FBI shuts two deepfake CSAM sale sites through a warrant on registry VeriSign
FBI agents used a warrant on registry VeriSign to seize two CSAM-for-sale sites that sold a 189GB collection on 315 girls for $64.90. Paris prosecutors arrested a 25-year-old French resident suspected of running them, the Justice Department said.
The Watch · Security desk
What happened
- Arlington County detective John Bamford, a member of the FBI cybercrime task force, filed the seizure warrant on Oct. 2 in the Eastern District of Virginia.
- The TAKE IT DOWN Act, passed last year, makes creating or sharing nonconsensual intimate deepfakes of real people a crime and lets courts order sites to remove them.
- Some material was recorded from or stolen out of victims' Snapchat, TikTok, Instagram and Facebook accounts, and several victims told police their accounts had been hacked.
- Collections compiled by convicted offenders were on offer, including one tied to Andrew Venegas, sentenced in Texas federal court to 30 years in April 2026.
- The sites claimed to host no files, only links to other non-affiliated sites, and administrators steered buyers toward cryptocurrency and private contact.
Why it matters
- Who's exposed exposure Operators abroad who keep domains with a US registry can lose them to a federal court in Virginia; in this case the suspected administrator is a French resident.
- Who's exposed exposure Teenagers' social media logins are where this supply chain starts, so account recovery and anti-extortion controls on those platforms sit upstream of anything a domain seizure reaches.
- What it limits constraint For now the TAKE IT DOWN Act is grounds for seizing domains; its criminal deepfake provision gets a court test only when someone is prosecuted under it.
Next story · Product · yesterday
Filing in OpenAI recording-device case lists one-way tickets to Saudi ArabiaConfirmed5 publishers
NudeLeaksTeens and NLTVIDS went offline this week through a registry in Virginia [2]. Agents served a search warrant on VeriSign, the Reston-based registry that controls the seized domains, and took servers, computers and other material, according to CyberScoop's account of the court documents [9].
Bamford's filing cites two bodies of law. The sites offered "a wide range of explicit content including CSAM and content that violates the TAKE IT DOWN Act, which prohibits the non-consensual sharing of intimate images," he wrote [10]. According to the court documents, the material included AI-generated deepfakes [1]. The reporting does not say how much of the catalogue was synthetic, and it does not describe charges under the new act against anyone.
The business was bulk resale. At least one site ran its own currency and sold images and videos singly or in bundles organized by victim, under disclaimers that disavowed child pornography [4]. The $64.90 bundle works out to 0.6GB and about 21 cents per victim [17][16].
The supply started with compromised and extorted accounts. Venegas is the filing's example of how one collector worked. "In the investigation and prosecution of Venegas, law enforcement learned that Venegas obtained sexually explicit images and videos of his victims in various ways, including extortion and the unauthorized accessing of victim social media accounts," Bamford wrote [14].
Resale continued after a collector's conviction. A collection named after Reuben Oswaldo Yeverino Rosales was on sale on one of the sites in 2022 and 2023, and Rosales was sentenced in 2022 to more than 34 years for sexual exploitation of children and cyber stalking [15]. The warrant says law enforcement first became aware of the sites in 2024 [8].
As reported, this is one storefront selling several offenders' collections. Seizing it removes a distribution point. The extortion and account takeovers that produced the material belong to separate cases, at least two of them already closed with long prison terms [13][15].
What to watch
- Any charge under the TAKE IT DOWN Act in this case would put the law's deepfake provision before a federal judge.
- The Paris Prosecutor's Office charging decision on the 25-year-old suspected administrator.
- Whether the 'other non-affiliated sites' the storefronts linked to are identified and seized.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap+20
- Incentives30
- Confidence70
Perspective Coverage
3 publishers- Builder
- Builder 15%
- Operator
- Operator 80%
- Investor
- Investor 5%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The FBI and French authorities arrested an individual and seized two websites used to disseminate child sexual exploitation material, including AI-generated deepfake media, according to court documents.
- [2]
The websites NudeLeaksTeens and NLTVIDS were seized and shut down by the FBI this week.
- [3]
According to the Department of Justice, the cybercrime division of the Paris Prosecutor's Office arrested an unnamed 25-year-old French resident suspected of being the primary administrator for the sites.
- [4]
The sites posted disclaimers disavowing child pornography while advertising and selling CSAM; at least one had its own currency used to buy images and videos individually or in bundles organized by victim.
- [5]
Some of the material came from victims' Snapchat, TikTok, Instagram and Facebook accounts, either recorded directly or stolen from their accounts; several victims reported to law enforcement that their accounts were hacked.
- [6]
A seizure warrant was filed Oct. 2 in the Eastern District of Virginia by Arlington County police detective and FBI cybercrime task force member John Bamford.
- [7]
The websites posted disclaimers stating they do not host or store files on their servers but link to "other non-affiliated sites"; administrators often encouraged cryptocurrency payments and urged individuals to contact them personally for some material.
- [8]
According to the seizure warrant, law enforcement first became aware of the websites in 2024.
- [9]
FBI officials executed a search warrant on VeriSign, a Reston, Virginia-based U.S. domain registry that controls the seized website domains, taking servers, computers and other material.
- [10]
"a wide range of explicit content including CSAM and content that violates the TAKE IT DOWN Act, which prohibits the non-consensual sharing of intimate images"
- [11]
The TAKE IT DOWN Act, passed last year, makes it a crime to create or share nonconsensual intimate deepfake media of real people, gives the Federal Trade Commission authority to enforce it, and allows courts to order websites to remove such content.
- [12]
One collection, containing 189GB of material on 315 different girls, sold for $64.90.
- [13]
Some advertised collections were compiled by individuals now serving prison sentences; Andrew Venegas pled guilty in a Texas federal court to sexual exploitation of children and receipt of CSAM and was sentenced to 30 years in prison in April 2026.
- [14]
"In the investigation and prosecution of Venegas, law enforcement learned that Venegas obtained sexually explicit images and videos of his victims in various ways, including extortion and the unauthorized accessing of victim social media accounts,"
- [15]
A collection available for sale on one of the sites in 2022 and 2023 was named after Reuben Oswaldo Yeverino Rosales, who was convicted and sentenced to more than 34 years in prison in 2022 for sexual exploitation of children and cyber stalking.
- [16]
The 315-girl collection priced at $64.90 works out to about 21 cents per victim.
- [17]
The 189GB collection averages 0.6GB of material per victim.
Sources
3 independent publishers whose own reporting we read for this story.
- cyberscoop.comFBI, French authorities seize deepfake CSAM-for-sale websites
1 article · October 7, 2026
- helpnetsecurity.comAuthorities seize sites selling hacked, stolen intimate images of 17,000 women and girls
1 article · October 8, 2026
- thecyberexpress.comHacked Social Media Photos Sold Online: FBI Takes Down the Site
1 article · October 8, 2026
Topics and entities
Topics
- Social media account takeover
- Non-consensual intimate imagery
- Child sexual abuse material enforcement
Entities
- U.S. Department of Justice
- U.S. Attorney's Office for the Eastern District of Virginia
- Verisign
- Federal Bureau of Investigation
- Paris prosecutor's office
- Take It Down Act