how to deal with leak & deepfake sites with infinite links

If you’ve ever handled your own DMCA takedowns and/or deepfakes, then you’ve surely heard of two malicious websites that seem to have links re-created daily. They are frustrating to work with due to non-compliance and don’t actually have real DMCA contacts.

For this article, I’m creating two fictitious leak sites – nudieleakies and ibidromies
(an iykyk kind of thing)

On that note: after reporting them, you can report them to their hosts or registrar. Typically they use registrars with extreme privacy, and Cloudflare as their host which does have an abuse department, but you should always confirm this by looking at their source code.

The good news is that the more often you report them, the further they get pushed down in Google’s search algorithm and in answer engines (e.g. ChatGPT or Gemini), they’re VERY unlikely to appear.

how malicious deepfake & leak sites get around search indexing

Before you can deal with the leaks or deepfakes you find on their website it’s important to understand some basics about link structure and how search engines, like Google or Bing, index those links. Or, in simpler terms, what tells Google and Bing that those links exist.

The “Spoof” / Bogus Link Structure Script Used By Ibidromes & Leaky Nudies (I Made These Up, They Aren’t Really Sites)

Normally when we visit a link on a website it will look something like this:

https://www.cutecats.com/breeds/colors/variations/orange-tabby

Intuitively, you might think if you go to cutecats.com/breeds/colors the page will display all of the breeds with the option of filtering results with colors – and that’s usually about right. The “orange-tabby” – which usually appears at the end of a link – is what makes that URL unique.

THE ACTUAL LINK STRUCTURE USED BY IBIDROMIES & LEAKY NUDIES AND WHY THEY ARE SO DIFFICULT TO SELF-MANAGE

For ibidromies specifically, there is at least some public security reporting around it beyond ordinary takedown complaints: Malwarebytes says it blocks ibidromies.com and associates the domain with fraud/phishing behavior. Leaky Nudies is just a mirror for them. So are their subdomains like “fenicemanagement” and others you may have encountered.

1. SEARCH FOR YOUR ONLINE PERSONA WITH GOOGLE

The first thing you’re going to do is a search in google with this exact query – obviously replace the “your_online_handle” with your actual handle:
your_online_handle leakynudies

Fair warning, these sites are INFESTED with malware, trojans, adware, popups, and malicious re-directs. So if you actually click onto these sites, DISABLE YOUR WIFI after the page loads and make sure you have the strongest level of popup protection enabled in your browser.

I have ways you can extract the links without ever clicking on any images located on the websites quickly and easier in a separate post

YOU DON'T NEED TO OPEN THE LINKS, SIMPLY RIGHT CLICK A FEW OF THE RESULTS ON GOOGLE'S SEARCH ENGINE RESULT PAGE, copy the URL and paste it into a notepad.

2. Compare the URLs

Now you probably have something that looks like this in notepad:

https://ibidromes.com/leak/photos/12345/rae-deepfakes-nudes-leaked-1
https://ibidromes.com/leak/photos/54321/rae-deepfakes-nudes-leaked-2
https://ibidromes.com/leak/photos/23154/rae-deepfakes-nudes-leaked-3

2 THINGS:

1. You can replace the “ibidromes” with “leakynudies” and get the same exact content.
2. Looking at this, you’d think that ibidromes.com is the website; leak might be a category, photos would be a type, and the slug (the ugly “rae-deepfakes-nudes-leaked-1”) would be the identity for the album or album name.

The -1, -2 and -3 in the link would be the unique item for the album item associated with the rae-soria-deepfakes-nudes-leaked would be the unique identifier for the subject (person) – e.g. each link would take you to a different photograph, or at least that would be the most intuitive and immediate analysis…

Except, that’s not the case here..

https://ibidromes.com/leak/photos/12345/rae-deepfakes-nudes-leaked-1
https://ibidromes.com/leak/photos/25315/rae-deepfakes-nudes-leaked-1

*note, the only difference here is 12345 and 25315 in that link. 🤔

What will happen is immediately after you get rid of this link:

https://ibidromes.com/leak/photos/12345/rae-deepfakes-nudes-leaked-1

You’ll encounter a new one with the same identifier, but different slug.

Then, when that one is reported, you’ll get another.

And another..

and another.

After reporting enough, you’ll see something like this:

https://ibidromies.com/leak/photos/12345/rae-deepfakes-nudes-leaked-1
https://ibidromies.com/leak/photos/12345/rae-deepfakes-nudes-leaked-2
https://ibidromies.com/leak/photos/12345/rae-deepfakes-nudes-leaked-3
https://ibidromies.com/leak/photos/12345/rae-deepfakes-nudes-leaked-4
https://ibidromies.com/leak/photos/12345/rae-deepfakes-nudes-leaked-5
https://ibidromies.com/leak/photos/54321/rae-deepfakes-nudes-leaked-1
https://ibidromies.com/leak/photos/54321/rae-deepfakes-nudes-leaked-2
https://ibidromies.com/leak/photos/54321/rae-deepfakes-nudes-leaked-3
https://ibidromies.com/leak/photos/54321/rae-deepfakes-nudes-leaked-4
https://ibidromies.com/leak/photos/54321/rae-deepfakes-nudes-leaked-5

In reality, each unique identifier is likely tied to the 12345, 54321 and 23154 – which is backwards from what we see in normal websites that aren’t trying to bypass search engine blacklisting.

