How We Discovered the Man Behind Two Deepfake Porn Websites

Content material warning: This text comprises descriptions of non-consensual sexual imagery.

Relying on which of his social media profiles you have been taking a look at, Mark Resan was both a advertising and marketing lead at Google or working for a dental implant firm, a human sources firm and a enterprise software program agency – all on the identical time.           

However a Bellingcat investigation has discovered that the Hungarian nationwide is the important thing determine behind, and the probably proprietor of, not less than two deepfake porn web sites – RefacePorn and DeepfakePorn – that till not too long ago have been promoting paid subscriptions. 

There isn’t any query concerning the nature of those web sites. RefacePorn’s touchdown web page reveals an specific video of a lady performing a sexual act. Because the video performs, her face is changed with a wide range of different girls’s faces. The textual content above declares: “Face swap deepfake porn. Add your face!” 

Deepfake porn websites corresponding to these, which use synthetic intelligence to create sexually specific pictures and movies – often with out the consent of these whose faces or our bodies are featured – have proliferated at an alarming charge in recent times. The impression on victims has been described as “life-shattering”, with the psychological well being results just like these reported by victims of sexual assault. 

Whereas the expertise to make these artificial pictures just isn’t new, the rise of mainstream AI picture generator instruments and “Nudify” apps has made it extra extensively obtainable to individuals with out deep technical experience. Earlier this yr, New Zealand MP Laura McClure held up an AI-generated nude of herself in parliament, describing the way it took her lower than 5 minutes to create after a fast Google search. 

A 2024 examine by the My Picture My Selection marketing campaign discovered that there was a 1,780 % enhance in sexually specific deepfakes final yr in comparison with 2019. Nearly all (99 %) of victims have been girls, in response to a 2023 examine by Safety Hero. 

The creation of such pictures and movies is now unlawful in a number of nations, together with the US and the UK, however laws has not caught up in lots of others, and the house owners of platforms that allow this content material usually face no repercussions. In Could 2024, the EU handed a directive which mandates that member states – together with Hungary, the place Resan resides – criminalise the creation and distribution of non-consensual sexual deepfakes by June 2027. 

Alexios Mantzarlis, co-founder of Indicator, a information web site that focuses on digital deception, stated his publication estimates that deepfake porn websites probably make tens of millions of {dollars} a yr. 

“The inducement system will live on till the instruments develop into too poisonous to deal with for area hosts and content material supply networks,” added Mantzarlis, who can be the director of the Safety, Belief and Security Initiative at Cornell Tech.

All Roads Result in Resan

Bellingcat’s investigation into RefacePorn and DeepfakePorn – which spanned company registries, area title registrations, cost redirect websites, web site code and leaked information – led us again to Resan. 

By simulating the acquisition of subscriptions on these web sites, Bellingcat was led by a sequence of redirects to a funds dashboard by Peerwallet, a cost processor that recorded greater than US$331,000 in gross sales from July 2024 to August 2025 by Dorocron LLP. Dorocron is a Canadian-registered firm whose major – if not sole – supply of revenue gave the impression to be from paid subscriptions to those websites. The true quantity is probably going larger, as this was simply one in all a number of cost processors the web sites have used.

Dorocron LLP didn’t reply to a number of requests for remark by way of electronic mail, and calls to the quantity listed on websites that had the corporate’s particulars of their authorized info sections went unanswered.

Resan is the one one that seems to have been publicly related to Dorocron LLP, and he’s additionally the only real director of a UK-registered firm, Facitic Ltd, that registered the area of RefacePorn. Resan didn’t reply to a number of requests for remark despatched by way of electronic mail over the previous two weeks. A number of emails and cellphone calls to Facitic Ltd additionally went unanswered.

Nonetheless, days after we first reached out to Resan, his LinkedIn and X profiles have been deleted, and his beforehand public Fb profile was both deleted or made non-public. Each RefacePorn and DeepfakePorn additionally turned inaccessible, displaying an error message that stated “this web site can’t be reached”. 

Archives of RefacePorn and DeepfakePorn, which have been beforehand obtainable on the Web Archive’s Wayback Machine, have additionally now been excluded from the archive. The Web Archive instructed Bellingcat it processed exclusion requests submitted by somebody with rights to each websites on Dec. 5. 

Following the Cash

Like different web sites Bellingcat has investigated, RefacePorn’s possession was hidden behind a community of web site domains, pretend web sites used to redirect funds, and worldwide enterprise registries. 

Utilizing the software DNSlytics, we examined the Google tag historical past on RefacePorn and located a tag that was additionally used on DeepfakePorn, in addition to an internet site known as facitic.com. 

Google Analytics tags are small items of distinctive code that builders can place within the backend of an internet site to trace its analytics. Every code is exclusive to a particular person, who can use the identical tag throughout a number of web sites. 

Each RefacePorn and DeepfakePorn provide tiered subscription packages with related names and costs primarily based on the variety of deepfakes that may very well be generated and the extent of help. 

