Latest / Show & Tell from Indicator / Unmasking AI Nudifier Networks: OSINT Techniques from Bellingcat's Kolina Koltai

Transcript

Unmasking AI Nudifier Networks: OSINT Techniques from Bellingcat's Kolina Koltai · Show & Tell from Indicator

• Craig Silverman: Hey welcome to Show and Tell, the podcast from Indicator that takes you inside digital investigations by leading journalists, OSINT investigators, threat analysts and researchers. I'm Craig Silverman. Alexios Mantzarlis: And I'm Alexis Mancelis. Indicator.media is a resource for professionals and citizens who want to understand and investigate digital deception. If is the first time you have heard about us, we hope you'll check out our investigations and workshop. Craig Silverman: And you can also sign up for our free newsletter using the link in the show notes or by of course going to Indicator.media. You can also hit subscribe below to make sure that you don't miss another episode of Show and Tell. Alexios Mantzarlis: Today we're talking to Kolina Goltay, a senior researcher and trainer at Bell and Cat. Kolina has a PhD from ⁓ School of Information and worked previously the Center for an Informed Public ⁓ at the University of Washington and ⁓ briefly the platform then known as Twitter. Hi Kolina. Kolina Koltai: Hi, thanks for having me here today. That's a good, that's a good coverage of my CV. Alexios Mantzarlis: I feel like there's an easy way to express when people work to the platform by using the name, which is a good one. ⁓ ⁓ % like friends, yes. ⁓ Kolina Koltai: Yeah, it's like Prince, like the artist formerly known as Prince, it's the platform formerly known as Twitter. Craig Silverman: And this, by the way, is Rosie because I feel like she is insisting on making an appearance in this episode. So this is Rosie. She is really hogging the limelight here, but I don't think anyone will object. Yes, she is actually quite good. I will attest to that, yes. Alexios Mantzarlis: Yeah An investigator of mice. Yeah. So I first came across Colleen's byline when I was still at Trust and Safety for Google. ⁓ was investigating the then rising and now unfortunately very established phenomenon of AI nudifiers. And I'd read this incredible investigation on the ever more creative payment infrastructure that ⁓ tools of abuse were using. So a little premise for those lucky enough not to know what nudifiers are. They are websites or apps that can turn any photo you upload into a nude version of that photo and so recreate the realistic looking naked body of the target. These sites have become more more sophisticated. They turn photos into videos at scale. Some of them can scrape all of the images from a victim's Instagram account. They're awful. And we've found that they make millions and reach millions on indicator through several reports. Bell and Cat, which is a nonprofit investigative outlet that hardly needs an introduction, hopefully, done some really impactful work and Kolina has been leading a lot of it. across, obviously, team's work, you all unmasked the operators of both nudifiers and the websites where this stuff is sometimes hosted and streamed, most notably Mr. Deepfakes, which given that this is going to be a pretty ⁓ dark place we're going to. Can we celebrate that Mr. Deepfakes has been down? Yay, has been offline for now almost a year, I guess, right? May last year, I think it was when I went. So there are some victories. And think that work like the one that Kalina and Bela Katu are behind and the reason for some of these victories. So we'll a link to our reporting in the notes to Kalina's work, but I'm excited to dig into some of your ⁓ reports. Kolina Koltai: Yay. Alexios Mantzarlis: investigation specifically, but before we go into the details, can you tell me a little bit about like how and why you kind of came across this piece, this field, why you've ended up covering it and kind of just how you have with the space, I guess. Kolina Koltai: Yeah. before I even do that, I want to just call out that this work is still really impactful. Like said, the Mr. D fake sites has come down. Almost always whenever we report on a site, it results in the site getting shut down or slowly dying a slow death because people don't interact with it, it becomes toxic. You make it so people can't do that business anymore. So the work is impactful. Even if you feel like it's a small company or a small portion of the millions and millions of sites, and it does feel a little bit like whack-a-mole. it's really impactful work. But ⁓ kind of got into this, I feel like, as ⁓ a fluke. I ⁓ that's kind of how people find their own things. ⁓ When ⁓ started at Bellingcat, I was trying to figure out what do I want to start reporting on, what do want to have an interest on. And just a whim, ⁓ if will, I was browsing Instagram, and I saw an account, and I was like, this is, I think, an AI image. And AI imagery was Alexios Mantzarlis: Hmm. Yeah. Kolina Koltai: kind of like starting kind of to get more popularity. But at the time, most AI images you imagine would have like lots of fingers, a lot of inaccuracies. And I was like, this is actually pretty good quality. If you spend a little more time, you looked at the images of this woman from photo to photo, you'd be like, OK, there's some inconsistencies here from image to image. But like I think at first glance, most people wouldn't have immediately clocked it as an AI image. And this is like 2022. So this is, before I think a lot of AI nudifiers were getting a lot of coverage. So initially began investigating the Instagram accounts that were using AI images ⁓ quickly discovered the ⁓ existence of AI nudifiers, which I had no idea. AI imagery and AI gen had been talked about, but very little on ⁓ the of taking a real person's face ⁓ and ⁓ the on it or generating a whole new image based on how this person looked like. So that I thought was an awful and horrible use of AI. I'm already not a huge fan of it, but this made it far worse. And I was like, okay, I'm just going to start reporting. found this site. I'm going to look onto it. And you start finding one site and then you find another, then you find another, and then it just becomes this whole big network and seemingly endless amounts. And I want to say that there is less sites than there was back in 2022, but that's not the case. Because as soon as one pops up, there's another one, like three more like Hydra-esque where they'll come up in its place. Alexios Mantzarlis: Yep. Kolina Koltai: And everyone's trying to get into the space because there is so much money to be made in the space. It's no better time than I guess to be a scammer or to try to like monopolize on like AI-generated technology, ⁓ because there's also lot of like lack of regulation in the space. So until the situation improves, I probably will still continue to work on this because there's not enough people still that work on it. think anyone that works and writes on this that helps kind of get these sites shut down, adds accountability, puts pressure on platforms and large tech companies to do something about it. I think just all helps. So it's all good. That's probably a long answer to your question. Craig Silverman: No, no, that's great. And it's kind of familiar in the sense that this is often the dynamic with these platforms is that nothing ever gets really fully stamped out, right? And so if the criteria as an investigator is like, I need to know that this will completely go away in order for me to work on it, like good luck, that's never gonna happen, number one. It is an interesting area though, in that, I mean, there's no partisanship around this. Everybody from any political party, platforms, everybody agrees this is awful, we don't want it, and yet it persists, you know, for a variety of reasons. And I'm curious, you know, on knowing those dynamics, knowing that it'll never fully go away, but you do see your wins, what are you sort of focusing on ⁓ understanding dynamic, that it'll never fully go away? So like, what is your kind of North Star? What