Behind a Secretive Global Network of Non-Consensual Deepfake Pornography

Warning: This article discusses explicit adult content and child sexual abuse material (CSAM)

One of the world’s largest online video game marketplaces says it has referred user accounts to legal authorities after a Bellingcat investigation found tokens to create nonconsensual pornographic deepfakes were being surreptitiously sold on the site.

Accounts on G2A were being used to collect payments for Clothoff, one of the most popular and controversial nonconsensual pornographic deepfake sites on the internet. Clothoff disguised the sales as if they were for downloadable gaming content.

“Security is one of our top priorities that we never compromise on, hence we have taken immediate action and suspended the sellers in question until we have investigated it fully,” G2A said, in a statement. “We also decided to report the case to the appropriate authorities.” (G2A said it was reporting the accounts and the companies affiliated with them to authorities in the “companies’ countries of origin” which, as this story outlines below, varies but includes the US and New Zealand.)

Clothoff is part of a loosely affiliated network of similar platforms uncovered in Bellingcat’s investigation.

The network, which also includes the sites Nudify, Undress, and DrawNudes, has variously manipulated financial and online service providers that ban adult content and non-consensual deep fakes by disguising their activities to evade crackdowns. Other services they have tried to exploit include Coinbase, Patreon, Paypal, Shopify, Steam and Stripe.

Behind one G2A account that was selling tokens for Clothoff is an IT solutions firm called Aurora Borealis Limited Liability Company, listed on the account’s contact page. On its website, Aurora Borealis claims G2A is one of its partners, which the gaming marketplace said is false.

Aurora’s CEO, a Valencia-based entrepreneur named Vitalii Ionov, did not reply to a request for comment, nor did his company. Ionov, as this investigation details, is affiliated with multiple entities that overlap with Clothoff and the network of deepfake porn sites. Another company he is listed as the CEO of has also falsely claimed to be partners with other companies, including Microsoft.

This investigation also uncovered a fake Clothoff CEO who was, in fact, an AI-generated image. The fake CEO notwithstanding, a trail of open source records reveals a loose network of real companies with real people attached to them behind Clothoff, Nudify, Undress, and DrawNudes.

The rapid proliferation of non-consensual pornographic deepfakes is an alarming phenomenon. Legislators in the UK recently made sharing such images illegal, while a bipartisan group of US Senators have proposed a law that would allow people to sue over them. Images of underage girls generated by Clothoff are currently the subject of a Spanish police investigation.

A recent report by independent research group Graphika said that there was a 2,408 per cent increase in referral links to nonconsensual pornographic deepfake sites across Reddit and X in 2023. A 2019 report by Sensity, a company that detects and monitors deepfakes, found that 96 per cent of deepfakes are non-consensual porn and, of those, 99 per cent are of women.

In this story, we take you through how we linked some of the biggest AI deepfake domains together, how we traced their illicit financial networks, and how we discovered the people operating in the shadows behind them.

Linking the Domains

Clothoff, DrawNudes, Nudify, and Undress all allow users to “undress” photos of any woman using AI, generating non-consensual intimate images of them. In doing so, they have racked up tens of millions of website visits in just the past four months. In the dozens of Telegram groups we found set up by these websites, some had as many as 800,000 followers. 

After examining the four platforms, we can reveal they are part of the same loosely affiliated network. We determined this by analyzing a web of myriad domains for each platform, finding a synthesis that bridged them together.

All of the four major platforms we researched have a dedicated second-level domain or SLD (e.g., Undress, Clothoff) and, out of that, each has multiple similar or duplicate websites across different top-level domains or TLDs (e.g., .vip, .io, .online).

This is illustrated below, where you can see some of the multiple TLDs of Undress.