When simulating a purchase order of one in all these packages – with out truly finishing cost – on DeepfakePorn, we obtained a hyperlink to make a cost hosted by the area “remakerai.me”. Equally, a mock buy on RefacePorn pointed us to a cost hyperlink on “airemaker.me”. Bellingcat has noticed using redirects, which can be utilized to obscure funds, by different deepfake porn websites. Many cost processors, together with Paypal and Stripe, have restrictions on shopping for or promoting sexually oriented on-line content material.

The redirected cost hyperlinks hosted on airemaker.me and remakerai.me supplied a number of cost choices together with Paypal, bank cards and cryptocurrencies. Bellingcat chosen the bank card choice, and in each instances was emailed a hyperlink to finish the acquisition on a cost platform known as Peerwallet. This electronic mail included a hyperlink to the vendor’s profile, Dorocron LLP. 

This profile confirmed the funds obtained by the vendor, which totalled greater than $331,000 as of August 2025. This revenue was associated to 16,264 gross sales. In response to this dashboard, Dorocron LLP had been a member of Peerwallet since July 22, 2024, which means these gross sales all occurred over the previous yr.

RefacePorn has been lively since not less than Could 2022, in response to promotional posts by an Instagram account with the username “Dorocron2323” and the account title “Hassler Mark”. Social media accounts for RefacePorn have been additionally created on X and Fb in Could 2022.

Whereas the transactions on Peerwallet weren’t damaged down by area, two have been the cost redirect websites for the deepfake porn websites we investigated. Bellingcat’s assessment of the 21 “accepted domains” listed on this profile discovered no proof that funds have been ever accepted by the opposite websites. 

Quick-lived, “disposable” domains are recognized for use by dangerous actors to evade detection, presenting a transferring goal for cost processors and authorities. As of publication, each airemaker.me and remakerai.me are not accessible. However in the midst of the investigation, we noticed RefacePorn and DeepfakePorn’s cost hyperlinks redirecting to different third-party websites, earlier than the websites went offline.

Of the 21 domains on Dorocron LLP’s Peerwallet profile, solely two have been nonetheless accessible as of the top of November, with the remainder both down as a consequence of expired domains or server points, displaying generic area parking pages, or requiring a login to view. Although virtually the entire websites had their registration info redacted, Resan was listed because the most up-to-date registrant for one of many expired domains.

The 2 websites nonetheless accessible listed a wide range of merchandise, together with eBooks and digital merchandise. Each had virtually an identical merchandise and templates, and listed Dorocron LLP beneath their firm info of their footers. 

Bellingcat tried to take a look at gadgets on every of the websites, and in each instances was prompted to log in. It was, nevertheless, unimaginable to register an account, and after we tried with an lively electronic mail handle we have been redirected to a login web page saying that the e-mail handle was “unknown”. 

Archived screengrabs of a number of the websites that now have expired domains or require a login to view confirmed that a lot of them adopted the identical format, promoting eBooks and video programs with “resell rights”.

Peerwallet instructed Bellingcat in September that Dorocron LLP was “not accepted” to promote deepfake porn, and that it was wanting into the problem. Nonetheless, when Bellingcat requested for an replace in November, Peerwallet appeared to have closed down. Emails to the cost processor’s founder have additionally gone unanswered. 

The Man Behind the Display

Dorocron LLP was registered in British Columbia, Canada in March 2022. We have been unable to confirm if Resan’s title was on the company information as info on firm house owners or administrators in British Columbia is restricted to legislation enforcement and different officers. 

Nonetheless, Resan’s title has been used to register not less than 13 websites alongside an electronic mail bearing  Dorocron’s title from way back to 2013, 9 years earlier than Dorocron was registered in Canada. The earliest area registration, from 2013, included the title of a now-dissolved UK-registered firm known as “Webnaser LTD”, whose registration paperwork additionally cite Resan as the only real director. 

A leak discovered on information breach web site Intelx.io reveals that an virtually an identical password (with totally different capitalisation of some letters) was used to log into this “dorocron” Gmail account and a Netflix account related to Resan’s private electronic mail handle. This password was additionally used to log into internet area registry GoDaddy utilizing RefacePorn’s help electronic mail handle. 

Leaked passwords on Intelx.io revealed one other hyperlink between Resan and DeepfakePorn: an electronic mail with the username “resanmark” was used to log into DeepfakePorn’s web site, with a password containing his start yr. In all, we discovered 4 distinctive passwords that have been reused between Resan’s private emails, the Dorocron emails, and a help electronic mail for RefacePorn. These 4 passwords embrace both Resan’s title or the date or yr of his start. 

Resan additionally posted two job listings from his now-deleted LinkedIn account a few yr in the past, for a full-stack internet developer and a WordPress developer at Dorocron LLP. Within the internet developer itemizing, he described the corporate as “creating and making use of revolutionary AI applied sciences” and stated the job would have “excessive wages”. We couldn’t discover some other particular person with a public affiliation to Dorocron LLP on LinkedIn or elsewhere.

