SUMMARY
This investigation, which took place between May and August 2022, shows that a network of German- and English-language Facebook pages are using the platform to build an online following of millions which can be financially exploited. We identified this network by analyzing various open-source information, such as Google Analytics and AdSense codes, web infrastructure, and CrowdTangle data.
The pages appear to build their audience by promoting clickbait content—including misinformation and conspiracy theories—generated within the network, while concealing the fact that they are part of the same network. The network employs multiple elements for monetization of web traffic, such as Google AdSense and e-commerce advertisements, suggesting that the main motivation for this operation is financial in nature. We can link this network to pravda-tv.com, a German website well-known for publishing misinformation and conspiracy theories.
Introduction
AnonHQ first caught our attention with this article it published in April 2022, claiming that the SARS-CoV-2 virus was engineered in a laboratory and released. To date, there’s no evidence supporting this claim, and scientific evidence so far indicates that the virus evolved naturally and was transmitted to humans in a zoonotic infection.
We observed that AnonHQ doesn’t disclose the identities of those who own the website or those who write for the website. The lack of transparency hasn’t hindered its audience growth, however. Its Facebook page showed that it amassed a large following: more than 5.5 million users had liked the page. The page also ran a Facebook group named Anonymous, with more than 39,000 followers. Notably, these numbers rival that of Facebook pages of reputable, traditional news outlets like CNBC and the Washington Post, which have more than 3.9 and 6 million likes, respectively.
The website and Facebook page of AnonHQ clearly seek to emulate Anonymous, an informal hacktivist collective known for various cyberattacks against governments and institutions, as demonstrated by the use of the Anonymous logo and part of its motto (“We Are Anonymous. Expect Us.”).
Screenshots of the anonhq.com home page, the About section on its Facebook page, and the group linked to the Facebook page. (Source: anonhq.com/archive, top left; Facebook, top right and bottom)
We first examined anonhq.com WhoIs information and server records using Domain Tools and DNSLytics. The WhoIs records showed that the website owner used a domain privacy service (Domains By Proxy, LLC), therefore no personally identifiable information about the website owner was available.
WhoIs records for anonhq.com. (Source: Domain Tools)
However, we noticed that anonhq.com shared the same mail server as another website, captain-planet.net, suggesting a link between the two.
Identical mail server used for anonhq.com and captain-planet.net. (Source: DNSLytics)
Following up on this lead, we identified a Google AdSense code (pub-8724753500373215) that captain-planet.net shared with two other websites, medizin-heute.net and unserplanet.net.
Reverse Adsense search on DNSLytics showed a Google AdSense code (pub-8724753500373215) common to captain-planet.net, medizin-heute.net, and unserplanet.net. The presence of the code on these websites was verified by checking the source code of these websites. (Source: DNSLytics, left; captain-planet.net, top right; unserplanet.net, center right; medizin-heute.net, bottom right)
Google AdSense codes enable website owners to monetize their web traffic by displaying ads and each code is specific to the owner. This makes Google AdSense codes useful for establishing associations between seemingly unrelated websites and identifying website ownership by tracing such associations. These codes have been used as a basis for investigating associations between websites and website ownership, as shown in this report by the Digital Forensic Research Lab and this report by Global Voices.
We also examined the Facebook pages of captain-planet.net (@wesaveblueplanet) and unserplanet.net (@unserplanet; “Our Planet” in German), finding that both pages essentially publish the same content, largely revolving around the themes of nature and environmentalism, except in different languages. captain-planet.net publishes content in English while unserplanet.net publishes in German.
We also observed the same pattern between anonhq.com (English) and the website derwaechter.com (German). The connection between these two was identified through a SpyOnWeb search, using a Google AdSense code present on anonhq.com (pub-5986748907447277). These two websites focused on the theme of conspiracy theories, such as the baseless claim that Ukraine has secret U.S. biological labs (see articles here and here). derwaechter.com was identified based on a shared Google AdSense code with anonhq.com. derwaechter.com has its own Facebook page (@waechter.investigativ; “Der Waechter” meaning “The Watchman” or “The Guard” in German).