We used DomainTools, a research provider that collects Whois and other Domain Name System (DNS) profile data, to identify which TLDs were registered by the four platforms and visited each site. Across all the domains belonging to Clothoff, Nudify, Undress, and DrawNudes, we found strikingly similar website layouts and designs. Several web addresses also redirect within the network of related platforms: for example, there are Undress domains that redirect to a Clothoff domain. There are also domains where a site bears the name of one of the other platforms within the network — for example, one site with Nudify as the SLD had an Undress banner on the site itself. 

Below you can see clear repetitions in the web designs used frequently across the websites, including across Clothoff, Nudify, Undress, and Drawnudes sites.

Overlapping information also appeared on the sites. While not every website listed a company or LLC as its owner, several of them did and there were commonalities.

Three companies in particular — BS Europe OÜ, GG Technology Ltd, and Itai Tech Ltd — were variously listed across the sites. Initially, it seemed that BS Europe OÜ was only listed on Clothoff sites, GG Technology Ltd on DrawNudes sites, and Itai Tech Ltd on Undress and Nudify sites. 

However, cached versions of the websites and their domains captured by Google revealed that older versions of at least three Clothoff sites also listed Itai Tech Ltd as their owner. 

The payment sites look incredibly similar, with three out of four even using the same image and text title. We used Chrome’s built-in developer tools to inspect each one, finding that they used the same template. As well, three of the four payment sites list the same company, Golden Falcon – FZCO, as their copyright holder, while another lists GG Technology Ltd. 

Given that so many of the web domains looked similar — and many were registered around the same time as each other — we investigated if there were any further connections in their hosting infrastructure.

Using the tool RiskIQ, we were able to look up the hosting history of the sites. While some of the domains are hosted on shared servers with thousands of other unrelated websites, we found that some were hosted on a dedicated server. The dedicated servers we found hosted a small list of domains, many of which were related to deepfake pornography. This was another clue that the same entity is behind the Clothoff, Nudify, Undress, and DrawNudes platforms and their various sites.

For example, for one of the dedicated server IPs, we found 35 domains that included “Clothoff”, “Undress”, and other similar domains (e.g., “deepnudify”) providing so-called nudify services. On this server, the majority of the domains also resolved on the same two dates in 2023, another indication that they are related.

We also found cloned copies of other AI websites on this server, such as an AI writing service that did not appear to have any connections to the deepfake network. We later found evidence that the cloned AI writing website was being used as a redirect to obscure payments.

Taken together, this evidence shows a strong correlation between Clothoff, Nudify, Undress, and DrawNudes, with their site architecture acting as a key clue in revealing their status as one shared network.

Unravelling the Video Game Scheme

Clothoff and DrawNudes collect payments through several third-party sites that are not traditional payment processors, concealing the true nature of the transactions and violating the terms of the sites.

Most notably, they used multiple gaming-related websites, among them a lesser-known site called Skinsback and the popular gaming marketplace G2A. In these cases, they pretend to sell and trade video game-related content but, in fact, taking payment for “coins” that can be redeemed to create AI pornographic deepfakes.

In the case of Skinsback, Clothoff used the site to facilitate trades of video game skins via the massively popular gaming platform Steam on their behalf. (“Skins” is a term for custom graphics that can change the appearance of something in a game, the trading of custom and added game content like this is part of a $50 billion market).

Bellingcat was able to determine this by navigating to the payments section of Clothoff’s website. Users were offered the option to pay via Steam.

When users clicked on the link, they were redirected to a URL on Skinsback.

The Skinsback URL asked a user to add funds to Clothoff’s account by exchanging purchased custom gaming content via Steam for Clothoff coins. In order to make the trades, they were asked to provide a URL from their Steam account that allows for the trading of gaming content.

After this story was published, Skinsback said in a statement that it had terminated Clothoff’s account and was conducting an investigation. A spokesperson for Steam said this form of trading “violates the Steam Subscriber Agreement” and that the company is also investigating.

While the Steam transactions facilitated by Skinsback involved the trading of gaming content, the transactions on G2A involved real money. Clothoff employs so-called “dealers”, or salespeople available 24/7 in chats for people who wish to buy coins to create pornographic deepfakes. They have repeatedly instructed buyers to pay them secretly through G2A.

