A collection of domains, controlled by a small group of users, could be used to spread fake news, bypass spam rule, or track and dox other users. (ProtectVoat)

submitted ago by MadWorld

Part 1 of 7

In continuation of the last submission, regarding the list of 20+ connected domains that spread fake news, I looked further into the characteristics of those domains and those submitters on Voat. I am not sure what to expect with this submission, other than presenting my findings and voice my opinions with the data I have collected at hand. You may notice that the archive dates are spread out across a whole week, that is because it was done in bits and pieces.

Notice that this data may be incomplete, as most of the 20+ domains were already offline or wiped, shortly after the last submission. Because of the number of domains involved, I made minimal effort to archive those sites. Lately, I had to resort to the timestamps from the search engine.

tl;dr: a collection of domains, controlled by a small group of users, could be used to spread fake news, bypass spam rule, or track and dox other users. Use vpn, tor, or anon proxies when possible, especially for high profile users.

Let's start by defining the metrics used to flag a domain, along with the submitters. A domain is flagged as suspicious, along with the users involved, if it exhibits one or a combination of the following characteristics:

  1. First submission to Voat being too close to domain's registration date: This strongly suggests that the submitter is directly or indirectly affiliated with the domain involved. This submitter either owns the domain or pushes the domain for its owner.
  2. Low traffic site recently been updated, closely followed by a submission to Voat: This suggests a weak but similar condition as #1.
  3. Site's wayback activity sparsely archived, with submission too close to the archived date: It suggests that the site showed some recent activity.
  4. Site's traffic history, followed too closely to the submission date: When a low traffic or barely active site made a submission on Voat, its traffic increases, followed by its decline back to zero or low traffic steady state.
  5. Multiple domains sharing the same set of IPs: Sharing IPs is common in shared hosting, but having those domains coincidentally showed up by a user or a small group of users, is not so common. This technique was probably used to circumvent Voat's spam rule, or possibly to disguise something else, such as repackaging of MSM news behind no-name domains.

Status of domains been investigated:

  • Domain1 akniinfo.com, taken offline, short-lived.
  • Domain2 cbinfo24.com, taken offline, short-lived.
  • Domain3 coolinfo24.com, taken offline, short-lived.
  • Domain4 cukam.com, taken offline, short-lived.
  • Domain5 cvikas.com, taken offline, short-lived.
  • Domain6 cvikasdrv.com, taken offline, short-lived.
  • Domain7 dailyinfo24.info, re-purposed, but traffic continued.
  • Domain8 fergieinfo.com, taken offline, short-lived.
  • Domain9 lifeinfo24.net, taken offline, short-lived.
  • Domain10 ludinfo24.com, taken offline, short-lived. First submission made 3 days after domain registration.
  • Domain11: mminfo24.com, taken offline, short-lived.
  • Domain12: policeglobal.com, still online on 2019-01-19.
  • Domain13: scandallinfo.com, online but data wiped, short-lived. First submission made only 12 hours after domain registration, very interesting!
  • Domain14: tapainfo.com, taken offline, short-lived. First submission made 4 days after domain registration.
  • Domain15: thenyherald.com, taken offline, short-lived. First submission made only 2.5 days after domain registration.
  • Domain16: tvrtinfo.com, taken offline, short-lived.
  • Domain17: usapatriotsvoice.com, taken offline on 2019-01-21.
  • Domain18: vtamedia.com, taken offline on 2019-01-21.
  • Domain19: classic2017.info, taken offline.
  • Domain20: ilovemyamerica.net, suspended.
  • Domain21 libertyinfonews.com, still online, but short-lived. First submission to Voat, 8 days dated from site's earliest article.

This list came from previous submission, where the domains were flagged for sharing a subset of identical articles that contained fake news. These domains also showed very short user engagement, suggesting clickbait nature.

Suspects found, evaluated by timestamps associated with domain registration, wayback archives, and site's traffic profile: Kilroy_1962, RussianIvantheCrazy, GizaDog, Dailytacs, yurisrevenge, nogarbagetrashonly, theoldones, Russianbots, Mogumbo, Sw0rdofDamocles, mattsixteen24, and Kippering. I tried to minimize the number of suspects and usually only flagged the first submitter to the domain.

