Deepfake Porn Empire | E3: The Notorious D.P.F.K.S.

Summary

---

Understood: Deepfake Porn Empire

Episode 3: The Notorious D.P.F.K.S.

Host: Sam Cole | Date: March 3, 2026 | Publisher: CBC

---

Overview

In this compelling episode, host Sam Cole and a multinational team of journalists and investigators unravel the global hunt for the anonymous kingpin behind the internet’s largest non-consensual deepfake porn site—MrDeepFakes.com. The episode focuses on the personal investigations of Danish journalist Ida Herskind, her collaboration with open-source intelligence (OSINT) specialist Zachariah Hamid, and the breakthrough that finally unmasked the site's operator: a seemingly ordinary Canadian hospital pharmacist named David Doe. The episode explores the technical, legal, and ethical barriers to accountability, and the chilling realities for victims targeted by this billion-click industry.

---

Key Discussion Points & Insights

1. Ida Herskind’s Entry into Deepfake Porn Investigation

• Trigger: Ida, a Danish journalist, is shaken by a news story about a British journalist discovering deepfake porn of herself. (01:18)
  • Quote [01:45]:
    "I just thought, it's unbelievable. She's a journalist, just like me. She's just doing her job." – Ida Herskind
• Ida is alarmed by the ease of accessing deepfake porn and its disturbingly realistic, violent, and misogynistic content. (02:10, 02:42)
  • Quote [02:10]:
    "It was so easy to find. I mean, it was literally a click away from Google search engine." – Ida Herskind
  • Quote [02:42]:
    "It's of Greta Thunberg...she's being bound and forced to give a blowjob while her hair is shaved off." – Ida Herskind

2. Inside the Mr. Deepfakes Platform

• MrDeepFakes is described as both a massive video streaming platform (over 70,000 videos) and an active forum (650,000 members) where users share, request, and barter for content. (05:02, 05:25, 05:40)
  • Quote [05:02]:
    "It looked like a streaming platform like Netflix." – Ida Herskind
• The community is toxic and misogynistic yet oddly collegial. (06:12)
  • Example [06:12]:
    "They write really nasty things about women, but also help each other out." – Ida Herskind
• Requests are frequently punitive or degrading in intent, exposing the hostile attitude towards female celebrities. (07:06)

3. Investigative Frustrations and Legal Barriers

• Despite Denmark’s laws against non-consensual pornography, enforcement is thwarted by perpetrators’ anonymity and technical obfuscation: VPNs, burner wallets, offshore hosting, and proxy registrations. (07:49)
  • Quote [07:49]:
    "People behind these platforms...do everything they can to hide their identities." – Sam Cole
• For years, media and authorities failed to unmask the perpetrator; even major outlets only got partway, masking the founder’s identity in interviews. (08:30)

4. Connecting the Dots: The Hunt for Mr. Deepfakes

• Ida tracks Danish victims and begins searching for uploaders using local usernames. She enlists Zachariah Hamid, an OSINT whiz, to help follow digital breadcrumbs. (10:54, 11:34, 12:00)
  • Quote [12:00]:
    "I just like clicking around on the Internet, trying stuff out..." – Zachariah Hamid
• Early investigations stall; tenuous links lead to dead ends or minor participants. (13:16)

5. Breakthroughs and Setbacks

• Investigators expand the search to a broader network. Even after high-profile media exposure (front page of Politiken, coverage of attacks on female politicians), nothing happens—perpetrators remain untouched, and the content is still online. (14:08, 14:26)
  • Quote [14:26]:
    "I was left with this very empty feeling because it had no consequences for the perpetrators...you could still go to Google." – Ida Herskind
• During a Christmas break, a relaxed Zachariah has an insight: he discovers leaked credentials (databases of breached usernames and passwords) and finds a link between the forum admin "DPFKS" and an email address. (16:27, 17:19)
• This unique password and related usernames tie back to another handle ("aznRico") and ultimately to a specific Canadian Hotmail account. (18:24, 18:57)

6. Network Visualization & Smoking Gun

• Zachariah creates a “dandelion”—a network visualization showing the connections between usernames, emails, and IP addresses, all radiating from the handle "AgentRico" and the DPFKS email. (19:51, 20:08)
• They hit a wall: lacking a direct, publicly visible link tying the suspicious email address to MrDeepFakes.com. (21:16)

7. Bellingcat’s Involvement & Final Evidence

• The international investigative collective Bellingcat is brought in to help seal the identification. (21:53)
• Bellingcat combs web archives and discovers that, until 2019, MrDeepFakes’s “Contact Us” form sent emails directly to the Gmail in question, clinching the association. (24:11)
  • Quote [24:11]:
    "This email was sent directly to the Gmail that was connected to this random Hotmail to this random guy in Canada." – Ida Herskind

