The global online forum trading in leaked nudes and its Christchurch links

Friday, 17 July 2026

This story is published in conjunction with the investigative journalism collective Bellingcat. You can read the full story here.

In 2024, a former track and field coach in Boston, Massachusetts, was sentenced to five years in jail for attempting to trick and extort more than 100 women, including student-athletes he coached, into sending him intimate photos.

According to the 2021 criminal complaint, Steve Waithe stole photos from some of the student-athletes’ phones under the pretence of using their devices to “film their form” at practices and meets. He also approached some victims via fake online accounts, telling them he had found their images on a forum site called leakedbb.com and offering to help them remove these photos if they provided more images for “reference”.

Authorities said Waithe also hired and paid another man to hack into the Snapchat accounts of women he coached or had other relationships with in an effort to steal and distribute nude images online.

In one post, according to the US Attorney’s Office, Waithe wrote: “Does anyone want to trade nudes? I’m talking girls you actually know. Could be exes or whatever. I have quite a few and [am] down to trade over snap[chat] or something.”

Legal documents do not name the sites on which Waithe distributed these images, but a cached version of a November 2020 post on LeakedBB – the same site he allegedly used to try to trick victims – had that exact wording. Another cached LeakedBB thread posted a few months later shows the same user offering to trade nudes of athletes, including “a lot that I actually know”.

One criminal conviction, in one corner of the USA, from several years ago doesn’t immediately present as a case with ongoing, international consequences; or one that is of any special interest to New Zealand. But through LeakedBB, the site on which Waithe apparently posted to try and share images, it is both of those things.

Since its inception in 2019, LeakedBB has traded in and profited from the wide distribution of such content. Multiple archived pages show LeakedBB’s users either requesting Snapchat hacks or offering to help others hack Snapchat accounts, sometimes for a fee.

In the criminal case against Waithe, the ownership of LeakedBB is never discussed. But payment streams, company records and website domain information appear to lead back to one individual: Jitendra Maharaj, a former pilot and co-founder of cryptocurrency payments platform Pay It Now, who lives in Christchurch.

The Press’ publishing partner, the international investigative journalism collective Bellingcat, spent weeks collecting online open source information linking Maharaj to LeakedBB. You can read the full investigation here. The Press then sent detailed findings to Maharaj and invited him to respond. We also spoke to him at his home about his apparent connection to the site. Neither he nor his lawyer directly addressed the findings or questions. In person, Maharaj said he did not know who was behind LeakedBB or operated it and that he was not sure if the website was down (LeakedBB has been down since June 6 – two days after The Press first contacted Maharaj.)

“All the evidence against me just sounded really weird,” he said. “It seems like there’s some kind of targeted attack out on me … manufactured evidence or something that’s pointing me to this garbage.”

He also claimed that he had been contacted by people “trying to harass me to get me to send them money” but declined to provide details on the record.

Profiting Off ‘Leaks’

LeakedBB was set up in 2019. Early on, it had sections for other types of “leaked” content such as computer programs and eBooks. But within months, the forum’s discussions were almost exclusively about pornographic images and videos that members claimed had been leaked – implying that it was non-consensual, hacked or stolen content.

Over the next seven years, LeakedBB built a sizeable following, averaging an estimated 2 million visits a month from March to May this year. The board statistics shown on LeakedBB’s homepage in May displayed 2.2 million registered users and more than 2.6m posts.

Images on the forum, based on posts found on LeakedBB itself and other social media sites, fall into two broad categories: those taken from adult content creators and those of private individuals never intended to be publicly shared. Shortly after LeakedBB went offline, a Reddit post noting the outage and asking for alternatives trended in the “hot” section of a piracy subreddit, accumulating almost 700 votes in a week. In response to a question by one commenter asking what the site was, another person replied: “Not only did it have ‘onlyfans’ content, also amateur, asian, arabic, celebrity and other hacked phone/icloud content from other sites.”