are you really thinking about and driving you to keep doing this work? Kolina Koltai: great question, especially because it's like, you know, very much you can't put the toothpaste back in the tube kind of thing. We can't go back in time and undo it. It's always going to be around. That is going to be reality. I'm not so naive to think that we can stamp it out forever, but we can add friction to the process. And when I talk about friction, and there's lots of different solutions, there's lots of interventions, there's things we can do from across the board in a variety of different fields that make it harder for these sites to exist, for people to profit off of it, and for the technology to become easily accessible. Alexios Mantzarlis: Mm-hmm. Kolina Koltai: you take this for other of like anti-social type behaviors or businesses, you imagine things like animal trafficking ⁓ gun running or drug sales, those things are always going to be there, but by because having things like laws and regulations, ⁓ a variety of things that makes it harder and harder for those businesses to succeed and to profit. You're going to try to push things to make it harder. ⁓ lots of ways we can add friction. ⁓ One is currently it's not illegal to own and operate these websites. Like there's a major gap in legislation for it. So there's been more laws put in place. If you talk about the US or even like globally that, you know, creating and distributing this content can kind of fall under like revenge porn laws ⁓ ones that are specific around AI creating an AI ⁓ of someone and distributing it. can't be like you can sue that person, but that's also really difficult. It puts again the onerous on the Alexios Mantzarlis: Yep. Kolina Koltai: A person does not only identify who's the person responsible and proven at court and then sue that person, which is a lot of work for the victim. And oftentimes in these cases, you don't know who the person is who's creating the content, ⁓ the malicious content. So I think where there is a major, major gap in just legislation. I think from tech companies, they have the ability to absolutely just decide not to host it. So if we talk about like web posters of these sites, there's lots of sites out there I can name drop or not name drop that will host these sites because... Alexios Mantzarlis: ⁓ that's name drop. ⁓ Kolina Koltai: Cloudflare, I was going to say Cloudflare. There's one of the big ones. But if the sites are harder to host or you go to a sketchier site or other places, Cloudflare could choose just not to even host these websites at all. Because if people have not done this before, you can go or a teenager can go, take your credit card, go and Google or any other search platform. That's not going be Google, but go and find AI Notifier, go on Telegram, go to anywhere. They get ads on Instagram, right? for it, like they can go to any sites, make a purchase for a dollar or two dollars, then within minutes, create a fairly convincing fake nude of any woman they want, whether it's sometimes an adult woman. In a lot of cases, it's actually of like younger women, of minors. So it's creating of CSAM, which is child sexual exploitation, or sorry, abuse materials, assortment to CSAM. So, and I think that's kind of like been like the pivotal point we talk about like. when things have actually gotten done is when it's very clearly a child. I think that means a lot of adult women aren't protected. I think it's absolutely of course if it's a 14-year-old. But there's been lawsuit after lawsuit. And the way that these sites are also obscured makes it hard to get any accountability. ⁓ I think. laws and legislation and all that as one component. think absolutely these platforms are just like spending more time and investing and making sure that content's not advertised, it's not hosted, they're not able to be found during search results, things like that. Those are all added things to the friction. And then there's also the payment processing component because ultimately, I think for most people who are in that space are in it because they want to make money. They're not necessarily in it because they absolutely love... deep fake pornography, that's like their main passion in life. It's because they want to make money overwhelmingly. They might enjoy the content themselves, but the goal is if it's not going to make them money, they're going to invest their time elsewhere. And so any process we add to or any component we can add that adds friction and makes it harder and harder to make money that way. Even if it's like pushing people to just using crypto. because there's no regulation on crypto. That's already a huge barrier. I've hung out in Discord spaces and online space where people talk about it, and people are still today really hesitant to sometimes use cryptocurrency because they worry they're going to get scammed. They send money to some account and they never hear back. so that's already a barrier to entry of friction in that process. So knowing that even you can't stop it out on everything, there are so many easy wins we can do that... make it harder for these companies to survive, for people to profit, for the content and spread, for people to get access to the site to do it. It's just there are lots and lots of opportunity and lots of work to be done in that space. Alexios Mantzarlis: Yeah, I hate the argument, ⁓ they will move to the dark web. My answer is let them, let them. It's going to be a smaller impact area. Let them go like it's insane. We've seen historically, the platforming, affects the reach. It's just easily and transparent and obvious when you're getting them off of billion user ⁓ and moving them to harder ⁓ to reach. So anyway, let's... To close this introductory segment, like as Kolina said, we want more people covering this, join us. The more the merrier, frankly, calling these tools out, there is impact to be had. There is unfortunately a huge catchment area. And what I found, both collaborating with Kolina and others, is that this is a beat where there is no jealousy among reporters, among investigators. Like we all want this stuff gone. We're happy to share lead lists. We're happy to share. camaraderie on this problem because we recognize how big it is. with that said, I'd love to jump into the I would our origin story, except it was just me discovering you. had no clue who I was. ⁓ But ⁓ article wrote about how I think it was, I want to say cloth of at the time was ⁓ using a range of ⁓ creative payment infrastructures, including gaming platforms and others make sure that they were getting money for products. And you money ⁓ moves this industry we've found. estimate that they make millions. You found budgets in the hundreds of thousands or millions as well. can you walk us little bit, kind of this article that we'll put in the links. you were able to A, connect domains tied to the Nudifiers because there's obviously a whole lot, are Hydra-esque was your word, uncover how you saw that they were using these kind of creative payment processes and then how you're also able to find kind of named individuals that were associated to it because ultimately naming and shaming also works, right? Like people... not want their names associated to this stuff because thankfully it does have a reputational cost. So maybe we can start with the payments element, walk us some of that if you want to show ⁓ tools, whatever, you want to do this. Kolina Koltai: Mm-hmm. Yeah. Sorry, I just realized I think we're missing an L on the belling cat. I think it's... I'm sorry, I think I just recognized that. So yeah, I think we need two Ls for the belling cat and the thing. Is it a double L officially? Sorry, just noticed that. Okay, so... Alexios Mantzarlis: ⁓ no! Okay. Is that? It's been double L. There we go. Craig Silverman: Alright, it's been double L'd. Yes. ⁓ Kolina Koltai: Yeah, you know what, I really am a big fan of that piece. That was like a really big... There's so much we actually didn't even include in that ⁓ because it was, think, not