Tara, Jesica, Ana, Lora: since a few weeks dozens of trolls on Twitter are dangling bait in front of American Trump supporters. Their goal: bring in as many clicks as possible for two commercial, (potentially Serbian) anti-islam websites. And it is working: in twelve days they reached a potential audience on Facebook of 3.8 milion users. Lead Stories went troll hunting together with Dutch fact checking website Nieuwscheckers (a Dutch version of this article can be read here).
They are trolls but they don't look anything like the creatures by that name from Scandinavian folk legends. No weird noses, tangled hair or flat feet in sight. Take Ana, for example. Active on Twitter since November 13 and according to her profile she is a "retired schoolteacher" and also an "artist for fun". On her picture she looks like a model. And she is: her profile picture was stolen from Serbian model and reality-tv star Stanija Dobrojevic.
From the same mold comes Deb Britt, who proudly presented her #NewProfilePic on November 14: it is a portrait of singer Ljupka Stevic, stolen from a Serbian news website. How about Gloria Hawner, posing on a terrace near the beach? In reality her picture is - again - Serbian singer Katarina Grujić. Gloria is one of the 66 trolls (at least, here's a list) that appeared on Twitter in November looking to snare American Trump-supporters.
Network
The trolls are all promoting articles from websites registered in Macedonia. They are part of a network that Dutch fact-checking website Nieuwscheckers already reported on back in August. But contrary to assumptions at the time it seems the creators seem to be Serbian speakers: the Twitter accounts all had their language set to Serbian. And, as we will see, there are more clues about their identity.
Back in September an earlier batch of trolls luring visitors to these websites were all deleted by Twitter.
The Tara's, Jesica's and MAGA's that came crawling out of their holes in November were pushing stories of two new sites, tapainfo.com and tvrtinfo.com, registered on November 15 and 19. The content of the sites is a mix of anti-islam and pro-Trump pulp, with headlines like 'MOB Of angry Muslims ravage through US neighborhood threatening to rape women' and 'SNOOP DOG ANNOUNCED HE'S OFFICIALLY LEAVING THE COUNTRY BECAUSE HE HATES PRESIDENT TRUMP...!'
These two new websites are only the last in a very long line that all seem to be part of the same network. A little bit of digging into the common ID codes used by the ad networks that were powering the ads on the sites immediately revealed a few dozen hits. By checking the domain registration data of these sites and by sorting them in chronological order it was possible to find out which ones were the oldest so they in turn could be investigated further to see if they could be connected to even older sites.
A first noticeable property shared by all the sites found in this way was that all their domain names seem to have been registered anonymously via One.com or Ascio Technologies and all of their WHOIS records contain the country code "MK" (for Macedonia). Many of the sites also used the "Colormag" theme for the Wordpress CMS they were running on.
In the end we managed to compile a list of 41 sites, with the oldest one (matyinfo.com, by now a Chinese site) dating back to June 25, 2016 and the newest one (tvrtinfo.com) being just two weeks old. Over the past year the network launched at least one new site every month but in some months it was five or even six.
Anyone launching that many new websites has to make up a lot of new names too. Often the ones chosen were variations on the same pattern: "something + info.com", the number "24", the word "media", omitting or adding a letter in an English word. This would result in domain names like universalemedia.net, universaleinfo.com, liberyinfo.com, libertyinfonews.com, dotinfo24.com...
A different pattern that stood out in the domain names was the use of words like "cvikas", "tamche", "svij", "oprem", "cukam" and "butam". We consulted with a language expert and were told these look like Macedonian or Serbian slang words with various sexual connotations. Some examples of domain names with these words include cukaminfo.com, cukammedia.com, opreminfo.com, opremmagazine.com, opremedia.com, tamche1966.com, svijmedia.com, cvikas.com or butam.net.
Articles published on the sites in the netwerk appear to have been promoted mainly via fake Facebook accounts that posted them to various pro and anti Trump groups on the social network (but mainly pro groups):
Image: CrowdTangle
The articles themselves are hyperpartisan, the news is often years old and sometimes completely made up. Fact checkers debunked some of the stories, for example this one about muslims threatening to leave the U.S. if they didn't get food without pork in it or about actor Bruce Willis urging everyone opposing Trump to move to Canada.