Source code of anonhq.com, showing the Google AdSense code pub-5986748907447277. A search on SpyOnWeb turned up several results, one of which was derwaechter.net. (Source: anonhq.com, top; SpyOnWeb, bottom)
As with anonhq.com, the WhoIs records for these websites also indicate that domain privacy services were used.
WhoIs records for derwaechter.net (top left), medizin-heute.net (bottom left), captain-planet.net (top right), unserplanet.net (bottom right). (Source: Domain Tools)
All told, these Facebook pages accumulated more than seven million likes and follows in total. It is probable that there are users who liked and followed more than one of these pages, therefore one caveat is that the total number of likes and follows doesn’t necessarily correspond to the actual number of users who liked and followed these pages. The latter number is likely to be smaller.
Information on Facebook pages and groups associated with these websites.
Notably, the Facebook pages for these websites are all run by accounts in Germany, based on the Page transparency tool on Facebook, even though Anon HQ’s Facebook page claims to be located in Delaware, Ohio.
All the Facebook pages we observed in this network were run by accounts in Germany, based on Facebook’s Page Transparency feature. (Source: Facebook)
Four of the websites provided cryptocurrency addresses for users to donate money; three of the four used the same cryptocurrency addresses in their request for donations from readers (captain-planet.net, unserplanet.net, derwaechter.net).
Screenshots of cryptocurrency addresses on the websites. Three of the websites display identical cryptocurrency addresses (Source: captain-planet.net/archive, top left; unserplanet.net/archive, top right; derwaechter.net/archive, bottom left; anonhq.com/archive, bottom right)
Germany has made it mandatory by law for websites to include an impressum, which needs to provide basic details about who or what organization is behind the website presence, such as the names of individuals and companies involved, their commercial address, and contact details like email addresses. In accordance with this law, the German-language websites derwaechter.net, medizin-heute.net, and unserplanet.net provide this information.
Impressums on unserplanet.net, medizin-heute.net, and derwaechter.net (clockwise from left). (Source: unserplanet.net/archive, medizin-heute.net/archive, and derwaechter.net/archive)
However, we were unable to locate the named individuals through a Google search. Medisanas Ltd. is a company manufacturing healthcare devices; we didn’t find evidence indicating that it is related to medizin-heute.net. This finding suggests that these are simply pseudonyms aimed at concealing the true identity of individuals involved in running these websites.
Sharing of content between associated Facebook pages and websites
The websites also tended to publish identical content in both English and German, commonly using identical or similar images to illustrate their articles, as seen from the screenshots below.
Identical articles in English (left) and German (right) published by this network of websites. (Source: captain-planet.net/archive, archive, archive; unserplanet.net/archive, archive, archive; anonhq.com/archive, archive, archive; derwaechter.com/archive, archive, archive)
Furthermore, we observed that the Facebook pages commonly shared content from sister websites—websites within the network that have no obvious relationship to the Facebook page. Sometimes, articles dating from a few years back are reshared again as if they are new (see the example of the lion article below).
A medizin-heute.net article about the antibiotic properties of honey, and an unserplanet.net article were shared by the Facebook pages Anonymous Offiziell and Der Waechter. The shares of the medizin-heute.net article all took place on the same day; the shares of the unserplanet.net article took place within minutes of each other. Anonymous Offiziell and Der Waechter ostensibly have no association to either of these websites. (Source: Facebook)
A captain-planet.net article claiming that lions ate three poachers was shared in October 2018 and shared again in April 2022 across multiple Facebook pages. The German Facebook pages shared the same content, translated to German on unser-planet.net (bottom row). (Source: Facebook)
Using data from CrowdTangle, we were able to analyze the number of shares from each of the involved domains (anonhq.com, captain-planet.net, unserplanet.net, derwaechter.net, and medizin-heute.net) and determine if certain Facebook pages accounted for a disproportionately larger number of shares for any of these five domains.
The number of shared URLs analyzed for anonhq.com was 10,000 (the limit we used for our data download request); 8,075 for derwaechter.net; 5,739 for captain-planet.net; 5,492 for unserplanet.net; and 2,344 for medizin-heute.net.
