In 2016, plastic was found in some Snickers bars and as a result the company issued recalls in 55 countries around the world. That resulted in a striking report by Euronews in March 2016 that showed people in Gaza throwing boxes of Snickers into a huge pit and setting them on fire:

youtube.com

In the video a man with a consumer protection bureau in Gaza says, "We destroyed Snickers and Mars chocolate after working with the products' importers and distributors. There was an order for them to be recalled from the market."

The story had nothing to do with cancer.

But now that video is getting a second life on Facebook and YouTube thanks to people making false claims that it's new, and that the candy is being destroyed due to it causing cancer.

This Facebook account shared the Euronews report in a group called "foodielock.com" on March 15. It falsely told the more than 8,000 group members that Snickers causes cancer and to "keep your baby away" from the candy. The post received more than 53,000 shares.

Facebook

The video has gone viral despite the fact that the original audio of the Euronews report was left intact, meaning anyone who watched it with the sound on could hear the real reason the candy was being destroyed.

The user, Timpy T NaZz, did not reply to a message sent by BuzzFeed News on Sunday night. By Monday morning the user had blocked the Facebook account of the BuzzFeed News reporter who reached out.

That post continues to inspire copycats and reshares. A page called the Press of World, which has close to 2.5 million fans, posted the video on Sunday with the exact same share text as the Timpy T NaZz account. Its post has generated 25,000 views in a little more than 24 hours.

This user reshared the Timpy T NaZz post and claimed that "mainstream North American media" was suppressing the story to help protect the company's profits.

Facebook: godlessun

The video was also posted March 11, by a page called the People's Content. It told its more than 150,000 fans that Snickers production stopped in 65 countries due to "Cancer Causing Ingredients."

Facebook: ThePeoplesContent

That video has generated over 3,400 shares, and and more than 90,000 views. The page did not reply to a message sent by BuzzFeed News.

The hoax has spread enough that Snickers Arabia posted about it on its Facebook page.

View Video ›

Facebook: SnickersArabia

"As many of our Snickers® lovers and loyal consumers have responded, the video which was taken in Gaza is 2 years old, and is related to a voluntary preventive recall caused by a quality issue impacting a very limited quantity of products, because we care about the safety of our consumers more than anything else," the post said.

The hoax is also spreading on YouTube. Videos created in recent weeks, as well as one from 7 months ago, repeat the false claims about Snickers. As of now the videos have generated far less engagement than the versions on Facebook.

One YouTube video from March 13 has the title, "Snickers and Mars Causes Cancer / Banned in 55 Countries."

YouTube

It's generated just over 3,000 views. Similar videos can easily be found by searching "Snickers cancer" on YouTube.

By comparison, the original Euronews video has generated just over 28,000 views in the two years it's been on YouTube.

Facebook

A pro-Trump super PAC funded by the billionaire Mercer family used Cambridge Analytica to help it generate millions of views for dark posted Facebook ads that aggressively attacked Hillary Clinton during the fall of 2016.

BuzzFeed News examined 27 dark posted ads from the Defeat Crooked Hillary Facebook page, which was run by the Make America Number One super PAC. (A dark posted ad looks like a post from a Facebook page but does not show up on a page's public timeline and is only seen by the users it was targeted to reach.)

The video ads — which were directed at specific audience segments on Facebook — pushed themes of Clinton’s corruption, her supposed failing health, and referred to her as “the most corrupt politician of our time” while suggesting she “might be the first president to go to jail.”

Make America Number One paid more than $1.2 million to Cambridge Analytica during the 2016 election cycle for services including campaign management consulting, web services, and “data acquisition services,” according to filings with the Federal Election Commission. The PAC did not disclose exactly what ads the firm worked on, or the specifics of the data and targeting services it provided. But Cambridge Analytica won an award and has previously taken credit for at least one of the PAC’s ads, which featured Michelle Obama and resulted in cease and desist letters from the Clinton campaign, as well as low ratings from fact-checkers.

Both Cambridge Analytica and Make America Number One are financed by Robert and Rebekah Mercer, who backed Donald Trump in the general election.

Cambridge Analytica is now at the heart of an international scandal for improperly obtaining data on 50 million Americans via Facebook, as well as for comments by its CEO that suggest the company engages in unethical and potentially illegal tactics on behalf of political clients.