On LeakedBB itself, sections featured threads that appeared to show women unconnected to the adult entertainment industry. Accompanying posts claim the images were leaked, hacked or even obtained through blackmail.

One post advertised images of girls from 29 US states: “There’s names and Facebook information if you want that,” the member, “Master Leaker”, posted. “There’s also two girls that got blackmailed into sending more nudes as well!”

Revenge porn

LeakedBB’s operating model sought to profit from and reward posters for non-consensual intimate image sharing (NCII), also known as revenge porn.

Except for preview images, most of the content users shared in the “leaks” section was behind a paywall and could only be accessed with memberships costing up to US$99.99 or by redeeming credits earned for posting “leaked” content. There was also an annual Christmas contest. Last year, prizes totalled more than $4000 in cryptocurrency for users who posted or liked the most threads.

The “leaks” were often posted with women’s purported real names, locations and social media accounts, as well as preview images showing their uncovered faces. One poster said sharing a woman’s social media details “adds to the experience”.

“For me, it makes my jerk-off sesh feel more personal, as if she’s an actual person I know rather than a moviestar/pornstarr.”

There were more than 80 responses to this thread, mostly thanking the original poster for sharing the content. One of them, however, claimed to be the woman shown in the images: “Please remove this link. These photos were illegally stolen from me. This constitutes revenge porn and violates US law. Police are already involved. Not only is it illegal but just gross.”

Who Is Lucifer NightStar?

The only account with the title of “Administrator” on the LeakedBB forum went by the username Lucifer NightStar. This user posted FAQs for the site and almost every forum announcement throughout its history.

The account profile did not state the user’s location, but it did show a local timestamp based on the user’s timezone settings, which matched GMT+12 – a timezone used in several countries in Oceania, including New Zealand and Fiji.

Lucifer NightStar’s recent posts generally avoid mentioning NCII, focusing on administrative updates, troubleshooting and the annual Christmas contest. However, in the first few months of the forum’s existence, the user posted a thread with a “LeakedBB Exclusive” of “leaked Kiwi girls”.

In another discussion thread from 2020, Lucifer NightStar vouched for a user’s ability to “influence” another member’s ex-girlfriend to share nudes.

Maharaj did not respond to The Press and Bellingcat’s question about whether he was Lucifer NightStar. However, one of the administrator’s posts revealed another possible connection.

The post, from May 2021, was in response to a user reporting problems paying for LeakedBB with Apple Pay. Lucifer NightStar shared a screenshot of what the payment screen should look like. A company name was visible in this image: “Logica LTD”.

New Zealand company records show that Logica Limited was registered by Maharaj in February 2021, just months before this post. The company address is also in Christchurch, where Maharaj lives. He is its sole director and his LinkedIn profile (deleted last month) stated that he was self-employed as the CEO of Logica NZ from May 2020 to August 2021.

This was not the only connection between LeakedBB and Logica Ltd. On May 4, 2022, a YouTube user with the display name “LeakedBB” uploaded a video on how to pay for memberships on the site. This video was also embedded on LeakedBB’s homepage.

The video showed how users could pay by credit card. When they clicked to purchase a membership, LeakedBB would redirect them to another website to buy a digital avatar pack (a collection of digital assets that can represent a person online) with a price corresponding to their selected membership tier.

The thumbnails of the digital avatars as well as their price and description, as shown in the video, were identical to those shown on the archived version of a site, logica.nz, which is recorded as Logica Ltd’s website on OpenCorporates. This site also lists “Logica LTD” in its copyright information at the bottom of its landing page.

(Bellingcat last accessed a live version of the video on June 15. By July 1, it had been removed by the uploader.)

When asked about the links between LeakedBB and Logica, Maharaj said only that “Logica was my company. I cannot say what happened there right now”.

Logica Ltd is still a registered New Zealand company. Maharaj himself submitted its most recent annual return in March this year.

