the home of online investigations

You can support the work of Bellingcat by donating through the following link:

How Google Analytics Codes Unearthed a Network of South African Fake News Sites

August 4, 2017

By Bellingcat Investigation Team

Translations: Русский

In July 2015, Lawrence Alexander published a report uncovering a number of ostensibly local, Ukrainian news sites that were actually operated out of the so-called “Troll Factory” of St. Petersburg, at 55 Savushkina Street. Lawrence found the connection between these sites by locating a shared Google Analytics ID, which showed that the sites were managed by a single Google account for tracking traffic statistics. This investigation led to a freelance web designer in Moscow who managed each of the sites, which included both his personal sites and the ones ran out of the St. Petersburg “Troll Factory.” Lawrence wrote a guide for Bellingcat on how to find and track these Google Analytics ID here, and Justin Seitz wrote a follow-up piece on automating the process with a Python script here.

Last month, a group of South African journalists used this method to uncover a series of websites linked to a company in India and the billionaire Gupta family, who have been accused of running disinformation campaigns against South African news organizations for critical coverage of the Gupta family’s business operations. Summaries of this investigation carried out by a group of South African journalists, including from News24, the amaBhungane Centre for Investigative Journalism, and the Daily Maverick‘s Scorpio investigative unit, can be found here and here.

The investigators found connections through WhoIs records, Google Analytics IDs, and AdSense IDs for ten websites, most of which directly target the veracity of the so-called Gupta Leaks and promoting the narrative of “white monopoly capital” (WMC). These sites, as listed by The South African, are: wmcleaks.com, wmcscams.com, dodgysaministers.com, wmc-scams.com, whitemonopolyafrica.com, whitemonopoly.com, fakeguptaleaks.com, publicopinion.co.za, southafricabuzz.co.za and whitemonopolycapital.com.

These sites put on the appearance of being grassroots South African news and investigative outlets, but are all apparently created by “CNET Infosystem,” a web design company based in Noida, Uttar Pradesh, India and ran by a man named Kapil Garg. The investigators detailed a few curious connections between Garg and his company with the billionaire Gupta family, who allegedly set up these sites to smear critics. For example, the Gupta family owns a company with an office in Noida and Garg used email addresses in the names of two Gupta brothers to register two of the ten websites.

Investigators into these websites provided a number of screenshots to Bellingcat to detail their research process. Below, the AdSense ID on publicopinion.co.za is found through searching through the source code. The unearthed AdSense ID was CA-PUB-8264869885899896, which reveals a number of sites related to India apparently developed by CNET Infosystem.

Further searches revealed even more information such as the following reverse AdSense ID search that showed other “news sites” registered to the same ID as publicopinion.co.za

After visiting these sites, we can verify that the codes are indeed the same by viewing the source code, as done earlier with publicopinion.co.za. Just open up the source code, press CTRL + F, and search for the same AdSense ID (CA-PUB-8264869885899896) as found on the other site.

Just as Lawrence Alexander found, some sites have additional tracking codes that may not be on every other site, opening up a new branch of investigation. On the wmc-scams.com site, which shares an AdSense ID with publicopinion.co.za, we can also find a Google Analytics ID in the source code — UA-101199457-4 (the -4 indicating its sequence among other sites with the UA-101199457 ID).

It was not very difficult for the investigators to find details about domain registration, as Kapil Garg did not try to hide important details, such as the screenshot below showing the WhoIs information for ajaygupta.info (referring to one of the Gupta brothers).

Taken all together, and we have a complex web of sites linked together by tracking codes and WhoIs registrations. Justin Seitz weaved together this data in one graphic showing the relationships (click image for full size):

For more information on the investigative process and tips on how you can use these techniques in your own research, see amaBhungane’s breakdown here.

Bellingcat Investigation Team

The Bellingcat Investigation Team is an award winning group of volunteers and full time investigators who make up the core of the Bellingcat's investigative efforts.

Join the Bellingcat Mailing List:

Enter your email address to receive a weekly digest of Bellingcat posts, links to open source research articles, and more.

7 Comments

  1. qualiall

    Pumping the brakes a little–but could it be a simple case of someone trying to cash in on ads? I know tons of fake news websites popping up during the elections from Macedonia-which was just a bunch of teenagers making some bank off the gullible.

    Reply
  2. Gina

    Thanks to all you IT Boffins – SA salutes you for assisting in what we already know – that the Guptas are pulling out all the stops. A question … is it possible to take legal action against these perpetrators or is it regarded as “free speech”? Take special care – we need you.

    Reply
  3. Rajesh valluri

    I think this is a simple case of someone trying to cash in on the demand for this news. The present of Adsense which earns the website owners perhaps 100 dollars a month st best, clearly indicates no billionaire is brhinf this.

    Very reckless to pin this on the Gupta’s without corroborating evidence.

    Reply
    • Ray

      Reckless? What would a company based in Uttar Pradesh know about news consumption in South Africa? What would be their interest, regardless, of ‘cashing in’ on this news? We have a population of 50 million people compared to India’s 1bn+ populous, many of whom have access to a smart phone sooner than they have access to proper sanitation. Why focus on little South Africa?

      You, my friend, are misguided.

      Reply
      • Bruce

        Considering that there have been strong economic connections between India and South Africa since at least the second half of the 19th century, and that there is a sizable population of ethnic East Indians in all of the former British territories of East and Southern Africa, many of whom undoubtedly still have family and friends in India proper, there is a very good chance that an Indian company would be very aware of news, especially economic and political news, in “little South Africa”, which is still a major player in world markets, thanks to gold and diamonds.

        Reply
  4. Eat Drink Stay Dubai

    Wow, I was actually searching for articles on using multiple domains/subdomains with GA and found this illuminating article instead.

    Thanks indeed for an interesting read, a welcome distraction during a cup of tea and just goes to show the connection between fake news and potential darker forces.

    Keep up the great work 🙂

    Reply

Leave a Reply

  • (will not be published)

You can support the work of Bellingcat by donating through the following link:

TRUST IN JOURNALISM - IMPRESS