8. The Reveal: Who is Mr. Deepfakes?

• Investigators expect either a reclusive, antisocial techie or an organized crime outfit—a “Walter White” or global syndicate. (24:51, 25:11)
  • Quote [25:52]:
    "The person behind MrDeepFakes.com is David Doe, a 36-year-old pharmacist working at a hospital ..." – Sam Cole
• David Doe, a mild-mannered and well-liked hospital pharmacist from Markham, Ontario, Canada, is unmasked as the site’s founder. His normal life contrasts sharply with his online exploits. (26:09-27:03)

9. Tracing David Doe’s Double Life

• Friends describe David as tech-savvy, friendly, and “always involved in something online”—from spambot SEO schemes to meme generators. (27:28)
• Doe began as a hobbyist, producing deepfake porn, guides, and uploading huge datasets. His site’s growth to millions of users brings in significant profits—at least $4,000 to $7,000/month by 2020, with later figures likely higher. (28:19, 29:08, 31:26)
  • Quote [29:53]:
    "He had a porn site with about 15 to 20,000 visitors a month... trying to find an explanation for ‘bottlenecks and reasons for slowness for tube site.’" – Sam Cole (narrating Doe’s online post)
• Revenue includes subscriptions, advertising, and a cut of deals brokered between users. Discussions show Doe seeking business advice and strategies for anonymous, offshore operations. (31:26)

10. Confronting Accountability and Publishing the Story

• With the evidence in hand, the investigative team is committed to naming Doe and confronting him—inverting years of women being forced onto front pages by his site. (32:46)
  • Quote [32:46]:
    "If we publish this story, we have to name him. I mean, we have to turn and flip the spotlight. He has been using women's faces for years—now it’s his turn to be on the front page." – Ida Herskind
• The European team lacks direct access to Doe in Canada, so they turn to CBC for collaboration with boots on the ground. (33:23)

---

Notable Quotes & Memorable Moments

• On how real virtual harm is:
  "So to say that it's fake is—yeah, it didn't happen physically, but it did happen online. And right now we live in a world that things happening online is also part of our physical world." – Ida Herskind (10:09)

• On the nature of the community:
  "The tone is very toxic but also very friendly too—really nasty things about women but also helping each other out." – Ida Herskind (06:12)

• On expectations versus reality of the perpetrator:
  "It was like a Breaking Bad style scenario…it totally confounded all of my expectations." – Ross Higgins (25:15, 25:50)

• On the need for naming Doe:
  "He has been using women's faces for years, exploiting them, earning money on them. Now it’s his turn to be on the front page." – Ida Herskind (32:46)

---

Important Timestamps

| Timestamp | Segment | |-----------|-------------------------------------------------------------------| | 01:01 | Ida Herskind reacts to her first exposure to deepfake porn. | | 02:42 | Violent and disturbing examples on Mr. Deepfakes site. | | 05:02 | Description of Mr. Deepfakes platform’s Netflix-like interface. | | 06:12 | Forum culture: toxic misogyny mixed with support. | | 11:34 | Ida and Zachariah begin collaborating. | | 14:08 | Ida's article makes front page, but no action results. | | 17:19 | Zachariah discovers data breach links while on Christmas break. | | 19:51 | The "dandelion"—network mapping of digital connections. | | 24:11 | Bellingcat finds Gmail link in site’s 2019 “Contact Us” form. | | 25:52 | Reveal: David Doe, a Canadian pharmacist, is Mr. Deepfakes. | | 27:28 | Classmate reflects on David's dual identity. | | 29:08 | Proof of financial success and operation scale. | | 32:46 | Decision to publish Doe’s name and confront him. | | 33:23 | Collaboration with CBC for direct confrontation. |

---

Conclusion & Next Episode Tease

Episode 3 ends as the investigative alliance prepares to confront David Doe in person, with CBC journalists joining the effort to bring the deepfake porn empire’s operator out of hiding. The stage is set for the season finale, where the team plans to demand answers and confront Doe with the evidence amassed from this years-long, cross-border pursuit.

---

Transcript

[BetterHelp Ad Voice]

This is an ad by BetterHelp.

[Sam Cole]

Did I talk too much?

[Ross Higgins]

Can't I just let it go?

[Sam Cole]

I was thinking so much.

