219 SHARES Share Tweet
SUMMARY
This investigation, which befell between Might and August 2022, reveals {that a} community of German- and English-language Fb pages are utilizing the platform to construct an internet following of tens of millions which may be financially exploited. We recognized this community by analyzing varied open-source data, akin to Google Analytics and AdSense codes, net infrastructure, and CrowdTangle knowledge.
The pages seem to construct their viewers by selling clickbait content material—together with misinformation and conspiracy theories—generated inside the community, whereas concealing the truth that they’re a part of the identical community. The community employs a number of parts for monetization of net visitors, akin to Google AdSense and e-commerce commercials, suggesting that the principle motivation for this operation is monetary in nature. We will hyperlink this community to pravda-tv.com, a German web site well-known for publishing misinformation and conspiracy theories.
Introduction
AnonHQ first caught our consideration with this text it printed in April 2022, claiming that the SARS-CoV-2 virus was engineered in a laboratory and launched. Up to now, there’s no proof supporting this declare, and scientific proof to date signifies that the virus developed naturally and was transmitted to people in a zoonotic an infection.
We noticed that AnonHQ doesn’t disclose the identities of those that personal the web site or those that write for the web site. The dearth of transparency hasn’t hindered its viewers progress, nevertheless. Its Fb web page confirmed that it amassed a big following: greater than 5.5 million customers had preferred the web page. The web page additionally ran a Fb group named Nameless, with greater than 39,000 followers. Notably, these numbers rival that of Fb pages of respected, conventional information shops like CNBC and the Washington Submit, which have greater than 3.9 and 6 million likes, respectively.
The web site and Fb web page of AnonHQ clearly search to emulate Nameless, an off-the-cuff hacktivist collective recognized for varied cyberattacks towards governments and establishments, as demonstrated by means of the Nameless brand and a part of its motto (“We Are Nameless. Count on Us.”).
Screenshots of the anonhq.com house web page, the About part on its Fb web page, and the group linked to the Fb web page. (Supply: anonhq.com/archive, prime left; Fb, prime proper and backside)
We first examined anonhq.com WhoIs data and server data utilizing Area Instruments and DNSLytics. The WhoIs data confirmed that the web site proprietor used a site privateness service (Domains By Proxy, LLC), due to this fact no personally identifiable details about the web site proprietor was out there.
WhoIs data for anonhq.com. (Supply: Area Instruments)
Nonetheless, we observed that anonhq.com shared the identical mail server as one other web site, captain-planet.internet, suggesting a hyperlink between the 2.
Equivalent mail server used for anonhq.com and captain-planet.internet. (Supply: DNSLytics)
Following up on this lead, we recognized a Google AdSense code (pub-8724753500373215) that captain-planet.internet shared with two different web sites, medizin-heute.internet and unserplanet.internet.
Reverse Adsense search on DNSLytics confirmed a Google AdSense code (pub-8724753500373215) frequent to captain-planet.internet, medizin-heute.internet, and unserplanet.internet. The presence of the code on these web sites was verified by checking the supply code of those web sites. (Supply: DNSLytics, left; captain-planet.internet, prime proper; unserplanet.internet, heart proper; medizin-heute.internet, backside proper)
Google AdSense codes allow web site house owners to monetize their net visitors by displaying advertisements and every code is particular to the proprietor. This makes Google AdSense codes helpful for establishing associations between seemingly unrelated web sites and figuring out web site possession by tracing such associations. These codes have been used as a foundation for investigating associations between web sites and web site possession, as proven on this report by the Digital Forensic Analysis Lab and this report by International Voices.
We additionally examined the Fb pages of captain-planet.internet (@wesaveblueplanet) and unserplanet.internet (@unserplanet; “Our Planet” in German), discovering that each pages primarily publish the identical content material, largely revolving across the themes of nature and environmentalism, besides in numerous languages. captain-planet.internet publishes content material in English whereas unserplanet.internet publishes in German.
We additionally noticed the identical sample between anonhq.com (English) and the web site derwaechter.com (German). The connection between these two was recognized via a SpyOnWeb search, utilizing a Google AdSense code current on anonhq.com (pub-5986748907447277). These two web sites targeted on the theme of conspiracy theories, such because the baseless declare that Ukraine has secret U.S. organic labs (see articles right here and right here). derwaechter.com was recognized primarily based on a shared Google AdSense code with anonhq.com. derwaechter.com has its personal Fb web page (@waechter.investigativ; “DerWaechter” which means “The Watchman” or “The Guard” in German).