Users were told to buy certain gaming keys from a reseller account on G2A and that, after this key was purchased, they would award the purchaser with coins in their Clothoff account.

One account making these sales on G2A has the username BestGameSale. It has amassed thousands of positive reviews and sales.

Bellingcat found another G2A account selling some of the same video game keys and using identical titles of the products they were selling.

That account has the username Battlekeys_com. Neither of the accounts replied to direct messages from Bellingcat. G2A said the accounts are under investigation.

“Only verified businesses can sell at our platform and we are making sure that they are legally compliant in every way, not just at the moment of registration, but also during their activity on the marketplace,” said G2A, in a statement. “Each seller undergoes periodic audits. Nevertheless, we are aware that situations like the one you have described are taking place by third-party agents.”

G2A also said that it contacted Clothoff, informing them “that all activities breaking law regulations are unacceptable for us. We also decided to report the case to the appropriate authorities.” When asked where these reports were made, G2A said it was making reports in the countries of origin of the companies in question (BestGameSale has a Delaware address on its profile, while Battlekeys_com lists a New Zealand address).

The AI deepfake network’s ties to video games don’t end there.

You will recall, as noted above, that a company called GG Technology LTD was listed on multiple sites across the network. GG Technology is also listed as the contact at the bottom of a video game skins website, CSCase.

CSCase also listed Ernst & Young’s (EY) Cyprus affiliate at the bottom of its homepage. However, a spokesperson for EY confirmed that the accounting firm, including its Cyprus affiliate, has no relation to or business with CSCase, GG Technology, DrawNudes, or any of the companies mentioned in this story. Their name was removed from CSCase’s website shortly thereafter. 

CSCase did not reply to a request for comment. 

It doesn’t end there. GG Technology was also listed on another website for selling video game content, Russia-based GGSel.net. GGSel currently lists a Russian LLC as its owner, but multiple cached pages of GGSel’s site on Yandex and Bing list GG Technology as the owner from March 2023 to May 2023.

Archived and cached pages site also shows it previously listed a company registered in Valencia called Intelligence Blockchain Solution SL — Spanish corporate registration documents show that Vitalii Ionov, a Valencia-based entrepreneur who will appear again later in this story, is its sole director. On his LinkedIn profile, Ionov, says he is a board member at GGSel.

Another gaming skins and content site being used to collect payments is IGV or iGVault. A Telegram bot asked users who asked to pay with “credit card/Apple Pay/Google Pay,” to instead purchase a “VIP Member” package from a seller called “AIPhoto” on IGV.

Over a week, this one account on IGV made around 200 sales for AI non-consensual image credits. IGV did not respond to a request for comment.

Enter Aurora Borealis

There is a single company listed on the profile of one of the G2A accounts that was making sales for Clothoff. Information about the firm reveals a concerning trail of evidence pointing to one prominent figurehead who may be behind the network of nonconsensual deepfake platforms that also includes Nudify, Undress, and DrawNudes.

On the “About” page of the “Bestgamesale” account an ‘Aurora Borealis Limited Liability Company’ is listed.

Aurora Borealis is incorporated in the US state of Delaware using a Registered Agent business that allows people to easily set up a company there. (Delaware is a noted haven for tax evasion and corporate secrecy).

On its website, which lists a phone number with an Atlanta, Georgia area code, Aurora says it is an IT solutions company. It lists G2A among its “partners”. However, G2A told Bellingcat that it has no partnerships with Aurora and has contacted them asking they remove the claim from their website.

The company’s CEO, Vitalii Ionov, is a Russian based in Valencia, Spain. Ionov is also listed as the CEO of a fintech company called IBS Tech. Both the Aurora and IBS Tech sites have a nearly identical layout.