[BetterHelp Ad Voice]

Take a breath. You're not alone. Let's talk about what's going on. Counseling helps you sort through the noise with qualified professionals, and online therapy makes it convenient. See if it's for you. Visit betterhelp.com randompodcast for 10% off your first month of online therapy. And let life feel free.

[Ida Herskind]

Better.

[Zachariah Hamid]

This is a CBC podcast.

[Sam Cole]

Quick heads up. In this episode, there are descriptions of deepfake videos that some listeners might find disturbing. Back when you started looking into deepfakes, when you started looking into this world in general, did you ever anticipate what where we'd be today with it? Did you ever think about where this would all end up?

[Ida Herskind]

No. I had had no clue. I had no clue how it would end up.

[Sam Cole]

This is Ida Herskind, and I work

[Ida Herskind]

in a Danish newspaper called Politik. In the culture department, Ida's covered everything

[Sam Cole]

from MeToo to scandals in Copenhagen's Royal Ballet. In the spring of 2024, she was looking for her next assignment when she saw a news story that stopped her cold. This is me in a porn video, but it's completely fake. This is just someone's fancy. A British journalist, while reporting on the rise of deepfakes in the uk, had found deepfake porn of herself. Ida had never seen anything like it.

[Ida Herskind]

I just thought, it's unbelievable. She's a journalist, just like me. She's just doing her job. And I was thinking, like, okay, is this something that happens in the dark web? Because I never see deepfake porn in my feed or in my social media.

[Sam Cole]

Right there. Ida opens a new tab, types in deepfake porn, hits enter.

[Ida Herskind]

And it was so easy to find. I mean, it was literally a click away from Google search engine. I was really shocked to see how realistic it is and also how violent it was and how malicious it was. It was like coming into the head of a creepy guy, you know?

[Sam Cole]

One video left her especially rattled. It's of Greta Thunberg, the Swedish climate activist.

[Ida Herskind]

It looks really realistic, but it's fake. And she's being bound and forced to give a blowjob or oral sex to her perpetrator while he is shaving her hair off. I also remember a title such as, Scarlett Johansson gets strangled to death by a creepy stalker. And these images, they were like, hunting me. And the biggest platform was Mr. Deep Fakes.

[Zachariah Hamid]

Mr. Deepfakes.

[Sam Cole]

Mr. Deepfakes.

[Zachariah Hamid]

Mr. Deepfakes. Is the most notorious non consensual deepfake porn site in the world. Mr. Deepfakes or the man behind Mr. Deepfakes.

[Ross Higgins]

This notorious Mr. Deepfakes. And he's this Mr. Big kind of character.

[Sam Cole]

Eda didn't know it at the time, but she had just ignited a chase that would become a 3 Country 4 Newsroom investigation into the world's largest deepfake porn website and the identity of the man behind it. I'm Sam Cole and this is understood deepfake porn empire episode three the notorious DPFKs. Back in 2017, I first saw that face swap porn of Gal Gadot. It was on a subreddit for celebrity fakes. But pretty soon, deepfake porn had its own dedicated subreddit r Deepfakes. It took off fast. By February 7, 2018, the subreddit had ballooned to roughly 100,000 members. The reason we know the numbers for that specific day is because that's the day Reddit pulled the plug. Rdeefakes was banned for violating the site's involuntary pornography policy. But killing the subreddit didn't kill the content. Deepfake Porn and the people making it simply migrated. That same week, a new site appeared. DPFKS.com the domain was later changed to MrDeepFakes.com. By the time Ida landed on the site in 2024, it was receiving millions of visitors a month.

[Ida Herskind]

And this platform popped up as the first link being presented to me from Google. And I clicked on it and I was so surprised how professional it looked. It looked like a streaming platform like Netflix. You had all these videos you could search for your favorite celebrities. It was very user friendly.

[Sam Cole]

Mr. Deepfakes has two sides. One side is the massive video library with over 70,000 videos. But the other side is what built Mr. Deepfakes reputation. A forum with about 650,000 members.

[Ida Herskind]

You can chat and you can also request videos like, hey guys, I would love to have some material with this girl. Can someone help me out? And then they pay each other making porn.

[Sam Cole]

When Taylor Klein went hunting for the person who'd been deep faking her, this is the side of the site she stumbled onto. We tried to get people making deepfake porn to talk to us on the record. Nobody would. But across the Internet, inside deepfake forums like the one on Mr. Deepfakes, they post their thoughts freely.

[Ida Herskind]

The tone is very like toxic, but also like very friendly to. So they write really nasty things about women, but also help each other out.

[Sam Cole]

For example, you'll get Heartfelt exchanges like this one that's stuck in my mind. My colleagues are going to read it.