Network map showing the Facebook pages, denoted by circles (nodes), that shared the most number of URLs (appearances) from any of the five domains in the network. The larger the text size, the greater the total number of appearances. A line between two nodes, also called an edge, indicate that the Page shared at least one URL from a domain. The thicker the line, the more URLs from that domain were shared by the page (more weight). Edges with a weight of less than 50 were filtered out for clarity. Graph generated using Gephi.
As expected, the Facebook pages that were directly related to a website (e.g. anonhq.com and ArmyAnonymous) most often shared URLs from that website. But our network map also showed that the pages ArmyAnonymous and Der Waechter commonly shared content from the sister websites, like captain-planet.net, medizin-heute.net, and unserplanet.net. This suggests that the Facebook pages are a vehicle for amplifying content from the network in general.
We Watch Fake Anonymous, a German-language Facebook page, previously investigated this network of websites and Facebook pages and observed the same behavior; their report on this network comes in two parts and can be found here and here.
NewsGuard, a company that rates the credibility of information and news websites and investigates disinformation, also reported the same activity between the Facebook pages Anonymous Offiziell, Der Waechter, Unser Planet, and Medizin Heute. These observations, which are independent of our investigation, validate our findings.
However, We Watch Fake Anonymous and NewsGuard didn’t report conclusive identities of the individual(s) involved in running this network of Facebook pages and websites with millions of followers. In hopes of addressing this question, we made this the objective of our investigation.
We inspected the Facebook accounts that were linked to associated websites. On the Facebook page of medizin-heute.net (@medizinheute), we found a link to the website vitaminum.net, which has its own Facebook page Vitaminum ProLife. While going through the timeline of Vitaminum ProLife’s Facebook page, we found, among other things: a re-share of a post by Der Waechter, a post sharing an article by pravda-tv.com, and a post sharing an article by anonymousnews.ru. Like most of the websites in this network, both pravda-tv.com and anonymousnews.ru publish content in German.
The presence of a link to vitaminum.net on the Facebook pages of Medizin Heute and Vitaminum ProLife. (Source: Facebook)
Association with pravda-tv.com and Nikolas Pravda
The WhoIs records for pravda-tv.com show that the owner uses a domain privacy service, but we didn’t need to rely on these records, as its founder, Nikolas Pravda, clearly indicated his involvement in the website, based on the information in the About Us page on pravda-tv.com. On the website, Pravda stated that he is originally from the Czech Republic and later moved to Germany, and that he spent 16 years working in marketing and advertising. He founded the website in 2012.
WhoIs records for pravda-tv.com. (Source: Domain Tools)
pravda-tv.com is a German website that has been cited in reports for publishing false information and conspiracy theories, some of which were debunked by fact-checkers in Germany (see here, here, and here). It held the dubious honor of being rated by NewsGuard as one of the top 10 German-language websites spreading COVID-19 misinformation in 2020, and cited for spreading election misinformation in the run-up to the German federal elections in 2021. It also published articles that promote pro-Kremlin narratives, like this one and this one.
Clicking on a link to pravda-tv.com brings up this warning by Facebook that the website doesn’t meet Facebook’s Community Standards.
A warning message that appears on Facebook upon clicking a link to pravda-tv.com. (Source: Facebook)
The exact reason for this isn’t given in the warning, but based on these posts dating back to 2019 by Pravda TV’s Instagram account (@pravdatvblog), several links leading to pravda-tv.com were considered to be spam by Facebook. Spam is against Facebook’s Community Standards. Among some reasons a person might receive such a warning is if they “Posted or shared something too quickly or too often in a short amount of time”, “Sent someone a message or link that they marked as unwelcome” or “Contacted people for commercial purposes without their consent”.
Interestingly, Pravda’s VK profile indicates he follows only two accounts. One of them is Pravda TV, which he is known to run, while the other is associated with anonymousnews.ru.
anonymousnews.ru was cited by the Bundestag, the German federal parliament, for repeatedly publishing false information and conspiracy theories. The website is no longer active, but its URL currently redirects to another domain anonymousnews.org, which continues publishing content along the same themes. Evidence suggests that both websites were run by Mario Roensch, a former member of the far-right political party Alternative for Germany. Buzzfeed News reported in February 2017 that Roensch went on the run from authorities following charges of “incitement of the people” and spreading disinformation, both of which are considered crimes in Germany.