On its site, IBS Tech also boasts of a partnership with G2A, as well as one with Microsoft. However, when contacted for comment, G2A said this is not true and Microsoft said it has no record of a partnership with IBS Tech. That makes two companies led by Ionov that have falsely represented themselves as partners of other companies.

Ionov, Aurora Borealis Limited, and IBS Tech did not respond to requests for comment.

Further solidifying Ionov’s connection to the network of deepfake platforms is the other G2A account that has been suspended for potential participation in illicit sales. That user, battlekeys_com, lists a company called Battlekeys Limited in New Zealand on its “About” page.

Battlekeys Limited’s business filings in New Zealand show that the company registered in 2017 and lists two Russian nationals, Ioulia Oundakova and Igor Klokov, as owners. However, the records also say that, as of 2023, the company only had two shareholders: Sergei Detsina and Vitalii Ionov, with Ionov owning 96 out of 100 shares.

Meanwhile, on her LinkedIn page, one of Ionov’s employees listed on the IBS Tech website says that she currently works for Battlekeys, establishing yet another link between the two companies he leads and the G2A accounts that were handling payments for Clothoff.

As mentioned above, Ionov says on LinkedIn that he is a Board Member of the Russia-based video game key company GGsel. GGSel previously listed GG Technology LTD as an affiliated entity on its website. GG Technology LTD, again, was also listed as an affiliated entity on the DrawNudes site. Altogether, this situates the various entities affiliated with Ionov within the network behind DrawNudes Clothoff, Nudify, and Undress.

Following the Money

It’s not just video game sites. The network containing Clothoff, Nudify, Undress, and Drawnudes also uses, or has attempted to use, over a dozen payment providers to surreptitiously collect money for selling “coins” to make nonconsensual pornographic deepfakes.

Most mainstream payment providers ban selling services that allow for the creation of nonconsensual pornographic deepfakes — many of them ban the sale of adult materials and services altogether. 

Key to avoiding detection from payment processors are the earlier mentioned “dealers”, who can be contacted 24/7 to facilitate secretive transactions by providing links to accounts that aren’t publicly advertised.

The process is fairly sophisticated, accepting a variety of different payment options depending on a site visitor’s IP address and country of origin. Dealers can provide buyers with multiple ways to pay for tokens through a large number of popular and conventional payment providers. 

Below you can see a sample of over a dozen payment options offered by Clothoff and DrawNudes, many of which were rotated in and out in recent weeks and months.

The dealers, in these cases, refer buyers to individual accounts and sometimes even fake websites that would generally be untraceable by or at least not obvious to most payment providers.

For example, one TLD of Undress, says it accepts payments with major credit cards. When a user opts to pay, they are redirected to another page hosted on a site called ‘AIGenerations.net’ that uses a payment processor called 2checkout.

In another example, a TLD of Nudify used Stripe to solicit payments with credit cards, banks, and even Cash App (the account stopped working after Bellingcat contacted Stripe). In this case, payments were redirected through a site called ‘GeneratePhotoAI.com.’ We were able to identify Stripe as the processor by using Chrome’s built-in developer tools.

In another case, a dealer on Clothoff offered an individual PayPal account to collect payment (the account was deleted after Bellingcat contacted PayPal for comment). 

In yet another case, a Clothoff dealer provided a link to a website, disguised to look like a computer repair site. The site ran on the ecommerce platform Shopify. Clothoff only used a Shopify domain and did not use the company’s services to process payments — instead, payment processing on the site was conducted through PayPal. The site was disabled after Bellingcat contacted Shopify.

The Clothoff, Nudify, Undress, and DrawNudes network also takes advantage of crypto payments and, for this, have variously used NOWPayments, Alchemy Pay, Coinbase, and Plisio. These services did not seem to use any redirecting tactic but rather appeared to take payments directly.

For example, when we selected the option to purchase coins through one of Nudify’s sites, they provided an identification code and linked us to pay directly with Alchemy Pay which accepts Visa, Mastercard, Apple Pay, and Google Pay. After clicking on the option to purchase coins via crypto for both Clothoff and DrawNudes, we were linked to a Coinbase account called “ClothOffAI.” Both domains used the same Coinbase account. Similarly, for Plisio, the same account name and photo are used. 

