Two recently created websites that routinely publish anti-Maduro content — Alexsnews.com and Sharesocial.app — appeared to have used inauthentic assets on Facebook to amplify their material. These assets (one fan page and two groups) impersonated well-known Spanish-language news outlets, such as CNN en Español.

By DFRLab’s count, at least 18 of assets, including the fake groups and page as well as associated accounts, have now been removed from the platform in response to the DFRLab’s investigation. A Facebook spokesperson told the DFRLab:

We routinely take action when we find violations of our Community Standards, including financially motivated activities like spreading clickbait content. In this case, we removed a number of Pages and accounts that used deceptive and spammy tactics to drive people to websites to generate ad impressions.

The DFRLab has previously identified similar behavior in which Facebook groups and fan pages took advantage of authentic media outlets’ credibility to reach a wider audience, such as during the Bangladesh 2018 elections. This behavior serves two functions: first, it uses high-profile names to draw in a larger audience more quickly; and, second, by doing so, it undermines audience trust in the media outlets being impersonated.

The use of inauthentic assets posting about politics is particularly worrisome in Venezuela, a country that is in the middle of a political, economic, and humanitarian crisis that has forced 4.5 million people to leave the country. Most recently, amidst a growing fear of a coronavirus outbreak, this dynamic has contributed to fears that the disease might lead to increased migration and, as a consequence, spread beyond the country’s borders.

The content published by these websites was related to political events in Venezuela. While the websites published political content with an anti-Maduro slant, they appeared to be primarily profit-driven, as the DFRLab found that the content had been monetized.

Part one: Impersonating CNN and NTN24

The DFRLab found a Facebook group and a page that impersonated CNN en Español (“CNN in Spanish”) and a Facebook group that pretended to be the Colombian right-wing television channel NTN24 in Venezuela.

NTN24 is a private Colombian broadcaster that focuses on international news and is available on cable in many Latin American countries. While it was banned from broadcasting in Venezuela by the Maduro regime on February 12, 2014, following its coverage of anti-government protests around that time, the channel is still available for Venezuelans to view online.

The official CNN en Español and NTN24 services both have Facebook pages but do not maintain groups on Facebook. Out of this lack, the fake groups were more easily able to position themselves as authentic, as they used the exact same name as the real outlets.

NTN24 Venezuela official Facebook page, without the “Noticias,” indicating Facebook’s blue verification label (blue boxes). By contrast, the NTN24 Noticias Venezuela fake group uses the original logo of NTN24 Venezuela (green boxes) as its cover photo. (Source: @danielsuarezper/DFRLab via NTN24 Venezuela/archive, top; NTN24 Noticias Venezuela/archive, bottom)

An analysis using social media listening tool CrowdTangle showed that, between March 1, 2019, and March 12, 2020, the majority of posts in these groups contained links. This behavior would not be surprising as the content of many pages and groups comprises links: in this case, however, over the last three months, most of these posts linked to articles from two specific websites — Alexsnews[.]com and Sharesocial[.]app.

Screenshots of analyses performed using CrowdTangle for the CNN en Espanol Latinoamerica Facebook page (top), the CNN en Espanol Facebook group (middle), and the NTN24 Noticias Venezuela Facebook group (bottom). The vast majority of posts to these assets impersonating CNN and NTN24 contained links to the two external websites. (Source: @danielsuarezper/DFRLab via CrowdTangle)

Part 2: the fringe websites

Alexsnews[.]com and ShareSocial[.]app are both fringe outlets mostly covering Venezuelan affairs and publishing anti-Maduro content. Both use the same template and publish sensationalist and misleading content: in early February 2020, for instance, Alexsnews[.]com used a video manipulated and taken out of context to claim that U.S. President Donald Trump had ordered a military intervention in Venezuela. Since the beginning of the year, the DFRLab has noticed that these websites were routinely garnering more engagement than traditional outlets when covering political events in Venezuela.

AlexsNews.com (top) and Sharesocial.app (bottom) share similar website templates. (Source: AlexsNews.com, top; Sharesocial.app, bottom)

The websites do not have an “About” section and do not provide any contact information for their operators. While articles published by ShareSocial[.]app do not have byline, most of the articles on AlexNews[.]com were written by Alex Paz, who authored over 1,200 publications between December 10, 2019, and March 10, 2020.

Both websites were created by a person named Facundo Delonuas: Alexsnews[.]com on December 6, 2019, and Sharesocial[.]app on September 26, 2019, according to website registration records.

Screenshots from website registration records (blue boxes) for Alexsnews.com (left) and Sharesocial.app (right) indicating that both websites were registered by Facundo Delonuas (red boxes). (Source: @jeanleroux/DFRLab via GoDaddy , left; @jeanleroux/DFRLab via GoDaddy , right)

According to his Facebook profile, Delonuas lives in Plottier, Argentina, and works for the Concejo Deliberante (local legislative institution) of the city. A publication by the Argentinian website Poder Local indicated that Delonuas is a real person that has written for the website of Plottier’s legislative house. Delonuas’s Facebook account was also listed as an administrator for the fake NTN24 Noticias Venezuela group.

Alexsnews[.]com and Sharesocial[.]app monetize their websites using the advertising monetization tools Google Adsense and Taboola. They share the same Google Analytics code, meaning that the money they receive from ads goes to the same person.

Image shows that AlexNews and ShareSocial use the same Google Analytics ID. (Source: @jeanleroux/DFRLab via DNSlytics)

They also use similar Taboola account names, “yosoyvenezolano” and “yosoyvenezolano-avance24,” both of which translate to “I am Venezuelan.”

Alexsnews.com and Sharesocial.app are connected through their advertising Taboola account, both containing the phrase YoSoyVenezolano (highlighted yellow), found in the source code for the websites. (Source:@jean_leroux/DFRLab via Sharesocial.app, top; AlexsNews.com, bottom)

Part 3: the connection

These fringe websites and Facebook pages were connected not only through their behavior (sharing links to the sites) but also through the identities of their Facebook administrators and moderators.

Graphic showing the connection of the websites to the Facebook groups and page through the Facebook admins. (Source: @danielsuarezper/DFRLab)

Both fake Facebook groups — CNN en Español and NTN24 Noticias Venezuela — shared moderators or administrators. As of March 13, 2020, they had six common Facebook accounts as either moderators or admins. However, the groups changed their admins constantly.

NTN24 Noticias Venezuela and CNN en Español fake groups shared at least six common admins (red boxes). (Source:@danielsuarezper/DFRLab via NTN24 Noticias Venezuela, left; CNN en Español/archive, right)

The most obvious connection discovered by the DFRLab was between the websites and the fake NTN24 group. This group was created by Delonuas, the same person who registered AlexNews[.]com and ShareSocial[.]app. Additionally, a Facebook page called Noticias Yuanflix Venezuela Informa, connected to another website registered by Delonuas, was listed as an administrator of the fake NTN24 Noticias Venezuela.