Roensch was eventually arrested in Hungary in March 2018 and extradited to Germany, where he was convicted for illegally selling firearms online in December 2018 and sentenced to three years and two months’ imprisonment.
We weren’t able to find information indicating that Pravda was or is associated with the websites allegedly run by Roensch, but one may speculate that anonymousnews.ru’s successful use of the Anonymous brand to attract an online audience may have inspired this network to do the same.
Screenshots of the VKontakte profiles of Nikolas Pravda and anonymousnews.ru. (Source: VKontakte)
Another website that is likely run by Pravda is anti-matrix.com, which like anonhq.com and derwaechter.net, publishes content about conspiracy theories (see examples here and here). We can establish a strong association between the two websites through multiple observations: the presence of links to anti-matrix.com on pravda-tv.com; the impressum on anti-matrix.com, which clearly shows it was copied from pravda-tv.com; the fact that pravda-tv.com and anti-matrix.com share the same IP address and mail server, according to DNSLytics.
Source code of pravda-tv.com containing links that direct users to anti-matrix.com, while the impressum on anti-matrix.com shows the name PRAVDA TV, suggesting that it was likely copied from pravda-tv.com. On the right of the impressum, we can see advertisements for books written by Pravda (Source: pravda-tv.com, top; anti-matrix.com/archive, bottom)
Identical IP address (85.13.129.143) and mail server (w0127fc6.kasserver.com) shared between pravda-tv.com and anti-matrix.com. (Source: DNSLytics)
We identified two Google Analytics codes (UA-168915890 and UA-199725947) on pravda-tv.com, which we had previously discovered on unserplanet.net, captain-planet.net, and derwaechter.com. Google Analytics enables website owners to track web traffic on websites; each code is unique to a particular user account.
The Google Analytics codes (UA-168915890 and UA-199725947) are present in the source code of pravda-tv.com, captain-planet.net, derwaechter.net, and unserplanet.net. (Source: pravda-tv.com/archive, top left; derwaechter.net/archive, bottom left; captain-planet.net/archive, top right; unserplanet.net/archive, bottom right)
These two shared Google Analytics codes provide strong evidence linking this network of Facebook pages, Facebook groups, and webpages to pravda-tv.com and by extension, Nikolas Pravda.
Pravda did not respond to our request for comment.
Heavy presence of product advertisements on associated Facebook pages and websites
pravda-tv.com has several features in common with the network of websites and Facebook pages. For example, pravda-tv.com is heavily populated by advertisements for products and links to online shops. One of them is for Vitaminum ProLife, which the Facebook page Medizin Heute also links to (discussed above).
Some of the advertisements displayed on pravda-tv.com. Note the advertisements to Vitaminum ProLife and its published books on the top-right hand corner. (Source: pravda-tv.com)
The Facebook pages in German (Unser Planet, Medizin Heute, and Der Waechter) also commonly interspersed posts from associated websites with posts promoting products from the e-commerce shop Waagemann.
Product advertisements for the e-commerce shop Waagemann posted on Facebook pages within the network. (Source: Facebook)
The English-language counterpart to Waagemann appears to be the website amazyble.com (Facebook page @amazyble; its Page transparency info shows that it is run by accounts mainly located in Germany). The Facebook page Anonymous Offiziell includes a link to the website anon-store.com, which redirects to the website amazyble.com, as DNSLytics showed. This establishes an association between the e-commerce shop and the Facebook pages in the network.
Screenshot of the Facebook page Anonymous Offiziell and URL redirect information. (Source: Facebook, top; DNSLytics, bottom)
Like the German Facebook pages, the English Facebook pages in the network posted advertisements for e-commerce (Amazyble in this case).