An undercover investigation by Channel 4 in Britain published Tuesday features Mark Turnbull, a managing director of Cambridge Analytica, boasting that his company conceived of the "Defeat Crooked Hillary" campaign for the PAC. He also said it was responsible for the ad creative.

"And then, we made creative, hundreds of different kinds of creative, and we put it online," he said.

A former spokesperson for the Make America Number One PAC did not reply to a request for comment from BuzzFeed News when first contacted about the ads months ago, and did not immediately respond Tuesday.

The targeted ads for Make America Number One provide a look at the fruits of Cambridge Analytica’s work during the US election for a prominent PAC.

View Video ›

Facebook: video.php

Make America Number One was a major client for Cambridge Analytica during the 2016 campaign, second only to the Trump campaign itself in terms of the money it received. At least some of the PAC’s ads targeted voters in key districts using Facebook, Google, and YouTube. The dark Facebook ads reviewed by BuzzFeed News generated significant reach and engagement on the platform — far more than the same video ads generated when uploaded to the PAC’s YouTube channel and shared with media to generate publicity.

The impressive engagement for the ads also suggests that the targeted messages connected with the intended audiences, helping deliver millions of video views and tens of thousands of comments and reactions. This could be the result of significant ad spend, or it’s possible that the ads generated organic reach on top of their paid placement.

Many of the ads are line with arguments Trump or his allies made publicly during the campaign, and some were promoted to press outlets at the time of their release.

Many of the same videos used in the dark Facebook ads were also shared on the Defeat Crooked Hillary page as links to YouTube — but they were not uploaded as native in the video, the most powerful way to generate views and engagement. Instead, it appears the PAC used native video for dark posted ads that could only be seen by the people they targeted.

BuzzFeed News was provided links to 27 dark post ads run by Make America Number One. The source who provided them accessed them via a tool designed for digital marketing competitive intelligence, and asked not to be named out of fear that it could cause Facebook to cut off the tool’s ability to access dark post ads. (The tool was not specifically designed to track dark post ads but the source was able to use it to do so.) BuzzFeed News confirmed these were dark posts ads by determining they do not appear on the timeline of the PAC’s Facebook page.

View Video ›

Facebook: video.php

On Oct. 6, 2016, the Defeat Crooked Hillary page targeted an ad that raised questions about Clinton’s health and echoed some of the conspiracy-minded claims about her that had been circulating and suggest she needs to be tested for drugs. (Weeks earlier Clinton fainted at a 9/11 memorial and was later diagnosed with pneumonia.)

The ad opens by stating, “If athletes need to be tested for drugs for the biggest race of their lives,” and then proceeds to a montage of Clinton coughing, fainting, and making awkward facial expressions, one of which is looped for extra effect. The ad closes with a question: “Shouldn’t candidates be tested for the biggest race of yours?” That ad was sent in two different dark posts the same day, suggesting it was targeted at two different segments. One generated 152,000 views and the other received 114,000.

View Video ›

Facebook: video.php

Another video ad was posted with the comment, “Crooked Hillary puts the lives of you and your families in danger in order to advance herself politically.” It generated 1.2 million views. The video focused on Bill Clinton’s offer of clemency to 16 prisoners affiliated with FALN, a Puerto Rican group that was linked to bombings in US cities.

View Video ›

Facebook: video.php

The theme of connecting Bill and Hillary was also used in ads that painted them as corrupt and having traded speaking fees and donations for access and special consideration while Hillary was secretary of state. “Corruption is just the family business,” concluded one ad.

The PAC also ran a targeted ad that came after a debate when Clinton pressed Trump on his behavior toward Vladimir Putin. Instead, the ad focused on Clinton’s connection to Putin. “Hillary knows Putin a little too well. She profited from a shady deal with Russia to give them U.S. uranium,” the post said. It generated over 440,000 views.

View Video ›

Facebook: video.php

The PAC’s YouTube page includes a full archive of all its videos, but it appears the organization was selective about which ones it highlighted to the press and the public. Some ad buys and associated videos were shared with reporters to generate press coverage and free attention for the ads, as is normally the case with campaigns and PACs. But others, such as the one about drug testing and Clinton’s health, does not appear to have been written up by media outlets upon its release.

