Unmasking AI Nudifier Networks: OSINT Techniques from Bellingcat's Kolina Koltai

How an OSINT Investigator Documented the Israeli Army’s Destruction of Southern Lebanon

In this episode of Show & Tell, hosts Craig Silverman and Alexios Mantzarlis talk with Barbara Marcolini, a visual investigative journalist with Amnesty International.  In this episode, Marcolini shares her journey from journalism to human rights work, highlighting her expertise in geolocation, video verification, and reverse image search. Barbara discusses Amnesty’s work documenting destruction in Southern Lebanon through a combination of on-the-ground reporting and open-source intelligence.  What you’ll learn:  📍 How to find footage for location-based videos: Use a town or city’s Wikipedia page to check for every spelling variant across different languages and alphabets. 📍 The site:t.me [http://t.me] Google dork: Pair any keyword with site:t.me [http://t.me] to surface Telegram channels relevant to your investigation. Telegram is where a lot of conflict footage lives and isn't easily searchable from inside the app. 📍Building geographic intuition through Google Earth: Repeated geolocation work in a small area creates a working mental map. After enough passes you can recognize a village from a new video before formally geolocating it. 📍Using reverse image search as a discovery tool, not just for verification: Screenshot a frame from a video and run it through Google Lens — not just to confirm what it is, but to find other posts featuring the location. About Barbara Marcolini:  Marcolini is a five-time news and documentary Emmy Award winner and Pulitzer Prize finalist. As an accomplished visual investigator, Marcolini was a founding member of the visual investigation team at The New York Times and is now an OSINT researcher with Amnesty's Evidence Lab, investigating human rights violations and crafting visual stories.  Links mentioned in this episode:  * Israel's extensive destruction of Southern Lebanon - Amnesty International  [https://www.amnesty.org/en/latest/research/2025/08/israel-lebanon-extensive-destruction/] * How good are generalist AI tools at identifying public figures in videos? - Indicator [https://indicator.media/p/how-good-are-generalist-ai-tools-at-identifying-public-figures-in-videos]  * Follow Barbara on X [https://x.com/babimarcolini] and Amnesty International on Instagram [https://www.instagram.com/amnesty/] ---------------------------------------- ABOUT SHOW & TELL: Show & Tell from Indicator takes you inside digital investigations as leading journalists, OSINT investigators, threat analysts, and researchers walk through real cases they've cracked. Each episode features a recognized figure in the digital investigations community. They don't just tell us what they did — they show us. Hosted by Indicator co-founders Alexios Mantzarlis and Craig Silverman. Produced by Ethan McCarthy.

Unmasking AI Nudifier Networks: OSINT Techniques from Bellingcat's Kolina Koltai

In this episode of Show & Tell, hosts Craig Silverman and Alexios Mantzarlis talk with Kolina Koltai, a senior researcher and trainer at Bellingcat. Kolina has led investigations into AI nudifiers and deepfake pornography networks. Her work has contributed to the takedown of MrDeepFakes, the largest deepfake community on the web, among other impact. Kolina walked through two investigations: one tracing the payment infrastructure used by deepfake/nudifier sites to avoid getting cut off by mainstream processors, and another that followed domain connections, whois history, and a company registrations to identify the likely operator of ReFacePorn and DeepFakePorn. Along the way she demos the tools live — with Craig joining in on DomainTools. What You'll Learn: 📍 Following the money: How AI nudifier sites use gaming platforms, Patreon credits, and redirect pages to obscure payments from processors like Stripe and Visa. 📍 Connecting domains with Google Tags: How shared analytics tags can link a network of sites to a single administrator — and which tools to use (DNSlytics, DomainTools). 📍 Whois history as an investigative resource: Why historical registration records can reveal information that was later hidden. 📍 From domain to person: How Kolina used OpenCorporates and UK Companies House records to find a named individual tied to a network of deepfake sites 📍 Inspecting archived HTML: How the Wayback Machine captures not just how a site looked, but its underlying code — and how Kolina found email addresses in archived donate buttons on MrDeepFakes 📍 Managing leads across sprawling investigations: Kolina's workflow using Google Docs, and Hunchly to keep track of breadcrumbs and digital assets. Links Referenced in This Episode: https://www.bellingcat.com/news/2024/02/23/behind-a-secretive-global-network-of-non-consensual-deepfake-pornography/ [https://www.bellingcat.com/news/2024/02/23/behind-a-secretive-global-network-of-non-consensual-deepfake-pornography/] https://www.bellingcat.com/news/2025/12/15/mark-resan-reface-deepfake-porn/ [https://www.bellingcat.com/news/2025/12/15/mark-resan-reface-deepfake-porn/] https://www.youtube.com/watch?v=dTMaXVTtOdw [https://www.youtube.com/watch?v=dTMaXVTtOdw] https://indicator.media/p/indicator-guide-to-connecting-websites-together-osint-tools-tags-ids-favicon [https://indicator.media/p/indicator-guide-to-connecting-websites-together-osint-tools-tags-ids-favicon] https://indicator.media/p/web-capture-tools-hunchly-forensic-osint-ubikron [https://indicator.media/p/web-capture-tools-hunchly-forensic-osint-ubikron] https://discord.com/invite/bellingcat [https://discord.com/invite/bellingcat] https://bsky.app/profile/koltai.bsky.social [https://bsky.app/profile/koltai.bsky.social] https://www.instagram.com/kolinakoltai/ [https://www.instagram.com/kolinakoltai/]

