The Host That Enables

A study published September 30 in the Journal of Online Trust and Safety follows that ordinary machinery. Sarah Morgan, Hany Farid and Sophie J. Nightingale identified 88 publicly accessible websites hosting what they classified as AI-generated non-consensual intimate imagery, or NCII. Thirty-eight were dedicated entirely to that material. They then mapped the services beneath those sites: hosting, content delivery, domain registration, DNS, certificates, content-management software, analytics, email and advertising.

The finding is not that the internet has discovered an obscure new abuse technology. It is that familiar infrastructure helps distribute abuse whose production receives much more attention. Stopping a generator from making an image and stopping a business from circulating it are different jobs.

But the map also demands care. A company appearing in a website’s technical footprint does not, by itself, establish that it stores the abusive files, receives advertising revenue from them, or knows what the operator is doing. Responsibility has to follow the actual service relationship. Otherwise, “the infrastructure enabled it” becomes an accusation broad enough to lose the mechanism that makes it useful.

A map, not a census

The researchers examined sites over six weeks in February and March 2026. Their initial list came from Google Alerts and adult-site directories, then expanded through tools suggesting similar domains. They manually reviewed 400 URLs and retained 88 sites identified as hosting synthetic NCII.

That is an exploratory sample, not a count of the entire abuse ecosystem. The authors acknowledge that similarity-based expansion could introduce bias, including possible infrastructure matching. Their focus on recognizable celebrities also matters. They identified people through familiarity or online verification and assumed those celebrities had not consented to this sexual content outside acting roles. That classification method is not equivalent to obtaining testimony from every person depicted.

These limits do not make the identified sites disappear. They tell us what the findings can support: a documented set of publicly accessible sites and the services observed around them, rather than a prevalence estimate for all online sexual abuse.

There is another important correction to the simplest headline. The 312 URLs not retained were not all proven examples of unrelated sites deliberately exploiting abuse-related search terms. The paper describes gambling sites, expired domains, password-protected pages, other adult material, generative-AI tools and some apparently innocuous pages. Eleven were aliases redirecting to already identified sites. The authors hypothesize that some used NCII-related keywords to attract traffic. Hypothesis should not quietly become motive.

The distinction is useful beyond academic housekeeping. If the aim is intervention, a list assembled for discovery must undergo further checking before it becomes a list used to deny service.

Nine layers do not have one off switch

The paper identifies Cloudflare, Google, Namecheap, WordPress and Proton Mail as leading providers in different categories. Those categories are not interchangeable.

A domain registrar administers a domain’s registration. DNS helps direct requests. A content delivery network sits in the delivery path. A content-management system supplies publishing software. Email supports communication. Search makes pages discoverable. These functions can support the same operation while giving their operators very different knowledge and control.

Even the numerical comparisons require their denominators. The researchers counted provider identifications, and a site could use multiple providers for one function. Some services could not be identified. Their reported percentages therefore are not uniformly percentages of the 88 sites.

For example, the advertising table lists Google’s DoubleClick at 40 of 92 provider identifications. That makes it the largest listed advertising provider, not a demonstrated majority of all sampled sites. Nor is a detected advertising integration a financial audit proving that a particular abusive page earned money through it.

The paper labels Cloudflare as a hosting provider in 64 observations, alongside extensive CDN and DNS involvement. That is the researchers’ classification using external web-analysis tools and page inspection. It should not be inflated into an independently verified inventory of abusive files stored on Cloudflare-controlled origin servers. An intermediary visible to those tools and the origin holding a site’s files are not necessarily the same thing.

This is not pedantry in service of corporate absolution. It is how a complaint reaches someone who can do something. Asking a search engine to delete a file from another company’s server is the wrong request. Asking it to assess whether that file should remain discoverable is not.

A useful accountability map identifies the lever, the operator and the effect. A logo collection only identifies whom to yell at.

The WordPress disagreement exposes the seam

Samantha Cole’s September 30 report for 404 Media includes a revealing exchange about WordPress.

A spokesperson told Cole that WordPress is open-source software, not a hosting provider, and that WordPress.org does not host or control content on independently hosted sites. That is a substantive distinction. Detecting WordPress software does not establish a hosting relationship with WordPress.com or Automattic.

Farid responded that WordPress.com does provide hosting and that Automattic services, including Jetpack and its image CDN, can serve material for sites hosted elsewhere. He also pointed to WordPress.org’s software-distribution services as an ongoing relationship with self-hosted installations.