Records show that Make America Number One PAC raised $20.7 million during the 2016 cycle and spent $19.6 million of that. Another recipient of the PAC’s money was Glittering Steel, a company owned by Steve Bannon, who left the Mercer-funded Breitbart to become the Trump campaign chair and later White House chief strategist. Kellyanne Conway, who managed the Trump campaign and went on to work at the White House, helped lead the PAC when it was backing Cruz. Rudy Giuliani’s law firm was also paid by the PAC.

The PAC’s biggest donor was Robert Mercer, who kicked in $15.5 million and whose daughter, Rebekah, is reported to have been heavily involved in the PAC. The PAC also received $1 million from Silicon Valley billionaire and Trump backer Peter Thiel, as well as a reported $100,000 from Erik Prince, the former head of the Blackwater military contracting firm.

Called “March for Our Lives 2018 Official,” it appeared to be one of the best places to get details about the event and connect with others interested in gun control. But those who joined the group soon found themselves puzzled. The admins often posted pro-gun information and unrelated memes and mocked those who posted about gun control.

“I'm a retired federal law enforcement special agent. There is and never has been any reason for a civilian to have a high-capacity high velocity weapon,” posted one member on Feb. 20.

“Shutup fed and stop trying to spread your NWO BS,” was the top reply, which came from one of the group’s admins. (NWO is a reference to the “new world order” conspiracy theory.)

A few days later the group’s name was changed to “Kim Jong Un Fan Club,” and members continued to wonder what was going on.

The simple answer is they were being trolled. The more complicated one is that while Facebook groups may offer a positive experience for millions of people around the world, they have also become a global honeypot of spam, fake news, conspiracies, health misinformation, harassment, hacking, trolling, scams, and other threats to users, according to reporting by BuzzFeed News, findings from researchers, and the recent indictment of 13 Russians for their alleged efforts to interfere in the US election.

And it could get worse. Facebook recently announced that group content will receive more prominent placement in the News Feed and that groups overall will be a core product focus to help reverse an unprecedented decline in active users in the US and Canada. The unintended consequence is that the more than a billion users active in groups are being placed on a collision course with the hackers, trolls, and other bad actors who will follow Facebook’s lead and make groups even more of a focus for their activities.

“This vision could backfire terribly: an increase in the weight of ‘groups’ means reinforcement of Facebook’s worst features  —  cognitive bubbles  —  where users are kept in silos fueled by a torrent of fake news and extremism,” wrote Frederic Filloux, coauthor of the influential weekly media commentary newsletter Monday Note.

Renee DiResta, a security researcher who studied anti-vaccine groups on Facebook, told BuzzFeed News that groups are already a preferred target for bad actors.

“Propagandists and spammers need to amass an audience, and groups serve that up on a platter. There’s no need to run an ad campaign to find people receptive to your message if you can simply join relevant groups and start posting,” she said.

To her point, the recent indictment of the 13 Russians repeatedly cited Facebook groups as a focus of workers at the Internet Research Agency.

“By 2016, the size of many organization-controlled groups had grown to hundreds of thousands of online followers,” the indictment said.

@corybe / Twitter / Via Twitter: @corybe

One part of the Russian effort on Facebook left unmentioned in the Mueller indictment — and that has not previously been reported — is that Facebook’s group recommendation system encouraged fans of troll-run pages such as Blactivist and Heart of Texas to organize themselves into groups based on their shared affinity for a page. To this day there remain many groups with automatically generated names such as “Friends Who Like Blacktivist” or “Friends Who Like Heart of Texas.” These groups appear to be small and inactive, but the fact remains that Facebook prompted Americans to organize into fan groups of Russian troll pages.

There’s no question that groups offer value to many Facebook users. They keep friends and former classmates close, and played a key role in helping organize the West Virginia teachers’ strike. They are the basis for a thriving global community of buy, sell, and barter networks. Groups were used to raise money for victims of the Las Vegas shooting, and help provide support to, and prevent suicide among, US military personnel. Facebook groups can restrict membership by being designated “secret” or “closed,” and as a result people often share deeply personal information and experiences because they feel protected from the prying eyes of search engines and the public at large.

That’s the case for Female IN, a secret Facebook group that today boasts a membership of more than 1.5 million women around the world. It was created by Lola Omolola, a Nigerian-born journalist now living in Chicago. She started it after more than 250 schoolgirls were kidnapped by a terrorist group in Nigeria. Many of the women in the group live in, or are originally from, African countries. But Omolola said it has grown to include women from other parts of the world.