Inside The Tools & Techniques That Exposed Facebook Transit Scams And TikTok's Polarization Industry

In this episode of Show & Tell, hosts Craig Silverman and Alexios Mantzarlis from Indicator talk with Clara Jiménez Cruz, co-founder and CEO of Maldita.es [http://Maldita.es], a Spanish nonprofit news organization that uses fact-checking, data journalism, and OSINT to expose disinformation and digital deception. Clara gave a hands-on look at three investigations that exposed how platform systems — not just bad actors — enable scams, monetized deception, and child exploitation. What You'll Learn: -The Transport Scam Network: How Maldita identified 1,075 Facebook pages impersonating public transit authorities across more than 60 countries. She showed the methodology (Facebook page transparency, ad library domain lookups, and DNS data) that scaled a tip into a global database. -TikTok's Polarization Industry: How hundreds of accounts used polarizing AI-generated political content to take advantage of TikTok's creator monetization program. -CSAM on TikTok: How Maldita found more than 5,200 AI-generated videos and 3,600 videos of real minors being sexualized on the platform. Clara revealed how TikTok's automated moderation failed to act on their reports, leading to a Digital Services Act enforcement investigation and a referral to Spanish prosecutors. Building Data Where There Is None: How manual spreadsheet annotation of Facebook page IDs and TikTok account IDs lets investigators track accounts that change names, measure coordinated creation times, and build findings that hold up to scrutiny. Working the Comments: Why looking at comment sections — not just content — is what cracked open the CSAM-to-Telegram pipeline. About Clara Jiménez Cruz: Clara is co-founder and CEO of Maldita.es [http://Maldita.es], a Spanish foundation and nonprofit news organization she co-founded with Julio Montes Moreno and grew into a powerhouse digital investigative outlet. Links Referenced in Episode: -Maldita.es [http://Maldita.es] transport scam investigation: https://maldita.es/investigaciones/20250716/transport-scam-network-international-facebook/ [https://maldita.es/investigaciones/20250716/transport-scam-network-international-facebook/] -Maldita.es [http://Maldita.es] TikTok polarization investigation: https://maldita.es/investigaciones/20260126/protests-ai-tiktok-money-polarization/ [https://maldita.es/investigaciones/20260126/protests-ai-tiktok-money-polarization/] -Maldita.es [http://Maldita.es] CSAM/TikTok investigation: https://maldita.es/investigaciones/20251211/predators-tiktok-goldmine-pedophiles/ [https://maldita.es/investigaciones/20251211/predators-tiktok-goldmine-pedophiles/] -MyOSINT Training free bookmarklets: https://tools.myosint.training/ [https://tools.myosint.training/] Subscribe & Follow Indicator: Free newsletter: https://indicator.media/ [https://indicator.media/] Social: https://bsky.app/profile/indicator.media [https://bsky.app/profile/indicator.media] Email us: editorial@indicator.media [editorial@indicator.media] Hit subscribe to never miss an episode!

Using Internal Docs, Burner Accounts and Ad Library Research to Expose Meta's Scam Ad Business

In this episode of Show & Tell, hosts Craig Silverman and Alexios Mantzarlis sit down with Jeff Horwitz, investigative reporter at Reuters. Jeff shares how he showed that Meta has earned billions of dollars from online scam ads—and how he used the company’s own ad system to prove his point. Jeff details how he combines leaked internal documents with hands-on experiments, including running his own "scam" ads to see how Meta’s AI tools would react. You’ll hear how Meta’s generative AI didn't just approve his deceptive ads—it offered suggestions to make them even sleazier. What You'll Learn: * His Approach: How Jeff uses document analysis, quantification methods, burner accounts, and internal sources to uncover stories. * The Scam Ad Experiment: Jeff explains how he partnered with Meta's own "trusted" ad agencies in China to run ads that explicitly violated platform rules. * AI-Enhanced Deception: Learn how Meta’s LLMs suggested high-pressure copy like "guaranteed profit" and "tired of living paycheck to paycheck" to improve scam performance. * The "Black Box" Problem: Why even internal Meta staffers often rely on setting up "clean" test accounts to understand what their own algorithms are doing. * Sourcing via LinkedIn: Jeff shares his "old school" but effective outreach tactics using LinkedIn Sales Navigator to find sources within big tech. About Jeff Horwitz: Before joining Reuters, Jeff covered Meta for The Wall Street Journal where he broke major stories on child exploitation on the platform, Instagram's negative impact on teen mental health, facilitation of human trafficking, and the amplification of political violence. His Facebook Files investigation used internal Meta documents to expose systemic issues across the company's platforms. Episode Highlights: * [1:46] Introduction to Jeff Horwitz and his investigative work * [4:47] How Jeff started investigating Meta's ad scam problem * [7:37] The power of documents in investigative journalism * [37:25] Meta's response to the scam ad reporting * [39:30] Lightning round: Jeff's digital tools and investigative methods