only one of the first reporting, we were like scooping other people at the same time on that kind of reporting because people were just kind of getting ideas of all these like big sites like Cloth Off, Undress, Nudify. Like those are some of the brand names, but there's also variations on those sites. And so what it's going to sound very simple. But essentially, I created a fake user account. I joined the sites with an email and said, all right, if I wanted to pay, how can I pay? thing I realized very quickly is that depending on which country I put myself in, so I use a VPN and I'll sometimes change my country location, there's different payment options. There's ones that are specific to Europe, ones specific to the US, ⁓ various countries. So you can explore ⁓ ways. And I thought it was really interesting that beyond just using something like PayPal or Stripe, they had some really unique options. And in particular, it's really sometimes hard to get away with using something like Stripe or PayPal because those payment processors do explicitly say, we do not support that. ⁓ that wants to use a Visa doesn't because Visa, MasterCard, those cards, do have laws, not laws, they do have regulations and it's against their terms of service to do it. And they really just do not want to be associated with it. they use a lot of deceptive ways. This might sound silly, but one of the ways that they have is they have a chat bot, a chat person you can talk to and say, ⁓ hey, you this person, they're going to help you and they're going to send you a link for payment. We just went in there like, hey, I would like to make a payment for this amount of money. I live here and they send you a link. The link they sent you was, in this a link to a video game web, ⁓ a site that video games and other like related currencies and things like that. ⁓ so like buy this game, this digital game, ⁓ we will give you coupons. And I know it doesn't seem like ⁓ deep, crazy investigation, but that's simply what it was and no one else had reported on. So sometimes just doing the really simple thing doesn't require any fancy tool besides maybe a... ⁓ Alexios Mantzarlis: going through the motions of a user, right? Not observing it from the outside, but actually behaving as a potential end user. And ⁓ you find through that piece that ⁓ gaming platforms were responsive to this stuff happening on their ⁓ surfaces? Were able to get feedback on taking things down or disabling the accounts related to these payments? Kolina Koltai: Yeah, exactly. Yes and no. when they're really, kind of use, I don't want to say obscure, but they use these sites that were not very easy to contact. We had to create accounts and act as a customer to be able to talk to someone. What I've unfortunately found is like some of the sites that are the accounts that we identified as selling these sort of like in lieu goods, these digital goods are still up and going. They said they would do an investigation and shut it down. And then of course. Alexios Mantzarlis: Hmm. Mm-hmm. Kolina Koltai: I think things temporarily stopped and then they came back again, which is unfortunate. But it's just, it kind of shows that there is a, in addition to like the gaming ones, there's been, there are other, there are so many different ways in which people were used. These sites were using third party platforms. So they were using something like Patreon. used, where they were like, oh, you buy these digital goods, support us on Patreon. Normal site that a lot of people use to support. And they're like, buy this thing. Alexios Mantzarlis: Mm-hmm. Kolina Koltai: and then you get the credits. Or it would be another sort of ⁓ gaming credit site. buy this digital good, so you don't have to even worry about shipping anything or doing any of that and get transferred it. So there are so many different ways that we conduct transactions online that if ⁓ one down or one gets burnt, it's almost like inconsequential. I don't say completely inconsequential because there is like a cost in setting it up, but it makes it a little bit that much harder. And I think that's what added it to my, they've had to like limit a lot of those. So if you go on a cloth off site today to go try to make purchases, those ones aren't necessarily ones available anymore. Cause I think our reporting and our pressure to do that has made it so those aren't viable avenues. And so it's still unfortunate that, know, I don't want say it's unfortunate. I think it's like, I of course would love to see a site like that shut down cause they are a pretty large site. But we've made it harder to, to, for them to make money off of it. Craig Silverman: Thank you. ⁓ Kolina Koltai: And now if you go to crypto, there's always going to be a crypto option, but I think that's still a little scary for people. would hope that... Hold on, let me back up. I think what's useful and kind of shows about some of this process is that it's actually, I don't want say it's not that difficult. I think anyone could do this process by just finding and following the path of how you go through this. I personally haven't done any physical purchases, but if people were to do it at purchase... you get ⁓ something that shows up on your credit card transactions as what did this come from? If you're purchasing something, there is another bit of record. There's lots of bits and data to this process lets you find clues. Another way that we did in our investigation was actually looking at through their credit card options. If you're like, hey, you can want to use your credit card, put it in here. And one thing we noticed when we clicked that button, even though we didn't go through the entire process of making a purchase, is that it would redirect us through a website and then take us to a checkout page. And if we're not paying attention, that could happen really quickly. So what we would look at is look at the URL bar. And very quickly, it would go to one page, and then it would go to another, and it seems like a checkout. And so it'll be a checkout page for something like a flower website or for a motorcycle handbook or really innocuous stuff that would be some sort of digital good. Alexios Mantzarlis: Yeah. Craig Silverman: Thank you. Alexios Mantzarlis: No. Craig Silverman: Hmm. Kolina Koltai: that you're making a purchase for that wouldn't get flagged either on like say Stripe or PayPal site and neither on your credit card because on your credit card it'll be like you're buying something from like a motorcycle place for like $30 you know. Alexios Mantzarlis: Yeah. And these intermediary sites are used for sign-on purposes too. Like the Google single sign-on, which is offered on many sites, often goes through an intermediary site that's something like, think for cloth office called like Greek yogurt dot CBD or whatever. So like there, there's a lot that can be, that can be done through that, looking at that. even just outbound traffic monitoring on ⁓ like similar web, which is, ⁓ some part of that is free, like seeing where some of that traffic goes can capture some of those domains. Craig Silverman: Yeah. Alexios Mantzarlis: payment domains. Very cool. Kolina Koltai: Yeah, absolutely. that, again, doesn't take anything that's too crazy, a tool that's not paid for. It's ⁓ sometimes just doing that and then letting, say, like a payment processor know it gets a shutdown quickly, and then they have to start all over again. And so adding friction, adding to that process, reporting it to the payment processors is... Obviously, there was a fair amount of stuff I have not reported on that I'll sometimes just message someone at the payment companies, and they'll get it very quickly shut down. I know sounds bad. I shouldn't just ⁓ about it, but it is a way to do a little bit good in the world, I think. Craig Silverman: I mean Alexios Mantzarlis: Yeah. Craig Silverman: Well, look, mean, this is, as we said before, this is an objectively bad thing that everybody agrees is a bad thing. So I think you're allowed to giggle. think