Secret groups like FIN are completely invisible to anyone who is not a member, and Facebook users can only join if they are invited by a current member. This is different from closed groups, which can be found via search, show up on user profiles, and enable anyone to request to be added to the group.

“We discuss everything from everyday day stuff like your children, your healthcare, and your individual interactions with people. We go from there to talking about domestic violence. People are sharing in real time what happens at their homes,” Omolola told BuzzFeed News in an interview facilitated by Facebook’s PR team. “Generally we are very actively and thoughtfully healing a population of women who are used to being silenced, and whose voices have never really historically mean that much.”

But even a group that Facebook itself points to as an example of the product’s value has to wage a battle against bad actors. Omolola and other FIN admins work constantly to keep men and spammers out of the group. They have to warn members about imposter FIN groups on Facebook that try to leverage her group’s success and brand among women. A post to the public FIN Facebook page from last fall warned women of a “FAKE FIN run by A MAN!!!”

“Some people try to use the [FIN] name to get a lot of people to their groups,” Omolola said. “We have contacted Facebook and Facebook knows about it, and are working on ways to protect us.”

View Video ›

facebook.com

Omolola says she working on trademarking the group’s name so she can ask Facebook can enforce her trademark and take imposter groups down faster. Right now, it’s mostly up to her and her members to go into fake FIN groups and warn people that it’s a scam.

Jennifer Dulski, the head of groups and community at Facebook, told BuzzFeed News that there is now a dedicated “integrity” team for groups, which includes people who specialize in security, product, machine learning, and content moderation. She pointed to new tools launched last year that help admins screen and easily remove members, and that lets admins clearly state the rules of a given group on its About page. (Omolola said these new features are all big time savers.)

“There is some negative content and behavior happening on Facebook, including in groups, and we take that really seriously,” Dulski said.

She emphasized that the the experience for most users is positive.

“It’s amazing to see what is actually happening in Facebook groups, and the vast majority of of activity and content in these groups is not only positive but also meaningful for the people involved in them.”

That messaging — bad content and actors make up a tiny fraction of overall groups activity — echoes what Mark Zuckerberg said after questions were raised about the spread of misinformation on its platform and its impact on the 2016 election.

DiResta sees a parallel, suggesting groups are at the same stage pages and the News Feed were prior to Facebook’s 2016 wake-up call about fake news: rife with manipulation and lacking proper oversight.

“We need to avoid a repeat of the kind of persuasive manipulation we saw on pages, so Facebook needs to be pay attention to these issues as they continue to increase their emphasis on groups,” DiResta said.

That emphasis on groups is now a cornerstone of Zuckerberg’s vision for the company and product. Last summer he announced an ambitious goal to drastically increase the number of Facebook users in “meaningful” groups from 100 to 1 billion.

“If we can do this, it will not only turn around the whole decline in community membership we've seen for decades, it will start to strengthen our social fabric and bring the world closer together,” he said in a speech at Facebook’s first Community Summit last summer.

But to get to a billion, Facebook will have to acknowledge and battle the spammers, hackers, and trolls who constantly exploit, take over, and buy and sell groups in order to make money or sow chaos. It will also have to confront the fact that its own recommendation engine at times pushes users into conspiracy theorist groups, or into those geared toward trolling, harassment, or illicit online activity.

Ben Kothe / BuzzFeed News

The global exploitation of groups

As the 2016 election moved into its final stretch, members of a Facebook group called Republicans Suck suddenly experienced an influx of new members who spammed the group with links to questionable stories on websites they’d never heard of.

Bobby Ison, a Kentucky man who was member of the group, told BuzzFeed News that he noticed the administrators and moderators of the group began to change and “some of them were obvious foreign accounts. Eastern European countries. Serbia, Bosnia, Croatia.”

Ison said he and others learned that the Facebook account of one of the group’s original admins had been hacked. With control of the admin’s Facebook profile, the hackers were then able to add whoever they wanted as admins, and remove the group’s original leaders.

“When they got his [account], they booted the other admins, and moved more of theirs in,” Ison said. “It was rather sad to witness.” (The admin whose account Ison said was hacked did not respond to inquiries from BuzzFeed News.)

