Evidence

The first hour belongs to evidence

Open the page and record exactly what is there. You are building a clean record of what was published, where it appeared, and when you found it. If the page disappears after you contact the site, you may not get another chance.

Capture all of this:

1. The complete page URL, copied from the browser address bar.
2. Full-page screenshots that show the address bar, page title, account name, visible images or video thumbnails, and surrounding page details.
3. The date and time you found it, including your time zone.
4. The title, username, post ID, file name, or collection name attached to the leak.
5. Any visible download count, view count, upload date, or links to related pages.
6. A short screen recording if the page changes as you scroll or the content only appears after clicking through.

Do not crop the screenshots down to the stolen image. A close crop proves very little about where the image appeared. The browser address, page layout, username, and surrounding details are part of the evidence.

Keep the original files, too. Do not edit them, rename them, or save over them. Your full-resolution original, creation date, export date, and upload history can matter if the claim is disputed later. Put a copy somewhere safe and leave it alone.

Do not pay the leak site to unlock a download just to collect proof. Do not install software it tells you to install. Do not enter the password you use on your creator account. A screenshot of what is already visible, backed by the exact URL and a timestamp, is enough to begin the enforcement process.

Most people reverse the order. They send an angry message, the page vanishes, and then they realize they never saved the URL or captured the account that posted it. Removal feels urgent because it is urgent. Evidence still comes first.

Search

One URL is a lead, not the full leak

Finding one page usually means you found the easiest copy to see. Leak sites copy from one another, users repost collections, and the same file can appear under several titles or usernames. That spread can happen quickly.

Start with the exact name or stage name attached to the leaked page. Search it in quotation marks. Repeat the search with older usernames, common misspellings, platform handles, and distinctive phrases from your captions. If the page uses a specific file title or collection name, search that exact wording as well.

Run a reverse image search using a distinctive still that is safe to submit to the search provider you choose. Try more than the cover image. Reposters often replace thumbnails, rename files, or combine several sets into one archive. A different frame may expose copies the first search missed.

Keep a running list. Every new URL gets its own row, even when several pages sit on the same domain. A notice that identifies one page does not automatically identify the rest of the site. If you find twelve URLs, you have twelve locations to document and track.

Do not spend the whole first day trying to reach the theoretical end of the search. Preserve what you find, begin action on the confirmed URLs, and keep searching in parallel. Waiting for a perfect list gives the existing copies more time to spread.

Targets

The page, the host, and the CDN are different targets

The name at the top of the website is not necessarily the company with the power or incentive to act. Three separate parties may be involved:

These are not interchangeable inboxes. Sending the same email to every address you can find is not an escalation strategy. First identify what each company actually provides. Then send the legally required information to the party responsible for the material or service at issue.

Start with the site’s published copyright contact or designated agent when one exists. Confirm that the contact is current. Old abuse addresses remain copied across online directories long after nobody monitors them. If the operator does not respond, move outward to the infrastructure supporting it and document every step.

Keep search removal moving at the same time. It solves a different problem.

The notice

Your notice needs six things

A takedown notice is a legal statement. It is not a complaint that the post is unfair, invasive, or hurting your income. Those facts may all be true, but the notice succeeds or fails on whether it identifies a protected work, an unauthorized use, and the material that must be removed.

Under 17 U.S.C. § 512(c)(3), an effective notice must substantially include:

1. A physical or electronic signature from the copyright owner or someone authorized to act for the owner.
2. Identification of the copyrighted work. If one notice covers multiple works on the same site, it may identify them through a representative list.
3. Identification of the infringing material and enough information for the service provider to locate it. In practice, that means the exact URL for each page, not the site’s home page.
4. Contact information sufficient for the service provider to reach the complaining party, including an address, telephone number, and an email address when available.
5. A statement that the complaining party has a good-faith belief that the disputed use is not authorized by the copyright owner, the owner’s agent, or the law.
6. A statement that the information in the notice is accurate and, under penalty of perjury, that the complaining party is authorized to act for the owner of the right involved.

Do not bury those elements inside a long personal account of what happened. Give the recipient a clear identification of your work, the exact location of each unauthorized copy, the required statements, and a way to contact you.

Review every URL before sending. A profile URL, search-results page, and direct content page are different locations. If the recipient cannot tell which material you want disabled, the notice may be treated as incomplete.

Also confirm that you own the rights you are asserting. Being visible in an image does not always mean you own the image. A photographer, studio, agency, or employer may hold some or all rights depending on the agreement and the circumstances. If you created the photo or video yourself and did not transfer the copyright, the ownership question is usually more direct.

Search engines

Search removal is a separate job

Getting a page removed from a leak site does not automatically remove it from search results. Search engines maintain their own indexes, legal-reporting systems, and review processes. The source page and the search listing must be handled on separate tracks.

This matters because a leak can keep appearing when someone searches your name even after the original page is unavailable. An old result may remain until the search engine recrawls the page or acts on a separate request. Other indexed copies may still work.

Submit each infringing search result through the search provider’s copyright-removal process. Use the exact result URL and the URL of the page it points to. Track that submission separately from the notice sent to the site or host.

De-indexing does not delete the material. It makes the reported URL harder to discover through that search engine. Host-level removal does the opposite: it attacks the source, but it does not guarantee that every search listing, cached reference, mirror, or repost disappears with it. You need both tracks because they produce different outcomes.

Check searches for your legal name, stage name, current username, previous usernames, and common variations. A clean result for one name says nothing about the others.

The record

Before the day ends, build the record

By the end of the first 24 hours, you should have more than a folder of screenshots and a sent-email receipt. You need a case record you can return to without reconstructing the entire day from memory.

For each URL, log the date found, the work shown, the page owner or uploader when visible, the party contacted, the date the notice was sent, any confirmation number, the response, and the next action. Save copies of the actual notices. A spreadsheet is enough if it is kept current.

This record tells you which URLs were removed, which ones are still active, and which target needs escalation. It also stops you from sending duplicate notices while missing another page entirely.

Then schedule the next search.

A removed file can return under a new URL, a different account, a renamed archive, or a mirror of the original site. The new copy will not inherit the status of the old notice. It has to be found, documented, and acted on.

That is why removal is not the end of the job. This is a repeating job, not a task with a clean endpoint.