Security1 publisherNot yet confirmed elsewhere2 min readPublished
FBI shuts two deepfake CSAM sale sites through a warrant on registry VeriSign
FBI agents used a warrant on registry VeriSign to seize two CSAM-for-sale sites that sold a 189GB collection on 315 girls for $64.90. Paris prosecutors arrested a 25-year-old French resident suspected of running them, the Justice Department said.
The Watch · Security desk
What happened
- Arlington County detective John Bamford, a member of the FBI cybercrime task force, filed the seizure warrant on Oct. 2 in the Eastern District of Virginia.
- The TAKE IT DOWN Act, passed last year, makes creating or sharing nonconsensual intimate deepfakes of real people a crime and lets courts order sites to remove them.
- Some material was recorded from or stolen out of victims' Snapchat, TikTok, Instagram and Facebook accounts, and several victims told police their accounts had been hacked.
- Collections compiled by convicted offenders were on offer, including one tied to Andrew Venegas, sentenced in Texas federal court to 30 years in April 2026.
- The sites claimed to host no files, only links to other non-affiliated sites, and administrators steered buyers toward cryptocurrency and private contact.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure Operators abroad who keep domains with a US registry can lose them to a federal court in Virginia; in this case the suspected administrator is a French resident.
- exposure Teenagers' social media logins are where this supply chain starts, so account recovery and anti-extortion controls on those platforms sit upstream of anything a domain seizure reaches.
- constraint For now the TAKE IT DOWN Act is grounds for seizing domains; its criminal deepfake provision gets a court test only when someone is prosecuted under it.
NudeLeaksTeens and NLTVIDS went offline this week through a registry in Virginia [2]. Agents served a search warrant on VeriSign, the Reston-based registry that controls the seized domains, and took servers, computers and other material, according to CyberScoop's account of the court documents [6].
Bamford's filing cites two bodies of law. The sites offered "a wide range of explicit content including CSAM and content that violates the TAKE IT DOWN Act, which prohibits the non-consensual sharing of intimate images," he wrote [7]. According to the court documents, the material included AI-generated deepfakes [1]. The reporting does not say how much of the catalogue was synthetic, and it does not describe charges under the new act against anyone.
The business was bulk resale. At least one site ran its own currency and sold images and videos singly or in bundles organized by victim, under disclaimers that disavowed child pornography [9]. The $64.90 bundle works out to 0.6GB and about 21 cents per victim [17][16].
The supply started with compromised and extorted accounts. Venegas is the filing's example of how one collector worked. "In the investigation and prosecution of Venegas, law enforcement learned that Venegas obtained sexually explicit images and videos of his victims in various ways, including extortion and the unauthorized accessing of victim social media accounts," Bamford wrote [13].
Resale continued after a collector's conviction. A collection named after Reuben Oswaldo Yeverino Rosales was on sale on one of the sites in 2022 and 2023, and Rosales was sentenced in 2022 to more than 34 years for sexual exploitation of children and cyber stalking [14]. The warrant says law enforcement first became aware of the sites in 2024 [5].
As reported, this is one storefront selling several offenders' collections. Seizing it removes a distribution point. The extortion and account takeovers that produced the material belong to separate cases, at least two of them already closed with long prison terms [12][14].
What to watch
- Any charge under the TAKE IT DOWN Act in this case would put the law's deepfake provision before a federal judge.
- The Paris Prosecutor's Office charging decision on the 25-year-old suspected administrator.
- Whether the 'other non-affiliated sites' the storefronts linked to are identified and seized.