  • Kilroy_1962
  • RussianIvantheCrazy
  • GizaDog
  • Dailytacs
  • yurisrevenge
  • nogarbagetrashonly
  • theoldones
  • Russianbots
  • Mogumbo
  • Sw0rdofDamocles
  • mattsixteen24
  • Kippering

Looking further into the suspects, I dumped all of the domains from their submission histories. There were 900+ domains, first sorted by domain names, then by IP addresses. As it was too much work to look at them individually, I only picked those domains that seemed unusual, or domains that shared similar names and/or with the same set of IPs. Many of the domains that were picked showed very similar characteristics as the ones that were previously investigated. They were relatively new domains made it to Voat, with a spike in their traffic histories. Some were strikingly clear to see that they were pushed by specific user. In one specific case, three domains were cascaded together, af-mg.com forwarded to dc-chronicle.com, with dc-chronicle.com's data on thenarrativetimes.org. Very interesting to say the least!!

List of domains picked up from suspects' submissions, that showed very similar behaviour to those of 20+ domains. Initial submissions were usually posted to Voat between days to 3 weeks, after domain registration or before traffic spike.

  • Domain22: americanews.network, offline, short-lived. First submission posted 10 days from domain registration.
  • Domain23: amirror.link, offline with bad gateway. First submission 6 days from domain registration.
  • Domain24: animeright.news, currently online, a shitpost website.
  • Domain25.1: americafastnews.net, offline, no ssl. Appeared to be 1 of 4 domains sharing same backend, see data log at the end. First submissions posted to Voat within 2 to 3 weeks of domain registration.
  • Domain25.2: conservativegeneration.net, offline, no ssl.
  • Domain25.3: conservativemind.net, offline, no ssl.
  • Domain25.4: topalertnews.com, offline, no ssl.
  • Domain26.1: newsusatoday.co, offline, expired. First submission 5 days from site's traffic spike.
  • Domain26.2 viraldailynews.co, offline, expired.
  • Domain27.1: politicalbelief.site, offline. First submission 12 days from domain registration.
  • Domain27.2: trumptroopers.com, offline. First submission 4 days from domain registration.
  • Domain27.3: viralview.site, offline.
  • Domain28: viralusfortrump.com, offline. First submission 4 days from domain registration.
  • Domain29.1: loveconservative.site, offline. First submission 13 days from domain registration.
  • Domain29.2: politicaltribes.site, offline.
  • Domain30: freedom-daily.com, re-purposed. First submission 21 days from previous domain registration.
  • Domain31.1: democratdossier.org, online. First submission between 1 week to 1 month.
  • Domain31.2: truthseries.net, online, no ssl. First submission 13 days before traffic spike.
  • Domain31.3: yellowvestmarch.com, online. First submission 15 days after domain registration.
  • Domain32: nationonenews.com, offline. First submission 7 days after domain registration.
  • Domain33: thenarrativetimes.org, online, connected to dc-chronicle.com, which itself was connected to af-mg.com. First submission 11 days before traffic peaked.
  • Domain34: nationonenews.org, offline. First submission 1 fucking day after domain registration.
  • Domain35.1: dc-chronicle.com, online, redirected from af-mg.com.
  • Domain35.2: af-mg.com, connected to dc-chronicle.com.
  • Domain36: dailycallernewsfoundation.org, online.
  • Domain37: redstatenation.com, online. First submission 8 days after domain registration.
  • Domain38: defiantamerica.com, online.

So it appears to me that there is likely a user or a small group of users, who are here to push contents, by hopping through disposable/burner domain names. Some of those domains pushed fake news, some pushed low quality contents or other bullshits. Some would circumvent spam rule with collection of domains at disposal. This is something that other goats can point out periodically. I am not too worried or concerned about that. But I am in a way concerned with its implications.

