Venezuelan fringe websites impersonate media outlets on Facebook

Facebook assets impersonating CNN en Español and NTN24 promoted content created by two external websites

@DFRLab
@DFRLab
Mar 24 · 7 min read

Two recently created websites that routinely publish anti-Maduro content — Alexsnews.com and Sharesocial.app — appeared to have used inauthentic assets on Facebook to amplify their material. These assets (one fan page and two groups) impersonated well-known Spanish-language news outlets, such as CNN en Español.

By DFRLab’s count, at least 18 of assets, including the fake groups and page as well as associated accounts, have now been removed from the platform in response to the DFRLab’s investigation. A Facebook spokesperson told the DFRLab:

We routinely take action when we find violations of our Community Standards, including financially motivated activities like spreading clickbait content. In this case, we removed a number of Pages and accounts that used deceptive and spammy tactics to drive people to websites to generate ad impressions.

The DFRLab has previously identified similar behavior in which Facebook groups and fan pages took advantage of authentic media outlets’ credibility to reach a wider audience, such as during the Bangladesh 2018 elections. This behavior serves two functions: first, it uses high-profile names to draw in a larger audience more quickly; and, second, by doing so, it undermines audience trust in the media outlets being impersonated.

The use of inauthentic assets posting about politics is particularly worrisome in Venezuela, a country that is in the middle of a political, economic, and humanitarian crisis that has forced 4.5 million people to leave the country. Most recently, amidst a growing fear of a coronavirus outbreak, this dynamic has contributed to fears that the disease might lead to increased migration and, as a consequence, spread beyond the country’s borders.

The content published by these websites was related to political events in Venezuela. While the websites published political content with an anti-Maduro slant, they appeared to be primarily profit-driven, as the DFRLab found that the content had been monetized.

The DFRLab found a Facebook group and a page that impersonated CNN en Español (“CNN in Spanish”) and a Facebook group that pretended to be the Colombian right-wing television channel NTN24 in Venezuela.

Screenshot of three fake assets, with boxes added around the number of followers and creation date for each. (Source: CNN en Español Latinoamerica/archive, left; CNN en Español/archive, top right; NTN24 Noticias Venezuela/archive, bottom right)

NTN24 is a private Colombian broadcaster that focuses on international news and is available on cable in many Latin American countries. While it was banned from broadcasting in Venezuela by the Maduro regime on February 12, 2014, following its coverage of anti-government protests around that time, the channel is still available for Venezuelans to view online.

The official CNN en Español and NTN24 services both have Facebook pages but do not maintain groups on Facebook. Out of this lack, the fake groups were more easily able to position themselves as authentic, as they used the exact same name as the real outlets.

The CNN en Español Latinoamerica fake page uses the original CNN en Español logo (orange box). Facebook group impersonating CNN en Español uses same name as the official page (red box). (Source: @danielsuarezper/DFRLab via CNN en Español/archive, top; CNN en Español Latinoamerica/archive, middle; CNN en Español/archive, bottom)
NTN24 Venezuela official Facebook page, without the “Noticias,” indicating Facebook’s blue verification label (blue boxes). By contrast, the NTN24 Noticias Venezuela fake group uses the original logo of NTN24 Venezuela (green boxes) as its cover photo. (Source: @danielsuarezper/DFRLab via NTN24 Venezuela/archive, top; NTN24 Noticias Venezuela/archive, bottom)

An analysis using social media listening tool CrowdTangle showed that, between March 1, 2019, and March 12, 2020, the majority of posts in these groups contained links. This behavior would not be surprising as the content of many pages and groups comprises links: in this case, however, over the last three months, most of these posts linked to articles from two specific websites — Alexsnews[.]com and Sharesocial[.]app.

Screenshots of analyses performed using CrowdTangle for the CNN en Espanol Latinoamerica Facebook page (top), the CNN en Espanol Facebook group (middle), and the NTN24 Noticias Venezuela Facebook group (bottom). The vast majority of posts to these assets impersonating CNN and NTN24 contained links to the two external websites. (Source: @danielsuarezper/DFRLab via CrowdTangle)

Alexsnews[.]com and ShareSocial[.]app are both fringe outlets mostly covering Venezuelan affairs and publishing anti-Maduro content. Both use the same template and publish sensationalist and misleading content: in early February 2020, for instance, Alexsnews[.]com used a video manipulated and taken out of context to claim that U.S. President Donald Trump had ordered a military intervention in Venezuela. Since the beginning of the year, the DFRLab has noticed that these websites were routinely garnering more engagement than traditional outlets when covering political events in Venezuela.

AlexsNews.com (top) and Sharesocial.app (bottom) share similar website templates. (Source: AlexsNews.com, top; Sharesocial.app, bottom)

The websites do not have an “About” section and do not provide any contact information for their operators. While articles published by ShareSocial[.]app do not have byline, most of the articles on AlexNews[.]com were written by Alex Paz, who authored over 1,200 publications between December 10, 2019, and March 10, 2020.

Both websites were created by a person named Facundo Delonuas: Alexsnews[.]com on December 6, 2019, and Sharesocial[.]app on September 26, 2019, according to website registration records.

Screenshots from website registration records (blue boxes) for Alexsnews.com (left) and Sharesocial.app (right) indicating that both websites were registered by Facundo Delonuas (red boxes). (Source: @jeanleroux/DFRLab via GoDaddy , left; @jeanleroux/DFRLab via GoDaddy , right)

According to his Facebook profile, Delonuas lives in Plottier, Argentina, and works for the Concejo Deliberante (local legislative institution) of the city. A publication by the Argentinian website Poder Local indicated that Delonuas is a real person that has written for the website of Plottier’s legislative house. Delonuas’s Facebook account was also listed as an administrator for the fake NTN24 Noticias Venezuela group.