Coinbase is of particular note in this case, as it prohibits the use of its services for adult content and services. In addition, to appeal to users who may be hesitant to purchase cryptocurrency, one of the websites, Nudify, provides clear and thorough instructions on how to purchase and send crypto through PayPal. There is a strong push on these sites to move towards crypto, where there is less oversight on transactions. 

In another case, Undress uses Patreon, a subscription-based crowdfunding platform that lets online creators put content behind a paywall, to collect payments. A Telegram bot on the site instructs users to, sign up for a monthly, recurring Patreon payment and provides them with a redirect link that masks the referral to the site. In fact, the redirect website used is one of the domains we found on a dedicated server.

Patreon suspended the account after being contacted for comment. “Patreon has zero tolerance for pages that feature non-consensual intimate imagery, as well as for pages that encourage others to create or purchase non-consensual intimate imagery,” a company spokesperson said in an emailed statement. “Following a thorough review, the account reported violates our policies and has been suspended and removed.”

When we asked about paying through PhonePe, we were given a QR code linking to a different individual’s account that accepted Google Pay, Amazon Pay, and PayTM. By decentralising their payment systems, their money trail is well hidden and provides multiple layers of protection from both the payment processing companies whose Terms of Service they are violating and from investigators. These transactions would appear to be a regular activity to these processors. 

Hidden Figures and a Fake CEO

Perhaps the strangest discovery through this entire saga was that an AI blogging site hosted exclusive interviews with both the “CEO” of Clothoff and the “Founder” of Undress.

The interviews themselves read like ChatGPT responses to prompts or poorly written prose that no executive would consider a marketing coup. Even more interesting is that the headshots of these people appear to be AI-generated. This was particularly odd since the other interviews on the website appear to feature real people.

The owner of the website told Bellingcat that the photos were supplied to his company by Clothoff and Undress and that his staff conducted the interviews over e-mail without ever interacting with the subjects. He admitted one of the profile photos did appear to be AI-generated

He added that his site assumed Clothoff and Undress were credible companies given they have “press” sections on their websites claiming to have been covered in major outlets like The Guardian, BBC, ABC News, and Forbes (these claims do not appear to be true). After being contacted, the owner removed the Clothoff interview from the website and said the other is pending investigation.

The AI-generated CEO and Vitalii Ionov aren’t the only figures connected to the network. A trail of companies registered across the world revealed other individuals with ties to Clothoff, Nudify, Undress, and DrawNudes. It is important to note that, given different legislation in different jurisdictions, not all of the companies with links to the platforms can be fully assessed and many use virtual office services to set up an address in a specific country or state. 

Golden Falcon FZCO was listed on three of the redirect websites we found. This company is registered in the United Arab Emirates, in one of the free trade zones established in the country. Because of this, we were not able to look up who registered the company. During the course of this investigation, the website that Golden Falcon set up to host some generic information about the company was taken offline. 

Itai Tech LTD is listed on Undress and Nudify domains. It is also hosted on cached versions of Clothoff domains. It usually has the same London address listed on these websites, except for two sites where it lists a fake US-based address, but with the same UK postcode.

According to Companies House, the United Kingdom’s public registry of business entities, Ita Tech was incorporated in August 2023 to Anastasija Provotorova using an address with a virtual office based in London. This London address on the filing matches that on the websites. The filing lists Provotorova as the only owner. 

From this filing, we were able to learn Provotorova’s age and main country of residence, Latvia. Knowing that there are often different spellings between Cyrillic and English spellings of names, we searched for people who would fit with the information we did have across several social media platforms, including VK and other Russian-based sites. This led us to Anastasia/Nastya/Nastia Provotorova, a woman from Riga, Latvia who matches in age with the name on the filing.

