Show & Tell from Indicator

How Renée DiResta realized Grokipedia suddenly stopped accepting edits

In this episode of Show & Tell, we speak to Renée DiResta about Grokipedia and the contestability of AI-mediated information sources. Grokipedia is worth studying not just as “a culture war artifact,” she said, but because even if Musk’s AI encyclopedia fades away, “something like it will exist at some point, and we may as well get in and figure out how to audit it now.” What You'll Learn: 📍AI-on-AI auditing and the contestability of AI encyclopedias: How Renée set up her Claude agent to review Grokipedia entries and coax Grok into improving them. 📍Automated monitoring checks: How a weekly script that logged in and reported edit status revealed that Grokipedia had stopped accepting edits. 📍Simple multi-model pipelines: How her AI Notes writer on X uses Zentropi to screen posts, has Claude Sonnet and Opus compete on drafts, and uses ChatGPT as a checker. 📍Publishing for the machines: Why AI systems can only cite what they can retrieve, and why investigators and fact-checkers need to put primary sources online in formats machines can read. Links mentioned in the episode 📍"Grokipedia Stopped Reviewing Edits in April. It Didn't Tell Anyone" (Lawfare): https://www.lawfaremedia.org/article/grokipedia-stopped-reviewing-edits-in-april.-it-didn-t-tell-anyone 📍”Grokipedia cites a Nazi forum and fringe conspiracy websites” (Indicator): https://indicator.media/p/grokipedia-cites-a-nazi-forum-and-fringe-conspiracy-websites 📍Invisible Rulers: The People Who Turn Lies into Reality: https://www.reneediresta.com/books/ 📍Zentropi: https://zentropi.ai/ 📍Wayback Machine: https://web.archive.org/ 📍Renée's newsletter: https://www.reneediresta.com/newsletter/ About Renée DiResta: Renée is an associate research professor at Georgetown, former technical research manager at the Stanford Internet Observatory, and author of "Invisible Rulers: The People Who Turn Lies into Reality." About Show & Tell: Show & Tell from Indicator takes you inside digital investigations as leading journalists, OSINT investigators, threat analysts, and researchers walk through real cases they've cracked. Each episode features a recognized figure in the OSINT, digital investigations, or trust & safety community. They don't just tell us what they did — they show us. Hosted by Indicator co-founders Alexios Mantzarlis and Craig Silverman.

• Transcript

How WSJ reporters caught Polymarket faking its own site

In this episode of Show & Tell, hosts Craig Silverman and Alexios Mantzarlis sit down with Wall Street Journal reporters Caitlin Ostroff and Neil Mehta, who found that Polymarket paid creators to place fake bets on a faked version of its platform. By reviewing more than 1,100 videos, they noticed that the screenshares themselves were from a faked version of the website. They discovered that the website was provided by Polymarket itself to paid creators. Along with uncovering that creators were paid to promote fake payouts, the reporters discovered that a firm called Virality ran a clipping campaign to promote the content to a US audience. What You'll Learn: 📍Scoping a video corpus: Why the WSJ reporters decided to narrow down the videos they’d review to a subset of creators and focus on TikTok 📍Debunking a trade: How to use Polymarket’s public market data to see whether a bet actually materialized or not 📍You can’t automate everything: Only multiple human reviews of the videos led the reporters to find the discrepancies that exposed the fake sites – an AI assistant saw nothing wrong with the content About Caitlin Ostroff and Neil Mehta: Caitlin Ostroff is a reporter who blends shoe-leather reporting with programming and data analysis. She is the co-author of “The Grifter’s Club.” Neil Mehta is a news associate at the Wall Street Journal who previously worked at New York Public Radio. Links Referenced in Episode: 📍"They Looked Like They Were Getting Rich on Polymarket—but None of It Was Real" (WSJ) https://www.wsj.com/business/media/polymarket-social-media-bets-prediction-market-441cdeb5 📍Polymarket Gamma Markets API: https://docs.polymarket.com/developers/gamma-markets-api/gamma-structure 📍Kalshi API: https://docs.kalshi.com/welcome 📍Dune Analytics: https://dune.com 📍Caitlin's post-publication stress bake — peach pie crumb bars: https://sallysbakingaddiction.com/peach-pie-crumb-bars/ 📍You can follow Caitlin at ceostroff.bsky.social and Neil at neilmhta.bsky.social ABOUT SHOW & TELL: Show & Tell from Indicator takes you inside digital investigations as leading journalists, OSINT investigators, threat analysts, and researchers walk through real cases they've cracked. Each episode features a recognized figure in the OSINT, digital investigations, or trust & safety community. They don't just tell us what they did — they show us. Hit subscribe to never miss an episode Follow on our other platforms for more content: 📍 Newsletter: indicator.media 📍 Bluesky: @indicator.media 📍 Instagram: @indicatordomedia 📍 LinkedIn: indicatormedia