[Zachariah Hamid]

So guys, I'm going to talk serious business here. I will stop. Stop with the fakes. Simply stop. Don't worry, it's not a personal or justice issue.

[Former Classmate]

I just lost the will to do it.

[Zachariah Hamid]

You'll be missed, man. But do what's best for you. Shame to see you go. I know this is hard to hear,

[Former Classmate]

but it's what's best for me and

[Zachariah Hamid]

my girlfriend, a real woman. It's a good reason to give it up. Cheers.

[Sam Cole]

So you get that and then you get posts like this one guy, he

[Ida Herskind]

wanted to have some Deepfake porno with this 20 year old actress and he just wrote, hey, can someone do some deep fake porno with this girl? Just pure anal. For her it was like a punishment. A punishment for her because you were appearing like a whore, he said, on her social media.

[Sam Cole]

Stumbling into this world, looking through this forum, it made Ida wonder.

[Ida Herskind]

It's Amigal in Denmark. To share pornographic material without consent. So how could I just sit on my laptop and then suddenly be on this webpage? Why can't the authorities shut it down?

[Sam Cole]

And of course we know it's because the people behind these platforms and producing this content do everything they can to hide their identities. The usernames, the VPNs, the obscure profile pictures. Which means even if you live in a place where sharing non consensual AI porn is a criminal offense, it can be difficult for the authorities to prosecute. That is, unless someone gives them a name. But Eda never imagined she'd be that person.

[Ida Herskind]

I had no idea that it could actually be possible to find the guy running the platform. It just simply wasn't on my radar.

[Sam Cole]

And that makes sense, because identifying the person behind Mr. Deepfake seemed impossible. Here's what anyone on the outside could see when the domain was registered, it was done using a proxy service that hid the owner's name and any clue about their location. From there, the site's hosting jumped between countries and anonymous offshore providers. And the money? Subscriptions were routed through cryptocurrency wallets that generated a new address for every transaction. This is like throwing out a burner phone after one call. Thousands of times the site had been widely reported on, but most media organizations treated MrDeepFakes.com as faceless and impenetrable. One German outlet, Der Spiegel, reported they believed that they had identified the man behind the site, but they didn't have enough evidence to Publish a full name. The closest anyone seemed to get to Mr. Deepfakes was in 2023. A BBC documentary claimed they'd spoken with the site's founder. They replaced his face and voice with an actor's, allowing him to be completely anonymous so they could ask him about the ethics of what he'd built.

[Ross Higgins]

I think that as long as you're not trying to pass it up as a real thing, that should really matter. Because it's basically fake. I don't really feel the consent is required.

[Sam Cole]

Sounds familiar, right? That's because it's basically the same answer Lux Luker, the guy running the Photoshop porn groups, gave more than 20 years ago. And it's something Eda heard too.

[Ida Herskind]

When I talked to some of my co workers, they were like, oh yeah, I heard about the phenomenon, deep fakes. Yeah, I heard about it. And yeah, but it's fake, you know, so whatever. But all of this is in one way realistic because it happened on somebody's computer. So to say that it's fake is. Yeah, it didn't happen physically, but it did happen online. And right now we live in a world that things happening online is also part of our physical world. Right.

[Sam Cole]

Eda made a decision. Even if she couldn't identify Mr. Deepfakes, she would try to do something for the thousands of women who'd been targeted.

[Ida Herskind]

So I thought, let's look into this.

[Sam Cole]

Ida started by tracking Danish targets across multiple sites.

[Ida Herskind]

And I started making a spreadsheet. And in a couple of days I had seen fake porn with more than 50 Danish celebrities.

[Sam Cole]

One of those led her to a user who'd uploaded 17 videos, someone who'd clearly missed the obscure username memoir.

[Ida Herskind]

I just noticed one user in Mr. Deepfake with a Danish name and I just searched for his name on social media and I found this 21 year old guy. But I couldn't document that the user on Mr. Deepfakes and the 21 year old guy was the same.

[Sam Cole]

So she decides to bring in backup. In the summer of 2024, IDA reached out to the Danish fact checking outlet, Czech Debt, which translates essentially to check it.

[Ida Herskind]

They have this specialist called Zachariah Hamid and he has like a black belt in open source intelligence. And I asked him if he maybe would like to collaborate.

[Zachariah Hamid]

I don't see myself as a black belt. I really don't. I just like clicking around on the Internet, trying stuff out and sometimes, you know, good stuff comes out of it.

