How We Discovered the Man Behind Two Deepfake Porn Websites

Content material warning: This text incorporates descriptions of non-consensual sexual imagery.

Relying on which of his social media profiles you have been , Mark Resan was both a advertising and marketing lead at Google or working for a dental implant firm, a human assets firm and a enterprise software program agency – all on the similar time.           

However a Bellingcat investigation has discovered that the Hungarian nationwide is the important thing determine behind, and the doubtless proprietor of, a minimum of two deepfake porn web sites – RefacePorn and DeepfakePorn – that till just lately have been promoting paid subscriptions. 

There isn’t a query in regards to the nature of those web sites. RefacePorn’s touchdown web page exhibits an specific video of a girl performing a sexual act. Because the video performs, her face is changed with a wide range of different ladies’s faces. The textual content above declares: “Face swap deepfake porn. Add your face!” 

Deepfake porn websites akin to these, which use synthetic intelligence to create sexually specific pictures and movies – normally with out the consent of these whose faces or our bodies are featured – have proliferated at an alarming price in recent times. The impression on victims has been described as “life-shattering”, with the psychological well being results much like these reported by victims of sexual assault. 

Whereas the know-how to make these artificial pictures is just not new, the rise of mainstream AI picture generator instruments and “Nudify” apps has made it extra broadly accessible to folks with out deep technical experience. Earlier this yr, New Zealand MP Laura McClure held up an AI-generated nude of herself in parliament, describing the way it took her lower than 5 minutes to create after a fast Google search. 

A 2024 research by the My Picture My Alternative marketing campaign discovered that there was a 1,780 % improve in sexually specific deepfakes final yr in comparison with 2019. Nearly all (99 %) of victims have been ladies, in response to a 2023 research by Safety Hero. 

The creation of such pictures and movies is now unlawful in a couple of international locations, together with the US and the UK, however laws has not caught up in lots of others, and the house owners of platforms that allow this content material typically face no repercussions. In Might 2024, the EU handed a directive which mandates that member states – together with Hungary, the place Resan resides – criminalise the creation and distribution of non-consensual sexual deepfakes by June 2027. 

Alexios Mantzarlis, co-founder of Indicator, a information web site that focuses on digital deception, mentioned his publication estimates that deepfake porn websites doubtless make thousands and thousands of {dollars} a yr. 

“The motivation system will live on till the instruments turn into too poisonous to deal with for area hosts and content material supply networks,” added Mantzarlis, who can also be the director of the Safety, Belief and Security Initiative at Cornell Tech.

All Roads Result in Resan

Bellingcat’s investigation into RefacePorn and DeepfakePorn – which spanned company registries, area title registrations, fee redirect websites, web site code and leaked knowledge – led us again to Resan. 

By simulating the acquisition of subscriptions on these web sites, Bellingcat was led by a collection of redirects to a funds dashboard by Peerwallet, a fee processor that recorded greater than US$331,000 in gross sales from July 2024 to August 2025 by Dorocron LLP. Dorocron is a Canadian-registered firm whose foremost – if not sole – supply of earnings seemed to be from paid subscriptions to those websites. The actual quantity is probably going increased, as this was simply certainly one of a number of fee processors the web sites have used.

Dorocron LLP didn’t reply to a number of requests for remark by way of e mail, and calls to the quantity listed on websites that had the corporate’s particulars of their authorized info sections went unanswered.

Resan is the one one that seems to have been publicly related to Dorocron LLP, and he’s additionally the only real director of a UK-registered firm, Facitic Ltd, that registered the area of RefacePorn. Resan didn’t reply to a number of requests for remark despatched by way of e mail over the previous two weeks. A number of emails and cellphone calls to Facitic Ltd additionally went unanswered.

Nonetheless, days after we first reached out to Resan, his LinkedIn and X profiles have been deleted, and his beforehand public Fb profile was both deleted or made non-public. Each RefacePorn and DeepfakePorn additionally turned inaccessible, displaying an error message that mentioned “this web site can’t be reached”. 

Archives of RefacePorn and DeepfakePorn, which have been beforehand accessible on the Web Archive’s Wayback Machine, have additionally now been excluded from the archive. The Web Archive advised Bellingcat it processed exclusion requests submitted by somebody with rights to each websites on Dec. 5. 

Following the Cash

Like different web sites Bellingcat has investigated, RefacePorn’s possession was hidden behind a community of web site domains, faux web sites used to redirect funds, and worldwide enterprise registries. 

Utilizing the software DNSlytics, we examined the Google tag historical past on RefacePorn and located a tag that was additionally used on DeepfakePorn, in addition to a web site referred to as facitic.com. 

Google Analytics tags are small items of distinctive code that builders can place within the backend of a web site to trace its analytics. Every code is exclusive to a selected consumer, who can use the identical tag throughout a number of web sites. 

Each RefacePorn and DeepfakePorn supply tiered subscription packages with related names and costs based mostly on the variety of deepfakes that might be generated and the extent of assist. 

