Case study: removing a leaked video from an offshore tube site

01The case in brief

The client was a woman who discovered that a video in which she appears had been uploaded to an adult tube site run from abroad. She did not know who had seen it or how far it had gone, and by the time she asked for help she was finding it hard to get through an ordinary day.

SARAZIM LLC handled the removal of the posts on that site, and the posts she instructed on were taken down. She did not stop there. Because the same file can be put back up by anyone who downloaded it, she also took the re-upload blocking service, which keeps watching for the same video after the first removal.

02Why an offshore tube site is different

A site like this is operated, and its servers sit, outside the country where its viewers live. There is often no working contact address, or the report button leads nowhere. You cannot simply write to the operator and expect an answer, and a local court order does not reach the server by itself.

Three things make it harder than a takedown on a mainstream platform. The contact details are hidden or the report channel does not work. The same video is copied across to mirror sites, while links and screenshots travel separately through messaging apps and forums. And when a preview turns up in image or video search, people who have never heard of the site can see it. Removing one post is therefore never the whole job.

That is why the first question in this case was not how to reach the operator, but who else holds the file: the hosting company, the network in front of the site, the registrar of the domain, and the search engines that show its previews.

03Where doing it alone breaks down

Most people try to handle it themselves first, and they hit the same walls. The first is having to watch it again: every report needs the exact address of every copy, which means going through the material page by page.

The second is not knowing who to ask. When the operator does not answer, the next stops are the company that hosts the server and the CDN that sits in front of the site, and each of them wants a different basis and format. The third is the return: the same video shows up again at a new address weeks later, and without someone watching, the damage simply restarts.

There is also the cost of doing it piece by piece. A person filing alone usually reports the one post she found, waits, sees nothing happen, and only then starts looking for a second route. Meanwhile the copies she has not found yet stay up. Working all lines at the same time is what keeps the list from growing faster than it shrinks.

04Intake without giving your name

The first conversation can be anonymous. The client did not have to give a name or phone number at the start, and nothing she said was shared beyond the person handling her file. Three questions come first: does she already know any addresses, does her face appear in a way that identifies her, and has she reported it anywhere herself.

Not knowing a single address is not a problem. SARAZIM LLC runs face-recognition detection that locates where a person's images have spread from 2 to 3 ordinary photos, so the client never had to search the sites or sit through the video again. Scope and price were set only after the spread had been mapped.

What she received at that stage was a plan, not a promise: which groups of addresses existed, which party each would go to, and what SARAZIM LLC would record and delete along the way. The founder is a security professional, formerly at Palo Alto Networks and certified CISSP, CISM, CEH, OSCP and GIAC GASAE, and the work is run the way an incident is run: scope first, then containment, then verification.

05Mapping the spread first

Nothing was filed until the spread was known. Finding only the original post and stopping there leaves the copies and the search results in place. Every address found was sorted into one of three groups, because each group goes to a different party on a different basis.

Face-recognition results were never used as they came out. A member of staff checked each match by hand. If a stranger's video slips into the list, a request goes to the wrong post and the posts that matter wait longer.

06Evidence before anything comes down

Recording comes at the same time as the first request, and sometimes before it. Once a post is gone there is no way to show what was at that address. For every address, SARAZIM LLC kept the URL, the time it was checked and a capture of the page.

That record does two jobs. It is what the client needs if she reports to the police or takes legal action. It is also the reference used later to decide whether a newly found post is the same video. It is not used for anything outside her case.

07Operator, host, CDN: in that order

Removal from an offshore site is never a single request. When the operator stayed silent, the requests moved to the companies that keep the site online. Many such sites sit behind Cloudflare. Cloudflare states that it cannot remove content it does not host, but that for sites using its pass-through service it forwards the complaint to the operator and the hosting provider, and gives the hosting provider the origin IP address so the content can be located.

Cloudflare's abuse form has its own category for non-consensual sexually explicit imagery, and Cloudflare says it generally cannot process complaints sent by email. For some categories you can ask that your report is not forwarded to the operator, which matters when the operator may be the uploader.