[Sam Cole]

Zakaria Hamid is not a journalist, he's an open source intelligence Specialist. His job is to figure out what the Internet already knows about you. This is not dark web stuff. It's forum posts, public records, forgotten accounts, leaked emails and passwords from old data breaches. All of it public. Zach follows all the little crumbs people leave behind online. And that's what Ida needed him to do.

[Zachariah Hamid]

She wanted to know if we could help her find who's behind this website, but also a Danish guy who's uploading Deepfake videos. I thought it was exciting. I said, yeah, you know, it's a good cause. I would love to help.

[Sam Cole]

Zach tries matching the username on Mr. Deepfakes with the 21 year old IDA found on social media. He goes through databases of leaked credentials, follows the digital crumbs, but there's nothing definitive.

[Zachariah Hamid]

We couldn't conclude 100% certainly that this is the guy. But there was enough evidence to at least contact him.

[Sam Cole]

So they decided to do the old fashioned thing.

[Ida Herskind]

We called him and he just said, like, fuck, no, it's not me, and hang up the phone.

[Zachariah Hamid]

Of course he denied everything.

[Ida Herskind]

And we knew that we couldn't really publish the story with his name because he's just such a little fish, you know, making 17 videos. So we just wrote this background article about the Mr. Deepfake.

[Sam Cole]

IDA published two stories, one with Zach about the Mr. Deepfakes platform generally and another about Denmark's female politicians who'd been targeted in Deepfake porn.

[Ida Herskind]

This is a big problem for our democracy that as a woman, if you are running, running for office, this could potentially be something you have to experience.

[Sam Cole]

The outlet Ida writes for, Politikin, made a big splash with her article. A full page photo with three politicians.

[Ida Herskind]

I mean, it was on the front page of Politikin. It was in a lot of Danish media. Everybody could agree that this is really a bad thing.

[Sam Cole]

And then. Nothing.

[Ida Herskind]

After the story came out, I was left with this very empty feeling because it had no consequences for the perpetrators. It really pissed me off that you could still go to Google and one click away you will see this terrible video with Greta Thunberg.

[Zachariah Hamid]

So we published that. We went our ways, we separated. You know, Ida did her thing, we did our thing.

[Ida Herskind]

I sort of had to put the project aside. But a couple of months after Zachariah called me in my Christmas vacation and told me that he couldn't stop researching on the platform Mr. Deepfakes and he actually found a guy that he thought was the key figure behind Mr. Deepfakes.

[BetterHelp Ad Voice]

This is an ad by BetterHelp.

[Sam Cole]

Did I talk too much.

[Ross Higgins]

Can I just let it go?

[BetterHelp Ad Voice]

Take a breath. You're not alone. Let's talk about what's going on. Counseling helps you sort through the noise with qualified professionals, and online therapy makes it convenient. See if it's for you. Visit betterhelp.com randompodcast for 10% off your first month of online therapy and let life feel better.

[Sam Cole]

You know that feeling when you reach the end of a really good true crime series, you want to know more. More about the people involved, where the case is now, and what it's like behind the scenes. I get that. I'm Kathleen Goldhar, and on my podcast, Crime Story, I speak with the leading storytellers of true crime to dig deeper into the cases we all just can't stop thinking about. Find Crime Story wherever you get your podcasts. It was December 2024, and Zachariah Hamid was on holiday.

[Zachariah Hamid]

And, you know, I was laid up on my couch. I was watching How I Met yout Mother. I think it was like 10 o' clock in the morning or something. You know, I just had breakfast. I was just enjoying life. It's Christmas break, right?

[Sam Cole]

Zach is still in his pajamas when his mind drifts from the romantic flailings of Ted Mosby and a little Rudolph nose bulb went off in his head.

[Zachariah Hamid]

You know, sometimes when you're working on something really, really hard, sometimes it's kind of hard to get this clear side, like where you think straight. And so when you go on vacation, your mind is relaxed and you can kind of look at things from new perspectives, right?

[Sam Cole]

Back in the summer, Zach had taken note of a username on the Mr. Deepfakes forum. This was someone with staff and administrator badges who'd been moderating posting rules.

[Zachariah Hamid]

User number one on the forum was this DPFKS username,

[Sam Cole]

dpfks, the consonants in deepfakes. At the time, that username hadn't led anywhere. But now Zach had access to a new database of leaked credentials.

[Zachariah Hamid]

I was like, damn, let me just try this thing, right? I was just curious. I wasn't expecting anything. I was like, let me just give it a shot.

[Sam Cole]

Zach pauses his episode, pulls up this new database, types in DPFKs, and immediately

[Zachariah Hamid]

I was just met with, you know, a few breaches where that username was present.

[Ida Herskind]

Huh.