that's fine, you know, when you get them booted off. And I mean, this sort of goes to what you mentioned before as well, which is that the motivation here is money. And if you choke off the money, the chances of them actually abandoning it and trying another scheme is increased. it's arguably like, if not the one of the best. Kolina Koltai: You Alexios Mantzarlis: Thank you. Craig Silverman: pressure points to go for. so, so kind of sticking with that, you know, you also follow kind of breadcrumbs related to the payment infrastructure for to ID the likely operator of a couple other deep fake sites. There was reface porn and deep fake porn. It got you also got you some insight into their revenue. ⁓ you having talked about that method, what about those sites? Was it the same thing with them? Was it a little bit different? You know, and, and ⁓ we sort of In terms of the concerns around OPSEC, like you said, in many cases, you aren't actually going through the transaction. You're watching the URL change. You're watching redirects. seeing who the processes are. But ⁓ do you think about the operational security aspect? And if you've ever made purchases, ⁓ do you deal with it there? Kolina Koltai: Yeah, absolutely. think ⁓ that one is a pretty fun one to work on just because, you know, I think ⁓ once started digging into those sites, ⁓ I like a number of sites. We really kind of focused on those two because they got the most traffic, ⁓ but person owned a variety of other sites. And there was so much that guy did wrong. think about if I were to create a site, I would have done a better job than he did. But one of the things is that because, as I mentioned, it's a lot of major credit card companies and payment processors don't want to accept this kind of content. But there are ones that do or brand new startups that do. And so one of the payment processors guys was using for a period of time, not for the entire time because they oftentimes have to switch because one will get ⁓ cut off and you'll switch to another one. did this in a particularly interesting way. So the payment process that we went through for these sites, as we go and create a user, say I want to make a purchase, you have an account, and they're like, OK, cool, we're going to email you a link to make this purchase. And I was like, ⁓ email. So now I even have a nice record. And of course, the email comes from a different site, some other innocuous AI site that has nothing to do with So I'm like, OK, here's another clue. Now I have another domain. But what was really interesting is that the payment processes they use, since it was kind of a startup guys, they weren't really probably thinking too much about OpsSec, ⁓ that you would say like, ⁓ you're making payments to this account. And I would click on that button ⁓ it would take me to the transaction history. So you can look at the history ⁓ this account and this user that you were making transactions. And I was like, ⁓ way. ⁓ didn't even need to really... ⁓ Craig Silverman: So this is like Venmo, but for a sort of, you know, major payment processing kind of thing. Yeah. Kolina Koltai: Exactly. You could see so much information out there this. ⁓ don't know why they decided to do this in case you wanted maybe transparency to each of the individual users, but it had a long list of all the domains that they were approved to do transactions, which included, of course, those ⁓ None of them were explicitly the deep fake ones because those probably wouldn't have been approved, but these intermediary redirect websites. It had the guy's name. It had ⁓ his information. ⁓ directly to his Skype. And it also had all the transactions. So you get to see the transaction data. Surprisingly, not just the numbers of how much each transaction was approved or not approved, but you could even see the names of the people who are making these transactions, which, of course, we didn't put into our story. But there was a ton of data. So we could see how much money this guy was making from most likely only deep fake pornography sites. And these are sites very clearly. They're not subtle. Reface porn, deep fake porn, you go to the site and it's like an image or video of a woman performing fellatio and her face switches to different faces. No level of subtlety. Very clear this is the site is designed to do. And so you're seeing that he's making hundreds of thousands of dollars. And this is just, again, one payment thing. So when you go to the site, they give you usually a litany of different options because if one gets shut down, someone's going to try another way, multiple ways. So they do this in multiple sites. Most of the sites don't just have one way of accepting payment because if that gets shut down, they're no longer to make money. And so yeah, that was just one way of doing that. So by going through this process. But there's lots of other ways because ⁓ just ⁓ before publish anything, we do so many different checks. We have so many different things because this could be really damaging. It's still the really, really taboo thing to say, ⁓ I a purveyor and an ⁓ owner of a site that generates this kind of content that most people consider to be an anti-social type thing. This is not a good thing. I find that there's only probably a few trolls online. They're like, yeah, this is great. So knowing that, you want to be able to obscure your identity. And so there's a lot of other tools and resources that we do that are almost like you would use for any other investigation. And we can walk through some of those right now if you guys like, which could be kind of Yeah. So there's lots of different ways. So let's see. Alexios Mantzarlis: Yes, let's. Craig Silverman: Sounds good. Let's get to the show portion of the show and tell. Absolutely. Yes. Kolina Koltai: Okay. So hopefully we can all see this. This is one of the tools that use called DNSlytics. ⁓ And so one thing I do for like a site or any site, in particular, it's just start looking at a variety of different ways. One thing I like to look for is something called a Google Tag. And so if you're not familiar with the idea of a Google Tag, think of this as a bit of code you embed on your website that allows you to track different analytics of about your visitor rate, how long people are staying. It can help you track for ads, a variety of stuff. So a lot of sites have it, and they're usually pretty unique to the person. So you don't create a Google Tag for each individual site. So you might be one person that has multiple sites and you put the same Google tag on all those sites. So this is just one tool that will do this. So imagine I put in reface porn.com. So I would do is I would look at the hosting history. If you're to try to go to this site nowadays, the site is ⁓ offline as a result of our reporting. But there's still historical information we can look. Yay. And they're still offline, which is great. So one thing I do is I'll look up at the history for a site like this. ⁓ And you can look at the history. So it'll sort of scrape and track over Alexios Mantzarlis: Yay! Kolina Koltai: kind of tags ⁓ analytics purposes ⁓ on this domain. ⁓ this, we can see that there have been two tags, ⁓ one GTM and one UA, and this is partially because ⁓ did update their tag system. ⁓ was something that Google inherently did. ⁓ first thing I would do is I would take a first tag and I would say, okay, I'm interested just because we know that these tend to be unique is we will look up if anyone else has used this tag. I'll put in the tag itself. And this already gets me a little bit of leads. Sometimes it doesn't lead anywhere. So I know that this tag has appeared on refaceport.com, which we already knew, and a site called eshopme.com. If you go check it out, it doesn't really load. You might use the web archive to look at it. And it may lead you to a lead, but sometimes it doesn't, which is part of the investigative process. But there was a second tag there. So I was like, all right, let's look at the second tag. ⁓ and now we get to see