Cont to part 2: https://voat.co/v/ProtectVoat/3001782/16431060

You are viewing a single comment's thread.

view the rest of the comments →

Kilroy_1962 ago

I see my name in that list, just what are you trying to say?

heygeorge ago

How did you find coolinfo24.com and the Mel Gibson article?

Kilroy_1962 ago

I remember the article but cant remember where I came across it.

heygeorge ago

Do you see the level of detail in OP? More info might be useful.

Kilroy_1962 ago

I come here to stay in the loop because it seemed easier to get around than 8chan. It was tough getting around here at first but then it got better and the information available is great. I can't swear that every link that I have provided is 100% but I do my best. I come here and see that I am suspected of something and it kind of pisses me off. I would like to know more about what I am being blamed for here, that's all.

heygeorge ago

I’m just wondering where you found the link.

Voat is at it’s core a lot of skeptics who are low on trust. It’s part of what makes this place tick.

Kilroy_1962 ago

That was almost 59 days ago, like I said, I saved the site in my bookmarks but as you know, it is gone. I tried looking through my history but it only goes back a month so I have no idea, Anything linked to pedos is something that interests me, I would like it wiped out, that is why I shared the link in the first place. I am getting leery about sharing anything after seeing my name in that list of suspects. I came to this place to keep up with the truth, be part of the plan to uncover all the corruptness but now feel like I am being associated with the wrong side. I know what side of all this I stand on but when I get accused of something it makes me wonder what the hell is really going on.

heygeorge ago

I think that good users are looking into what appears to be manipulation of the site. I really don’t know what you’re worried about. If you haven’t been accused of being a shill, you’re hardly a goat! Lol

Kilroy_1962 ago

When I seen Suspect under my name, it makes me worry. If I could remember where I got the link, I would sure tell everyone. Just for shits and giggles, can you tell me what all sites you visited 59 days ago? I sometimes chase links found in the discus forums like at GP and other news sites but it was so long ago I just cant remember. I guess I am just going to let it go and see what the investigators find. I will think twice about sharing anything going forward but I still want to know what is going on. Thanks for the civil replies, I will work on a thicker skin. :-)

heygeorge ago

Ha! I know what sites I generally get my information from, yes.

For my edification, what news site is ‘GP’?

Interesting idea if the links are being spammed in discussions at other sites. @MadWorld

We are all on the same page, trying to figure out what’s going on.

What I find interesting are the responders who don’t want to talk about it and respond with insults or otherwise. I have seen this tactic used (unfortunately modestly successfully) in the past on this site.

MadWorld ago

Interesting idea if the links are being spammed in discussions at other sites.

Thanks for the ping. That is a lot of data to look through. Most of the domains under the first list were spammed on twitter. Somewhere on my last submission, there is a archive of what other twitter users have found. Numerous accounts were being created. I stopped digging further after it became obvious to me that this sort of thing has happened before. Not enough data to make an objective conclusion, but this list should be convincing, at the least, that similar attempts were made back in September 2018. This opens another question.

Given the political nature of the contents, did this group of domains selectively push, in the time of its needs? Has there been major events taking place around that time frame? What are the goals? To blind the citizens in terms of feel-good-and-lay-back-doing-nothing news? Maybe these are the questions the GA mods would know better.

What I find interesting are the responders who don’t want to talk about it and respond with insults or otherwise. I have seen this tactic used (unfortunately modestly successfully) in the past on this site.

I tried to post this submission, when I knew I could stick around. But so far only a few showed up or actually attempted to explain the data given. So far @Kilroy_1962 tried to explain it the best he/she could. That is much appreciated. I recall @theoldones just told me to fuck off, without any attempt to explain the data. A simple and reasonable reasoning would suffice; instead, he wants me to formally accuse him in two submissions [1] [2], and then reminded me via PM XD. All that unnecessary walk around the focus.

theoldones ago

I recall @theoldones just told me to fuck off, without any attempt to explain the data.

cunt, you just drop that shit at my doorstep and expect me to not get mad or object?

what the fuck of explanation do you want to be hearing right now?

All that unnecessary walk around the focus.

OH REALLY WHAT FOCUS. perhaps you should just fucking name it. what is the focus you just implied?