Once we found her VK profile, we were able to locate her other social media accounts as she used similar photos throughout her profiles. Provotorova has recently relocated to Thailand and, according to her LinkedIn profile, is currently an investment consultant for a real estate company. 

She did not reply to a request for comment.

 
GG Technology LTD, which has come up multiple times in this investigation and is listed on DrawNudes, a payment redirect website, and several video game DLC websites. According to Companies House, it was incorporated in April 2022 by Yevhin Bondarenko, whose first name is also transliterated as Evgeniy and Evgeny in other places. This filing also matches the UK address listed on the deepfake and video game websites where GG Technology was named.

Notably, in June 2022, Bondarenko updated the address associated with this incorporation to a location in London, using a similar virtual service as Itai Tech LTD. Bondarenko is the only listed owner and sole director of GG Technology LTD.

Going off the original location information, age, and listed Ukrainian residency, we were able to identify Bondarenko’s social media profiles, which match his age, and location in Ukraine. Bondarenko identifies himself as a founder of an analytics company on his Instagram account and resides in Ukraine.

Bondarenko did not reply to a request for comment.

During this investigation, DrawNudes changed the company listed on its website to Sol Ecom Inc., which was incorporated in Florida in the United States in September 2021. This business has a single owner, Kyrylo Ivannyk, who initially used an address in Miami, Florida, and currently uses a mailing address in Los Angeles, CA.

We found an inactive business called Sol Amber Group LTD registered in the UK in his name, which also revealed his birthdate and Ukrainian nationality. Using what we know about Ivannyk’s name and this company’s name, we were able to identify a long list of other business ventures and websites run by Ivannyk, at least on paper, in the US, and the alternative spellings of his name, Kirill/Cyril Ivannik.

This includes a concrete business registered in New Jersey, a Muslim rosary and bead company registered in the UK, a digital marketing brand in New York, a line of male enhancement supplements, and many identically branded websites selling everything from pet toys to electronics.

Ivannyk did not reply to a request for comment.

Finally, on Clothoff’s main site, they list a company called BS Europe OÜ, a registered entity in Estonia. Matching up with the address listed on Clothoff’s site led us to an incorporation record of BS Europe OÜ, filed originally in February 2016 to a Serhii Cheromush. He is listed as the sole owner. 

Serhii Cheromush also goes by Sergey/Sergii Cheremush and has a large business and social media presence. Cheromush has multiple business incorporations in his name, including one called ‘BestSeller Group USA LLC’ registered in Florida in the United States. Cheromush is originally from Russia and, according to his Instagram, gained digital citizenship in Estonia in 2020 and moved to Los Angeles the year after. He appears to be active in the entrepreneur community, as well as interested in AI technologies. He recently hosted a meetup centred around using AI technology in different business opportunities, using an AI-generated image to promote the event.

Cheromush did not reply to a request for comment.

The Big Picture

It is abundantly clear that DrawNudes, Clothoff, Nudify, and Undress operate in ways designed to secretly funnel money through legitimate payment providers by faking who they are and what they are selling. They are also incorporated in ways to hide the identity of their operators, the people who are ultimately making money off of the production of nonconsensual deepfake pornography.

The four core sites, which appear to be part of a decentralized network, allow the sale of these dubious services to go on even if one payment provider or one payment processor goes down, and as the companies jump from one illicit sales method to another.

There are multiple redundancies and layers in the organization to prevent any lull in collecting funds, and the rising demand for pornographic deepfakes appears to have kept them on a growth trajectory. In fact, Clothoff is currently looking to hire more ‘dealers’ to not only keep up with demand, but to be available 24/7 to potential customers. 

However, these organisations have not perfectly covered their tracks. There are real people who have lent their names, and even their companies, to these platforms.

---

This story was updated after publication to include a statement from Skinsback confirming that Clothoff’s account on the site had been terminated.

Michael Sheldon and Nathan Patin contributed research.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Instagram here, X here and Mastodon here.