All sites seem to use a common list of articles which get reposted over and over again. For example the headline "Florida: Largest food stamp fraud bust in history, $20M, Muslim store owners arrested" was found on no less than 21 sites in the network. As we wrote before on Lead Stories the story originally came from the Miami Herald and there were several non-muslims among the people who got arrested.
Often the articles are stolen from other websites with bad reputations like NeonNettle ("Notorious Pedophile 'Crucified' By Vigilante Gang As Warning To Child Abuser", copied on 11 sites) or RedIce.tv ("Norwegian Army Chief: Europe Needs to Destroy Islam if they are Going to Survive", copied at least 12 times and debunked long ago).
We also discovered several stories originally published on websites by Christopher Blair, an American publishing satirical fake news in an effort to fool conservatives and Trump supporters into sharing fake stories and hoping to teach them to be less gullible. But this network blindly copied his stories without indicating or warning that they were satirical. Take for example the story "Michelle Obama's Doctor Goes On Record: 'I Know What I Saw'" (which claims she is a man): it was copied no less than 18 times by sites in the network. Another one which has resurfaced more than 12 times so far is the classic "Cops Take A Knee Then Walk Out On Redskins Leaving Them Stranded In Their Locker Room Overnight".
New Strategy: Twitter
The trolls which appeared on Twitter in November initially attempted to build some credibility before starting their real job: spamming articles for tapainfo.com and tvrtinfo.com. They would retweet pro-Trump memes and hyperpartisan sites like Breitbart. "Deb Britt" also retweeted a couple of messages of fellow-troll Ana. And they tried to gain followers by spreading hoaxes - messages with a proven viral potential.
On November 16 'John' tweeted a video of migrants wrecking a police car in Italy. But the video was made as part of an Italian movie and the fake message had been going around since 2014. Ana retweeted a fake message on November 16 coming from American anti-islam activist Amy Mek. The man in the video is not an imam preaching sharia on a German square but right-wing German provocateur Sven Liebich.
Trolls building their image first like this are a minority: soon the owners behind the (likely) Serbian pulp news websites switched to a different tactic. The 35 trolls that surfaced since start by following about 100 accounts and then post three links each to stories on tapainfo.com or tvrtinfo.com. The goal of this seems to be to stay under the radar because of the low volume. It appears it hasn't worked though: today Twitter has been slaying trolls in a virtual massacre that killed almost all trolls registered before November 24.
Reach
The two sites have reached a potential audience of 3.8 million people on Facebook in the week between November 15 and 27. Links to stories on tapainfo.com were shared over 22,000 times on Facebook pages with over three million followers in total. Tvrtinfo.com was able to rack up 6,330 shares with just 22 Facebook posts and reached over 800,000 potential followers. The public Facebook pages publishing the messages are mostly hangouts for Trump supporters, with names like "Drain the Swamp", "Army of Deplorables" and "Team Trump 2020".
With a story about a menacing message of a muslim leader to all Christian Americans (which was published on November 22) tapainfo.com reached a potential audience of 1.6 million in four days. In the U.S. it was retweeted by a major super PAC and a Fox News contributor:
A major pro-Trump super PAC, The Committee to Defend the President, & Rob O'Neill, who has been a Fox News contributor, on Saturday both shared an anti-Muslim hoax from a Macedonian fake news site. The hoax has spread on multiple fake news sites since last year. pic.twitter.com/6GeXxqG3ow
-- Alex Kaplan (@AlKapDC) November 26, 2018
Sources & acknowledgements
This story is a co-production of Nieuwscheckers (Peter Burger) and Lead Stories (Maarten Schenk). Information about the network of websites was discovered to a large degree via Lead Stories' monitoring tool Trendolizer.
Reach numbers are rough estimates based on CrowdTangle, a tool which indexes over 1.5 million public Facebook pages; reach inside Facebook groups is not counted. CrowdTangle establishes potential reach based on page likes and Twitter followers; this means some users can be counted twice.
You can read the list of fake Twitter accounts here. Also see the information on this network collected by American troll-hunter Josh Russell. The full list of sites in the network can be found here.
Thanks also goes to Jaap Kamphuis of the University of Leiden for his expertise in Slavic languages.