a few more things. So one thing we can clearly see is that both reface porn and deepfakeporn.app use the same Google tag. And we can see when they were first seen and when they were last seen. And in addition to that, we see a few other things. So we have a site that's called facidic.com, vrface.app, facechangermain.xyz, and then facidic again using this tag. And so now we've really got this idea that, There's a few sites here that are probably linked together. It's probably the same administrator or someone who ever built the website put this tag on there. But then that may not necessarily always be enough to link it together. There's other clues. But this is where we kind of start off. I also find that this is really useful for identifying networks. And so what we could do then is go to one of these other sites. And so what I might be interested in is unfortunately this tool does not give me a history of who is ownership. And that is another way in which we look at it. So we look at it. We try to identify history and connections. There's a lot of other ways to do this, but I find Google Tags is a really useful starting point. And I actually think it would be kind of fun if you guys wanted to experiment and use a tool that I think you guys have, which is domain tools. When we do workshops and we teach, it's not just always me demoing it. I always find that people learn the best when they get to do it. So I don't know if you guys want to do part of the investigation with me. Craig Silverman: Yes, I mean, that sounds awesome. So I do have a domain tools account. I am a huge domain tools and Iris fan. ⁓ It's their investigation platform. And I will note for people who are that if you are a journalist, Domain Tools has a sort of grants program for journalists ⁓ for society organizations where if you apply, they will often quite happy to give you access. I also, so as I sort of load that up for me, I also just want to note for people, so you talked about how ⁓ there are different types of Google tags, right? There's like GTM, there's G dash, there's UTM dash, there's PUB dash. For folks who are in kind of understanding the changes and the dynamics of that, we do actually have a ⁓ piece that wrote a little while back when Google first made the change describing the differences. So we'll put a link to that. in the show notes. And in addition to that, I did also write ⁓ a guide to connecting websites together through shared code and tags. And so we'll put a link to that in there as well, so that people can get a sense if they want to learn more. Because as you mentioned, like DNSlytics, Rosie is really desiring to get on camera again. ⁓ DNSlytics one place you can go to look for shared tags. Built with is another, there's a few other options. And as we sort of segue into domain tools, domain also has been increasingly collecting Google tags over the last few years. And so they've got a little database there as well. All right, so is the idea that now I should start sharing and I'm going to pull up domain tools and you're going to tell me where to go from here? All right. Kolina Koltai: Yes, you should do that. And as you pull that up, I'll also say that I think one of the things that I always talk about when using tools and investigations is that you never should rely on just one tool. I always say variety is the spice of life. ⁓ Variety is the spice of life when it comes to tools, because you never know what each one of these tools has captured. ⁓ even though, say, Iris's domain tools and DNS analytics both track Google tags, Craig Silverman: Yes. Mm-hmm. Kolina Koltai: they may not always have the exact same Google tags depending on when that data was scraped. Because it's not like it's constantly doing, especially depending on how popular or how unpopular a site may be. They may have scraped it once that year, maybe once, maybe in two years. And so it never hurts. Like we use this for any other tool we use for investigation. There's lots of tools that claim to do the same thing and they will do the same thing, but they may not always have the exact same information in that. So the use and availability of getting a bunch of tools is also a really useful component in these kinds of investigations. Craig Silverman: Absolutely. That's right, yeah. Kolina Koltai: So I like using both something like domain tools and DNSlytics for looking up stuff like Google tags. I look up the ⁓ mailing address. It's not obviously mailing address. I forget the exact. But it's basically it's bit of address for when you think about a digital email inbox. ⁓ That was something that we saw with Clothop is that there was a bunch of sites that were using the same sort of address. We might look at IP addresses, particularly if someone's using a Craig Silverman: Mm-hmm. Right. Kolina Koltai: dedicated ⁓ server, they all might have the same IP address, which also made us able to link sites together within our cloth op and our undress investigation. So there's lots of different avenues within a website structure that lets you clues to be able to link things together. So once you start linking websites together, saying, hey, we think maybe the same administrator, or in some cases, the same owner of these sites. ⁓ Craig Silverman: Yeah. Kolina Koltai: we can say, all right, we may not see anything clearly on this deepfake porn site, but a site that is not a deepfake porn site, but we know is connected, might have clues about ownership. So that's how we can go about this. Craig Silverman: Yeah. Well, look, let's dive in. when we pull up some results in Domain Tools, obviously, there'll be some IP information, some other stuff there. So what site do want me to put in here? Kolina Koltai: Let's go with reface porn.com. ⁓ It's porn. Right. Craig Silverman: Refacehorn.com. All right, there we go. Yeah, so let me get to the pivot engine to start here. Yeah. Kolina Koltai: ⁓ And so one thing. Yes, wonderful. So I think this is a great. So say this was our starting website, which we did under DNSlytics. saw that DeepFake Porn is also connected to it through the same Google tag. But in this case, one thing I wanted to look up is historical who is information. And sometimes this isn't very easily dead end because a lot of people opt to redact ⁓ who is, which is basically the information about who is the owner of the website. But sometimes people mess up. They create a website. They put in all the information and forget to hit the redact button. And then they go, ⁓ no, wait, hold on. And they go and then redact it later. So looking up the historical Whois information, if you get lucky, you're able to get a piece of clue that someone maybe forgot to redact. So ⁓ usually when you use any free site, they'll just tell you whatever the most recent is. ⁓ But in this case, since we have it, what I would recommend to you, is to look up ⁓ the Whois history and see if we can find any particular clues. Craig Silverman: Yes. Right, so what we see here is like the first thing on the default pivot engine screen is that it was first seen, so it appears to have been registered ⁓ in 1201, 2020. But as you noted, Domain Tools, when you have access, ⁓ is taking snapshots of the who is and the registration information all the time. So I'm going to click now on who is history. And if we sort of scroll back to those early records here, is you see a bunch of these icons of sort of, you know, the ⁓ eye with the line through it, and I'll on that and the tool tip, it says privacy protector records. So just as you were kind of describing, at a certain point, it's a common behavior that people register a domain, they don't pay for privacy right away for whatever reason, they don't know what they're going to do with it or they forget to. And then, you know, they start to get further along and they're like, ⁓ man, I got to protect my stuff. And so this is like, ⁓ you could probably relate, this is the pattern love to see, which is At some point they paid for privacy, but they forgot to do that in the first few records. So I guess we