BANNER: (Source: @r_osadchuk/DFRLab via www.flaticon.com)

Two of the most popular viral news aggregators in Ukraine ran a series of inauthentic Facebook pages to amplify external links to their own content and build their national audience, a DFRLab investigation has found.

On September 16, 2019, Facebook took down 149 pages, along with other assets, associated with Znaj Media Holdings, a large Ukrainian media conglomerate, for engaging in “coordinated inauthentic behavior.” The DFRLab examined 121 of the pages, 64 of which corresponded to the five Ukrainian media outlets of Znaj Media Holdings: Znaj.ua, Politeka.net, Akcenty, Hyser, and Clutch.ua. Znaj appeared also to be a possible subsidiary of a private PR firm, Pragmatico.

In its announcement, Facebook stated:

Beyond its connection to Pragmatico, this network appeared to be a systematic attempt at audience-building: the pages coordinated with one another to amplify the content of the multiple viral news aggregators under the Znaj Media umbrella. They did so by coupling generic news and lifestyle content with hyper-local coverage.

It was also a sizeable operation, as many of the pages had thousands of followers, and some reached several million. On its website, Znaj Media states its mission is “informing people” and claims it holds a leading position in the Ukrainian media market. Indeed, two of its subsidiaries, Znaj.ua and Politeka.net, both fall within the top three most visited websites in Ukraine. The pages may have had a commercial purpose, as the Znaj Media website includes a price list for ad placements on the websites of the various outlets under the Znaj Media umbrella. There is no information available as to who owns the media conglomerate, but the declared financial beneficiary is identified as a non-resident of Ukraine.

Facebook attributed the operation to a Ukrainian PR firm by the name of Pragmatico. Among the pages in the set was one by the same name.

A video advertisement on the firm’s Facebook page included a phone number, which showed up in a Powerpoint slide for a separate company by the name of “Doping Digital Agency” in which the company claimed to own and operate Znaj.ua, Politka.net, and Clutch.ua.

For the sake of this article, “Znaj.ua” and “Politeka.net” will be used to refer to the off-platform websites or website brands. “Znaj” and “Politeka,” without the appendages, will be used to refer to either specific Facebook pages, to the broader group of Facebook pages under each name, or to the parent company, Znaj Media Holdings. Similarly, while Znaj Media Holdings is likely a subsidiary of Pragmatico, the piece will refer to the former as most of the assets investigated fell under its direct purview.

A significant portion of the remaining pages in the takedown subset related to Znaj.ua and Politeka.net, two online news aggregators under the Znaj Media Holdings umbrella. Both websites primarily aggregate and republish news and social media content from elsewhere under their respective brands, providing only partial attribution in the form of mentions to social media post authors and hyperlinks to other media outlets. Neither of the two websites features bylines.

Of the 121 pages Facebook shared with the DFRLab, 58 — nearly half — corresponded to the local branches of one of these two news aggregators. These pages were named after the capital cities of the various oblasts (i.e., provinces) of Ukraine and devoted themselves to posting regional news. All the links on these pages led to the respective subdomains on the main domains of Znaj.ua and Politeka.net. A similar naming pattern — Realny plus a city name — also occurred for the pages associated with Realny (or “Real,” in Ukrainian).

The DFRLab also categorized a group of “one-off” pages as “Other;” these pages did not demonstrate a direct affiliation with Znaj Media Holdings. In terms of content, some of them focused on general interest topics, such as local news, politics, lifestyle, entertainment issues, while others were more specific; for example, some focused on the 2019 Ukrainian snap elections and the Ukrainian-Russian war in eastern Ukraine. Furthermore, an additional 19 pages were branded with Realny and behaved in a different manner, primarily posting memes and only occasionally linking to particular Znaj Media subdomains.

The DFRLab found several key indicators of coordination among these pages. One of these indicators was a single page creation date, which suggested that the same person or entity may have created them. The chart below shows that 37 of the Znaj and Politeka pages were created on December 22, 2018. This number constituted 30 percent of all the pages the DFRLab analyzed.

A significant number of the pages with a creation date of December 22, 2018, had zero posts but many followers. Of the 18 pages devoted to the Politeka brand created on that date, 12 (66 percent) had no posts. Of the 19 pages devoted to the Znaj brand, 16 (84 percent) had no posts.

On average, 14,153 users followed each of the post-less Politeka pages, while 12,307 followed each of the post-less Znaj pages. The smallest follower count for a Politeka page with no posts was 9,928, while the smallest follower count for a similarly blank Znaj page was 8,309. These follower counts are unusually large for pages without any content and suggested the use of inauthentic audience-building techniques.

A CrowdTangle analysis of the pages revealed significant surges in followers across the same dates for both Politeka and Znaj pages. Both the Politeka and Znaj pages for the Ukrainian city of Kropyvnytski, for example, were established on December 22, 2018, and had 1,900 followers within a week’s time. From December 30-January 5, both pages gained over 600 followers. Other significant growth periods were the late April to early May and late August to early September, when the pages saw an increase of 30 to 80 percent in followers. The overlap of time periods of similar extreme growth for two notionally independent pages further strengthens the possibility of coordination.