[Zachariah Hamid]

That's curious. And so I started looking into it and, like, I went from the username, then I found an email that was attached to it.

[Sam Cole]

The first hit was a Gmail account with the same five letters as the username dpfkscommail.com, dpfkscom, mail.com. and that Gmail had a leaked password.

[Zachariah Hamid]

The password was super unique. So I was like, okay, it was 11 characters.

[Sam Cole]

The thing about a password this unique is that it basically becomes a digital license plate. It's hard to crack on its own, but easy to match in the wild. And Zach found it again and again, often paired with another username. Azn, Rico, Asian Rico. And then he found this same password attached to another entirely different breached Hotmail address.

[Zachariah Hamid]

I was like, this can't be, you know, by chance, right?

[Sam Cole]

At which point Zach was like, okay, pause. Time to call Ida.

[Zachariah Hamid]

We hadn't talked since we published back in September, right? So I was like, what's up, Ida? How's it going? You know, formalities. What have you been up to, House? Life. And then I was like. I said to her, I was like, ida, are you still interested in defects? Because if you are, I think I got something here.

[Ida Herskind]

Sagaria. He just started talking to me on the phone, like, explaining all this, you know, with usernames and passwords and data leaks and connecting the dots. And I just. I said, like, sagriya, stop. We have to meet. You have to explain it to me in a meeting.

[Sam Cole]

To explain it, Zach made EDA a very elaborate presentation.

[Zachariah Hamid]

Let me just fire it up here. Can you see this?

[Sam Cole]

Zach shared his screen with me, and suddenly I was looking at an infinite chart, all expanding out of one username in the middle. It looks like a dandelion. It's just like an explosion of like. Like rays out from the center. And the center is Agent Rico, right?

[Zachariah Hamid]

Yeah, exactly. That's the username. And these are, like, where that username has been used, some document IDs. And so when I do this.

[Sam Cole]

Oh, my gosh, I just, like, exploded even more.

[Zachariah Hamid]

Yeah, we can see this personal email address. The Mr. Deflags email address. The username and the password are all tied together. And this is how I visualize it, and this is how I show it to my colleagues.

[Sam Cole]

Standing in his office, the presentation blooming across a big screen, Zach laid out the chain of evidence to Ida.

[Ida Herskind]

What Zagaria found was a username that had the same letter as a Gmail. That Gmail was connected to a Hotmail belonging to this random guy in Canada,

[Sam Cole]

a random Canadian with a real world name.

[Ida Herskind]

When he told me, I. I thought, it can't be true. I mean, it sounds so unrealistic because these guys, they do everything they can to hide. And I thought, how could we ever make sure that it's him? How can we ever, like, confront him? How could we ever publish a story about it?

[Sam Cole]

Ida was right to be skeptical because Zach's research had a missing link.

[Zachariah Hamid]

Because we couldn't with 100% certainly say that the DPFKSCOM mail email address was tied to the Mr. Defects website.

[Ida Herskind]

This could be a random guy just like picking five letters DPFK s by coincidence.

[Zachariah Hamid]

She was like, this is great and we're definitely heading in the right direction, but we're still missing that smoking gun, right?

[Ida Herskind]

So we decided to contact Bill and Cat.

[Ross Higgins]

We got an email and it said, we think we know who this Mr. Deepfakes is. Would you be interested in having a call with us? And we're a little bit skeptical because we always get emails like that.

[Sam Cole]

Ross Higgins is a team lead and investigator at bellingcat. As far as investigative teams go, calling bellingcat is like putting out the bat signal. When you need information, there's a good chance they can find it. Ross team is known for digging up evidence on everything from the MH17 plane crash to the poisoning of Russian dissident Alexei Navalny. But they'd actually looked into IDing Mr. Deepfakes before and had hit a wall. This is part of why Ross was so skeptical about Eda and Zach's claim.

[Ross Higgins]

But we decided to have a meeting with them and then they showed us a presentation that convinced us that they were really onto something.

[Sam Cole]

It is a very convincing dandelion people.

[Ross Higgins]

All they were saying to us was, we've got this information. Can you verify some of this? Because we can't link this to the website directly. Can you find a way to do that? So we were immediately interested. And then there was the possibility of actually naming the guy as well based off the this information. If only we could find those few threads.

[Sam Cole]

A few days later, Eda and Zach get an email from Ross's team. Can they jump on a call?

[Ida Herskind]

It was cross borders, different time zones. People from bellingcat, people from Pigin, people from Czech and bellingcat just told us, very calm, like, I don't know how to like, very help me out, Samantha.

[Sam Cole]

Like they were very nonchalant, right?