• Transcript

How to poison AI research agents

In this episode of Show & Tell, researcher Hal Triedman showed us how easy it can be to poison an AI research agent. Hosts Craig Silverman and Alexios Mantzarlis talked with Hal, a computer science PhD student at Cornell Tech and former senior privacy engineer at the Wikimedia Foundation, about his preprint “Deep-Research Agents Can Be Poisoned via User-Generated Content.” Hal walked us through his findings that demonstrated how you can trick AI research agents into citing fake products just by appending short text to Reddit pages. Hal also shared several free resources that can help you investigate Wikipedia. What You’ll Learn: 📍 How AI research agents can be "poisoned": Adding a sentence or two to a Reddit page that Google or OpenAI deem relevant for a query can cause research agents to cite products, apps, and investments that don't exist. 📍What this means for AI search manipulation: At roughly two cents per run, a deceptive actor can test thousands of queries for a couple hundred dollars, with success rates of 20–40% on topics where UGC sites feature prominently on Google. 📍How to find stories on Wikipedia: Where to find pageviews for Wikipedia pages over time as well as how to follow discussions among Wikipedians about how to handle certain topics and controversies. About Hal Triedman: Hal is a second-year PhD student in Computer Science at Cornell Tech, working with Vitaly Shmatikov’s lab on privacy, security, and AI. Prior to that, he worked as a Senior Privacy Engineer at the Wikimedia Foundation. Links Referenced in Episode: 📍 Hal’s preprint — arxiv.org/abs/2605.24245 📍 Pageview data for Wikipedia – pageviews.wmcloud.org and https://analytics.wikimedia.org/publi... 📍 Wikimedia Enterprise API · The Signpost 📍 Follow Hal on Bluesky — harold.bsky.social About Show & Tell Show & Tell from Indicator takes you inside digital investigations as leading journalists, OSINT investigators, threat analysts, and researchers walk through real cases they've cracked. Each episode features a recognized figure in the digital investigations community. They don't just tell us what they did — they show us. Hit subscribe to never miss an episode Follow on our other platforms for more content: 📍 Newsletter: indicator.media 📍 Bluesky: @indicator.media 📍 Instagram: @indicatordomedia 📍 LinkedIn: indicatormedia

• Transcript

How a Haaretz reporter infiltrates companies offering disinformation-as-a-service

In this episode of Show & Tell, Craig and Alexios talk with Omer Benjakob, the disinformation and cyber reporter for Haaretz. Omer worked with international collaborators on a seminal series of investigations into “Team Jorge,” a shady marketing operation that claimed it could help him and his collaborators interfere with an election in sub-Saharan Africa. He calls the product that Team Jorge and similar companies offer "disinformation-as-a-service" (or DaaS, a term he’s hoping will catch on). We also discussed his more recent collaboration with Libération into a smear operation targeting French mayoral candidates. What you'll learn: 📍 Insight into why fake accounts are the core element of disinformation-as-a-service,” rather than clickbaity false content. These accounts, or “avatars,” are built on real identifiers like SMS-verified phone numbers, in-country IPs and working email accounts. As he put it on the show, "Jorge's avatars are realer than my mom.” 📍 How to validate the claims of a shady vendor. To verify Team Jorge could actually do what it pitched, the reporters commissioned a live demo about Emmanuel the emu, a popular TikTok account. They then traced that demo’s results to verify the company’s claims. 📍 How to use AI to support reporting and research. Omer created a bespoke transcription service that can store everything locally on his machine and avoid the privacy risks of saving on the cloud. He also built a searchable repository of screenshots captured during his investigations. A script runs at the end of every day, files every screenshot into a database, runs visual analysis on each file, and lets him semantically search four years of captures. Thanks to Lead Stories (https://leadstories.com/newsletter), the founding sponsor of Show & Tell. Lead Stories is a global fact-checking organization with journalists working in a dozen languages around the world. Their slogan is "Just Because It's Trending Doesn't Mean It's True." Lead Stories combines old fashion journalism skills with technology to find and debunk false claims on social media. Fact checking is about adding information, not censorship.