should click on the earliest record here, which is 2020-1202, right? Is that a helpful one? Kolina Koltai: Yeah. That's a helpful one. That's where I would always recommend starting because it's the first time. And sometimes we get lucky and sometimes there isn't anything there. Craig Silverman: Right. So here's, here's I'll highlight sort of the stuff that seems to be somewhat unique about it. So what are we seeing here? Kolina Koltai: Let's see, it says registered organization. And we would keep noted. So what I would also do is look at the other records as well to see if like, because sometimes it's not always clear when a website changes ownership. So that's also, think, an important component of this is when this comes up. Because we could see that it was in 2020, but then we don't see it again until maybe like three months later. So we don't know if maybe ownership had changed at this point or not. So I would say. Craig Silverman: Right, yes. And we can sort of see here as well that when it was first bought, it expired in, you know, when it was created in 2020-2001 and it was going to expire a year later, right? And so if we sort of move along to another one, ⁓ it looks like they're not going to give us anything there. Let me skip along. And it looks like it's got similar info there when we get to 2021-06 and had it in the previous one as well. And so what's the next specs thing that we should take a look at? Kolina Koltai: actually go to like after all the privacy stuff and maybe we get lucky there. Craig Silverman: All right, yeah, that's definitely more interesting. Kolina Koltai: and see, now here's the bit of clue. ⁓ If you recall from just a few moments ago when we were looking ⁓ DNSlytics and we saw a list of sites that were connected to the same Google tag, one of those sites was facitic.com. And now we have facitic.ltd. ⁓ And so this is a clue. So whenever we think about investigations, ⁓ they lead us to dead ends or ⁓ of stuff changes over time. But if we see something like this, that like, ⁓ OK, the same name. And so this doesn't give us a name immediately. ⁓ We see that it's facitic.ltd, it says Dubai, ⁓ and that's about it. But I wouldn't say we end there, necessarily. What we can look up now is stuff about facitic. And there's two things we can do. One, we can look up facitic.com ⁓ on their Whois history, because if we were to visit it, it looks like a normal, regular site. I don't think it's upline anymore. But if we were to go to facitic.com, ⁓ since this is not a deepfake porn site, maybe we got lucky with ownership similarly with the who is information. Craig Silverman: All right, so I've pulled up, I did a new search now on facetik.com. We're back in the pivot engine. So I should go back, I guess, into who is history as well on that. Kolina Koltai: Yeah, let's do that. Craig Silverman: Okay, excellent. the go back as far as 2007. Is there a particular place that's probably useful to check in terms of the most interesting owner? Kolina Koltai: Well, let's just check, see on this first one, see if there's even anything on the most recent one here. That's yeah. Craig Silverman: on the most recent one. Okay, there we go. So we've got the end of 2025. And it looks like that has been redacted for privacy. Kolina Koltai: Oh, it's been redacted. Okay. So let's go back just one more. Craig Silverman: And it looks like this is just showing ⁓ GoDaddy as ⁓ the registrar and then giving us in terms of ⁓ the actual person. Kolina Koltai: right. So we got the company name. So what we would do is if we tried checking out and seeing the who is information and we couldn't find anything else. If that is a dead end, which it can be because we don't know, they're more than one ways. of course you can just Google facetik, but it has a business name, facetik LTD. So what I would do is I'm going to screen share my screen again. ⁓ so let's see, I'm going to share my screen. very realistic of the whole investigator process. So OK, so we see facetik.com here. We now see Facetik LTD. So what I would do is now use a different tool, which is called Open Corporates. Craig Silverman: but I'll just note that they do have more than million corporate records in it. That's the data that they shared on the webinar that I was just watching. ⁓ It's pretty awesome. Yeah. Kolina Koltai: That's a lot. They can't have everything. Actually, Canada has really good ⁓ privacy laws, which could be also annoying as an investigator. Craig Silverman: Right. Kolina Koltai: ⁓ I would put in Focetic LTD and just see if anything comes up. Ah, and here is the one. So it now says in active, but at the time of the investigation, it was active and possibly, if I were to hint, it did shut down. I think they put it out right around where we're publishing. So that's fun. But we can see that there is a business here for Focetic LTD through UK Companies House, which is really open. So we can even go directly there if we want. But here it gives us a name, Mr. Mark Risson. Craig Silverman: Yeah. Kolina Koltai: And so now we have a bit of clue, we have a name. And so from there, use, as you see, we use a variety of different tools from looking at website structure. We saw, we started off with ⁓ Reface porn. We're able to connect deep fake porn to it. So we now have a couple of different sites, which would help us in just going through these payment angles. And we were like, all right, let's also look at the who is information. We've got Lucky and there was Pacific LTD as the owner in one of them before it was redacted. And now we can look up that Mr. Mark Rissaud is an owner. And so in a sense, would this be enough just this to say whether or not this person, if Mark was the owner? ⁓ And he may say, may not be exactly, but we found more more evidence. So when we were talking about that payment platform in which we all saw these transactions, his name, including his direct Skype is the owner of those. And those were links directly sent to us from Deepak Ford. and reface port when we tried to make transactions. So it just kind of highlights the variety of different tools you can use in making connections from the ⁓ official business names to who is registries to ⁓ Google tags. And we didn't get into it. We could also talk about IP addresses of when sites are created and all that kind of stuff. I think this all kind of adds to the ⁓ investigative process. Or sometimes you hit dead ends. ⁓ And other times you get really lucky and people weren't really thinking. So maybe when this guy created Facitik, he was thinking this would be his front-facing thing, had no problem saying it. ⁓ I do think it's interesting that he ⁓ registered this in the UK. He is based in Hungary for as far as we know. He also created companies that are based in Canada. And those are the more recent companies, which I think he maybe switched to for privacy reasons. ⁓ But I think it is ⁓ just kind of like this fun. process. It's kind of like trying to find all the clues and the puzzle pieces and how they fit together. Alexios Mantzarlis: Well, y'all taught at least one person something new, which is me. I'm embarrassed to say I didn't know open corporates. So clearly I haven't watched enough of Greg's workshops either, ⁓ that's great. Kolina Koltai: you ⁓ no. Alexios Mantzarlis: ⁓ shift gears ⁓ from our work, you know, from the deep dives into your investigations. Let's just have ⁓ a little bit of a back and forth on a couple of about how you work. You know, this trajectory that we did pulled up almost an infinite amount of domains of tags, of leads, of IP addresses, of advert. Like I find it with the advertisers that like have algorithms that the scam sites and especially Southeast Asia to like alternate through and cycle through a set of names. And if I store them well enough, then I... I mean, in my mind, I have this name, Baudorf, B-O-D-R-F-F, which they've been using routinely in triple-barrel names. But obviously, my mind is not a great storage system. Like, do you have any recommendations on how to, like, categorize all