⚠️ A note before you read this
During this investigation, Sidenty identified an individual we believe to be connected to the operation of this marketplace, and found several corroborating connections to that individual. We are deliberately not publishing that identity, any username, platform profile, location, or other detail that could reveal who this person is, even in redacted or partial form.
We are withholding this for two reasons. First, French authorities have arrested suspects in this case but have not officially named them; publishing our own identification would get ahead of an active criminal investigation and the judicial process. Second, everyone we discuss here is presumed innocent until a court rules otherwise, and our identification, however well-supported we believe it to be, is an investigative lead, not a legal determination.
This article documents only the technical infrastructure of the marketplace itself.
Background
In early 2025, a creator contacted Sidenty to report that her intimate content was being sold on NudeLeaksTeens.com, a commercial marketplace offering paid albums and VIP access. At her request, we do not publish any detail that could identify her.
This case study documents what we found using open, verifiable sources, and describes the extent of what we were ultimately able to determine. We do not name any individual in this article. Any person connected to this operation is, unless stated otherwise by official sources, presumed innocent.
1. The domain
Verisign RDAP data (queried 9 Oct 2026) shows NUDELEAKSTEENS.COM was registered on 2022-07-12 through Namecheap, with an expiry of 2028-07-12.
Historical MX records show an unusual early choice: French IONOS consumer mail servers (mx00.ionos.fr / mx01.ionos.fr), appearing 2022-07-13, one day after registration. Within months the domain moved to Cloudflare-routed mail, briefly to Hostinger in mid-2023, then back to Cloudflare, where it remained into 2026. This was our first signal that the operation was likely French-based.
The earliest archive.ph capture of the live site dates from 20 November 2022. Registration, a dedicated mail setup, and a functioning storefront within four months is consistent with a planned commercial launch rather than an ad hoc leak dump.
A related domain, nltvids.com, was registered on 2026-02-20 through Sollutium EU sp. z o.o — useful for tracking the brand’s later expansion, not its 2022 origin.
2. Marketplace economics
An archived VIP product page, captured 8 December 2023, listed “Exclusive Leaks Access – Buy 300 Amethysts” for $29.90, with a “Total Sold” badge reading 1,684. Payment was accepted via cryptocurrency or CashApp. Related product packs on the same capture ranged from roughly $26.90 to $99.90. The site also operated a “gems” reward system incentivizing users to re-share albums and recruit new members into Telegram channels, and tracked account-level reward history tied to individual site usernames.
We treat the sales badge as a marketing figure, not an audited sales count. Even so, a VIP product showing over 1,600 recorded sales, alongside a tiered pack structure, a referral economy, and persistent per-account reward tracking, indicates an organized commercial operation rather than an informal leak site.
3. The Shoppy storefront and file delivery
The operation also sold through Shoppy.gg, under the seller name Nud3LeaksT3ns — the same handle used on the brand’s Telegram channels. A product listing, archived 9 October 2026, instructed buyers that after payment, files would be delivered via MEGA: a contact invitation would appear from the email address nudeleaksteens.contact@gmail.com, which the buyer had to accept to access the content. We have withheld the direct link to this listing and its archived capture, as the original page contains content we judged inappropriate to surface further.
This detail matters because the operator published this address themselves, as the operational contact for a paid product. Its role in granting access to the MEGA storage holding the content identifies it as an administrative account for the marketplace, not a general inbox.
4. Additional brand-aligned email addresses
Based on the naming pattern of the confirmed contact address and the French signals already identified in the domain’s mail infrastructure, we tested a small set of plausible variants using bulk email-verification tools. Three were confirmed as registered, all with French-market webmail providers: nlt3ns0@hotmail.fr, nltns0@outlook.fr, and nltns4@outlook.fr. We treat their existence as a further infrastructure signal consistent with the French-operator pattern.
5. Credential exposure of the operations accounts
Have I Been Pwned lists the Gmail contact address in two stealer-log compilations: ALIEN TXTBASE (added to HIBP 15 February 2025) and Synthient Stealer Log Threat Data (added 11 April 2025). The three additional addresses identified in Section 4 were also present in the Synthient compilation. All entries record that email addresses and passwords tied to these accounts were captured by infostealer malware at some point.
We did not retrieve, test, or use any credentials associated with these exposures. We flag this as a further data point on the operation’s infrastructure and account hygiene, not as a basis for any conclusion about who controls these addresses.
6. Telegram and brand presence
Public Telegram indexes list NLT-branded channels whose bios link back to nudeleaksteens.com and to a contact handle matching the Shoppy seller name, with channel history dating to mid-2022. Third-party traffic estimates (Semrush, August 2026) put monthly visits to the domain in the range of 130,000–140,000; we treat such estimators as order-of-magnitude only, since different tools report substantially different figures.
7. What we could not confirm from infrastructure alone
We could not independently verify exact revenue figures (third-party reporting on court filings cites a claimed $25,000–$30,000 per month, which we attribute to that reporting, not our own measurement), the full scope of victims, or ownership of several adjacent domains we initially flagged and later ruled out based on separate WHOIS ownership.
8. Beyond infrastructure
The technical indicators above, domain history, mail infrastructure, operational email addresses, and their credential exposure, formed the backbone of our investigation. But infrastructure alone has a ceiling: it can establish patterns and geography, not identity.
As noted at the start of this article, our investigation went further than what is documented in Sections 1–7. Using additional, independent lines of inquiry, we reached a level of confidence sufficient to identify an individual we believe connected to this operation, and to escalate that finding to law enforcement. Consistent with the reasons explained above, we are not detailing that part of our work here.
This is also where our published findings end. What happens next, whether that identification holds up, and what legal consequences follow, is for French authorities and the courts to determine.
This investigation was substantially completed in early 2025, well before the developments described below. During that period, we made multiple attempts to bring our findings to the attention of law enforcement. We are publishing this case study now, alongside the official announcements, both to document our methodology for the OSINT community and because we believe creators affected by this marketplace deserve to understand how this kind of investigation works.
What follows is the public record as it stands today, independent of our own investigation.
Official developments (not part of our findings)
For context, we note the following public record, which is separate from and not caused by our investigation: on 6 October 2026, French authorities announced the arrest of two suspects in the Nord department, described as the marketplace’s main administrators. On 7 October 2026, the Paris prosecutor announced the shutdown of nlthub.pk, nltvids.com, and nudeleaksteens.com, citing more than 17,000 affected individuals and the seizure of over €700,000 in cryptocurrency. The U.S. Attorney’s Office for the Eastern District of Virginia and the FBI announced the seizure of related domains the same week. Those suspects remain unnamed in official releases and are presumed innocent unless and until a court rules otherwise.
What creators can do
If your content appeared on NudeLeaksTeens, nlthub, or related NLT channels:
- Report to French authorities via the address published by the Paris prosecutor.
- Report NCII to the FBI at ncii.ic3.gov.
We do not replace law enforcement.
Note for law enforcement: Sidenty’s complete technical case file (including archived captures, cryptographic hashes, a documented investigation timeline, and our findings regarding individuals potentially connected to this operation) is available to authorised law enforcement and judicial authorities on request via support@sidenty.com. Requests are verified through official channels before any material is shared.