An investigation by Bellingcat has identified a Hungarian national, Mark Resan, as the central figure behind at least two deepfake pornography websites that until recently sold paid subscriptions, generating hundreds of thousands of dollars from sexually explicit, non-consensual content. The findings expose how easily such platforms can operate in regulatory grey zones, exploiting gaps in law enforcement, payment systems and digital oversight.
Resan publicly presented himself online as a marketing lead at Google or as an employee of multiple unrelated companies, while social media posts showed him travelling in luxury destinations from Bali to Dubai. Behind this curated professional image, Bellingcat’s investigation found that he was likely the owner and operator of RefacePorn and DeepfakePorn, sites that used artificial intelligence to superimpose women’s faces onto explicit sexual videos, often without consent.
The nature of the websites was unambiguous. RefacePorn’s homepage openly displayed explicit videos encouraging users to upload faces for “face swap deepfake porn.” Such platforms are part of a rapidly expanding ecosystem of AI-driven sexual exploitation that campaigners describe as devastating for victims, with psychological impacts comparable to sexual assault. Studies cited by Bellingcat show a 1,780 percent rise in sexually explicit deepfakes since 2019, with women making up nearly all identified victims.
The spread of this content has been fuelled by mainstream AI tools and so-called “nudify” apps that require little technical skill. Lawmakers have struggled to keep pace. While countries such as the US and the UK have moved to criminalise non-consensual sexual deepfakes, many jurisdictions have not. In the European Union, member states have until 2027 to criminalise such material under a new directive, leaving a window in which operators can continue largely unchecked.
Bellingcat’s reporting shows that deepfake porn can be highly profitable. By simulating subscription purchases, investigators traced payment flows through multiple redirect sites to a Peerwallet dashboard linked to Dorocron LLP, a Canadian-registered company. That account recorded more than US$331,000 in sales between July 2024 and August 2025, representing over 16,000 transactions. The true figure is likely higher, as the sites used several payment processors over time.
Dorocron LLP did not respond to repeated requests for comment, and phone numbers listed on associated websites went unanswered. Resan himself also did not respond. Shortly after Bellingcat contacted him, his LinkedIn and X accounts disappeared, his Facebook profile was taken offline or made private, and both RefacePorn and DeepfakePorn became inaccessible. Archived versions of the sites were later removed from the Internet Archive following exclusion requests submitted by someone claiming rights to the domains.
The investigation connected Resan to the operation through a web of corporate records, domain registrations, shared analytics codes and leaked credentials. He was the sole publicly associated individual with Dorocron LLP and the only director of Facitic Ltd, a UK-registered company that owned the RefacePorn domain. Leaked data showed repeated password reuse across Resan’s personal accounts, Dorocron emails and administrative logins linked to the deepfake sites.
Bellingcat also uncovered evidence that Resan had been running similar online ventures for more than a decade, registering domains as far back as 2013. Job listings posted on his now-deleted LinkedIn account described Dorocron LLP as a company “developing and applying revolutionary AI technologies,” with no public indication that this referred to deepfake pornography.
The sites used a common tactic to evade scrutiny from payment processors, routing customers through short-lived redirect domains before landing on third-party payment platforms. This practice makes enforcement difficult, allowing operators to quickly switch domains when one is blocked. Although Peerwallet told Bellingcat it had not approved Dorocron LLP to sell deepfake pornography, the platform itself appeared to shut down months later, leaving further questions unanswered.
While RefacePorn and DeepfakePorn were not among the largest players in the industry, their impact remains significant. Traffic data showed tens of thousands of monthly visits, and tests conducted during the investigation found no meaningful safeguards to prevent the uploading of images of minors. In countries such as Hungary, where Resan is believed to be based, child sexual abuse material is illegal even though deepfake porn targeting adults remains largely unregulated.
Experts say smaller deepfake porn sites are often the most reckless, taking greater risks as larger platforms face legal and regulatory pressure. According to Alexios Mantzarlis of the digital deception news site Indicator, these operators are ready to replace any site that collapses under scrutiny, driven by user demand and the ease with which new tools can be launched.