these breadcrumbs so even if they're not immediately helpful, you can return to them or that when later you find it, you're like, wait, what was the site name again? Kolina Koltai: Yeah, you know what? I can say what my process is, which may not be helpful for everyone. Because I find that it is very much like that because there are plenty of investigations where you go down a rabbit hole, but you don't know for sure if it's a rabbit hole. And it may seem completely pointless until later on in your investigation, you're like, wait a second, didn't I see that name before? Didn't I see that? And so I will old school write notes and use post-its. Alexios Mantzarlis: Is that please? Yeah. Kolina Koltai: I will very much like conspiracy theory board you putting a thing in strings. But I also use like a digital, exactly. Actually I use that GIF as like the intro where we teach digital flip-frizz racing. Like that's what it feels like. I use a tool called Mirrorboard where I actually can like digitally do this where I'll put like a photo or I'll put a clue and I'll like actually do that physically what makes it a little bit less intense when it's like not paper. But I also will just honestly use Alexios Mantzarlis: Amazing. Always sunny in Philadelphia. Very nice. Yeah. Mmm. Mm-hmm. Kolina Koltai: a lot of the Google products, I'll use Google Docs. I'll just write stuff and I'll create tabs. And then what's nice is that it's because it's all searchable that if I say like, I'll save the word for cynic and I collect that, I'll put that on there. And then ⁓ I use another tool called Hunchly, which will basically save your process. There's plenty of times where ⁓ I've to a site and then couldn't remember the process of exactly how I got there or where was it. It's too hard to try to search through like Alexios Mantzarlis: Mm-hmm. Kolina Koltai: my browser history. So I use Huntly as like an archiving service to show the process of the work of how I got there. And it keeps an archive of all the sites and all the things that I'm doing. I not only do I have a history of that, but it's saved locally on my device that I have. One thing we found in the reface and defake porn sites is that, because we use Web Archive, and I actually have one more demo I would love to be able to show, we can do very short, is that it's a really useful source because people, you know, when they start a site, they're sometimes a little sloppy. And so sometimes there's clues at the beginning of the site. And then later on, when they tighten up, they remove all those clues trying to be better at that opsec. And we found in the midst of, after we reached out for write or apply to Mark Rison about this, the archived versions of the sites were all removed. that had never happened to me in an investigation because we used it as a resource. So we had emailed the internet archive and like, Alexios Mantzarlis: Because they complained to... Kolina Koltai: head guy emailed me back, which was really cool. I was nerding out about it. I was like, ⁓ But if the owner of those sites, you can email them and ask for the site to be removed. So one, also reconfirmed that the guy is the owner. But... ⁓ Craig Silverman: Yeah. if you're on a internet site. Yes. Right. Yeah, I mean, that's it is a thing that people aren't aware of is that if you are the copyright owner, you can make a request and they will honor that request. and so, you know, to your point about Hunchley, one of the beautiful things about it is you create your own personal archive. Right. So, of course, you were expecting to link to the Wayback Machine and point people to that. You would have never have thought, ⁓ it's going to disappear, but it can disappear. And if you don't have your personal archive in addition to trying to do the public archive, you could end up in a bad situation in an investigation. Kolina Koltai: Absolutely. So gosh forbid he were to come back and say like, there's no evidence for any of this. It's all gone from the archives for this site, all this stuff. Like fortunately, we do keep a lot of records of investigation, but I think part of the process in doing these investigations is keeping pretty thorough records, keeping your archive and making those searches. Alexios Mantzarlis: I'm obsessive about screenshotting stuff. Like I just, know it's nuts, but like I screenshot everything I see that is even fishy and then eventually have this huge screenshot files that ⁓ Kolina Koltai: The screenshots are good and everything. Craig Silverman: Alexios, you would be a good candidate for Hunchly ⁓ or the other one, the one that I recommend, because Hunchly is great, ⁓ but the free version is very limited. So the best free one that I've used for the continuous capture is Ubicron, ⁓ is, I'll put a link in the show notes as well. We did a guide to the different web capture tools that are out there. And for me, ⁓ if you don't have budget for Hunchly or Forensic OSINT, Alexios Mantzarlis: Hahaha. That's right. Craig Silverman: Ubicron is your best option where you can just turn it on and have stuff saved in a specific folder. So, Kalina, what did you want to show us as your kind of final demo then? Kolina Koltai: Yes, because we're talking about websites and archives. I want to talk about our Mr. Deepfakes investigation because this is a site that had a lot of history that is also now offline, which is great. And also the owner is a guy in Canada, so relevant, I guess, for the Canadian. Alexios Mantzarlis: Those Canadians. Craig Silverman: Lots of these Canadian, country is being slandered here on this podcast. Kolina Koltai: And not every Canadian is nice, it's what I've learned. Alexios Mantzarlis: Not all Canadians. Craig Silverman: hahahahah ⁓ Kolina Koltai: ⁓ So what I have here, which may look very scary if you're unfamiliar with it, but I want to talk it through and without showing too much, is what I have here is ⁓ on the left side of my screen is actually ⁓ an archived version of the mysterydeepfakes.com forum. So the mysterydeepfakes site had multiple components, but one of the main components or two main components is the ⁓ hosting. So they hosted... videos that were deep faked from celebrities. were, in my opinion, think, the largest deep fake community, particularly around ⁓ celebrity deep fakes and pornography. So I think they even claim it down here in the bottom in the text here, largest deep fake community. And so they had a forum component, whereas things got even worse. So they had the celebrities where they hosted, but the forums is way for like users to interact and included places where people could like sell their deep fake services. So in these forums, you would have people say, Hey, I want to make a video of this person who's like a private citizen, like might be a friend that they know, whoever, and they could exchange all this other information or here are the files I used to make for this. So it was more like a collaborative community space for people who are ⁓ enjoyers and creators of that kind of content. ⁓ in the perverts, yeah. I love the word pervert. I think it's underused. I think we've got to bring it back. I love that you brought that up. I love calling someone a pervert. Craig Silverman: Let's just say perverts. It's a pervert community. Yes! Alexios Mantzarlis: Hehehehehe Kolina Koltai: So a lot of perverts in this community. ⁓ And one thing people may not know, including sort of a screenshot, which we love a screenshot, ⁓ is that a bunch of, ⁓ and again, it's similar to all these other sites, it gets scraped. So Web Archive scrapes the information and kind of makes a captured copy of the site, not only how it physically looks, but including the HTML of the website, which basically is just sort of the bricks and pieces of it. So this is where you can imagine your Google tags might be. Alexios Mantzarlis: That's awesome. Kolina Koltai: ⁓ And so one thing that's really useful is using just the website infrastructure this way, using something called Inspect. So what you would do to access this left is