Supply code of anonhq.com, exhibiting the Google AdSense code pub-5986748907447277. A search on SpyOnWeb turned up a number of outcomes, certainly one of which was derwaechter.internet. (Supply: anonhq.com, prime; SpyOnWeb, backside)
As with anonhq.com, the WhoIs data for these web sites additionally point out that area privateness providers had been used.
WhoIs data for derwaechter.internet (prime left), medizin-heute.internet (backside left), captain-planet.internet (prime proper), unserplanet.internet (backside proper). (Supply: Area Instruments)
All instructed, these Fb pages amassed greater than seven million likes and follows in whole. It’s possible that there are customers who preferred and adopted a couple of of those pages, due to this fact one caveat is that the overall variety of likes and follows doesn’t essentially correspond to the precise variety of customers who preferred and adopted these pages. The latter quantity is more likely to be smaller.
Info on Fb pages and teams related to these web sites.
Notably, the Fb pages for these web sites are all run by accounts in Germany, primarily based on the Web page transparency device on Fb, though Anon HQ’s Fb web page claims to be situated in Delaware, Ohio.
All of the Fb pages we noticed on this community had been run by accounts in Germany, primarily based on Fb’s Web page Transparency function. (Supply: Fb)
4 of the web sites offered cryptocurrency addresses for customers to donate cash; three of the 4 used the identical cryptocurrency addresses of their request for donations from readers (captain-planet.internet, unserplanet.internet, derwaechter.internet).
Screenshots of cryptocurrency addresses on the web sites. Three of the web sites show equivalent cryptocurrency addresses (Supply: captain-planet.internet/archive, prime left; unserplanet.internet/archive, prime proper; derwaechter.internet/archive, backside left; anonhq.com/archive, backside proper)
Germany has made it obligatory by regulation for web sites to incorporate an impressum, which wants to offer fundamental particulars about who or what group is behind the web site presence, such because the names of people and corporations concerned, their business deal with, and get in touch with particulars like e-mail addresses. In accordance with this regulation, the German-language web sites derwaechter.internet, medizin-heute.internet, and unserplanet.internet present this data.
Impressums on unserplanet.internet, medizin-heute.internet, and derwaechter.internet (clockwise from left). (Supply: unserplanet.internet/archive, medizin-heute.internet/archive, and derwaechter.internet/archive)
Nonetheless, we had been unable to find the named people via a Google search. Medisanas Ltd. is an organization manufacturing healthcare gadgets; we didn’t discover proof indicating that it’s associated to medizin-heute.internet. This discovering means that these are merely pseudonyms geared toward concealing the true id of people concerned in operating these web sites.
Sharing of content material between related Fb pages and web sites
The web sites additionally tended to publish equivalent content material in each English and German, generally utilizing equivalent or comparable photographs for example their articles, as seen from the screenshots beneath.
Equivalent articles in English (left) and German (proper) printed by this community of internet sites. (Supply: captain-planet.internet/archive, archive, archive; unserplanet.internet/archive, archive, archive; anonhq.com/archive, archive, archive; derwaechter.com/archive, archive, archive)
Moreover, we noticed that the Fb pages generally shared content material from sister web sites—web sites inside the community that don’t have any apparent relationship to the Fb web page. Typically, articles courting from just a few years again are reshared once more as if they’re new (see the instance of the lion article beneath).
A medizin-heute.internet article concerning the antibiotic properties of honey, and an unserplanet.internet article had been shared by the Fb pages Nameless Offiziell and Der Waechter. The shares of the medizin-heute.internet article all befell on the identical day; the shares of the unserplanet.internet article befell inside minutes of one another. Nameless Offiziell and Der Waechter ostensibly don’t have any affiliation to both of those web sites. (Supply: Fb)
A captain-planet.internet article claiming that lions ate three poachers was shared in October 2018 and shared once more in April 2022 throughout a number of Fb pages. The German Fb pages shared the identical content material, translated to German on unser-planet.internet (backside row). (Supply: Fb)
Utilizing knowledge from CrowdTangle, we had been in a position to analyze the variety of shares from every of the concerned domains (anonhq.com, captain-planet.internet, unserplanet.internet, derwaechter.internet, and medizin-heute.internet) and decide if sure Fb pages accounted for a disproportionately bigger variety of shares for any of those 5 domains.
The variety of shared URLs analyzed for anonhq.com was 10,000 (the restrict we used for our knowledge obtain request); 8,075 for derwaechter.internet; 5,739 for captain-planet.internet; 5,492 for unserplanet.internet; and a pair of,344 for medizin-heute.internet.