[Ida Herskind]

Very nonchalant.

[Sam Cole]

We do this all the time, no big deal. I know what you're saying.

[Ida Herskind]

You know, like me and Sagrian feeling like we were in this crime plot. And then these guys from bellingcat, they just found the link. In a few days, the Bell and

[Sam Cole]

Cat team had pulled up old versions of the Mr. Deepfakes website on archive.org and buried inside those cached source codes, they found it. A direct link between the Mr. Deepfakes site and the DPFKS Gmail account.

[Ida Herskind]

They found that the Contact Us formula. When you used to send an email to Mr. Deepfakes back in 2019, this email was sent directly to the Gmail that was connected to this random hotmail to this random guy in Canada.

[Sam Cole]

When you imagine who might be behind the largest deep fake porn website in the world, a site with a forum training people how to make non consensual deepfake porn targeting tens of thousands of women, be honest, who comes to mind? In Zach's imagination, Mr. Deepfakes looked like this.

[Zachariah Hamid]

This is some guy holed up somewhere in a basement. Maybe he works in a morgue. Like he's isolated. This guy's by himself. You know, this is not a guy who leaves his house and he's probably wearing a hoodie. He probably likes monster energy drinks, you know, stuff like that. Right.

[Sam Cole]

Ross, meanwhile, pictured something much bigger.

[Ross Higgins]

The website was so well organized and it was using Internet service providers that you typically see running operations to do with money laundering and organized crime. So when I found out it was just this guy in Canada, it totally confounded all of my expectations and it actually threw us off. We had a crisis of confidence halfway through this investigation because we saw this guy and we thought, this can't possibly be the guy who's running this website. It was like a Breaking Bad style scenario. It was really weird.

[Sam Cole]

Yeah, this was your Walter White.

[Ross Higgins]

Exactly.

[Sam Cole]

The person behind MrDeepFakes.com is David Doe, a 36 year old pharmacist working at a hospital living in Markham, a suburb north of Toronto.

[Zachariah Hamid]

You know, he has a wife, he lives in a nice house, drives a nice car and you know, he just living life like everybody else.

[Ida Herskind]

He's just this total normal guy helping people out, taking their medicine at a hospital.

[Zachariah Hamid]

And I'm David, we're both pharmacists here and we'll be going through some medications you may be taking when you go home.

[Sam Cole]

David took part in a series of videos for one of the hospitals where he worked. A pharmacist telling nervous patients how to deal with their pain medications, how to avoid constipation, supplement their iron.

[Zachariah Hamid]

The acronym FAST is an easy way to remember sudden signs and symptoms of a stroke.

[Ida Herskind]

Looking at David Doe on his social media and on his friends and family's social media, you would never guess that he is like the key figure behind the biggest platform in the world for Deep Vapor.

[Zachariah Hamid]

Never all the information in this video is also written in your hip and knee package. Have a great day.

[Sam Cole]

We contacted more than a dozen people who know or knew David Doe. Some ignored us, others declined to talk. One former classmate sent us a note to share so long as we didn't identify them. My colleague is going to read it.

[Former Classmate]

David was a friendly guy. He was always nice to me and occasionally would be part of our late night study groups in pharmacy school. He did offer car rides to people as well and that was always helpful, especially when it's dark out. He seemed to always have a lot of friends and was never really antisocial. David was always into something technology related. I believe he used to run spam bots that would drop a link to his websites on various sites in order to increase the SEO. I believe he was also making a meme generator site while in school as a way of making income, which apparently was not a success. He was always involved in something different, so it would be difficult to keep track of exactly what he was doing online.

[Sam Cole]

But that's what bellingcat is for.

[Ross Higgins]

We found just about everything that exists about this guy and what he's been doing in the last 10, 15 years

[Sam Cole]

from what they found. David Doe started out as a hobbyist.

[Ross Higgins]

He got interested in the deep fake pornography. He was actually producing his own content. Then he started to produce his own guides on how to produce this. So he was much more of an active kind of hobbyist to begin with. Okay. And this is when people really weren't talking about this type of stuff.

[Sam Cole]

By 2018, do was taking deepfake porn seriously.

[Ross Higgins]

He was uploading insane numbers of images onto the forums for people to, to kind of play around with. He was obviously putting a lot of time and effort into what he was

[Sam Cole]

doing and clearly it was paying off. Okay, in some parts of Canada, if you're a public servant above a certain pay grade, your income is published.

[Ross Higgins]

So we know what his salary is. And then we look at the fact that he's living in a certain neighborhood, which is quite nice, and he's driving a brand new Tesla. So you start to think, okay, he seems to be doing very well, even by pharmacist standards.

