29.11.2023
7 min
1898
The article analyzes how such platforms operate in the shadows: using domain networks, shell companies, payment redirects and cloaking services to circumvent payment system rules and avoid liability. Particular attention is paid to the digital traces that still allow to reconstruct the real structure of such a business.
The article reveals the risks for victims, legal gaps and systemic problems of regulating AI content, showing why deepfake porn is not just a technological problem, but a serious threat to human rights and digital security.
Depending on which of his social media profiles you looked at, Mark Ressan was either a marketing executive at Google or worked simultaneously at a dental implant company, an HR company, and a business software firm.
But the investigation has revealed that a Hungarian national is a key figure and the alleged owner of at least two deepfake porn sites – RefacePorn and DeepfakePorn – which until recently sold paid subscriptions.
There is no doubt about the nature of these websites. The landing page of RefacePorn shows a sexually explicit video of a woman having sex. As the video plays, her face is replaced with the faces of different women. The text above proclaims: “Face swapping in deepfake porn. Upload your face!”
Such deepfake porn sites, which use artificial intelligence to create sexually explicit images and videos – usually without the consent of those whose faces or bodies are depicted – have spread at an alarming rate in recent years. The impact on victims has been described as “life-destructive” and the mental health consequences are similar to those reported by victims of sexual assault.
While the technology for creating these synthetic images is not new, the proliferation of AI-powered image-generating tools and apps like Nudify has made them more accessible to people without deep technical knowledge. Earlier this year, New Zealand MP Laura McClure showed off an AI-generated nude photo of herself in parliament, describing how it took her less than five minutes to create it after a quick Google search.
Research by the My Image, My Choice campaign in 2024 found that the number of sexual deepfakes increased by 1,780 percent last year compared to 2019. Almost all (99 percent) of the victims were women, according to a 2023 Security Hero study.
The creation of such images and videos is now illegal in several countries, including the United States and the United Kingdom, but legislation has not caught up with many others, and platform owners who allow such content to be posted often face no consequences. In May 2024, the EU passed a directive that requires member states, including Hungary, where Resan lives, to criminalize the creation and distribution of sexual deepfakes without consent by June 2027.
Alexios Mantzarlis, co-founder of the news site Indicator, which focuses on digital deception, said his publication estimates that deepfakes are likely making millions of dollars a year.
“The incentive system will exist until the tools become too toxic to work with domain hosts and content delivery networks,” added Mantzarlis, who is also the director of the Security, Trust, and Protection Initiative at Cornell University of Technology.
The investigation into RefacePorn and DeepfakePorn, which covered corporate registries, domain name registrations, payment redirection sites, website code, and data leaks, led us back to Resan.
While simulating subscription purchases on these websites, a series of redirects were recorded to the Peerwallet payment panel, a payment processor that processed over $331,000 in sales by Dorocron LLP between July 2024 and August 2025. Dorocron is a Canadian-registered company whose primary, and likely sole, source of revenue was paid subscriptions to these sites. The actual amount is likely higher, as it was only one of several payment processors used by the websites.
Dorocron LLP did not respond to multiple email requests for comment, and calls to a number listed on the sites that provided the company’s information in their legal information sections went unanswered.
Resan is the only person who appears to be publicly associated with Dorocron LLP, and he is also the sole director of the UK-registered company Facitic Ltd, which registered the RefacePorn domain. Resan did not respond to multiple email requests for comment over the past two weeks. Multiple emails and phone calls to Facitic Ltd also went unanswered.
However, a few days after we first contacted Resan, his LinkedIn and X profiles were deleted, and his previously public Facebook profile was either deleted or made private. Both RefacePorn and DeepfakePorn also became inaccessible, displaying an error message saying “this site cannot be reached.”
Like other websites, RefacePorn’s ownership was hidden behind a network of website domains, fake websites used to redirect payments, and international business registries.
Using the tool DNSlytics, we checked the Google tag history for RefacePorn and found a tag that was also used on DeepfakePorn, as well as a website called facitic.com.