Both statements sharpen the question if kept within their bounds. An installation of freely available software is not the same as a currently supplied hosting or image-delivery service. Conversely, being an open-source project does not make every associated service relationship vanish.

The exchange does not establish that every sampled WordPress site used those additional services. It establishes why investigators must separate them. Blocking access to software updates is also not equivalent to removing the abusive material already published with that software.

Here, precision protects two things at once: a credible route to interrupt abuse and the general freedom to use common software without its distributor becoming the universal editor of everything built with it.

Search removal is real—and narrower than removal

The study found 82 of the 88 sites within the first two pages of Google results under its search protocol. That result needs its procedure attached.

Researchers searched using words from known site addresses, then joined those words, and finally entered full URLs if necessary. They were testing whether already identified sites could be surfaced. The result is not evidence that an arbitrary ordinary query leads to abuse sites 93 percent of the time. It measures a route to known destinations, not everyone’s encounter with Search.

Google told 404 Media it could not investigate the specific claims without the domains. The researchers’ ethics protocol prevents them from publicly sharing the NCII-hosting URLs. That creates a practical distinction between public disclosure and a secure, authorized reporting channel. It does not establish whether any particular provider had previously received a usable report.

Google also described policies against non-consensual explicit content and measures including removal requests, demotion and advertising restrictions. Cloudflare, Proton and Namecheap did not respond to Cole’s requests for comment. Silence to a reporter does not establish what internal action, if any, a company took.

There is a concrete Google product announcement to examine. In February, the company announced a simpler Search reporting process that allows people to submit multiple images together, track requests through “Results about you,” and opt into filtering of additional explicit results in similar searches. It also described links to emotional and legal support resources.

Those are worthwhile design choices on their stated terms. Combining reports can reduce repetitive work. Tracking gives a complainant something more useful than a vanished form submission. But this is Google’s account of the feature, not an independent evaluation of its effectiveness across the sites in the study.

And removal from Search is not removal from the host. Reducing discovery can limit exposure without recalling copies or stopping direct access. The correct response is neither to dismiss search intervention as pointless nor to mistake it for containment.

Interruption needs an accountable process

The authors recommend permanent service bans for sites exclusively or predominantly devoted to NCII, and suspensions or search demotion for broader sites until sustained good-faith removal efforts occur. They also advocate restrictions on monetization. These are proposals, not demonstrated outcomes of this observational study.

Their strongest premise is that waiting for every victim to pursue every copy leaves the distribution system largely intact. Their most difficult implication is that infrastructure intervention can affect more than the offending material.

An account-level decision may interrupt an entire site. A mistaken classification can therefore burden people whose lawful material or communications share that service. The solution cannot simply be to give a handful of infrastructure firms a larger, less answerable veto over online existence.

Nor can that danger be used as a universal excuse for inaction. Nonintervention is not an absence of consequences. Where a service continues supporting a verified abusive operation, the people depicted bear costs while the provider’s workflow remains undisturbed.

A defensible process should begin with a verified description of the abuse and the provider’s actual relationship to it. It should identify which intervention is available, why that intervention fits the evidence, and whether a narrower measure could address the harm. Decisions need recorded reasons and a route to challenge errors. Urgent protection should not depend on making an affected person publicly reproduce the material.

These are standards for a response, not findings that every named company lacks them. The study and Cole’s reporting do not provide a complete audit of each provider’s complaint handling.

There should also be a way to report a mistaken refusal to act. “Appeal” cannot mean only that a paying customer can challenge suspension while a person depicted without consent has no way to contest an ignored complaint.

The person outside the contract

The coherenceism question is not whether all nine infrastructure layers cooperate smoothly. They may already cooperate beautifully for the site operator. The question is whose feedback that smooth operation excludes.

A person whose likeness becomes sexual inventory is affected by relationships they did not choose: between a publisher and a host, a domain owner and a registrar, a page and a search index. A system that recognizes only the contracted parties mistakes its billing perimeter for its moral perimeter.

That does not require every provider to possess every power. It requires each to explain the power it does possess and what happens when credible evidence reaches it. Shared responsibility becomes useful only when it produces specific duties rather than nine opportunities to redirect a complaint.

The next test is operational: whether verified reports receive meaningful decisions, whether interventions reduce access or monetization, whether errors can be corrected, and whether the reporting burden falls less heavily on those already harmed. None of those outcomes follows automatically from a policy page or a study’s recommendation.

The internet’s layers are separable for sound engineering reasons. The people depicted without consent still experience the result as one injury. “Please contact the next provider” is not much of an architecture for repair.