Eventually, former admins and members fled to start a new, closed group called

“Republicans Suck....again!!!!”

“As some of you know, the old REPUBLICANS SUCK has been hacked and taken over by hackers and trolls, which is something that is happening in several groups,” reads the pinned message for the group from one of its administrators.

Ison said the old group’s new overseas admins stepped up their spamming efforts in order to drive traffic from the group to their sites, presumably so they could earn ad revenue.

“It turned into a horrible page after they finally took over. Posting some of the most outlandish stories I've seen,” he said.

BuzzFeed News spoke via Facebook Messenger with one of the profiles currently listed as an admin of the group. That account has previously posted online about a Ford van for sale in Macedonia and written posts in Macedonian. Many of the account’s earliest posts in groups were for online moneymaking schemes. The person running the account said they were only added as an admin of the group two months earlier and didn't know anything about the group takeover last year.

“For the first time I hear from you that this group is stolen,” they wrote. They said they are not profiting in any way from the group. (BuzzFeed News could not confirm whether the profile’s name is linked to a real person.)

“We have no interest, we have no profit, we do not do with advertisements,” they said, and offered to make a BuzzFeed News reporter an admin of the group as a sign of goodwill.

“It would not be unusual to request to join 30 to 40 groups at a time, wait a few minutes to get approvals, and then spam links throughout those groups."

Newsweek Media Group

The embattled publisher of Newsweek and the International Business Times on Tuesday admitted that three of its websites were running malicious code that experts say is used to commit ad fraud.

Newsweek Media Group issued a press release Tuesday afternoon that said the company “has been alerted to a piece of potential code that disrupted ad tracking and ad viewability. This piece of code affected IBTimes.sg, IBTimes.co.in and IBTimes.co.uk.”

NMG said it is conducting an internal investigation “to identify the individuals responsible and will take the necessary action.”

The admission comes after a BuzzFeed News report last month revealed that investigations by multiple ad technology firms found that several of the publisher’s sites were buying traffic and engaging in ad fraud. At the time the company denied any fraudulent activity.

A source told BuzzFeed News that the sudden admission by NMG may be connected to ongoing reporting by the Wall Street Journal. A recent Journal story revealed new details about an investigation into NMG by the Manhattan District Attorney, including that the DA is now looking into reports of ad fraud.

BuzzFeed News asked NMG if its press release was issued as result of questions from the Journal. “The press release speaks for itself,” said Ken Frydman, CEO of Source Communications, a PR firm recently retained by the company.

The malicious code loaded on NMG’s sites was first discovered by DoubleVerify, a digital media measurement company, last year. The firm previously told BuzzFeed News that as a result of a detailed investigation into NMG properties it classified IBT’s Singapore, India, UK, and US sites “as having fraud or sophisticated invalid traffic.”

DoubleVerify also classified Newsweek’s UK edition as fraudulent, and the company's chief operating officer, Matt McLaughlin, said that site contained the same malicious code that NMG acknowledged Tuesday. NMG declined to say why its statement did not list Newsweek UK as one of the sites containing the code.

Less than 20 minutes after issuing its press release about malicious code, the company sent another release to announce new appointments and a “strategic investment” in Newsweek, which NMG CEO Dev Pragad called the “the jewel in our crown.”

McLaughlin told BuzzFeed News that the code used by NMG is designed to interfere with the ability of third-party measurement systems to determine how much of a digital ad was viewable during a browsing session. In order for an ad impression to be considered valid, it must be at least partially viewable to a user. This code manipulated data to ensure that otherwise unviewable ads showed up in measurement systems as valid impressions, which resulted in payment being made for the ad.

McLaughlin said the code is often injected into the browser by a bot visiting a site. It’s extremely rare to find an ostensibly reputable publisher running this type of code, he said.

“We’ve seen it on a few sites that have been very low volume and generally not important in the industry. This is by far the largest group of sites where we’ve seen it directly on the site,” he told BuzzFeed News.

The revelation of the code further validates findings outlined in the previous BuzzFeed News article, which revealed that several IBT properties were buying traffic that originated on pirated video-streaming and file-sharing websites. When a user visited these sites, a new browser window was automatically opened as a pop-up or pop-under. NMG then routed this low-quality traffic through other domains in order to disguise its origins and make it seem like high-quality referral traffic.