• Transcript

How an OSINT Investigator Documented the Israeli Army’s Destruction of Southern Lebanon

In this episode of Show & Tell, hosts Craig Silverman and Alexios Mantzarlis talk with Barbara Marcolini, a visual investigative journalist with Amnesty International. In this episode, Marcolini shares her journey from journalism to human rights work, highlighting her expertise in geolocation, video verification, and reverse image search. Barbara discusses Amnesty’s work documenting destruction in Southern Lebanon through a combination of on-the-ground reporting and open-source intelligence. What you’ll learn: 📍 How to find footage for location-based videos: Use a town or city’s Wikipedia page to check for every spelling variant across different languages and alphabets. 📍 The site:t.me Google dork: Pair any keyword with site:t.me to surface Telegram channels relevant to your investigation. Telegram is where a lot of conflict footage lives and isn't easily searchable from inside the app. 📍Building geographic intuition through Google Earth: Repeated geolocation work in a small area creates a working mental map. After enough passes you can recognize a village from a new video before formally geolocating it. 📍Using reverse image search as a discovery tool, not just for verification: Screenshot a frame from a video and run it through Google Lens — not just to confirm what it is, but to find other posts featuring the location. About Barbara Marcolini: Marcolini is a five-time news and documentary Emmy Award winner and Pulitzer Prize finalist. As an accomplished visual investigator, Marcolini was a founding member of the visual investigation team at The New York Times and is now an OSINT researcher with Amnesty's Evidence Lab, investigating human rights violations and crafting visual stories. Links mentioned in this episode: Israel's extensive destruction of Southern Lebanon - Amnesty International How good are generalist AI tools at identifying public figures in videos? - Indicator Follow Barbara on X and Amnesty International on Instagram ABOUT SHOW & TELL: Show & Tell from Indicator takes you inside digital investigations as leading journalists, OSINT investigators, threat analysts, and researchers walk through real cases they've cracked. Each episode features a recognized figure in the digital investigations community. They don't just tell us what they did — they show us. Hosted by Indicator co-founders Alexios Mantzarlis and Craig Silverman. Produced by Ethan McCarthy.

• Transcript

Unmasking AI Nudifier Networks: OSINT Techniques from Bellingcat's Kolina Koltai

In this episode of Show & Tell, hosts Craig Silverman and Alexios Mantzarlis talk with Kolina Koltai, a senior researcher and trainer at Bellingcat. Kolina has led investigations into AI nudifiers and deepfake pornography networks. Her work has contributed to the takedown of MrDeepFakes, the largest deepfake community on the web, among other impact. Kolina walked through two investigations: one tracing the payment infrastructure used by deepfake/nudifier sites to avoid getting cut off by mainstream processors, and another that followed domain connections, whois history, and a company registrations to identify the likely operator of ReFacePorn and DeepFakePorn. Along the way she demos the tools live — with Craig joining in on DomainTools. What You'll Learn: 📍 Following the money: How AI nudifier sites use gaming platforms, Patreon credits, and redirect pages to obscure payments from processors like Stripe and Visa. 📍 Connecting domains with Google Tags: How shared analytics tags can link a network of sites to a single administrator — and which tools to use (DNSlytics, DomainTools). 📍 Whois history as an investigative resource: Why historical registration records can reveal information that was later hidden. 📍 From domain to person: How Kolina used OpenCorporates and UK Companies House records to find a named individual tied to a network of deepfake sites 📍 Inspecting archived HTML: How the Wayback Machine captures not just how a site looked, but its underlying code — and how Kolina found email addresses in archived donate buttons on MrDeepFakes 📍 Managing leads across sprawling investigations: Kolina's workflow using Google Docs, and Hunchly to keep track of breadcrumbs and digital assets. Links Referenced in This Episode: https://www.bellingcat.com/news/2024/02/23/behind-a-secretive-global-network-of-non-consensual-deepfake-pornography/ https://www.bellingcat.com/news/2025/12/15/mark-resan-reface-deepfake-porn/ https://www.youtube.com/watch?v=dTMaXVTtOdw https://indicator.media/p/indicator-guide-to-connecting-websites-together-osint-tools-tags-ids-favicon https://indicator.media/p/web-capture-tools-hunchly-forensic-osint-ubikron https://discord.com/invite/bellingcat https://bsky.app/profile/koltai.bsky.social https://www.instagram.com/kolinakoltai/

