case involving domains tied to the sale of CSAM and intimate imagery, and that a federal warrant can target specific domain names. It also shows why enforcement against online abuse may involve different steps: domain control, investigations into suspected operators, and requests to platforms or hosts to remove material.

It does not show that the operation stopped circulation. The available reporting provides no follow-up measurement of whether files were removed from outside hosts, whether new domains appeared, or whether the seizure reduced access to the material. Nor does it establish how widespread AI-generated abuse material is beyond this case.

The next public details that would clarify the operation are whether charges follow, how authorities resolve the different arrest and site counts, and whether investigators report that copies hosted elsewhere were taken down.