--- title: "Cloudflare, Google and Proton Serve Sites Hosting Deepfake Abuse, Study Finds" description: "Researchers found 88 abuse sites drawing hosting, ad space and email services from five providers whose own terms bar illegal content." author: "rews desk" published: 2026-09-30T16:02:39Z modified: 2026-10-01T01:50:47Z url: https://rews.cc/a/cloudflare-google-and-proton-serve-sites-hosting-deepfake-ab-020dc1 language: en tags: ["deepfakes", "infrastructure", "cloudflare", "google", "abuse", "tech"] publisher: "Rews (https://rews.cc)" --- # Cloudflare, Google and Proton Serve Sites Hosting Deepfake Abuse, Study Finds *Researchers found 88 abuse sites drawing hosting, ad space and email services from five providers whose own terms bar illegal content.* By rews desk · September 30, 2026 · https://rews.cc/a/cloudflare-google-and-proton-serve-sites-hosting-deepfake-ab-020dc1 ## In brief - A peer-reviewed study says five major web infrastructure providers supply services to 88 sites hosting AI-generated abuse imagery - Cloudflare provided the most services; Google, Namecheap, WordPress and Proton supplied ads, domains, software and mail - Google and WordPress disputed the findings; Cloudflare, Proton and Namecheap declined to comment - Of 400 addresses initially gathered, 312 were unrelated sites using abuse keywords to rank higher in Google searches - The researchers urged providers to cut services to the sites and choke off the distribution supply Some of the biggest names in internet infrastructure supply the hosting, advertising, email and security services that keep the most popular sites hosting nonconsensual, A.I.-generated imagery online, a study published on Wednesday found. Hany Farid, a professor of computer science at Dartmouth College, and Sophie Nightingale and Sarah Morgan of Lancaster University wrote *The Backbone of Abuse*, which appeared in Stanford’s peer-reviewed Journal of Online Trust and Safety. Over six weeks in February and March, they gathered 400 web addresses through keyword searches and Google Alerts, then narrowed the list to 88 sites actively hosting the material, most of it depicting female celebrities, pop singers and K-pop idols, along with women in politics and activism. Using open-source tools such as WHOIS to trace each site’s vendors, the researchers found that five companies dominated. Cloudflare supplied what the authors called the lion’s share of services: hosting, content delivery, domain-name servers and analytics. Google provided security certificates and advertising space for a majority of the sites, Namecheap was the leading domain registrar, WordPress the main content-management system and Proton the mail server. Each of those companies forbids customers from using its services for illegal activity. Publishing or threatening to publish A.I.-generated nonconsensual sexual imagery is a federal crime in the United States, and such material is illegal in many other countries. Cloudflare, Proton and Namecheap did not respond to requests for comment from 404 Media, which first reported the findings. A Google spokesman said in a statement: “Without the specific domains from the report, we can’t investigate these claims. We have strict policies against non-consensual explicit content — including AI-generated imagery — across all our products.” He said the company blocks ads on such sites, removes images from Search on request and demotes sites with high numbers of removals. A WordPress spokesman said the software maker is “open-source software, not a hosting provider,” adding that WordPress.org “does not host websites or provide hosting services to sites that use WordPress, and we do not have access to or control over content published on independently hosted WordPress sites.” Dr. Farid pushed back. While WordPress.org does not host sites, he said, WordPress.com does: “It’s operated by Automattic, which Matt Mullenweg also runs, and it hosts millions of sites. Any NCII site on WordPress.com is squarely within scope.” He said Automattic’s Jetpack tool and content-delivery network can serve the images themselves from the company’s own servers, and that WordPress.org maintains an ongoing service relationship with self-hosted sites through updates, plugin distribution and security patches. Dr. Farid pointed to Automattic’s legal fight with WP Engine, when Mr. Mullenweg announced in 2024 that WP Engine was blocked, then unblocked, from WordPress servers — proof, he said, that “the project can and will cut a specific operator off from those services.” “So ‘no access to or control over’ is not entirely accurate,” Dr. Farid said. The providers have drawn lines elsewhere. Cloudflare dropped the harassment site Kiwifarms in 2022 after initially refusing, and cut off 8chan in 2019, the sex-work network Switter in 2018 and the neo-Nazi site The Daily Stormer in 2017. In 2023, when victims of the Girls Do Porn trafficking ring demanded Cloudflare stop serving sites carrying their abuse footage, the company answered that it had no control over the content of sites using its services, no ability to remove material and no knowledge of who posted it. 404 Media has also reported that Proton handed Spanish police information identifying a pseudonymous activist in 2024. The study’s other finding was quieter but telling. Of the 400 addresses the researchers first gathered, 312 turned out to be gambling, travel or cooking sites with no deepfake content at all — pages stuffing abuse keywords into their code to climb in Google search results, a sign of how large the market for the imagery has become. Ms. Morgan, who coordinates the Lancaster project, said the group targeted infrastructure because it is the distribution supply. Journalists can unmask site owners and legislation can deter, she said, but: “Creators are going to create and people are going to demand. We can’t stop that. But we can call for providers to cut the distribution supply and stop enabling these sites.” The paper’s recommendation is exactly that: providers should stop supplying services to the sites.