Google Analytics tags are small pieces of unique code that developers can place on the backend of a website to track its analytics. Each code is unique to a particular user, who can use the same tag across multiple websites.
Both RefacePorn and DeepfakePorn offer tiered subscription packages with similar names and prices, depending on the number of deepfakes generated and the level of support.
When simulating a purchase of one of these packages – without actually making a payment – on DeepfakePorn, we received a payment link hosted on the domain “remakerai.me.” Similarly, simulating a purchase on RefacePorn directed us to a payment link on “airemaker.me.” Many payment systems, including Paypal and Stripe, have restrictions on the purchase or sale of sexually explicit content online.
The redirect payment links posted on airemaker.me and remakerai.me, offered several payment options, including Paypal, credit cards, and cryptocurrencies. The credit card option was selected, and in both cases, I received an email with a link to complete the purchase on a payment platform called Peerwallet. This email contained a link to the seller’s profile, Dorocron LLP.
This profile showed the funds received by the seller, which as of August 2025 amounted to over $331,000. This revenue was associated with 16,264 sales. According to this dashboard, Dorocron LLP has been a member of Peerwallet since July 22, 2024, meaning all of these sales occurred within the past year.
According to promotional posts from an Instagram account with the username “Dorocron2323” and the account name “Hassler Mark,” RefacePorn has been active since at least May 2022. RefacePorn’s social media accounts were also created on X and Facebook in May 2022.
While Peerwallet transactions were not broken down by domain, two of them were payment redirection sites for the deepfake porn sites we investigated. A review of the 21 “approved domains” listed in this profile found no evidence that payments were ever accepted through other sites.
Short-lived “disposable” domains are known to be used by attackers to evade detection, creating a moving target for payment systems and authorities. At the time of publication, both airemaker.me and remakerai.me are no longer available. However, during our investigation, we noticed that the payment links for RefacePorn and DeepfakePorn were redirecting to other third-party sites before the sites went down.
Of the 21 domains on Dorocron LLP’s Peerwallet profile, only two were available as of late November, with the rest either unavailable due to expired domains, server issues, displaying generic domain parking pages, or requiring a login to view. While registration information had been removed from almost all of the sites, Resan was listed as the last registrant of one of the expired domains.
The two sites that were still available listed a variety of products, including e-books and digital products. Both had nearly identical products and templates, and listed Dorocron LLP in the footer.
When attempting to check the available products on each of these sites, users were prompted to log in in all cases. However, creating a new account proved impossible: even when using a valid email address, the system redirected to a login page with a message that the email address was “unknown.”
Archival screenshots of a number of sites whose domains have since expired or that required authorization to access show that many of them operated in a similar fashion. They used similar designs and offered e-books and video courses with so-called “resale rights.”
In September, payment processor Peerwallet said Dorocron LLP was not licensed to sell deepfake porn and announced an internal review. However, when it was re-queried in November, Peerwallet was no longer operational, and emails to its founder went unanswered.
Dorocron LLP was incorporated in British Columbia, Canada, in March 2022. We were unable to verify whether Resana’s name was in the corporate records, as information about owners or directors of a company in British Columbia is only available to law enforcement and other officials.
However, Resana’s name has been used to register at least 13 websites, along with an email address in the name Dorocron, since 2013, nine years before Dorocron was registered in Canada. The earliest domain registration, from 2013, contained the name of a now-defunct company registered in the United Kingdom called “Webnaser LTD,” whose registration documents also list Resana as the sole director.
A leak discovered on Intelx.io shows that a nearly identical password (with some capitalizations different) was used to log in to a Gmail account called “dorocron” and a Netflix account linked to Resan’s personal email address. This password was also used to log in to the GoDaddy domain registry using the RefacePorn support email address.
The leak of passwords on Intelx.io revealed another connection between Resan and DeepfakePorn: an email address with the username “resanmark” was used to log in to the DeepfakePorn website, and the password contained his year of birth. In total, we found four unique passwords that were reused across Resan’s personal emails, Dorocron emails, and RefacePorn support emails. These four passwords contain either Resan’s name or the date or year of his birth.