When simulating a purchase order of certainly one of these packages – with out really finishing fee – on DeepfakePorn, we acquired a hyperlink to make a fee hosted by the area “remakerai.me”. Equally, a mock buy on RefacePorn pointed us to a fee hyperlink on “airemaker.me”. Bellingcat has noticed using redirects, which can be utilized to obscure funds, by different deepfake porn websites. Many fee processors, together with Paypal and Stripe, have restrictions on shopping for or promoting sexually oriented on-line content material.

Graphic: Galen Reich

The redirected fee hyperlinks hosted on airemaker.me and remakerai.me supplied a number of fee choices together with Paypal, bank cards and cryptocurrencies. Bellingcat chosen the bank card possibility, and in each circumstances was emailed a hyperlink to finish the acquisition on a fee platform referred to as Peerwallet. This e mail included a hyperlink to the vendor’s profile, Dorocron LLP. 

This profile confirmed the funds acquired by the vendor, which totalled greater than $331,000 as of August 2025. This earnings was associated to 16,264 gross sales. In accordance with this dashboard, Dorocron LLP had been a member of Peerwallet since July 22, 2024, that means these gross sales all occurred over the previous yr.

RefacePorn has been energetic since a minimum of Might 2022, in response to promotional posts by an Instagram account with the username “Dorocron2323” and the account title “Hassler Mark”. Social media accounts for RefacePorn have been additionally created on X and Fb in Might 2022.

Whereas the transactions on Peerwallet weren’t damaged down by area, two have been the fee redirect websites for the deepfake porn websites we investigated. Bellingcat’s evaluate of the 21 “authorized domains” listed on this profile discovered no proof that funds have been ever accepted by the opposite websites. 

Quick-lived, “disposable” domains are recognized for use by dangerous actors to evade detection, presenting a shifting goal for fee processors and authorities. As of publication, each airemaker.me and remakerai.me are now not accessible. However in the midst of the investigation, we noticed RefacePorn and DeepfakePorn’s fee hyperlinks redirecting to different third-party websites, earlier than the websites went offline.

Of the 21 domains on Dorocron LLP’s Peerwallet profile, solely two have been nonetheless accessible as of the top of November, with the remaining both down because of expired domains or server points, displaying generic area parking pages, or requiring a login to view. Although nearly the entire websites had their registration info redacted, Resan was listed because the most up-to-date registrant for one of many expired domains.

The 2 websites nonetheless accessible listed a wide range of merchandise, together with eBooks and digital merchandise. Each had nearly equivalent merchandise and templates, and listed Dorocron LLP underneath their firm info of their footers. 

Bellingcat tried to take a look at objects on every of the websites, and in each circumstances was prompted to log in. It was, nevertheless, unimaginable to register an account, and after we tried with an energetic e mail deal with we have been redirected to a login web page saying that the e-mail deal with was “unknown”. 

Archived screengrabs of a few of the websites that now have expired domains or require a login to view confirmed that lots of them adopted the identical format, promoting eBooks and video programs with “resell rights”.

Peerwallet advised Bellingcat in September that Dorocron LLP was “not authorized” to promote deepfake porn, and that it was trying into the difficulty. Nonetheless, when Bellingcat requested for an replace in November, Peerwallet appeared to have closed down. Emails to the fee processor’s founder have additionally gone unanswered. 

The Man Behind the Display

Dorocron LLP was registered in British Columbia, Canada in March 2022. We have been unable to confirm if Resan’s title was on the company data as info on firm house owners or administrators in British Columbia is restricted to legislation enforcement and different officers. 

Nonetheless, Resan’s title has been used to register a minimum of 13 websites alongside an e mail bearing  Dorocron’s title from way back to 2013, 9 years earlier than Dorocron was registered in Canada. The earliest area registration, from 2013, included the title of a now-dissolved UK-registered firm referred to as “Webnaser LTD”, whose registration paperwork additionally cite Resan as the only real director. 

A leak discovered on knowledge breach web site Intelx.io exhibits that an nearly equivalent password (with completely different capitalisation of some letters) was used to log into this “dorocron” Gmail account and a Netflix account related to Resan’s private e mail deal with. This password was additionally used to log into internet area registry GoDaddy utilizing RefacePorn’s assist e mail deal with. 

Leaked passwords on Intelx.io revealed one other hyperlink between Resan and DeepfakePorn: an e mail with the username “resanmark” was used to log into DeepfakePorn’s web site, with a password containing his beginning yr. In all, we discovered 4 distinctive passwords that have been reused between Resan’s private emails, the Dorocron emails, and a assist e mail for RefacePorn. These 4 passwords embrace both Resan’s title or the date or yr of his beginning. 

Resan additionally posted two job listings from his now-deleted LinkedIn account a couple of yr in the past, for a full-stack internet developer and a WordPress developer at Dorocron LLP. Within the internet developer itemizing, he described the corporate as “growing and making use of revolutionary AI applied sciences” and mentioned the job would have “excessive wages”. We couldn’t discover some other particular person with a public affiliation to Dorocron LLP on LinkedIn or elsewhere.