[Sam Cole]

From the first time he looked into the site, Ross had wondered about how do ran the business of Mr. Deepfakes.

[Ross Higgins]

Well, he tells us this himself because we had all of his posts under his various aliases. So for example, we did see him complaining on One forum that PayPal had limited his stealth account. This would appear to be an anonymized account that he was using purely for running the business of Mr. Deepfakes.

[Sam Cole]

Forum posts all tied to the same cluster of David Doe's aliases. Talk about troubleshooting, platform issues, recruiting designers, writers, developers and SEO support. In one post, just months after the site's launch, he wrote that he had a porn site with about 15 to 20,000 visitors a month, and he was trying to find an explanation for, quote, bottlenecks and reasons for slowness for tube site. On another forum, he asked about anonymous debit cards advertised as a way to make untraceable purchases. Which brings us to the big how much money was MrDeepFakes.com making? Some of the site's revenue streams are obvious visible right on it. Premium subscriptions and advertising. But there was another revenue source.

[Ross Higgins]

He did describe on another post how he was the webmaster of an adult tube site and he was taking a cut from the creators who were posting the pornography on his website. Remember, he's got this huge community that's connected to it. People were requesting more specific things between each other on the message boards, and there was talk of payment on the message boards. So what we suspect is that there were all kinds of grubby deals being done behind the scenes that obviously we weren't privy to because it's not open source.

[Sam Cole]

But there was plenty they could see.

[Ross Higgins]

On other forums he was looking for advice on how to set up on offshore companies. And in another post, he was saying that his website was earning him between US$4,000 and US$7,000 a month.

[Sam Cole]

That post was in 2020. By 2025, the traffic to Mr. Deepfakes had grown significantly and the exact profit generated by the site is unknown.

[Ida Herskind]

It really gave me the creeps because this guy, David Doe, he does everything he can to hide behind secret usernames and whatnot, and suddenly you just have this investigative team online, like, going through his whole life and finding so many pieces and information like pointing at him.

[Sam Cole]

Collectively, the dpfks Gmail could be linked to aliases, usernames, passwords and email accounts that overlapped with David Doe's personal and professional information going back more than a decade, each of them dots that connected to IP addresses traceable to specific locations in Canada where David Doe lived, worked and studied. Ida knew it was time and that the team needed to do something nobody else had done.

[Ida Herskind]

And everybody agreed. If we publish this story, we have to name him. I mean, we have to like, turn and flip the spotlight. He has been using women's faces for years, exploiting them, earning money on them. Now it's like his turn to be on the front page.

[Sam Cole]

But there was one problem, a big one.

[Ross Higgins]

He was in Canada and we were all in Europe, and we really needed some kind of opportunity to speak to him. And we knew that if we sent all of this information to him via email, he just ignore it.

[Ida Herskind]

This is like a really big allegation. So we have to make sure that he has received all the allegations. We have to meet him face to face. And we were all sitting here in Europe and none of us could go to Canada and confront him. So we contacted cbc.

[Sam Cole]

It was time to send out another bat signal.

[Ross Higgins]

And we said, look, would you maybe be interested in becoming a partner in this project? And they said, yes.

[Sam Cole]

Next time on the final episode of Deepfake Porn Empire.

[Zachariah Hamid]

I was actually like, this is crazy.

[Ross Higgins]

This is the hunt, right?

[Zachariah Hamid]

How do we track him down?

[Sam Cole]

CBC reporter Eric Seto takes the Mr. Deepfakes investigation offline and into hospital hallways and suburban streets as the team closes in on David Doe and demands answers

[Zachariah Hamid]

right now on Porter CBC News.

[Sam Cole]

Understood. Deepfake Porn Empire is written and produced by our showrunner, A.C. rowe, and me, your host, Sam Cole. In this episode, you Heard archival tape from CBC, Channel 4, BBC and How I Met yout Mother from 20th Century Fox and CBS. Recorded voices in this episode included Mac Cameron, John Lee, and the Understood team. Arman Agbali is the producer, our sound designer is Julian Uzieli. Veronica Simmons is our story editor, and our executive producer is Nick McCabe. Locos. If you want to hear more stories about the Internet and the people who shape it, check out Last Season About Elon Musk. It tells the story of how his upbringing in apartheid South Africa shaped the politics he later brought to the White House and Big Tech. You can find the making of Musk wherever you're listening to me now by scrolling back in your Understood feed. And make sure to follow us while you're at.

[Zachariah Hamid]

For more cbc podcasts, go to cbc ca podcasts.