Neither page was running ads during the audience growth peaks in December and April, which suggested the followers were not acquired through paid Facebook advertising. The Znaj page did not run ads at all, while the Politeka page launched its first ads — in the form of promoted posts — on September 2, 2019.

The DFRLab also examined the Facebook users following the pages. The users had human-like patterns of activity and seemed to be primarily from Ukraine. Spam-like behavior or account locations vastly different from the followed pages’ region of interest would indicate automated activity or the use of like farms; neither was immediately apparent in this case.

While there was no clear evidence of inauthentic audience-building measures to explain the unusual follower growth for the content-less pages, both the Politeka and Znaj pages exhibited signs of clear coordination.

The local Politeka and Znaj pages for the city of Zhitomir, for example, shared an identical post at the same time, and both pages contained only this single post.

Of the 22 corresponding regional pages for the Znaj.ua and Politeka.net websites, 17 (77 percent) featured identical cover photos.

In addition to amplifying its own content, the various pages for each of the two aggregators also amplified links to the other aggregator. The Znaj page, for example, shared links to articles on both Znaj.ua and Politeka.net. Despite being hosted on two different domains, the articles communicated the same message: Aleksand Knyazuk, a Ukrainian Ministry of Interior official, might be corrupt. The sharing of each other’s content on multiple occasions, especially when it promoted a singular message, suggested these aggregators were coordinating.

The Politeka Kropyvnytskyi page provided further evidence of coordination between the Politeka and Znaj assets in its profile picture history. Despite posting no content, the page had updated its profile photo from the Znaj.ua logo to the Politeka logo. The page had never changed its name, however, according to its page transparency section.

The DFRLab also discovered that the Znaj.ua and Politeka.net external website domains are hosted on the same server. According to SpyOnWeb, a domain analytics platform, the domains share the same server IP addresses. Moreover, Clutch.ua, which also belongs to the Znaj Media portfolio, is also hosted on the same servers.

As further proof, according to Whois.net, a single company — Imena UA (Internet Invest Ltd) — was used to register and host all three websites.

Other pages included in the takedown amplified both news aggregators. LeapKids Академія Нещастя (“LeapKids Academy of Misfortune”) and Київ Проти Корупції (“Kyiv Against Corruption”), for instance, both published posts that linked to the Znaj.ua and Politeka.net websites.

Some of the Realny pages engaged in similar behavior but also exhibited characteristics that distinguished them from the remainder of the assets in the takedown. The Realny pages posted identical memes as one another and also served as content amplification platforms for specific external websites. Two of the Realny pages linked to the Znaj.ua website, while others, such as “Realny Lutsk” and “Realny Zhitomir,” linked to external websites devoted to their corresponding city. (For example, the Lutsk page linked to Lutsk.rayon.in.ua; the Zhitomir page linked to Zhitomir.info.)

This behavior suggested that the Realny outlet aimed to attract hyper-local audiences using generic memes in tandem with region-specific news content. Most often, each of these pages served as a content amplification platform for a single website.

The DFRLab investigated whether the Realny pages were tied to Znaj Media Holdings and could not find any evidence of a connection. That said, the pages Real Lviv and Real Kharkiv both shared content from SQ Media, which, according to Whois.net and similar to Politeka.net, Znaj.ua, and Clutch.ua, was also registered using Imena.ua’s registration services. Additionally, the cities that SQ Media covers in specific subsections on its website overlaps significantly with the Facebook page names (e.g., “Real Lviv,” “Real Kharkiv”); for example, SQ Media’s page has subsections devoted to Lviv and Kharkiv extensively.

Another page included in the takedown, Міністерство Люстрації (“Lustration Ministry”), exhibited a different content amplification strategy altogether: the use of paid Facebook advertising. This page focused mostly on accusations that various Ukrainian politicians were corrupt, publishing incriminating links to articles from Znaj.ua and Politeka.net that it paid to promote via Facebook advertising. The Znaj.ua website, in turn, reprinted some of the promoted posts from this page.

Some of the politicians featured in Lustration Ministry’s promoted content were also the subjects of pages dedicated to personally attacking them; these pages were also included in the takedown.

The DFRLab found numerous indicators of coordinated activity among the assets in this takedown set, including identical page creation dates, identical posts and links, as well as the amplification of the same set of external websites, some of which shared a server IP address.

The pages primarily posted local Ukrainian news content, much of which was lifted from other Ukrainian news outlets with only partial attribution. This network may have been partially politically motivated — some of the pages launched personal attacks against particular Ukrainian politicians — and partially commercial in nature. The Znaj Media website, however, also published a price list for ad placements on its various online subsidiaries.

Despite posting no content, some of the pages exhibited several periods of abnormal audience growth. It remains unclear how these pages managed to amass substantial followings. The DFRLab tested two theories: the use of authentic paid Facebook advertisements and the use of inauthentic “like farms,” but found that neither explained the periods of sharp audience growth.

Follow along for more in-depth analysis from our #DigitalSherlocks.