Apart from his hyperlinks to Dorocron LLP, Resan can also be the sole director and particular person with important management of Facitic Ltd, a UK-registered firm which was listed because the registrant for RefacePorn. 

Utilizing DomainTools, we have been capable of see the historic registrant info in a WHOIS lookup of the positioning’s area registration. Once we checked this in August 2025, we have been capable of see that, as of June 2025, Facitic Ltd was the registered proprietor of RefacePorn. This info was later redacted – as it’s for different websites linked to Resan akin to DeepfakePorn. 

ICANN, which regulates web sites, requires area title suppliers to confirm the accuracy of their prospects’ particulars, together with the registrant’s title and make contact with particulars. Such particulars are publicly seen by default, however could be anonymised utilizing paid privateness providers. 

The UK registration for Facitic Ltd lists Resan’s nation of residence as Dubai, whereas the registration for one other UK firm he registered – which was additionally listed because the proprietor of a few of the now-expired authorized domains on Dorocron LLP’s Peerwallet profile – states that he resides in Cyprus. In the meantime, Resan’s social media accounts said that he lives in Hungary. On Peerwallet’s dashboard, the first consumer of Dorocron is listed as being based mostly in Hungary. 

It’s unclear if Resan really holds positions in any of the six firms he listed himself as working at on his Fb and LinkedIn profiles. Bellingcat has reached out to those firms to test, however has not acquired any replies as of publication. 

A few of the connections Bellingcat discovered between RefacePorn and Mark Resan:

On Nov. 10, 2025, a couple of weeks earlier than we contacted him, Resan utilized for Facitic Ltd to be struck off the UK firms register. Primarily based on Resan’s filings, Facitic Ltd was included with an preliminary capital of £100 in January 2024, and there was no recorded change in its accounts since. 

This comes as UK regulator Ofcom cracks down on web sites related to UK companies providing AI-powered nudify providers. On Oct. 23, Ofcom imposed a £50,000 superb on UK-registered firm Itai Tech Ltd, which has been linked to a few of the greatest deepfake pornography websites on the planet, for failing to stop kids from accessing pornographic content material. 

It’s unclear what triggered Resan to file to dissolve the corporate, and he didn’t reply to Bellingcat’s question about this. 

Small Websites, Huge Hurt

The web sites linked to Resan usually are not among the many largest within the deepfake porn business. The same however a lot bigger web site that Bellingcat has investigated, MrDeepFakes, acquired thousands and thousands of visits every month. Bellingcat and its companions Tjekdet, Politiken and CBC uncovered the positioning’s key administrator David Do in Might, with MrDeepFakes going offline after we reached out to Do for remark. 

Compared, RefacePorn and DeepfakePorn acquired about 91,000 and 154,000 visits in October, in response to digital advertising and marketing platform SemRush. However their smaller dimension doesn’t imply they will’t trigger important hurt. 

Mantzarlis, of the information web site Indicator, mentioned there have been “smaller gamers” taking larger dangers round regulation, akin to “Crush AI”, a bunch of Chinese language-owned apps that bypassed Meta’s moderation guidelines to run 25,000 adverts on Fb and Instagram earlier than the social media large sued them. 

“These smaller gamers are sometimes those which might be extra actively attempting to face out on social media to meet up with the larger ones,” Mantzarlis mentioned.

In the middle of our investigation, we ran assessments utilizing the free options on RefacePorn to find out if there have been any restrictions on pictures that might be uploaded on the web site. 

With out really producing the content material, we uploaded AI-generated pictures of grownup ladies and underage ladies. Not like on different web sites we’ve examined, which have added the naked minimal of checks to stop importing pictures depicting kids, there was no restriction or proof of age-related safeguards on RefacePorn. 

Whereas there aren’t legal guidelines in Hungary explicitly prohibiting deepfake porn, the possession, creation and distribution of sexually specific pictures of minors is unlawful. 

“Because the extra established web sites come underneath sustained regulatory strain and others get litigated into oblivion, the minnows are able to attempt to seize market share,” Mantzarlis mentioned. 

And whereas some websites akin to RefacePorn and DeepfakePorn might fold within the face of public scrutiny, others proceed to function, unchecked and simply accessible, on-line. 

“These web sites are eminently replaceable and there is not any cause to consider that there’s any type of ‘model loyalty’,” Mantzarlis mentioned. “Perpetrators are going to seek for ‘nudify’ or click on on an advert and go to no matter software does the job.”

——

Melissa Zhu contributed to this report.

Bellingcat is a non-profit and the power to hold out our work relies on the sort assist of particular person donors. If you need to assist our work, you are able to do so right here. It’s also possible to subscribe to our Patreon channel right here. Subscribe to our Publication and comply with us on Bluesky right here and Mastodon right here.