Community map exhibiting the Fb pages, denoted by circles (nodes), that shared probably the most variety of URLs (appearances) from any of the 5 domains within the community. The bigger the textual content dimension, the better the overall variety of appearances. A line between two nodes, additionally referred to as an edge, point out that the Web page shared no less than one URL from a site. The thicker the road, the extra URLs from that area had been shared by the web page (extra weight). Edges with a weight of lower than 50 had been filtered out for readability. Graph generated utilizing Gephi.
As anticipated, the Fb pages that had been immediately associated to an internet site (e.g. anonhq.com and ArmyAnonymous) most frequently shared URLs from that web site. However our community map additionally confirmed that the pages ArmyAnonymous and Der Waechter generally shared content material from the sister web sites, like captain-planet.internet, medizin-heute.internet, and unserplanet.internet. This implies that the Fb pages are a car for amplifying content material from the community generally.
We Watch Faux Nameless, a German-language Fb web page, beforehand investigated this community of internet sites and Fb pages and noticed the identical conduct; their report on this community is available in two elements and may be discovered right here and right here.
NewsGuard, an organization that charges the credibility of knowledge and information web sites and investigates disinformation, additionally reported the identical exercise between the Fb pages Nameless Offiziell, Der Waechter, Unser Planet, and Medizin Heute. These observations, that are impartial of our investigation, validate our findings.
Nonetheless, We Watch Faux Nameless and NewsGuard didn’t report conclusive identities of the person(s) concerned in operating this community of Fb pages and web sites with tens of millions of followers. In hopes of addressing this query, we made this the target of our investigation.
We inspected the Fb accounts that had been linked to related web sites. On the Fb web page of medizin-heute.internet (@medizinheute), we discovered a hyperlink to the web site vitaminum.internet, which has its personal Fb web page Vitaminum ProLife. Whereas going via the timeline of Vitaminum ProLife’s Fb web page, we discovered, amongst different issues: a re-share of a publish by Der Waechter, a publish sharing an article by pravda-tv.com, and a publish sharing an article by anonymousnews.ru. Like many of the web sites on this community, each pravda-tv.com and anonymousnews.ru publish content material in German.
The presence of a hyperlink to vitaminum.internet on the Fb pages of Medizin Heute and Vitaminum ProLife. (Supply: Fb)
Affiliation with pravda-tv.com and Nikolas Pravda
The WhoIs data for pravda-tv.com present that the proprietor makes use of a site privateness service, however we didn’t must depend on these data, as its founder, Nikolas Pravda, clearly indicated his involvement within the web site, primarily based on the knowledge within the About Us web page on pravda-tv.com. On the web site, Pravda said that he’s initially from the Czech Republic and later moved to Germany, and that he spent 16 years working in advertising and promoting. He based the web site in 2012.
WhoIs data for pravda-tv.com. (Supply: Area Instruments)
pravda-tv.com is a German web site that has been cited in experiences for publishing false data and conspiracy theories, a few of which had been debunked by fact-checkers in Germany (see right here, right here, and right here). It held the doubtful honor of being rated by NewsGuard as one of many prime 10 German-language web sites spreading COVID-19 misinformation in 2020, and cited for spreading election misinformation within the run-up to the German federal elections in 2021. It additionally printed articles that promote pro-Kremlin narratives, like this one and this one.
Clicking on a hyperlink to pravda-tv.com brings up this warning by Fb that the web site doesn’t meet Fb’s Group Requirements.
A warning message that seems on Fb upon clicking a hyperlink to pravda-tv.com. (Supply: Fb)
The precise cause for this isn’t given within the warning, however primarily based on these posts courting again to 2019 by Pravda TV’s Instagram account (@pravdatvblog), a number of hyperlinks resulting in pravda-tv.com had been thought of to be spam by Fb. Spam is towards Fb’s Group Requirements. Amongst some causes an individual may obtain such a warning is that if they “Posted or shared one thing too rapidly or too typically in a brief period of time”, “Despatched somebody a message or hyperlink that they marked as unwelcome” or “Contacted individuals for business functions with out their consent”.