McLaughlin said the malicious code on the IBT sites and Newsweek UK is specifically used to ensure that ads hidden in a pop-under window, for example, are rated as fully viewable even when the user can’t see them.

“By combining the automated traffic buying with this malicious browser override they made impressions that had low viewability due to invalid traffic acquisition look to be more legitimate in their viewability metrics,” he said.

NMG’s press release said it is currently working with three accredited verification companies to measure its traffic, and that it is in the process of getting certified with the Trustworthy Accountability Group, an industry initiative to combat ad fraud.

TAG CEO Mike Zaneis told BuzzFeed News that it has "just begun working with Newsweek."

"We believe they are committed to not only responding to the current problems exposed on their sites, but also in developing a proactive strategy for making them safer long term. TAG can be a partner for any publisher in that endeavor," he said.

BuzzFeed News; Getty Images

A little more than a year ago, Sarah Palin’s Facebook page began serving its more than 4 million fans a steady diet of links to news stories on Sarahpalin.com, the former governor’s very own conservative clickbait site.

But in October a puzzling pattern emerged with the links shared on her page. The content was the same, and written by the same authors, but the domain wasn’t sarahpalin.com. That month saw the Palin news operation move to sarahpalinnews.com, according to data from analytics service SimilarWeb. Two months later the links shared on her Facebook page included sarahpalinblog.com and govsarahpalin.com. By January sarahpalinamerica.com and officialsarahpalin.com had arrived. February gave birth to the awkwardly named sarahpalin-blog.com.

Same content, same writers, same big Facebook page driving nearly all the traffic — but constantly shifting domain names. Why?

Facebook

It turns out Palin and her publishing partner, Young Conservatives LLC, are using an increasingly popular tactic of quickly hopping from one domain name to another in order to blunt the impact of Facebook’s recent News Feed algorithm changes. It’s also used by publishers as a way to stay one step ahead of blacklists used by brands and agencies to keep their ads off controversial or inflammatory websites. (This tactic unintentionally reinforces another key fact about Facebook: People don’t seem to notice or care about the URL attached to a particular link being shared on a Facebook page.)

“Once any site is found on a blacklist due to fraud, hate, fake news, or a variety of reasons and see monetization impacted, they drop the domain, acquire a new [one] and start over using a lot of the same content,” Marc Goldberg, the CEO of TrustMetrics, a company that evaluates online publishers and apps for quality, told BuzzFeed News. “This is a common practice among all sites, not just limited to news. Sometimes they keep the domain dormant for a period of time and then use it to try and get back into the ad ecosystem with another trick.”

imgflip.com

Young Conservatives LLC works with Sarah Palin on her websites and Facebook page, and it has also been using domain hopping for its own properties. The company’s once-flourishing YoungCons.com domain is no longer being shared from its Facebook page with more than 1 million followers. Instead, the page is constantly cycling through domains such as americanewscentral.com, americanewsalert.com, americanewshub.com, digitalpoliticsdaily.com, digitalpoliticalnews.com, digitalnewsalerts.com, and breakingpoliticalalert.com, among others.

The company said in a statement to BuzzFeed News that it’s trying to adapt to Facebook algorithm changes that began affecting its sites as of August 2017. Though Facebook made a January announcement to say it will begin showing less content from pages in the News Feed, many publishers actually saw a drop in referral traffic beginning at the end of last summer.

“Facebook has recently made changes that negatively affect publishers and we are testing different ways to try and combat those changes,” said the statement from the company, which was founded by former Dartmouth College students Joshua Riddle and David Rufful.

The company declined to comment on Sarah Palin or its other partners. BuzzFeed News sent a request for comment via the contact form on Palin’s site and via email but did not receive a reply.

Alexa Traffic Rank Patterns For Sites Shared By Sarah Palin's Facebook Page

These charts show the traffic ranking of websites that have been shared by Sarah Palin's Facebook page. The increases and declines indicate how quickly traffic can appear or disappear for a site as a result of its presence (or lack thereof) on her Facebook page.

Alexa

Cyrus Massoumi, a former conservative news publisher who now runs a liberal news site, said switching domains helped him raise Facebook referral traffic after it sagged. He said domain hopping is necessary due to the mysteries of algorithm changes, and what he sees as a lack of communication from Facebook.

