CTech – Israeli hackers Noam Rotem and Ran Locar say they have exposed a network of dozens of websites dedicated to spreading disinformation in support of US President Donald Trump. The purpose of the network, which has gone unnoticed since the 2016 US election, is to market Trump-related merchandise to supporters, the hackers said. The network is still active, spending money to gain traffic, and appears to be gearing up in preparation for the upcoming 2020 election, the two said. Rotem and Locar published their findings in a report that was viewed by Calcalist.

This is how the network operates, according to Rotem and Locar: the websites continuously publish fake news stories. They also serve up advertisements, links, and marketing content pushing products such as Trump hats, posters portraying the US president as Rambo, and coins bearing Trump’s portrait, dubbed Liberty Coins.

Rotem and Locar’s first lead was the website Liberty Focus, which was flagged earlier this month as a fake news site by Canadian cyber researcher Steffan Watkins. Rotem and Locar were able to link the site’s operator, 93jdwd, to dozens of similar sites, all of which shared the same IP address. By monitoring the sites’ outbound traffic, Rotem and Locar were able to identify a shared folder stored on the AWS cloud. There they unveiled thousands of files used to operate a total of 146 websites, all of which regularly published fictional stories presented as news.

According to the hackers, many of the web addresses were registered by the same person, who identified as Jackson Lin, through a company called Extreme Wisdom. Another company linked to some of the sites is Alabama company Click Wu, which the two identified as a company marketing Trump merchandise.

Some of the websites used Facebook advertising to boost their exposure. Facebook documents political ads purchased on its platform, and a review of its archive showed that websites connected with the network spent hundreds of thousands of dollars on advertisements on the popular social platform.