On websites examined by The American Desk, contributors uploading collections of intimate photographs were required to provide the name of the person supposedly depicted. For several listings, we found public social media accounts whose photographs matched or closely resembled the thumbnails used to advertise those collections.
On one marketplace, we paid Bitcoin for a VIP membership listed at $40 and containing 250 points. Five points later, we received a link to a collection advertised as containing a woman's private photographs.
The website even offered customers reward points for leaving reviews.
It was the kind of system you'd expect from an online gaming platform or digital subscription service. Except the advertised merchandise was allegedly leaked intimate imagery, sometimes claimed to have originated from hacked social media accounts, including Snapchat.
These websites weren't hidden away on the dark web. They were accessible through ordinary browsers, with recognizable storefronts, account dashboards and payment systems.
To understand how one of these operations worked, The American Desk purchased access.
What followed was a look inside a marketplace that had adopted the mechanics of ordinary online commerce to sell something far more personal.
Inside the Transaction
The website didn't allow customers to purchase individual albums directly. Instead, buyers had to purchase a prepaid package of points, which could then be used to unlock links to collections.
The VIP package was listed at $40 for 250 points. We purchased the package using Bitcoin.
Once the payment was processed, the points appeared in our account. Unlocking a collection cost five points. After the deduction, the website provided one link to a folder hosted on MEGA, a legitimate cloud-storage platform.
The link was successfully delivered.
We did not open the folder or download its contents. As a result, we could not establish whether the advertised photographs were present, whether they were authentic or how they might have been obtained.
The American Desk did not need to view anyone's intimate photographs to verify the marketplace's business model. A Bitcoin purchase of a VIP package listed at $40 was enough to establish that customers could buy credits and exchange them for access to listings advertised under women's names.
The transaction demonstrated that the marketplace accepted payment and delivered a link advertised as providing access to a collection of women's private photographs.
The website claimed a 250-point package could last five to six months, depending on how frequently customers unlocked collections. It promoted daily updates and exclusive material reserved for VIP members.
Then there was the loyalty program.
Customers who purchased access to a collection and left a review were promised an additional 20 points, enough to unlock four more links.
The website also advertised automatic email delivery of MEGA links, a customer dashboard for retrieving previous purchases and the ability to import certain collections directly into a personal MEGA account.
Those additional features were not independently tested.
The structure encouraged repeat visits. Customers purchased points upfront, spent them unlocking collections and could earn additional points through reviews.
Rather than paying for individual albums, buyers entered a system that encouraged them to continue browsing and spending their remaining balance.
And what they were browsing wasn't organized solely by the type of material being advertised.
It was organized around people.
The Name Is Not Optional
Across the websites examined by The American Desk, many collections were advertised under individual women's names. Some explicitly claimed to contain photographs or videos obtained through compromised Snapchat accounts.
The websites' submission requirements called for uploaders to include the name of the person depicted in the material.
We wanted to know whether those names corresponded to identifiable people outside the marketplaces.
For several listings, The American Desk located publicly accessible social media accounts bearing the advertised names. Photographs appearing on those accounts matched or closely resembled the thumbnails used to promote the corresponding collections.
The findings connected those listings to identifiable online profiles. They did not establish what appeared inside the paid collections, whether the material had been stolen or whether the individuals had authorized its distribution.
The American Desk is withholding the names, social media accounts and identifying photographs to avoid drawing additional attention to the individuals.
Still, the matches demonstrated that the listings weren't simply advertising anonymous photographs. They were associating collections with names and images that could be connected to people's public online identities.
In August 2026, the FBI warned that criminals were compromising social media and personal accounts to steal sexually explicit photographs and videos.
The agency described methods including phishing attacks, stolen credentials and schemes in which offenders impersonated platform support personnel to obtain access to accounts.
The stolen material could then be distributed or sold, sometimes accompanied by names, usernames and other identifying information.
The American Desk could not verify that the collections it examined originated through those methods. But the prominence of names and identifying photographs reflected an important feature of the trade described by federal investigators.
A woman's identity wasn't merely incidental to how these websites advertised their material. It was part of how their collections were organized.
And a recent international investigation demonstrated how far that practice could go.
What the NLT Crackdown Revealed
On October 7, 2026, the U.S. Department of Justice announced the seizure of two domains associated with NudeLeaksTeens, commonly known as NLT, a marketplace advertising stolen intimate photographs and videos.
The following day, France's National Gendarmerie disclosed findings from an international investigation into the operation.
Authorities reported identifying material affecting more than 17,000 women of various nationalities. Two brothers, ages 21 and 25, were arrested on suspicion of being principal administrators.
Investigators also reported seizing more than €700,000 in digital assets, including cryptocurrencies. That figure represents seized assets, not verified marketplace revenue.
But one of the investigation's most revealing findings concerned how the platform encouraged users to participate.
According to French authorities, NLT rewarded users with virtual currency for providing identifying information about women featured on the website.
That information included names, ages, places of residence and occupations. Investigators also documented the categorization of women by physical appearance, including numerical attractiveness ratings.
In NLT's reported system, identifying a woman could itself earn a reward.
The platform wasn't simply advertising collections of intimate imagery. According to investigators, it encouraged users to contribute personal information about the people associated with that material.