Online connections

Another apparent connection between Maharaj and LeakedBB was the site’s Domain Name System (DNS) records. Within these, Bellingcat found that the mail server set up to accept emails for LeakedBB.com was previously set to LeakedBB.net. It was later changed to ProtonMail.

LeakedBB.net had its DNS certificate (used to prove ownership of a domain) issued by another site, mybbplugins.com. WHOIS ‒ the online registry of domain ownership ‒ records that mybbplugins.com was publicly registered to Maharaj from December 2011 to February 2019, after which the registrant information was redacted.

The oldest saved archive of the payment screen on LeakedBB, from November 2019, provided another link. The archived HTML code for the page included a PayPal account and associated ProtonMail address. That email address included a string of seven digits as the username (I.e., 1234567@protonmail.com). The sequence was an exact match for part of a phone number appearing on records for websites registered to Maharaj’s name, including mybbplugins.com, from 2008 to 2011. (It is unclear whether Maharaj was using this phone number in 2019, by the time LeakedBB was set up, and a different Fiji-based phone number was used with his name when the registration for mybbplugins.com was renewed in 2016.)

‘Bulletproof hosts’

Sites like LeakedBB present some of the thorniest problems for agencies trying to curb the proliferation of NCII and revenge porn.

In New Zealand, that agency is Netsafe. It is the only approved body under the Harmful Digital Communications Act 2015 and often handles revenge porn complaints. Under the legislation, people face up to two years’ imprisonment or a fine up to $50,000. For a company, the fine can be as high as $200,000.

Netsafe chief online safety officer Sean Lyons said New Zealand’s law was quite novel. It was able to respond to generative AI technology that didn’t exist when it was written and it gave New Zealand courts powers to issue takedown orders, even in other countries.

But it was mostly intended for use where one individual was harming another, Lyons said. Particularly when it came to “unmasking” the offending party. And, if the offending party was overseas, then the law’s efficacy largely relied on responsible platforms doing the right thing.

“Unfortunately, we do come across what is sometimes referred to in the industry as bulletproof hosts,” Lyons said.

“So there are times when, within our process, we will have contacted platforms or hosts and they will have said, ‘Who the heck are you?’… [Or] ‘We know what we’re doing, we are quite comfortable with what we are doing, and we don’t give a stuff about what it is that you are telling us, or about New Zealand law, or about the harm.’”

These hosts were usually niche sites that existed expressly to disseminate a particular type of harmful content, Lyons said: child sex abuse, violence, gore or incitement to hate. Or NCII.

“[They] exist because they are trafficked by people who have an interest in that niche and an interest in that content. Another equally worrying adjunct to this is that alongside the direct threat to shame and embarrass somebody, there is the sense of embarrassment and horror that the people can experience when they know that there are people that are looking at this content for their own pleasure.”

In the US, which accounted for about 40% of LeakedBB’s web traffic in May, the Take it Down Act recently came into effect. This federal law requires platforms to quickly remove NCII when it is reported.

There has been little discussion of the law on LeakedBB. One user asked in the “Help” forum how it would affect the site and its members back in October 2025, but Lucifer NightStar never responded to the post.

Jitendra Maharaj has not responded to any of the apparent links between him, his companies and LeakedBB in the six weeks since The Press first contacted him. Pay It Now, the company Maharaj co-founded, did not respond to requests for comment (there is no suggestion it has any knowledge of or involvement in LeakedBB).

LeakedBB accepted cryptocurrency payments through NOWPayments, a gateway based in the Netherlands and Estonia. In response to questions from Bellingcat, NOWPayments confirmed that LeakedBB’s activities violated its terms of service. It said it had deactivated LeakedBB’s account and blacklisted the platform immediately, as of June 4.

LeakedBB.com remains down.

If you are a victim or know anyone who is affected by image-based abuse, resources and support are available through StopNCII.org.

This article is based on reporting by Kolina Koltai from Bellingcat. Galen Reich and Melissa Zhu also contributed.