Alexsnews[.]com and Sharesocial[.]app monetize their websites using the advertising monetization tools Google Adsense and Taboola. They share the same Google Analytics code, meaning that the money they receive from ads goes to the same person.

Image shows that AlexNews and ShareSocial use the same Google Analytics ID. (Source: @jeanleroux/DFRLab via DNSlytics)

They also use similar Taboola account names, “yosoyvenezolano” and “yosoyvenezolano-avance24,” both of which translate to “I am Venezuelan.”

Alexsnews.com and Sharesocial.app are connected through their advertising Taboola account, both containing the phrase YoSoyVenezolano (highlighted yellow), found in the source code for the websites. (Source:@jean_leroux/DFRLab via Sharesocial.app, top; AlexsNews.com, bottom)

These fringe websites and Facebook pages were connected not only through their behavior (sharing links to the sites) but also through the identities of their Facebook administrators and moderators.

Graphic showing the connection of the websites to the Facebook groups and page through the Facebook admins. (Source: @danielsuarezper/DFRLab)

Both fake Facebook groups — CNN en Español and NTN24 Noticias Venezuela — shared moderators or administrators. As of March 13, 2020, they had six common Facebook accounts as either moderators or admins. However, the groups changed their admins constantly.

NTN24 Noticias Venezuela and CNN en Español fake groups shared at least six common admins (red boxes). (Source:@danielsuarezper/DFRLab via NTN24 Noticias Venezuela, left; CNN en Español/archive, right)

The most obvious connection discovered by the DFRLab was between the websites and the fake NTN24 group. This group was created by Delonuas, the same person who registered AlexNews[.]com and ShareSocial[.]app. Additionally, a Facebook page called Noticias Yuanflix Venezuela Informa, connected to another website registered by Delonuas, was listed as an administrator of the fake NTN24 Noticias Venezuela.

The NTN24 fake group was created by Facundo Delonuas, who allegedly worked for the website of Plottier’s legislative house. (Source: NTN24 Venezuela/archive)

AlexNews[.]com, however, was also connected to these groups. One of the common admins of both fake groups was Alex Paz, who shares a name with the individual that authored much of the content on the Alexsnews[.]com website. Alex Paz also posted several links to the CNN en Español and NTN24 Noticias Venezuela groups.

Screenshots from the Facebook profile for Alex Paz (left) and the admin and moderator page for CNN en Español (right). Alex Paz was a common administrator for the AlexNews Noticias and CNN en Español pages and listed himself as a manager for AlexNews Noticias. (Source: @luizabandeira/DFRLab via Alex Paz/archive, left; CNN en Español/archive, right)

Another aspect of Facebook is that, besides individual accounts, pages can also be administrators for groups on the platform. In this case, the fake CNN en Español Latinoamerica page was also one of the admins of the fake CNN en Español group, suggesting that the two assets were connected. Moreover, the admins of the page were located in Argentina and Venezuela, where Delonuas and Alex Paz indicated they are based, respectively.

The fake CNN en Español page was one of the admins of the fake CNN group. The admins of this page were located in Argentina and Venezuela. (Source: @danielsuarezper/DFRLab via CNN en Español/archive)

Finally, the Facebook page Yo apoyo a Juan Guaidó (“I support Juan Guaidó”) linked to the website in its About section and was one of the admins of the CNN en Español page. There was, however, no indication that Guaidó’s team was involved with the page. Moreover, AlexsNews[.]com has previously published content critical of Guaidó’s public statements; in one example, Alex Paz published an article encouraging military intervention in Venezuela after Guaidó claimed that intervention was not his preferred course to remove Maduro from power.

Screengrabs from the CNN en Español Facebook page indicating “Yo apoyo a Juan Guaidó” was one of the page admins. (Source:@danielsuarezper/DFRLab via CNN en Español/archive)

Three apparently inauthentic Facebook assets were used to amplify content published by two external websites. While the websites published anti-Maduro content, they did not necessarily have a political motivation: because the websites were monetized, it is likely that the primary motivation for these assets was financial rather than political influence.

For monetized websites, more clicks translate to more money. As such, in an attempt to garner more page views, the websites’ owners appeared to have created Facebook pages and groups masquerading as real news outlets, literally capitalizing on a seeming affiliation with a reputable outlet.

The secondary effect of coopting the identities of established media outlets is a possible reduction in public confidence in the outlets being impersonated. A reader may understand that a story posted by the fake assets is untrue but be unable to distinguish that the assets themselves are fake (i.e., that it is not from the reputable news outlet). Conversely, a less careful reader might assume the information to be true because it appears to be from a reputable outlet, even when it is not. This dynamic is particularly concerning in Venezuela, where the government controls most of the information flow and citizens depend on independent outlets to receive trustworthy information.


Daniel Suárez Pérez is a Research Assistant, Latin America, with the Digital Forensic Research Lab.

Luiza Bandeira is a Research Associate, Latin America, with the Digital Forensic Research Lab.

Jean le Roux is a Research Associate, Southern Africa, with the Digital Forensic Research Lab.

Follow along for more in-depth analysis from our #DigitalSherlocks.

DFRLab

@AtlanticCouncil’s Digital Forensic Research Lab.

@DFRLab

Written by

@DFRLab

@AtlanticCouncil's Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

DFRLab

DFRLab

@AtlanticCouncil’s Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

Welcome to a place where words matter. On Medium, smart voices and original ideas take center stage - with no ads in sight. Watch
Follow all the topics you care about, and we’ll deliver the best stories for you to your homepage and inbox. Explore
Get unlimited access to the best stories on Medium — and support writers while you’re at it. Just $5/month. Upgrade