The marketplace where The American Desk purchased its membership was not NLT. We found no evidence establishing that the two shared operators, payment systems or contributors. Nor did we determine whether the website we tested rewarded uploaders for identifying women.
Nevertheless, the NLT investigation established how a separate, major operation had incorporated personal identities and financial incentives into its business model.
Its shutdown also raised a broader question: what happens to this trade when one marketplace is taken offline, but others continue operating?
The Storefront Is Public but Its Operators Are Harder to Identify
The websites examined by The American Desk were accessible through ordinary browsers. Determining where the infrastructure behind them was actually located proved less straightforward.
A network lookup associated with one examined website pointed to infrastructure connected to DDoS-Guard, a service that protects websites against certain types of cyberattacks. The associated network was operated by IQWeb FZ-LLC, with registration information pointing to the United Arab Emirates.
That doesn't establish where the marketplace's operators or underlying servers are located. Services such as DDoS-Guard can route traffic through intermediary infrastructure, meaning the publicly visible network address may belong to the protection provider rather than the website's actual host. DDoS protection is also widely used by legitimate businesses and is not itself evidence of wrongdoing.
Some examined websites used domains ending in .pk, Pakistan's country-code extension. That, too, provides little certainty about their operators' location. Domain extensions, intermediary networks, payment services and file-storage providers can involve entirely different jurisdictions.
The contrast was striking: these marketplaces required contributors to identify the people supposedly depicted in their collections, while the publicly visible technical records offered no equivalent certainty about who was operating the websites.
A Removal Notice on One Site and a New Listing on Another
During the investigation, The American Desk encountered another finding that raised questions about the effectiveness of removing material from these marketplaces.
One of the websites had advertised a new collection that day.
We took its publicly displayed thumbnail and searched for matching or similar images elsewhere online. The results led to other websites advertising similar material.
One result stood out.
When we opened the corresponding page, the content was unavailable. Instead, the website displayed a notice suggesting that the material had likely been removed following a Digital Millennium Copyright Act (DMCA) request.
Meanwhile, a similar collection remained advertised on the newer marketplace.
The American Desk could not establish whether the underlying files were identical, whether a formal copyright complaint had actually been submitted, whether any files had been removed or whether the two listings used the same storage link.
The thumbnail search connected a newly advertised collection to a page on another website displaying an unavailable-content notice that cited a possible DMCA request. The notice was not independent confirmation that a takedown had occurred.
The finding illustrated the limits of what a removal notice on one website can establish about the availability of similar listings elsewhere.
The separation between marketplaces and file-hosting services adds another complication.
Our test purchase ended with one MEGA link. The marketplace handled the transaction, while a separate cloud-storage service was used for the advertised delivery.
MEGA is a legitimate provider, and The American Desk found no evidence that the company knowingly participated in unlawful activity connected to the transaction.
But removing a marketplace listing does not automatically disable an external file-sharing link. And disabling a link cannot retrieve copies that other users may have already saved.
The federal TAKE IT DOWN Act addresses some of these challenges. Since May 19, 2026, covered online platforms have been required to provide a process for reporting qualifying nonconsensual intimate imagery and to remove reported material and known identical copies within 48 hours of receiving a valid notice.
The Federal Trade Commission can enforce those requirements.
Still, removing material from one service cannot guarantee that every previously distributed copy has disappeared.
For someone attempting to regain control over intimate imagery, the problem may extend well beyond the website where it was first discovered.
What If the Women Never Find Out
There's a question hanging over these marketplaces that no purchase receipt can answer.
How many of the women whose names appear in the listings actually know they're there?
The American Desk did not contact the individuals identified during the investigation, and we could not establish how many were aware of the advertised collections.
The FBI has documented that people affected by intimate-image theft may not realize their accounts were compromised or that their material was subsequently distributed.
For someone whose photographs have been stolen, discovering one listing may provide little indication of how widely the files have circulated.
A collection can be copied, transferred to another account or advertised on a different website. A removal request might address one appearance without revealing whether others exist.
Adults affected by nonconsensual intimate-image distribution can seek assistance through StopNCII.org, which helps participating platforms detect and prevent the sharing of intimate images.
Victims can also report stolen or nonconsensually distributed material to the FBI.
But no single service can guarantee the removal of every copy across the internet.
And that is perhaps the most troubling imbalance revealed by this investigation.
On the marketplace we examined, purchasing advertised access required little more than a Bitcoin payment, a points balance and a few clicks.
The people whose names appeared in those listings were given no comparable guarantee that the material could be located, removed or prevented from resurfacing.
A Business Built Around Someone Else’s Identity
The American Desk verified that one marketplace accepted our Bitcoin payment, credited our account with 250 points and delivered one MEGA link after five points were redeemed for a listing advertised as containing a woman's private photographs.
We did not verify the contents of the advertised collection or establish that the material had been obtained without consent.
But we documented a commercial system that encouraged repeat purchases, rewarded customer participation and required contributors to attach names to their submissions.
For several listings, those names and thumbnails corresponded to publicly identifiable social media profiles.
The NLT investigation demonstrated the scale another operation in this market had reached, while our thumbnail search illustrated the uncertainty surrounding similar listings appearing across different websites.
Together, the findings reveal how ordinary e-commerce practices can be applied to a market advertising access to people's purportedly private lives.
For the customer, the transaction ends with an unlocked link. For the person named in the listing, there's no guarantee the consequences end there.