Curiously, Pravda’s VK profile signifies he follows solely two accounts. Considered one of them is Pravda TV, which he’s recognized to run, whereas the opposite is related to anonymousnews.ru.
anonymousnews.ru was cited by the Bundestag, the German federal parliament, for repeatedly publishing false data and conspiracy theories. The web site is not energetic, however its URL presently redirects to a different area anonymousnews.org, which continues publishing content material alongside the identical themes. Proof means that each web sites had been run by Mario Roensch, a former member of the far-right political get together Various for Germany. Buzzfeed Information reported in February 2017 that Roensch went on the run from authorities following costs of “incitement of the individuals” and spreading disinformation, each of that are thought of crimes in Germany.
Roensch was ultimately arrested in Hungary in March 2018 and extradited to Germany, the place he was convicted for illegally promoting firearms on-line in December 2018 and sentenced to 3 years and two months’ imprisonment.
We weren’t capable of finding data indicating that Pravda was or is related to the web sites allegedly run by Roensch, however one could speculate that anonymousnews.ru’s profitable use of the Nameless model to draw an internet viewers could have impressed this community to do the identical.
Screenshots of the VKontakte profiles of Nikolas Pravda and anonymousnews.ru. (Supply: VKontakte)
One other web site that’s possible run by Pravda is anti-matrix.com, which like anonhq.com and derwaechter.internet, publishes content material about conspiracy theories (see examples right here and right here). We will set up a robust affiliation between the 2 web sites via a number of observations: the presence of hyperlinks to anti-matrix.com on pravda-tv.com; the impressum on anti-matrix.com, which clearly reveals it was copied from pravda-tv.com; the truth that pravda-tv.com and anti-matrix.com share the identical IP deal with and mail server, based on DNSLytics.
Supply code of pravda-tv.com containing hyperlinks that direct customers to anti-matrix.com, whereas the impressum on anti-matrix.com reveals the title PRAVDA TV, suggesting that it was possible copied from pravda-tv.com. On the suitable of the impressum, we will see commercials for books written by Pravda (Supply: pravda-tv.com, prime; anti-matrix.com/archive, backside)
Equivalent IP deal with (85.13.129.143) and mail server (w0127fc6.kasserver.com) shared between pravda-tv.com and anti-matrix.com. (Supply: DNSLytics)
We recognized two Google Analytics codes (UA-168915890 and UA-199725947) on pravda-tv.com, which we had beforehand found on unserplanet.internet, captain-planet.internet, and derwaechter.com. Google Analytics allows web site house owners to trace net visitors on web sites; every code is exclusive to a specific person account.
The Google Analytics codes (UA-168915890 and UA-199725947) are current within the supply code of pravda-tv.com, captain-planet.internet, derwaechter.internet, and unserplanet.internet. (Supply: pravda-tv.com/archive, prime left; derwaechter.internet/archive, backside left; captain-planet.internet/archive, prime proper; unserplanet.internet/archive, backside proper)
These two shared Google Analytics codes present sturdy proof linking this community of Fb pages, Fb teams, and webpages to pravda-tv.com and by extension, Nikolas Pravda.
Pravda didn’t reply to our request for remark.
Heavy presence of product commercials on related Fb pages and web sites
pravda-tv.com has a number of options in frequent with the community of internet sites and Fb pages. For instance, pravda-tv.com is closely populated by commercials for merchandise and hyperlinks to on-line retailers. Considered one of them is for Vitaminum ProLife, which the Fb web page Medizin Heute additionally hyperlinks to (mentioned above).
A number of the commercials displayed on pravda-tv.com. Word the commercials to Vitaminum ProLife and its printed books on the top-right hand nook. (Supply: pravda-tv.com)
The Fb pages in German (Unser Planet, Medizin Heute, and Der Waechter) additionally generally interspersed posts from related web sites with posts selling merchandise from the e-commerce store Waagemann.
Product commercials for the e-commerce store Waagemann posted on Fb pages inside the community. (Supply: Fb)
The English-language counterpart to Waagemann seems to be the web site amazyble.com (Fb web page @amazyble; its Web page transparency information reveals that it’s run by accounts primarily situated in Germany). The Fb web page Nameless Offiziell features a hyperlink to the web site anon-store.com, which redirects to the web site amazyble.com, as DNSLytics confirmed. This establishes an affiliation between the e-commerce store and the Fb pages within the community.
Screenshot of the Fb web page Nameless Offiziell and URL redirect data. (Supply: Fb, prime; DNSLytics, backside)
Just like the German Fb pages, the English Fb pages within the community posted commercials for e-commerce (Amazyble on this case).
Posts selling merchandise on Amazyble featured on the English Fb pages related to anonhq.com and captain-planet.com. (Supply: Fb)
On TrustPilot, an internet site that permits clients to fee companies, we discovered a five-star (out of 5) assessment for Waagemann left by the person Amazyble—that is one more affiliation established between these two e-commerce web sites and one other indication that they’re a part of the identical operation.
