Bellingcat

Bellingcat is an Amsterdam-based open-source intelligence (OSINT) investigative organization that uses publicly available data — social media archives, satellite imagery, corporate registries, data breach records, financial filings — to investigate war crimes, human rights violations, and AI-enabled digital harms. Founded in July 2014 by British journalist Eliot Higgins, the organization has grown from a one-person blog into a Netherlands-registered nonprofit with thirty-plus staff journalists and sixty-plus contributors. Its primary intersection with the AI-harm movement is a deepfake investigations unit that has exposed the operators behind several of the world's largest non-consensual deepfake pornography platforms, combining digital forensics and financial tracking to hold anonymous commercial operators publicly accountable.

Founding and open-source investigation model

Higgins launched Bellingcat after years of analyzing weapons-shipment footage from the Syrian Civil War on his personal blog "Brown Moses," demonstrating that open-source methods could yield investigative findings surpassing what reporters with formal institutional access could produce. Incorporated as Stichting Bellingcat (a Dutch foundation) with ANBI (public benefit organization) status — requiring that at least 90 percent of an organization's activities serve the public benefit — Bellingcat is headquartered in Amsterdam, with offices in Berlin (since 2021) and The Hague. Funders include the Adessium Foundation, Open Society Foundations, Porticus, the Sigrid Rausing Trust, the National Endowment for Democracy, and the Nationale Postcode Loterij, which awarded Bellingcat a €500,000 prize in 2019. Up to 45 percent of revenue comes from training workshops, individual donations, and Patreon subscriptions; the remainder from foundation grants. Bellingcat's major non-AI investigations — identifying the Buk missile unit that downed Malaysia Airlines Flight 17, naming the GRU officers behind the 2018 Salisbury poisoning, and tracing the FSB surveillance team that poisoned Alexei Navalny — established the OSINT model that underpins all subsequent work, including the deepfake track.

AI harm investigations — deepfake abuse platforms

Starting in 2025, Bellingcat built out an investigative strand focused on the commercial ecosystem sustaining non-consensual deepfake imagery. Each investigation applies the organization's OSINT methodology to identify anonymous operators of platforms that aggregate and profit from AI-generated image-based sexual abuse.

In January 2025, Bellingcat and the German broadcaster STRG_F revealed that MrDeepFakes — then the world's largest deepfake pornography marketplace, with approximately 650,000 members and 2 billion views — prominently advertised two AI applications: Deepswap AI, connected through multilayered Hong Kong and British Virgin Islands corporate structures to Nexgo, a Hong Kong Stock Exchange-listed Chinese fintech company; and Candy.ai, owned by Malta-based EverAI Limited. Following Bellingcat's inquiry, Google suspended DeepSwap PRO from the Play Store and Apple removed it from the App Store.

In May 2025, Bellingcat — in collaboration with Danish outlets Tjekdet and Politiken and the Canadian Broadcasting Corporation — identified David Do, a 36-year-old pharmacist at Oak Valley Health in Toronto, as a central administrator of MrDeepFakes, which hosted approximately 70,000 explicit videos with 2.2 billion total views. Investigators traced Do's identity through aliases across data breach databases, cryptocurrency accounts, porn forums, and warez sites active since 2008, cross-referencing credentials from public breach databases with IP addresses, account metadata, and public records. MrDeepFakes ceased operations on May 4, 2025 after Do was contacted for comment. His employer placed him on leave and initiated an internal investigation; the Ontario College of Pharmacists opened a regulatory review. The investigation coincided with the U.S. Congress passing the Take It Down Act, which criminalized non-consensual deepfake pornography distribution.

In December 2025, Bellingcat identified Mark Resan, a Hungarian national, as the operator of RefacePorn and DeepfakePorn — two deepfake abuse sites that generated over $331,000 in paid-subscription revenue between July 2024 and August 2025. Investigators traced revenue flows through the payment processor Peerwallet to a Canadian limited liability partnership (Dorocron LLP), matched shared Google Analytics tags across multiple domains, and correlated registrations through UK company records showing Facitic Ltd as the registered site operator. Both sites became inaccessible following Bellingcat's inquiry; Facitic Ltd filed for dissolution in November 2025.

Online Investigations Toolkit and training

In September 2024, Bellingcat launched its Online Investigations Toolkit — a free, collaboratively maintained directory of open-source investigation tools organized by category (satellite imagery, social media, transport, archiving), with descriptions, use cases, requirements, and limitations for each entry. The toolkit is explicitly positioned as shared infrastructure for the broader investigative journalism and human rights community.

Alongside the toolkit, Bellingcat runs paid training workshops for journalists, lawyers, and finance professionals, and maintains a volunteer research community that contributes to investigations. The organization has partnered with Utrecht University to establish an investigative hub where students conduct open-source investigations with Bellingcat support. Training revenue constitutes roughly half the organization's income alongside foundation grants.

Role in the movement

Bellingcat's contribution to the AI-harm movement runs primarily through the deepfake abuse investigations: original investigations that directly resulted in the shutdown of three major non-consensual deepfake platforms, the removal of AI applications from major app stores, and professional regulatory consequences for a platform operator. The investigative methodology — financial forensics, data-breach credential correlation, corporate-registry tracing — applies the empirical-audit-and-expose model developed by ProPublica and The Markup to the domain of AI-enabled image-based abuse. The Online Investigations Toolkit and training program extend this methodology to journalists and researchers globally, embedding OSINT techniques across the investigative community as open infrastructure.