For videos and/or albums, you may see TWO occurrences of these numerical strings that you’ll have to extract.

WHY this matters and how that identifier affects YOU

That ID is most likely A PICTURE, VIDEO OR ALBUM OF YOU.

The slug in this scenario is useless and is generated using a script with the value being a variable.

You could technically type in any of these things and it would show the same exact content.

EXAMPLES OF IBIDROMIES & LEAKYNUDIESS LINKS

https://ibridromies/leak/photos/12345/rae-soria-my-grandmothers-birthday-1
https://ibridromies/leak/photos/12345/rae-soria-some-complete-strangers-birthday-1
https://ibidromies/leak/photos/12345/rae-soria-ajgdfirahgiheaog-whatever-i-want-to-put-here-ihaerihgiaegriaehgiohagrihaergihaerghiaeihg-1

You could literally add anything to the end of that link – which is essentially how they look you up in their own system. In a Python script it would look like this:

@app.get("/leak/photos/{post_id}/{slug}")
def show_post(post_id: int, slug: str):
    post = db.get_post(post_id)
    return render_template("post.html", post=post)

Their JavaScript indicates that they “crawl” these links automatically to create an extra version of it.

Crawl = The website sends Google a DM saying "please visit this URL and add it to your massive directory of links (AKA index.)"

All of this is automated and lacks human oversight, so Google just automatically indexes it and accepts the request. It visits the site and confirms it exists and a new links is made. That’s literally all it is.

We call this “Black-hat SEO”

Black-hat SEO is where you manipulate search engines and attempt to get around their rules or use tactics that harm others.

What ibidromiess and nudieyleakies do is attempt to skirt around Google’s policies after a link is reported, which essentially flags them and lowers their rank in results. After Google receives x amount of reports, the offending sites are blacklisted – or essentially the domain is forbidden from appearing in search engine results.

While Bing, DuckDuckGo and even Yandex have proactively dealt with this, somehow the largest search engine in the world pales in comparison to its smaller competitors.

3. using their link structure to your benefit & reporting the links ahead of time

Depending upon whether or not you want to hire a service (I have project Diana in the works currently, but if you’re in a hurry to get content removed:

I recommend Bruqi – I KNOW they offer 50% off your first month using this promo link – so, basically $15 for a full month of service.)

DIY Method For Deepfake & Leaked Content Removal

Now that you understand link basics, we can start combining YOUR PERSONAL INFO with their link-building strategy.

As I mentioned before – I HIGHLY recommend TURNING YOUR WIFI OFF while you visit their sites.

1. Search your main handle and username.
2. Click the link. Do not click any popups after getting onto the website.
3. Turn off your Wifi.
4. Figure this out: is this a PAGE/INDIVIDUAL IMAGE or is it an ENTIRE ALBUM?
5. If your wifi is disabled, right click your name at the top of the album and copy the link. Turn your wifi back on and it should take you directly to the album. If not, then keep searching for it.
6. In this particular link, the “123456” is the most important part of that link.
7. Now you can work backwards and forward in the URL bar with that, using the same https://ibidromes.com/creator/content-creator/photo/ + 123456 but replacing the “123456” with 123457 123458 123459 123460
   Do you remember in elementary when they made you learn to recognize patterns? That’s all this is. You can also count backwards: 123456, 123455, 123454, 123453, 123452, 123451, 123450, 123449
8. Once you’ve identified all of those key identifiers, you can start getting them all into a spreadsheet.

In a spreadsheet, you can play around with the links once you identify patterns in your links with the identifier. You'll probably see a lot of links similar to what I have in there. You can do a find and replace for:
-your-user-name-here- 
and replace it with your actual username, for example: 
-rae-
Use hyphens for any spaces in your online identity.

You can also use that spreadsheet and replace:
.ibidromes.com
with:
.leakynudies.com

5. reporting links that don’t exist yet

The links may not be “indexed” but you can still report them since they technically exist, and they will be blacklisted before they are ever even generated. After reporting them you’ll see “not indexed” but they will most likely show as “approved.”

The trickiest part of this is that a model can have multiple IDs on these sites, and a link can have multiple IDs. Then you also have album IDs, so you need to extract them before doing anything else and start there.

In an upcoming post, I’ll be providing other uses with Excel.

the project diana prototype

My software is being designed to counteract these links and determine which links are real and which are not. If you’d like to fund or contribute to my project, you can check out my contact info. I also have scripts that predict what will come next since a lot of these “deepfake” and alleged leak sites are designed to bypass Google’s systems.

I intend on designing it with a hybrid membership OR pay-as-you-go “credits” system.

I have my scripts being uploaded to my github account, but they are private to ensure they don’t end up in the wrong hands.

If you want human oversight in the meantime to handle some takedowns for you, I’m happy to help!