Screenshot of a assessment on Waagemann left by Amazyble on Trustpilot. (Supply: Trustpilot)
Amazyble’s personal Trustpilot evaluations additionally recommend an affiliation with the community of internet sites. One assessment was left by Sonja Schmidt—this is identical title used within the e-mail deal with listed on the impressum of medizin-heute.internet.
Screenshots of a assessment left by Sonja Schmidt for Amazyble and a part of the impressum on medizin-heute.internet. (Supply: Trustpilot, left; medizin-heute.internet, proper)
Our findings strongly point out that Pravda is concerned on this community, however the dimension of the community makes it unlikely that just one particular person is chargeable for operating all of those web sites and Fb accounts. Throughout our investigation, the Web page transparency data for the Fb web page Unser Planet modified. On 4 July 2022, the Web page transparency data didn’t checklist the title of the admin. However on 15 July 2022, we noticed that Taylan Demir was listed as one of many admins of the web page.
A LinkedIn seek for Taylan Demir confirmed that he’s the proprietor of Waagemann. A Fb publish by Demir in February 2021, containing a picture of the Waagemann brand, confirmed that he was looking for partnerships for his e-commerce enterprise.
Screenshots of the change in Web page transparency data from 4 to fifteen July 2022, a Fb publish by Demir, and Demir’s LinkedIn profile, exhibiting that he’s the enterprise proprietor (unternehmensinhaber in German) of Waagemann. (Supply: Fb, prime left, prime proper and backside left; LinkedIn, backside proper)
Taken collectively, we will infer that Demir can also be concerned within the operating of no less than some Fb pages and web sites within the community.
Science Suggestions reached out to Meta with our findings. Of their response, Meta said that they didn’t contemplate this exercise to be in violation of Fb’s Group Requirements, particularly the coverage towards inauthentic conduct. On the time of this report’s publication, the Pages we examined stay operational.
Conclusion
Our findings point out {that a} community of German- and English-language Fb pages, working primarily in Germany, is exploiting the platform to direct net visitors to its web sites and affiliated e-commerce retailers Waagemann and Amazyble (see community map beneath).
The community of internet sites and Fb accounts detected on this investigation. Graph generated utilizing Maltego. Word: This map shouldn’t be thought of exhaustive; the community possible entails extra Fb pages and teams.
These Fb pages construct that net visitors by amplifying clickbait content material—together with misinformation and conspiracy theories—generated from inside the community, whereas concealing the truth that they’re really a part of the identical operation. This has the impact of creating the amplification seem natural, when it isn’t.
Having amassed tens of millions of followers, the community can harness varied instruments to monetize net visitors, akin to Google AdSense and product commercials, suggesting that the principle motivation for this operation is monetary in nature, though one additionally can not exclude attainable political and ideological motivations.
The International Disinformation Index reported in 2020 that disinformation websites in Europe raked in additional than US$76 million in advert income yearly. Clearly, disinformation is large enterprise, enabled by platforms’ prioritizing the promotion of content material attracting engagement, versus content material of excessive credibility.
Though monetization of disinformation generally takes place via the location of internet advertising, this specific community’s promotion of e-commerce retailers represents one other potential method to profit financially from such an operation, and income via such a channel could also be even tougher to trace than for on-line advert income.
When the community is taken as an entire, we will see that it employs each innocuous and conspiratorial clickbait—posts about animal welfare and conservation are juxtaposed with disinformation about “Ukrainian bio-labs”. The usage of such disparate themes might enhance the Fb pages’ attraction to completely different audiences, permitting the community to draw extra followers.
Due to the shortage of transparency when it comes to possession of those web sites and pages, it may be difficult for Fb customers to keep away from collaborating unwittingly within the promotion of such networks, whether or not it’s by merely liking a Fb web page or sharing its content material.
Within the face of platforms’ inaction towards such for-profit disinformation operations, which don’t essentially violate present insurance policies akin to these towards inauthentic conduct, it’s important to enhance the overall inhabitants’s media literacy expertise to allow customers to acknowledge when a supply could also be unreliable, as the primary line of protection towards being an unwitting participant in a disinformation operation. As well as, open-source investigations that reveal the internal workings of disinformation operations, like this one, will likely be important in bringing such operations to gentle and guaranteeing that the general public is conscious of the actors concerned and the impression of such actions.