An Investigation by Sidenty
On March 18, 2024, Dutch news outlet Algemeen Dagblad published an article about Dutch celebrity women being targeted in deepfake pornography. In response, Sidenty launched an internal investigation into the most prominent platform hosting this content: MrDeepFakes.
Our investigation led to the identification of the individual behind the website: a Canadian national. Initially, we chose not to publish his identity, as a documentary series covering the case was still in development. However, after other media outlets independently uncovered and reported parts of the story we felt it was important to share our full findings. This report outlines exactly how we identified the owner of MrDeepFakes.
How We Identified the Owner
On March 28, 2024, our team identified the individual operating MrDeepFakes. He is a Canadian pharmacist, married, and recently became a father. Our investigation uncovered a long-standing pattern of involvement in illegal adult websites dating back to the late 2000s.
Prior to launching MrDeepFakes in 2018, he developed a prototype site under the domain dpfks.com, which we discovered referenced on a lesser-known imageboard resembling 4chan.
Later, the domain dpfks.com was redirected to mrdeepfakes.com, while still using the same icon image. This continuity strongly suggests that both sites were operated by the same individual. Using OSINT tools, we discovered that the email address [email protected] was also linked to the alias AznRico.
AZNRICO
The username AznRico appears on over a dozen forums dating back to the 2000s, often linked to adult or warez content.
Some notable sites include:
- freeones.com – Uploaded pornography in 2009
- biguz.net – Uploaded deepfake porn of Hayley Williams in 2016
- wjunction.com – Discussed offshore hosting for adult sites
- blackhatworld.com – Requested virtual assistants to upload tube videos
On freeones.com, the user AznRico listed his birthdate as November 15, 1988. Through the alias AznRico, we were able to trace additional usernames with our OSINT tools associated with him, including ddo88 and dj01039.
BlackHatWorld: A Trail of Usernames
The user ddo88 on BlackHatWorld later changed their name to SepticFish—but traces of the original alias remain.
Posts by SepticFish include:
- Seeking contacts in the deepfake community (Feb 12, 2018)
- Launching a deepfake streaming site
- Hiring virtual assistants for uploading and managing celebrity biographies (https://www.blackhatworld.com/seo/virtual-assistant-to-create-and-write-biography-pages.1434722/)
All of this fits the timeline of MrDeepFakes’ launch.
Another Alias: dj01039
Another alias tied to David Do is dj01039, used on offshorecorptalk.com. In one post, this user asked for advice on setting up a private offshore company to run an adult website, mentioning CCBill and Verotel as payment processors.
This alias was also used on kernel-video-sharing.com, a commercial adult site script coincidentally the same type of script used on MrDeepFakes.com.
“David Do”
Using our OSINT tools, we identified a direct link between the username AznRico and the private email address [email protected]. Based on this evidence, we asked our collaborating journalist at Algemeen Dagblad to contact him via his private email. When confronted, David claimed that he had purchased the domain but had since sold it.
To this day, we have found no indication in WHOIS records that the domain was ever sold or transferred.
Deletion of Social Media Accounts
After contact was made through Algemeen Dagblad, both his YouTube and Instagram accounts were deleted. Fortunately, we captured screenshots before deletion.
Publication and Aftermath
On April 3, 2024, Algemeen Dagblad published their findings in collaboration with us: Link to article (AD.nl)
Since then, the MrDeepFakes team has remained silent and on May 6 the website turned dark.
This investigation into MrDeepFakes is just one example of how open-source intelligence and collaboration can bring truth to light. We will continue to defend the rights of individuals affected by digital abuse and we will not stop until accountability becomes the norm.