Understood: Deepfake Porn Empire

Episode 3: The Notorious D.P.F.K.S.

Host: Sam Cole | Date: March 3, 2026 | Publisher: CBC

Overview

In this compelling episode, host Sam Cole and a multinational team of journalists and investigators unravel the global hunt for the anonymous kingpin behind the internet’s largest non-consensual deepfake porn site—MrDeepFakes.com. The episode focuses on the personal investigations of Danish journalist Ida Herskind, her collaboration with open-source intelligence (OSINT) specialist Zachariah Hamid, and the breakthrough that finally unmasked the site's operator: a seemingly ordinary Canadian hospital pharmacist named David Doe. The episode explores the technical, legal, and ethical barriers to accountability, and the chilling realities for victims targeted by this billion-click industry.

Key Discussion Points & Insights

1. Ida Herskind’s Entry into Deepfake Porn Investigation

• Trigger: Ida, a Danish journalist, is shaken by a news story about a British journalist discovering deepfake porn of herself. (01:18)
  • Quote [01:45]:
    "I just thought, it's unbelievable. She's a journalist, just like me. She's just doing her job." – Ida Herskind
• Ida is alarmed by the ease of accessing deepfake porn and its disturbingly realistic, violent, and misogynistic content. (02:10, 02:42)
  • Quote [02:10]:
    "It was so easy to find. I mean, it was literally a click away from Google search engine." – Ida Herskind
  • Quote [02:42]:
    "It's of Greta Thunberg...she's being bound and forced to give a blowjob while her hair is shaved off." – Ida Herskind

2. Inside the Mr. Deepfakes Platform

• MrDeepFakes is described as both a massive video streaming platform (over 70,000 videos) and an active forum (650,000 members) where users share, request, and barter for content. (05:02, 05:25, 05:40)
  • Quote [05:02]:
    "It looked like a streaming platform like Netflix." – Ida Herskind
• The community is toxic and misogynistic yet oddly collegial. (06:12)
  • Example [06:12]:
    "They write really nasty things about women, but also help each other out." – Ida Herskind
• Requests are frequently punitive or degrading in intent, exposing the hostile attitude towards female celebrities. (07:06)

3. Investigative Frustrations and Legal Barriers

• Despite Denmark’s laws against non-consensual pornography, enforcement is thwarted by perpetrators’ anonymity and technical obfuscation: VPNs, burner wallets, offshore hosting, and proxy registrations. (07:49)
  • Quote [07:49]:
    "People behind these platforms...do everything they can to hide their identities." – Sam Cole
• For years, media and authorities failed to unmask the perpetrator; even major outlets only got partway, masking the founder’s identity in interviews. (08:30)

4. Connecting the Dots: The Hunt for Mr. Deepfakes

• Ida tracks Danish victims and begins searching for uploaders using local usernames. She enlists Zachariah Hamid, an OSINT whiz, to help follow digital breadcrumbs. (10:54, 11:34, 12:00)
  • Quote [12:00]:
    "I just like clicking around on the Internet, trying stuff out..." – Zachariah Hamid
• Early investigations stall; tenuous links lead to dead ends or minor participants. (13:16)

5. Breakthroughs and Setbacks

• Investigators expand the search to a broader network. Even after high-profile media exposure (front page of Politiken, coverage of attacks on female politicians), nothing happens—perpetrators remain untouched, and the content is still online. (14:08, 14:26)
  • Quote [14:26]:
    "I was left with this very empty feeling because it had no consequences for the perpetrators...you could still go to Google." – Ida Herskind
• During a Christmas break, a relaxed Zachariah has an insight: he discovers leaked credentials (databases of breached usernames and passwords) and finds a link between the forum admin "DPFKS" and an email address. (16:27, 17:19)
• This unique password and related usernames tie back to another handle ("aznRico") and ultimately to a specific Canadian Hotmail account. (18:24, 18:57)

6. Network Visualization & Smoking Gun

• Zachariah creates a “dandelion”—a network visualization showing the connections between usernames, emails, and IP addresses, all radiating from the handle "AgentRico" and the DPFKS email. (19:51, 20:08)
• They hit a wall: lacking a direct, publicly visible link tying the suspicious email address to MrDeepFakes.com. (21:16)