• Transcript

Inside The Tools & Techniques That Exposed Facebook Transit Scams And TikTok's Polarization Industry

In this episode of Show & Tell, hosts Craig Silverman and Alexios Mantzarlis from Indicator talk with Clara Jiménez Cruz, co-founder and CEO of Maldita.es, a Spanish nonprofit news organization that uses fact-checking, data journalism, and OSINT to expose disinformation and digital deception. Clara gave a hands-on look at three investigations that exposed how platform systems — not just bad actors — enable scams, monetized deception, and child exploitation. What You'll Learn: -The Transport Scam Network: How Maldita identified 1,075 Facebook pages impersonating public transit authorities across more than 60 countries. She showed the methodology (Facebook page transparency, ad library domain lookups, and DNS data) that scaled a tip into a global database. -TikTok's Polarization Industry: How hundreds of accounts used polarizing AI-generated political content to take advantage of TikTok's creator monetization program. -CSAM on TikTok: How Maldita found more than 5,200 AI-generated videos and 3,600 videos of real minors being sexualized on the platform. Clara revealed how TikTok's automated moderation failed to act on their reports, leading to a Digital Services Act enforcement investigation and a referral to Spanish prosecutors. Building Data Where There Is None: How manual spreadsheet annotation of Facebook page IDs and TikTok account IDs lets investigators track accounts that change names, measure coordinated creation times, and build findings that hold up to scrutiny. Working the Comments: Why looking at comment sections — not just content — is what cracked open the CSAM-to-Telegram pipeline. About Clara Jiménez Cruz: Clara is co-founder and CEO of Maldita.es, a Spanish foundation and nonprofit news organization she co-founded with Julio Montes Moreno and grew into a powerhouse digital investigative outlet. Links Referenced in Episode: -Maldita.es transport scam investigation: https://maldita.es/investigaciones/20250716/transport-scam-network-international-facebook/ -Maldita.es TikTok polarization investigation: https://maldita.es/investigaciones/20260126/protests-ai-tiktok-money-polarization/ -Maldita.es CSAM/TikTok investigation: https://maldita.es/investigaciones/20251211/predators-tiktok-goldmine-pedophiles/ -MyOSINT Training free bookmarklets: https://tools.myosint.training/ Subscribe & Follow Indicator: Free newsletter: https://indicator.media/ Social: https://bsky.app/profile/indicator.media Email us: editorial@indicator.media Hit subscribe to never miss an episode!

• Transcript

Using Internal Docs, Burner Accounts and Ad Library Research to Expose Meta's Scam Ad Business

In this episode of Show & Tell, hosts Craig Silverman and Alexios Mantzarlis sit down with Jeff Horwitz, investigative reporter at Reuters. Jeff shares how he showed that Meta has earned billions of dollars from online scam ads—and how he used the company’s own ad system to prove his point. Jeff details how he combines leaked internal documents with hands-on experiments, including running his own "scam" ads to see how Meta’s AI tools would react. You’ll hear how Meta’s generative AI didn't just approve his deceptive ads—it offered suggestions to make them even sleazier. What You'll Learn: His Approach: How Jeff uses document analysis, quantification methods, burner accounts, and internal sources to uncover stories. The Scam Ad Experiment: Jeff explains how he partnered with Meta's own "trusted" ad agencies in China to run ads that explicitly violated platform rules. AI-Enhanced Deception: Learn how Meta’s LLMs suggested high-pressure copy like "guaranteed profit" and "tired of living paycheck to paycheck" to improve scam performance. The "Black Box" Problem: Why even internal Meta staffers often rely on setting up "clean" test accounts to understand what their own algorithms are doing. Sourcing via LinkedIn: Jeff shares his "old school" but effective outreach tactics using LinkedIn Sales Navigator to find sources within big tech. About Jeff Horwitz: Before joining Reuters, Jeff covered Meta for The Wall Street Journal where he broke major stories on child exploitation on the platform, Instagram's negative impact on teen mental health, facilitation of human trafficking, and the amplification of political violence. His Facebook Files investigation used internal Meta documents to expose systemic issues across the company's platforms. Episode Highlights: [1:46] Introduction to Jeff Horwitz and his investigative work [4:47] How Jeff started investigating Meta's ad scam problem [7:37] The power of documents in investigative journalism [37:25] Meta's response to the scam ad reporting [39:30] Lightning round: Jeff's digital tools and investigative methods