English
Asociación Española de Imagen Científica y Forense

Beyond the image: the infrastructure that sustains AI-enabled abuse

A review of the study by Morgan, Farid and Nightingale on non-consensual synthetic intimate images, and a proposal for discussing how to document web infrastructure rigorously.

By · Published on · Updated on

Diagram of the services and technologies surrounding a web publication.
AEICF conceptual diagram: services and technologies involved in a web publication. It does not represent a specific site.

Reading and discussion · AEICF

A manipulated image can be the starting point for an investigation. But its circulation depends on a network of services that make it possible to publish a page, keep it accessible, find it and generate revenue. Looking at that network raises important questions for those of us working with scientific and forensic imaging: what can we observe, how do we document it, and how far can that evidence take us?

Sarah Morgan, Hany Farid and Sophie J. Nightingale explore this perspective in The Backbone of Abuse: How Infrastructure Providers Enable the Proliferation of AI-Generated Non-Consensual Intimate Imagery, published on Sept. 30, 2026 in Journal of Online Trust and Safety. They examine non-consensual synthetic intimate images, a form of abuse in which manipulation of the image does not make the harm to the person depicted any less real.

What they studied and what they found

Between February 5 and March 19, 2026, the team manually reviewed 400 candidate sites. It identified 88 containing the material under study; 38 of these were devoted entirely to it. The selection began with alerts and directories and was expanded using similar-domain tools. It focused on depictions of famous people and used indicators from the sites and their content to classify them. The non-consensual nature of the images was based on a reasoned presumption about those individuals, not on individual verification of their consent.

Of 400 candidate sites reviewed, the study identified 88 containing non-consensual synthetic intimate images; 38 of those 88 were devoted entirely to that content. Data collection ran from February 5 to March 19, 2026.
Our own visualization of the counts reported by Morgan, Farid and Nightingale (2026), section 3, pages 5–8. The 38 sites are a subset of the 88. This is not an estimate of prevalence across the Internet.

The authors examined nine components: hosting, content delivery networks (CDN), DNS, domain registration, SSL certificates, content management systems, analytics, email and advertising. Their analysis identifies a concentration of detections among certain providers and technologies. Figure 1 and appendix A of the article detail the counts and denominators used for each service.

Three keys to interpreting the results

The sample does not represent the whole Internet

This is an exploratory study with a defined search procedure and observation period. Selection based on similar domains may introduce bias; nor can the results simply be applied to people without a public profile, private spaces or sites that were not found. Its contribution is to describe and shed light on part of the ecosystem, not to provide a universal census.

A percentage needs a denominator

In the category the article calls hosting, Cloudflare appears in 64 of the 105 provider identifications: approximately 61%. That base of 105 is not the number of sites. A site may use several services in the same category, and in other categories some information could not be identified. Presenting all proportions as percentages of the 88 sites would change the meaning of the results. See section 4.1, figure 1 and table 1 of the appendix.

Finding a known domain does not measure everyday exposure

The researchers located 82 of the 88 sites in the first two pages of Google search results. They did so using searches constructed from domains they already knew, in some cases entering the full URL. The result shows whether the sites could be located using that protocol; it does not measure the likelihood that someone would find the content through a generic search. The procedure and its steps are explained in section 4.4, page 11.

Services, intermediaries and software: different relationships

To apply this line of work to forensic documentation, we propose distinguishing the function observed with precision. A public IP address may correspond to an intermediary that receives requests and forwards them to another server. Detecting that address therefore does not, by itself, identify where the original content is stored. The Cloudflare documentation on DNS and reverse proxying describes this separation between its network and the origin server.

Something similar applies to content management systems. Detecting WordPress may indicate the use of software installed on a third-party hosting service. It does not demonstrate that the site is hosted on WordPress.com. The official WordPress documentation expressly distinguishes open-source software from the commercial hosting service.

These caveats are our proposed technical reading of the study. They do not diminish the value of investigating infrastructure; they help frame relationships that can be verified. It is important to distinguish the observation from the function attributed to it and from any conclusion about control, knowledge or responsibility. Such conclusions require additional evidence and specific analysis.

What could accompany a web capture

The question we at AEICF pose is whether a capture could be more informative if accompanied by a record of the observed infrastructure. This would be a line of work to evaluate, not a procedure that this study has validated for our work.

  • Object and time. Page or resource examined, date, time and time zone. A relationship observed today may have changed when checked again.
  • Preserved observation. DNS record, HTTP response, certificate presented or relevant code excerpt, together with its source and the method used to obtain it. The original data allows the interpretation to be reviewed.
  • Attributed function. Distinguish domain registration, DNS, intermediary services, origin hosting and detected software. Where the evidence does not establish a function, explicitly leave it undetermined.
  • Scope and alternatives. State what has been verified, what comes from an external tool and which explanations remain open. Sharing a provider or technology does not, by itself, prove that two sites have the same operator.
  • Preservation and review. Document tools and versions, preserve the necessary records and calculate integrity hashes. A hash helps verify that a file has not changed; it does not by itself establish that its interpretation is correct.

Before proposing an investigation, the reproducibility of observations, the handling of discrepancies between tools and the minimum information required would need to be assessed. It would also be necessary to define how to protect the data of affected individuals and prevent the documentation from amplifying the dissemination of abuse. The usefulness of technical context depends both on what it helps explain and on the limits it makes clear.

Original study and sources

Morgan, S., Farid, H. and Nightingale, S. J. (2026). The Backbone of Abuse: How Infrastructure Providers Enable the Proliferation of AI-Generated Non-Consensual Intimate Imagery. Journal of Online Trust and Safety, 3(4). Published on Sept. 30, 2026.

The illustrations are original diagrams prepared for this reading. The sample chart uses the counts published by the authors; the infrastructure diagram is conceptual and does not represent an investigation of a specific site.