I'm on a Google Chrome browser. So I would do like left click or sorry, right click and click Inspect. But nearly every single browser that I'm aware of has this option to inspect the site. And so what you're seeing now is actually the archived version HTML code of the site. So there's bits and pieces and clues that we found from this that helped us in our investigation. One, again, through the payment structure here. So there's a donate button here. If you were to just click on this, and I'll show you what happens when I go and click on it, it doesn't really take us, do anything to us, and it'll direct us to like a PayPal screen, but not really anything useful if it loads. So it just says PayPal.com, web service, there's no information here. So even though it's collected that, clicking it itself does not get us to where we want to go. So what I would do, is look at, well, there must have been an email address. When you're putting it in, putting something like a PayPal button or a donate button, any of that, you would actually want to put in a bit of contact information. So what I would do is click this little button down here or up in the corner here that lets you select something and take you to that area without necessarily clicking on it. So it'll take you to the piece of code. And I wonder if it's might be too small to see, but you can also recreate and do this exactly at home. But oh, gosh, let's see. What you can actually see here is an email address that says davidjames01039 at gmail.com. so getting any email address is wonderful because then there's a whole litany of tools you can use to be able to figure out who is the owner of that email address. And you also have a of a username. So we can think about ways we think about social engineering, the way that people create names or businesses. We see things people reuse names or reuse businesses or reuse passwords. So you might imagine David James also going by DJ01. 039, which is also how we found forum posts by this account. ⁓ But in addition to that one, there's another button down here that's an email, which people will always use to be like, your contact email. So clicking on this actually gets us another email address, which we can sort of see here. Gosh, it's a little small, but it gets us a deep fake, dpfkscom at gmail.com. And so now using the web archive and inspecting the site, we're able to get not Alexios Mantzarlis: Yeah. Kolina Koltai: two different email leads ⁓ who's going to lead us back. Both those emails ⁓ us identify the owner. ⁓ Those were the things we were able to maybe easily discover ⁓ it wasn't something for the Web Archive archiving both ⁓ what the site looked like at that time, but also the bit of web code ⁓ at that time. ⁓ Craig Silverman: Yeah, I mean, it's a great tip. And the other one I'll just throw in on that is if you're hunting for Google tags, Google tags will also often show up in the source code of a web page. So if you see that DNSlytics is telling you that a certain code has been on that website and you want to actually know if it is still there as of today, you can go to that website, you can choose View Source in your browser ⁓ and search for that exact code, doing a sort of command F. ⁓ or Ctrl F on the page. And that can help you manually for your own sake confirm ⁓ that a tag is there. so, Kalina, thank you so much for the demos and for sharing that knowledge. Yeah. Alexios Mantzarlis: Yeah, this was great. And before we hand off, you tell people the best way to follow both you and Bellenke? Kolina Koltai: Yeah. Yeah, absolutely. We are on a variety of socials. You can always go to bellandcat.com, but we're also on Instagram. We're on YouTube. I think we're on Macedon. We're definitely on Blue Sky. We're on all of those if you want to follow those. ⁓ I am personally on Blue Sky if you want to follow the work that I do. And actually just secretly, ⁓ not secret, but just the other day, ⁓ launched Instagram. So I also have at cleanaculti on Instagram just because I'll ⁓ start posting in there to be engaging with the Alexios Mantzarlis: Hmm Kolina Koltai: as ones do. So the followers, right? So you can certainly find us on Blue Sky, but yeah, BellionCadac.com. You can go there, you can find a list of all the stuff. And if I can, if you're interested in learning more about just these kinds of methods or another community of this, and I can plug our Discord community. So we have a public Discord that has like hundreds of thousands. I'll have to double check how many. I think it's definitely over like, I think 60,000 now, maybe 70,000 people. Alexios Mantzarlis: The followers. Kolina Koltai: who are open source research enthusiasts. ⁓ lots of cool stuff that comes out of there. People share news stories. It's actually where I get a lot of my news is like what people are sharing in there. ⁓ actually investigations and stuff has come down. People were able to like geolocate photos of like people who are on some of most like wanted lists. do lots of really amazing things on there. And then even if you're like, I'm so interested in that, I even want to do more, how can I help? We also have our Belintat volunteer community. And these are people that you applied to get into it, you want to learn more. We actually spent time training and teaching people how to do these investigations. and you're able to pitch your own investigations and it's an extra sort of like level up kind of component. We about to have a hundred people in our volunteer community that help us with investigations. And even for some of the work that we've been recently doing around DHS and immigration reporting, I've worked with several people in there to help us sort of just geolocate and categorize and catalog and archive a bunch of footage we've seen of immigration arrests that have been happening here in the US. So please check out all those resources. I think that's it. Craig Silverman: And even though most of them were bad, they were very effective. And even though many of them were racial-based, they were very effective. Yeah, I mean, listen, I will will co-sign on the Bell and Cat Discord. If you're a person who is interested in this area, want to learn about it, want to participate, it is probably the largest, most active and most valuable kind of open source investigation community anywhere on the Internet. So free to join. you know, look, we at Indicator, are on the socials as well. ⁓ So you can get more episodes and other video content from us by hitting subscribe on this channel if you're on YouTube or if you are listening to us on Spotify or on Apple, can also of course subscribe and follow the show. we offer a free newsletter if you want to sign up at Indicator.Media. Alexios Mantzarlis: Rosie the Cat does not have social media accounts yet, but we are working on those. You have to follow Show and Tell in order to see her. But with that said, thanks to everyone who watched or listened. And so much, Kalina, for joining us. This was really, Kolina Koltai: That was going to be my question. She should have her own Instagram. Yeah. Oh, if I can plug one more thing I just remembered. If you're interested in being able to practice doing some of this, another thing we offer are belly cat challenges. I think every month we offer a series of challenges for anyone who wants to partake. You can go and do the ones that are coming out for this month or ones from way back. We've been doing them for more than a year. They're a really fun way to be able to practice different open source skill sets in a way that you don't have to feel like you're creeping on anyone. Alexios Mantzarlis: Please, plug away. Kolina Koltai: geolocation to photo analysis to a whole variety of stuff. Those are really fun monthly challenges we offer and they're free, of course, to everyone who wants to practice. Alexios Mantzarlis: There's a world of resources out there, folks. Get ⁓ cracking. again, Kalina, so much for your work and for coming ⁓ here us. Kolina Koltai: Yeah, thanks for having me. Alexios Mantzarlis: Bye.