Apart from his hyperlinks to Dorocron LLP, Resan can be the sole director and individual with important management of Facitic Ltd, a UK-registered firm which was listed because the registrant for RefacePorn. 

Utilizing DomainTools, we have been capable of see the historic registrant info in a WHOIS lookup of the positioning’s area registration. Once we checked this in August 2025, we have been capable of see that, as of June 2025, Facitic Ltd was the registered proprietor of RefacePorn. This info was later redacted – as it’s for different websites linked to Resan corresponding to DeepfakePorn. 

ICANN, which regulates web sites, requires area title suppliers to confirm the accuracy of their clients’ particulars, together with the registrant’s title and speak to particulars. Such particulars are publicly seen by default, however might be anonymised utilizing paid privateness providers. 

The UK registration for Facitic Ltd lists Resan’s nation of residence as Dubai, whereas the registration for one other UK firm he registered – which was additionally listed because the proprietor of a number of the now-expired accepted domains on Dorocron LLP’s Peerwallet profile – states that he resides in Cyprus. In the meantime, Resan’s social media accounts said that he lives in Hungary. On Peerwallet’s dashboard, the first person of Dorocron is listed as being primarily based in Hungary. 

It’s unclear if Resan truly holds positions in any of the six firms he listed himself as working at on his Fb and LinkedIn profiles. Bellingcat has reached out to those firms to test, however has not obtained any replies as of publication. 

A number of the connections Bellingcat discovered between RefacePorn and Mark Resan:

On Nov. 10, 2025, a number of weeks earlier than we contacted him, Resan utilized for Facitic Ltd to be struck off the UK firms register. Based mostly on Resan’s filings, Facitic Ltd was integrated with an preliminary capital of £100 in January 2024, and there was no recorded change in its accounts since. 

This comes as UK regulator Ofcom cracks down on web sites related to UK companies providing AI-powered nudify providers. On Oct. 23, Ofcom imposed a £50,000 effective on UK-registered firm Itai Tech Ltd, which has been linked to a number of the greatest deepfake pornography websites on this planet, for failing to stop youngsters from accessing pornographic content material. 

It’s unclear what triggered Resan to file to dissolve the corporate, and he didn’t reply to Bellingcat’s question about this. 

Small Websites, Huge Hurt

The web sites linked to Resan should not among the many largest within the deepfake porn trade. The same however a lot bigger web site that Bellingcat has investigated, MrDeepFakes, obtained tens of millions of visits every month. Bellingcat and its companions Tjekdet, Politiken and CBC uncovered the positioning’s key administrator David Do in Could, with MrDeepFakes going offline after we reached out to Do for remark. 

Compared, RefacePorn and DeepfakePorn obtained about 91,000 and 154,000 visits in October, in response to digital advertising and marketing platform SemRush. However their smaller measurement doesn’t imply they will’t trigger important hurt. 

Mantzarlis, of the information web site Indicator, stated there have been “smaller gamers” taking larger dangers round regulation, corresponding to “Crush AI”, a bunch of Chinese language-owned apps that bypassed Meta’s moderation guidelines to run 25,000 advertisements on Fb and Instagram earlier than the social media big sued them. 

“These smaller gamers are sometimes those which might be extra actively attempting to face out on social media to meet up with the larger ones,” Mantzarlis stated.

In the middle of our investigation, we ran assessments utilizing the free options on RefacePorn to find out if there have been any restrictions on pictures that may very well be uploaded on the web site. 

With out truly producing the content material, we uploaded AI-generated pictures of grownup girls and underage women. In contrast to on different web sites now we have examined, which have added the naked minimal of checks to stop importing pictures depicting youngsters, there was no restriction or proof of age-related safeguards on RefacePorn. 

Whereas there aren’t legal guidelines in Hungary explicitly prohibiting deepfake porn, the possession, creation and distribution of sexually specific pictures of minors is unlawful. 

“Because the extra established web sites come beneath sustained regulatory stress and others get litigated into oblivion, the minnows are able to try to seize market share,” Mantzarlis stated. 

And whereas some websites corresponding to RefacePorn and DeepfakePorn might fold within the face of public scrutiny, others proceed to function, unchecked and simply accessible, on-line. 

“These web sites are eminently replaceable and there is not any cause to consider that there’s any type of ‘model loyalty’,” Mantzarlis stated. “Perpetrators are going to seek for ‘nudify’ or click on on an advert and go to no matter software does the job.”

——

Melissa Zhu contributed to this report.

Bellingcat is a non-profit and the power to hold out our work relies on the type help of particular person donors. If you want to help our work, you are able to do so right here. It’s also possible to subscribe to our Patreon channel right here. Subscribe to our E-newsletter and comply with us on Bluesky right here and Mastodon right here.