Operation Doppelganger: How Deepfake Porn Sites and Dark Web Forums Exploit Filipinos
One evening, a young woman in Quezon City received a string of frantic messages from her friends. A pornographic video had begun circulating in private group chats, and to their horror, it appeared to feature her. Shock and denial turned quickly into humiliation as she explained it wasn’t real. She had never recorded anything like it. But the video carried her face, grafted seamlessly onto another body, convincing enough that strangers began to share it as if it were authentic.
Her case is no longer rare. In the recent Senate Hearing on Deepfake Pornography, Deep Web Konek (DWK) presented the findings of Operation Doppelganger, a months-long investigation into deepfake pornography, nudification apps, and exploitative online forums. Today, we are making this report public for everyone. What it reveals is a rapidly expanding system of synthetic abuse, powered by AI tools and hidden networks, where the Philippines is both a target and an active participant.
By June 2025, DWK's Cybercrime Investigation Division identified more than 130 active “undress” and “nudify” websites. Marketed under names such as Undress AI, DeepSwap, and AI Nude Maker, these platforms promise to transform ordinary photos into pornographic images. DWK found entire directories grouping these services together, some listing over 170 porn-related AI platforms and more than 60 nudification tools. Some even highlighted “Pinay” as a keyword, signaling that Filipino women and minors alike are deliberately targeted. Using open-source intelligence techniques, DWK traced more than 3,000 links tied to such platforms, many of which advertise aggressively on Twitter/X clones, Discord-style communities, and adult forums.
What appeared on the surface web was troubling enough, but the dark web confirmed how deeply this ecosystem runs. Investigators discovered forums in the Tor network dedicated to synthetic sexual material. One, called xDArt, mirrored a standard online community but hosted thousands of posts trading AI models, nudification scripts, and guides to bypass content filters. In a single thread, more than 13,000 posts were dedicated to text-to-image pornography generation, while others focused on text-to-video tools. Subforums blurred the line between fantasy and reality, openly sharing childlike AI-generated material. Filipino usernames and references surfaced repeatedly, pointing to local participation in the trade.
DWK monitored these communities using controlled accounts, archiving forum data without engaging or distributing material. Metadata such as usernames, timestamps, and linked cryptocurrency wallets were preserved to map how synthetic sexual content was flowing across networks. The process revealed just how structured these underground spaces have become, with tutorials, automation scripts, and monetization models exchanged freely among members.
The tools enabling this abuse range from seemingly harmless “entertainment” nudification apps to advanced AI workflows combining face-swapping, nudification, and video morphing. In many cases, predators could take photos scraped from social media and transform them into explicit material within minutes. While some AI platforms included safeguards, underground forums provided instructions to disable them, effectively weaponizing mainstream technology for exploitation.
Alongside nudify services, DWK also documented the circulation of deepfake porn videos involving local celebrities. Since December 2024, more than 100 unique videos have been logged across Telegram channels and cloud-sharing services. The distribution process is systematic: private Telegram groups with hundreds of members serve as drop points, before the videos are mirrored into invite-only servers and packaged into torrents or downloadable archives.
The commercial side is equally organized. Some operators rely on freemium models, offering low-quality previews while charging for HD or exclusive content. Others run subscription systems, with payments ranging from ₱500 to ₱1,000 per user. E-wallet transactions linked to these groups confirm a steady flow of income, proving that deepfake pornography has shifted from fringe hobby to profitable business.
DWK’s workflow combined surface web reconnaissance with dark web monitoring. More than 130 platforms were logged and categorized, while forensic detection tools confirmed AI generation through telltale artifacts such as distorted hands, mismatched lighting, and unnatural facial blending. Actor profiling showed that clusters of repeat offenders were behind a large volume of activity, suggesting that relatively few operators drive most of the distribution.
The results of Operation Doppelganger reveal an unsettling truth: synthetic pornography has become industrialized, and Filipino victims are directly in its crosshairs. The involvement of Filipino users underscores that the country is not just a victim market but also an active participant in the global trade of synthetic exploitation. This creates a profound legal challenge. Current laws were written to address recorded material and are not yet equipped to prosecute crimes involving synthetic media. That gap leaves victims without protection and perpetrators with room to operate.
For DWK, the work ahead is clear: continued monitoring of this evolving underground, exposing its methods, and pressing for policy reforms, stronger platform accountability, and public education. Without urgent action, the Philippines risks deeper entanglement in a system where exploitation is not only digital, but increasingly indistinguishable from reality.
As part of our commitment to transparency, DWK is releasing this report to the public following its presentation at the Senate Hearing on Deepfakes.
Reference Links:
https://freeimage.host/i/KonDPus
https://freeimage.host/i/KonDr8X
https://freeimage.host/i/KonDgat