About a year ago, Resan also posted two job postings from his now-deleted LinkedIn account: a full-stack web developer and a WordPress developer at Dorocron LLP. In the web developer listing, he described the company as “developing and deploying revolutionary AI technologies” and said the job would be “highly paid.” We were unable to find any other individuals publicly linking their activities to Dorocron LLP, either on LinkedIn or elsewhere.
In addition to his ties to Dorocron LLP, Resan is also the sole director and significant controlling shareholder of Facitic Ltd, a UK-registered company listed as the registrant of RefacePorn.
Using DomainTools, we were able to view historical registrant information in the WHOIS query for the site’s domain registration. When we checked this in August 2025, we were able to see that as of June 2025, Facitic Ltd was the registered owner of RefacePorn. This information was later removed, as was the case for other Resan-related sites such as DeepfakePorn.
ICANN, which regulates websites, requires domain name providers to verify the accuracy of their customers’ data, including the registrant’s name and contact details. Such data is publicly available by default, but can be anonymized using paid privacy services.
In the UK, Facitic Ltd’s registration documents list Resan’s country of residence as Dubai, while the registration of another UK company he registered – which was also listed as the owner of some of the approved expired domains on Dorocron LLP’s Peerwallet profile – lists him as residing in Cyprus. Meanwhile, Resán’s social media accounts indicate that he resides in Hungary. The Peerwallet dashboard lists the primary user Dorocron as residing in Hungary.
It is unclear whether Resán actually holds positions at any of the six companies he listed as employees on his Facebook and LinkedIn profiles.
Some connections discovered between RefacePorn and Mark Resan:
On November 10, 2025, a few weeks before we contacted him, Resan filed an application to have Facitic Ltd struck off the UK Companies Register. According to Resan’s documents, Facitic Ltd was registered with an initial capital of £100 in January 2024 and has had no changes to its accounts since then.
This comes as the UK regulator Ofcom is cracking down on websites linked to UK companies offering AI-powered nudity services. On October 23, Ofcom fined UK-registered Itai Tech Ltd, which was linked to some of the world’s largest deepfake pornography sites, £50,000 for failing to prevent children from accessing pornographic content.
The websites associated with Resan are not among the biggest players in the deepfake porn industry. In comparison, other similar platforms of much larger scale were visited by millions of users every month. One such site was previously exposed as part of a separate investigation, which resulted in the identification of a key administrator. The platform was shut down shortly after attempts to get a comment from that person.
By comparison, RefacePorn and DeepfakePorn received about 91,000 and 154,000 visits in October, respectively, according to digital marketing platform SemRush. But their smaller size does not mean they cannot cause significant damage.
Manzarlis, of the news site Indicator, said there are “smaller players” taking bigger risks with regulation, such as “Crush AI,” a group of Chinese apps that circumvented Meta’s moderation rules to run 25,000 ads on Facebook and Instagram before the social media giant sued them.
“These smaller players are often more active in trying to stand out on social media to catch up with the bigger players,” Manzarlis said.
During our investigation, we ran tests using RefacePorn’s free features to determine if there were any restrictions on the images that could be uploaded to the website.
Without creating actual content, we uploaded images of adult women and underage girls that were generated using artificial intelligence. Unlike other websites we tested, which added minimal checks to prevent images depicting children from being uploaded, there were no restrictions or evidence of age guarantees on RefacePorn.
While Hungary has no laws explicitly prohibiting deepfake porn, storing, creating, and distributing sexually explicit images of minors is illegal.
“As more established websites face constant regulatory pressure and others face lawsuits, those that are lagging behind are ready to try to grab market share,” Mantzarlis said.
And while some sites, such as RefacePorn and DeepfakePorn, may fail under the scrutiny of the public, others continue to operate online unmonitored and easily accessible.
“These websites are completely replaceable, and there is no reason to believe that there is any form of ‘brand loyalty,’” Mantzarlis said. “Criminals will search for ‘nudify’ or click on an ad and go to any tool that does the job.”
