Unmasking AI Nudifier Networks: OSINT Techniques from Bellingcat's Kolina Koltai
Show & Tell from IndicatorShow Notes
In this episode of Show & Tell, hosts Craig Silverman and Alexios Mantzarlis talk with Kolina Koltai, a senior researcher and trainer at Bellingcat. Kolina has led investigations into AI nudifiers and deepfake pornography networks. Her work has contributed to the takedown of MrDeepFakes, the largest deepfake community on the web, among other impact.
Kolina walked through two investigations: one tracing the payment infrastructure used by deepfake/nudifier sites to avoid getting cut off by mainstream processors, and another that followed domain connections, whois history, and a company registrations to identify the likely operator of ReFacePorn and DeepFakePorn. Along the way she demos the tools live — with Craig joining in on DomainTools.
What You'll Learn: 📍 Following the money: How AI nudifier sites use gaming platforms, Patreon credits, and redirect pages to obscure payments from processors like Stripe and Visa. 📍 Connecting domains with Google Tags: How shared analytics tags can link a network of sites to a single administrator — and which tools to use (DNSlytics, DomainTools). 📍 Whois history as an investigative resource: Why historical registration records can reveal information that was later hidden. 📍 From domain to person: How Kolina used OpenCorporates and UK Companies House records to find a named individual tied to a network of deepfake sites 📍 Inspecting archived HTML: How the Wayback Machine captures not just how a site looked, but its underlying code — and how Kolina found email addresses in archived donate buttons on MrDeepFakes 📍 Managing leads across sprawling investigations: Kolina's workflow using Google Docs, and Hunchly to keep track of breadcrumbs and digital assets.
Links Referenced in This Episode: https://www.bellingcat.com/news/2024/02/23/behind-a-secretive-global-network-of-non-consensual-deepfake-pornography/ https://www.bellingcat.com/news/2025/12/15/mark-resan-reface-deepfake-porn/ https://www.youtube.com/watch?v=dTMaXVTtOdw https://indicator.media/p/indicator-guide-to-connecting-websites-together-osint-tools-tags-ids-favicon https://indicator.media/p/web-capture-tools-hunchly-forensic-osint-ubikron https://discord.com/invite/bellingcat https://bsky.app/profile/koltai.bsky.social https://www.instagram.com/kolinakoltai/
More from Show & Tell from Indicator
In this episode of Show & Tell, we spoke to Shayan Sardarizadeh about his approach to debunking viral fakes for BBC Verify. "I want to check everything for AI," he told us. "I don't care where it comes from. If it comes from a national TV, if it comes from a politician posting it on their official TikTok, I don't trust anything." What You'll Learn: 📍Choosing where to look, and what to ignore when it comes to viral fakes 📍Why AI detectors are now an essential element of verification and why Shayan prefers the SynthID-based ones 📍How detectors can still fail, with a worked example from a viral image of Donald Trump 📍How reverse search is an essential complement to AI detectors and a mandatory starting point for any verification task Links mentioned in the episode 📍Shayan's thread on the viral Trump image: https://x.com/Shayan86/status/2100642920437108946 📍"AI generators are now required to offer detection tools. We tested them (and they need work)" (Indicator): https://indicator.media/p/ai-generators-are-now-required-to-offer-detection-tools-we-tested-them-and-they-need-work 📍You can follow Shayan on X at @Shayan86 and on LinkedIn: https://www.linkedin.com/in/shayan-sardarizadeh-0121555a/ About Shayan Sardarizadeh: Shayan is a senior journalist at BBC Verify covering disinformation, conspiracy theories and AI. About Show & Tell: Show & Tell from Indicator takes you inside digital investigations as leading journalists, OSINT investigators, threat analysts, and researchers walk through real cases they've cracked. Each episode features a recognized figure in the OSINT, digital investigations, or trust & safety community. They don't just tell us what they did — they show us. Hosted by Indicator co-founders Alexios Mantzarlis and Craig Silverman.
In this episode of Show & Tell, we speak to Renée DiResta about Grokipedia and the contestability of AI-mediated information sources. Grokipedia is worth studying not just as “a culture war artifact,” she said, but because even if Musk’s AI encyclopedia fades away, “something like it will exist at some point, and we may as well get in and figure out how to audit it now.”
In this episode of Show & Tell, hosts Craig Silverman and Alexios Mantzarlis sit down with Wall Street Journal reporters Caitlin Ostroff and Neil Mehta, who found that Polymarket paid creators to place fake bets on a faked version of its platform.
In this episode of Show & Tell, researcher Hal Triedman showed us how easy it can be to poison an AI research agent.
In this episode of Show & Tell, Craig and Alexios talk with Omer Benjakob, the disinformation and cyber reporter for Haaretz.