7. Bellingcat’s Involvement & Final Evidence

• The international investigative collective Bellingcat is brought in to help seal the identification. (21:53)
• Bellingcat combs web archives and discovers that, until 2019, MrDeepFakes’s “Contact Us” form sent emails directly to the Gmail in question, clinching the association. (24:11)
  • Quote [24:11]:
    "This email was sent directly to the Gmail that was connected to this random Hotmail to this random guy in Canada." – Ida Herskind

8. The Reveal: Who is Mr. Deepfakes?

• Investigators expect either a reclusive, antisocial techie or an organized crime outfit—a “Walter White” or global syndicate. (24:51, 25:11)
  • Quote [25:52]:
    "The person behind MrDeepFakes.com is David Doe, a 36-year-old pharmacist working at a hospital ..." – Sam Cole
• David Doe, a mild-mannered and well-liked hospital pharmacist from Markham, Ontario, Canada, is unmasked as the site’s founder. His normal life contrasts sharply with his online exploits. (26:09-27:03)

9. Tracing David Doe’s Double Life

• Friends describe David as tech-savvy, friendly, and “always involved in something online”—from spambot SEO schemes to meme generators. (27:28)
• Doe began as a hobbyist, producing deepfake porn, guides, and uploading huge datasets. His site’s growth to millions of users brings in significant profits—at least $4,000 to $7,000/month by 2020, with later figures likely higher. (28:19, 29:08, 31:26)
  • Quote [29:53]:
    "He had a porn site with about 15 to 20,000 visitors a month... trying to find an explanation for ‘bottlenecks and reasons for slowness for tube site.’" – Sam Cole (narrating Doe’s online post)
• Revenue includes subscriptions, advertising, and a cut of deals brokered between users. Discussions show Doe seeking business advice and strategies for anonymous, offshore operations. (31:26)

10. Confronting Accountability and Publishing the Story

• With the evidence in hand, the investigative team is committed to naming Doe and confronting him—inverting years of women being forced onto front pages by his site. (32:46)
  • Quote [32:46]:
    "If we publish this story, we have to name him. I mean, we have to turn and flip the spotlight. He has been using women's faces for years—now it’s his turn to be on the front page." – Ida Herskind
• The European team lacks direct access to Doe in Canada, so they turn to CBC for collaboration with boots on the ground. (33:23)

Notable Quotes & Memorable Moments

• On how real virtual harm is:
  "So to say that it's fake is—yeah, it didn't happen physically, but it did happen online. And right now we live in a world that things happening online is also part of our physical world." – Ida Herskind (10:09)

• On the nature of the community:
  "The tone is very toxic but also very friendly too—really nasty things about women but also helping each other out." – Ida Herskind (06:12)

• On expectations versus reality of the perpetrator:
  "It was like a Breaking Bad style scenario…it totally confounded all of my expectations." – Ross Higgins (25:15, 25:50)

• On the need for naming Doe:
  "He has been using women's faces for years, exploiting them, earning money on them. Now it’s his turn to be on the front page." – Ida Herskind (32:46)

Important Timestamps

| Timestamp | Segment | |-----------|-------------------------------------------------------------------| | 01:01 | Ida Herskind reacts to her first exposure to deepfake porn. | | 02:42 | Violent and disturbing examples on Mr. Deepfakes site. | | 05:02 | Description of Mr. Deepfakes platform’s Netflix-like interface. | | 06:12 | Forum culture: toxic misogyny mixed with support. | | 11:34 | Ida and Zachariah begin collaborating. | | 14:08 | Ida's article makes front page, but no action results. | | 17:19 | Zachariah discovers data breach links while on Christmas break. | | 19:51 | The "dandelion"—network mapping of digital connections. | | 24:11 | Bellingcat finds Gmail link in site’s 2019 “Contact Us” form. | | 25:52 | Reveal: David Doe, a Canadian pharmacist, is Mr. Deepfakes. | | 27:28 | Classmate reflects on David's dual identity. | | 29:08 | Proof of financial success and operation scale. | | 32:46 | Decision to publish Doe’s name and confront him. | | 33:23 | Collaboration with CBC for direct confrontation. |

Conclusion & Next Episode Tease

Episode 3 ends as the investigative alliance prepares to confront David Doe in person, with CBC journalists joining the effort to bring the deepfake porn empire’s operator out of hiding. The stage is set for the season finale, where the team plans to demand answers and confront Doe with the evidence amassed from this years-long, cross-border pursuit.