“Publishers have found that their domains are often penalized by Facebook's algorithm over policy changes that they don't announce publicly. As a result you can see your traffic go from 300K people a day to 100K overnight,” he told BuzzFeed News. “Then, after setting up a new domain the traffic almost instantly returns to exactly where it was.”

Facebook declined to comment specifically on domain hopping. But a spokesperson told BuzzFeed News that the company’s goal "is to make sure that we're consistently valuing those who publish accurate high-quality content and enforcing against those who repeatedly publish spam and false news. To do this, we're actively working to generalize our policies and algorithms.”

The spokesperson also pointed to the company’s recent announcement of an effort to identify “trusted sources” of information that will see their content prioritized in the News Feed.

Along with trying to mitigate algorithm changes, domain hopping can also be used to stay ahead of ad blacklists aimed at keeping brands off sites publishing hate speech, misinformation, or inflammatory political content. Some ad platforms are now taking additional measures to block publishers using domain hopping.

“Constantly changing the URLs does appear to be keeping them ahead of domain blacklisting, so platforms like ours have blocked the entire seller ID, meaning if you’re a company selling ads on behalf of these sites, you’re blocked from selling ads on any site through our platform,” said Ken Van Every, senior business development manager for publisher relations at DataXu, a company that provides software to help marketers purchase ads.

Other domain hoppers

Conservative sites aren’t the only ones shifting domain names. Occupy Democrats, the most influential liberal partisan Facebook page according to a BuzzFeed News analysis last year, hasn’t updated occupydemocrats.com since October.

In May it purchased washingtonjournal.com for $75,000 from an entrepreneur and domain seller named Michael Mann. Soon after, Occupy Democrats began to place its latest content on that domain and share it from its Facebook page. That led to tens of millions of visits to the site between May and August, according to SimilarWeb.

But that traffic spike also caused C-SPAN, which holds a trademark for “Washington Journal,” to take note and begin a legal process to claim the washintonjournal.com domain. The resulting arbitration process found in favor of C-SPAN and as of today the domain redirects to the Washington Journal section of its site.

"In this case, as in several others before it, C-SPAN used the law to protect our reputation for straightforward, nonpartisan coverage of public affairs,” Bruce Collins, C-SPAN’s corporate VP and general counsel, told BuzzFeed News.

Occupy Democrats now uses washingtonpress.com as its primary domain. The company did not respond to a request for comment from BuzzFeed News.

Facebook

Along with Sarah Palin, Young Conservatives LLC works with other large conservative Facebook page owners, such as Allen B. West, Diamond and Silk, and Stacey Dash. All of them operate associated conservative news sites, and all of them have been domain hopping in recent months. In each case, their most recently shared sites are subdomains of URL’s owned by Young Conservative, such as staceydash.americanewshub.com or diamondandsilk.americanewsalert.com.

Allen West’s main domain until last fall was allenbwest.com, a popular conservative news site. But as of October allenwest.com (without the “b”) suddenly began getting significant traffic before falling off by the end of the year. Now West’s Facebook page with its more than 2.7 million fans primarily shares links to allenwestblog.americanewscentral.com. It too will likely change soon, as West’s site has since January 2017 used more than a dozen different domains with his name in them, according to an analysis of URLs shared from his page. BuzzFeed News sent a request for comment via the contact form on West’s site but did not receive a reply.

Though domain hopping is taking hold among some publishers, it’s possible that it may already be past its prime. In a sign of just how quickly traffic tactics come and go, Massoumi said lately he’s not seeing the same traffic bump for publishers who try it.

“As of recently, I've seen other publishers continue to do this, but the traffic hasn't moved for them, it stays down." ●

Lam Thuy Vo contributed reporting to this story.

BuzzFeed News

Links from Newsweek have been banned from one of the biggest traffic-driving sections of Reddit due to concerns about paid spamming, BuzzFeed News has learned.

Earlier this month, moderators of /r/news decided to classify all submitted links to Newsweek.com as spam due to what a source says was a coordinated effort to promote content from that site. The /r/news subreddit has more than 15.5 million subscribers and is the 15th-largest community on Reddit.

The source, a longtime Redditor with knowledge of /r/news moderation practices, said moderators concluded that links were being submitted at high volume by influential Reddit accounts in order to drive traffic to Newsweek.com.