Posts promoting products on Amazyble featured on the English Facebook pages associated with anonhq.com and captain-planet.com. (Source: Facebook)
On TrustPilot, a website that allows customers to rate businesses, we found a five-star (out of five) review for Waagemann left by the user Amazyble—this is yet another association established between these two e-commerce websites and another indication that they are part of the same operation.
Screenshot of a review on Waagemann left by Amazyble on Trustpilot. (Source: Trustpilot)
Amazyble’s own Trustpilot reviews also suggest an association with the network of websites. One review was left by Sonja Schmidt—this is the same name used in the email address listed on the impressum of medizin-heute.net.
Screenshots of a review left by Sonja Schmidt for Amazyble and part of the impressum on medizin-heute.net. (Source: Trustpilot, left; medizin-heute.net, right)
Our findings strongly indicate that Pravda is involved in this network, but the size of the network makes it unlikely that only one individual is responsible for running all of these websites and Facebook accounts. During our investigation, the Page transparency information for the Facebook page Unser Planet changed. On 4 July 2022, the Page transparency information didn’t list the name of the admin. But on 15 July 2022, we observed that Taylan Demir was listed as one of the admins of the page.
A LinkedIn search for Taylan Demir showed that he is the owner of Waagemann. A Facebook post by Demir in February 2021, containing an image of the Waagemann logo, showed that he was seeking partnerships for his e-commerce business.
Screenshots of the change in Page transparency information from 4 to 15 July 2022, a Facebook post by Demir, and Demir’s LinkedIn profile, showing that he is the business owner (unternehmensinhaber in German) of Waagemann. (Source: Facebook, top left, top right and bottom left; LinkedIn, bottom right)
Taken together, we can infer that Demir is also involved in the running of at least some Facebook pages and websites in the network.
Science Feedback reached out to Meta with our findings. In their response, Meta stated that they didn’t consider this activity to be in violation of Facebook’s Community Standards, specifically the policy against inauthentic behavior. At the time of this report’s publication, the Pages we examined remain operational.
Conclusion
Our findings indicate that a network of German- and English-language Facebook pages, operating primarily in Germany, is exploiting the platform to direct web traffic to its websites and affiliated e-commerce shops Waagemann and Amazyble (see network map below).
The network of websites and Facebook accounts detected in this investigation. Graph generated using Maltego. Note: This map should not be considered exhaustive; the network likely involves more Facebook pages and groups.
These Facebook pages build that web traffic by amplifying clickbait content—including misinformation and conspiracy theories—generated from within the network, while concealing the fact that they are actually part of the same operation. This has the effect of making the amplification appear organic, when it is not.
Having accumulated millions of followers, the network can harness various tools to monetize web traffic, such as Google AdSense and product advertisements, suggesting that the main motivation for this operation is financial in nature, although one also cannot exclude possible political and ideological motivations.
The Global Disinformation Index reported in 2020 that disinformation sites in Europe raked in more than US$76 million in ad revenue every year. Clearly, disinformation is big business, enabled by platforms’ prioritizing the promotion of content attracting engagement, as opposed to content of high credibility.
Although monetization of disinformation commonly takes place through the placement of online advertising, this particular network’s promotion of e-commerce shops represents another potential way to benefit financially from such an operation, and profits through such a channel may be even harder to track than for online ad revenue.
When the network is taken as a whole, we can see that it employs both innocuous and conspiratorial clickbait—posts about animal welfare and conservation are juxtaposed with disinformation about “Ukrainian bio-labs”. The use of such disparate themes could improve the Facebook pages’ appeal to different audiences, allowing the network to attract more followers.
Because of the lack of transparency in terms of ownership of these websites and pages, it can be challenging for Facebook users to avoid participating unwittingly in the promotion of such networks, whether it is by simply liking a Facebook page or sharing its content.
In the face of platforms’ inaction against such for-profit disinformation operations, which do not necessarily violate existing policies such as those against inauthentic behavior, it is critical to improve the general population’s media literacy skills to enable users to recognize when a source may be unreliable, as the first line of defense against being an unwitting participant in a disinformation operation. In addition, open-source investigations that reveal the inner workings of disinformation operations, like this one, will be critical in bringing such operations to light and ensuring that the public is aware of the actors involved and the impact of such activities.