The domain's registrar is a further point of contact. ICANN requires accredited registrars to publish an abuse contact and to take reasonable and prompt steps to investigate and respond to abuse reports. The registrar is found through the domain's registration record, for example with ICANN Lookup.

• Operator: the site's own contact or report form, if one exists and works. It is tried first because it is the fastest when it answers.
• Hosting provider: the company running the server where the file actually sits. Cloudflare gives it the origin IP address, so it can find the file on its own machines.
• CDN: does not remove content it does not host, but passes the complaint on and tells the host where the file actually sits.
• Registrar: the company the domain is registered through, reached through its published abuse contact.

08What each notice contained

Offshore sites and their suppliers mostly work in English, and a notice that is not in the expected shape is often closed unread. SARAZIM LLC's notices in this case always carried the same five elements.

No video file or capture was attached. A precise address is all the recipient needs to find the post, and every attachment is one more copy in circulation. Where a request was refused, it went back with the grounds strengthened to answer the reply; where the operator never answered, it went to the host and the CDN.

Search results were handled separately. Google lets the person shown, or their representative, request removal of real or fake sexual imagery from Google Search. For sexual images Google says it will do its best to find and remove duplicates, and only the URLs listed in the form are reviewed, which is why the address list built earlier is used here line by line. Google can only remove the result, not the page on the host.

09Removed means checked, not sent

A request sent is not a removal. Every address was opened again, and a post was recorded as removed only when it was actually gone. Offshore sites sometimes hide the post page while the file stays reachable, or move the same video to a new address.

The removal on the tube site in this case was judged on that standard, and progress and results went to the client as a written report. The removal rate of 98.2% that SARAZIM LLC publishes is an internal figure counted the same way, on confirmed removals rather than requests.

Re-upload blocking

Re-uploads usually appear some time after the first removal. Someone who downloaded the file posts it elsewhere, or a mirror site copies it back. Titles and file names change, so searching by title or keyword misses them. Monitoring therefore runs on the video's own identifiers: metadata and hash values, not the footage. SARAZIM LLC does not keep the video once the work is done. When the same video turns up, the new address is recorded and a request goes out straight away. Whether to pursue the original uploader is agreed with the client at contract stage.

A person who still holds the file on her own phone can add a second layer. StopNCII.org creates a hash on the device; the image or video never leaves it. Partner platforms, which include Microsoft's Bing, Reddit and several large adult sites, look for matches. It is for adults who appear in the material, and it reaches only partner platforms, not the wider internet.

Monitoring is not a one-off search. It repeats every cycle, and each finding goes through the same steps as the first round: compare against the stored hash values, record the new address, file with the right party, open the address again to confirm. A video that has been down for a while is not proof that it will stay down.

10Your legal footing, and what the case shows

In the United States, covered platforms have had to run a notice-and-removal process since 19 May 2026. A valid request carries a signature, enough information to locate the image, a good-faith statement that it was not consensual, and contact details; it may come from an authorised person acting for you. The platform must act within 48 hours and make reasonable efforts to remove known identical copies. The FTC enforces it.

In the United Kingdom, Ofcom states that from 17 March 2025 sites and apps in scope of the Online Safety Act must take down non-consensual intimate images when they become aware of them. In Australia, the eSafety Commissioner can issue a removal notice to a host or platform requiring removal within 24 hours, on a complaint by the person shown or someone authorised by them, where that person or the poster ordinarily lives in Australia.

None of these binds an operator who simply ignores the law, which is why the host, CDN and search route matters. What the case showed is plain: an offshore site can be cleared when the spread is mapped and each line goes to the right party, and the job is not finished at removal. Time matters, because copies and shared links multiply the longer a video stays up. The client's part was small: explain, answer a few questions, read the report.

If you are in the same situation now, the order is simple. Write down each address and the time you saw it. Send nothing to the uploader or the site. If you do not know the addresses, 2 to 3 ordinary photos of your face are enough to start the search. Then let one party hold the list, file the notices and check the results, so that you do not have to look at the video again.