“In the case of Newsweek, it appears that they recruited high-volume/high-karma posters to post their articles,” said the source. (Reddit users earn “karma” points by participating on the site.)

The source said publishers and other entities sometimes pay influential Reddit users to submit their links with the goal of generating traffic. The source asked not to be identified in order to maintain their status within the Reddit community.

In a statement to BuzzFeed News, Newsweek Media Group said it’s aware Newsweek links have in some cases been classified as spam on Reddit, but said it does “not engage in any form of paid promotion on this platform.”

“We are aware of some instances of Reddit users submitting links without engagement or comment causing them to qualify as spam. We are in active discussions to address this so that we can ensure all of our writers are aware of the latest guidelines when posting content,” the statement said.

Even with the /r/news ban, BuzzFeed News has identified several Reddit accounts that continue to submit Newsweek links to subreddits such as /r/politics at high volume. These accounts appear to exist only to share Newsweek content. The owners of these accounts did not respond to private messages sent via Reddit.

The partial Reddit ban for Newsweek comes as the company is already under scrutiny for its audience development practices. BuzzFeed News recently reported that several of its International Business Times editions were buying traffic and engaging in ad fraud. The company admitted to buying traffic but denied it engages in ad fraud. (The report did not accuse Newsweek.com of buying traffic or engaging in ad fraud.)

In the wake of that report, NMG’s chairman, finance director, and top advertising sales executive resigned, and NBC News reported that the company “lost hundreds of thousands of dollars in ad commitments.” An ad platform issued a press release to publicly call out NMG. “You lied, you cheated, and you destroyed the trust that your organization held in all of our eyes,” said the release from Brandzooka. In a statement issued after this story was published, NMG said, "We do not have any direct commercial relationship with Brandzooka nor have we heard of this brand."

NMG also fired top editors and reporters at Newsweek after the site reported on a recent raid of the NMG offices by the Manhattan District Attorney’s office, which took place as part of an ongoing investigation.

Growth in Reddit traffic to Newsweek

SimilarWeb

A previous statement from NMG to BuzzFeed News emphasized that Newsweek “is now reaching its highest-ever global audience and it is now also our highest revenue-generating site.”

Data from web analytics service SimilarWeb confirms that Newsweek’s audience has increased at an impressive rate since May of last year — and part of that growth has come thanks to a significant increase in referral traffic from Reddit.

Up until March of last year Reddit was the second-biggest source of social referral traffic to Newsweek, accounting for roughly the same percentage of traffic as Twitter. Facebook was its biggest social referral source, which is common for digital publishers.

But beginning in April, the percentage of Reddit referral traffic to Newsweek began to climb. By June, Reddit had become the site’s biggest social referral source, accounting for more than half of its social referral traffic, according to SimilarWeb. (Search traffic from Google remained the site's biggest overall source of traffic throughout this period.)

Between October and January — Newsweek’s biggest recent traffic months — Reddit was responsible for more than 60% of Newsweek’s social referral traffic. This means that in the span of just a few months the percentage of social referral traffic going to Newsweek from Reddit doubled.

Newsweek.com Social Referral Traffic

SimilarWeb

As that increase was happening, moderators at /r/news began to notice “patterns and behaviors” that led them to conclude Newsweek links were being spammed, according to the source who spoke to BuzzFeed News. As a result, earlier this month /r/news moderators decided to mark all submitted links from Newsweek as spam. This means Newsweek links are not eligible for voting or comments, and users do not see them.

But while /r/news has shut the door on Newsweek, its content continues to be submitted to other subreddits at high frequency from accounts that appear to specialize in promoting the publication.

Reddit

BuzzFeed News identified three accounts — marstonstudio, theryansit, nstone28 — that over the past two months together submitted more than 160 links to Newsweek content. They did not submit links for any other websites. After this article was initially published, BuzzFeed News was directed to a Twitter account also called theryansit that belongs to a Newsweek reporter, Ryan Sit. When contacted for comment, he said the Reddit account is his and that he uses it to share his stories.

"I post my articles on Reddit and rarely comment on their threads to let the conversations evolve organically," he wrote in a response posted to Twitter. He said Reddit suspended his account for three days last week.

"Point taken, I'll probably engage more going forward," he said.

A third account, boopbot3000, submitted more than 60 Newsweek links over the past three months, and only once shared a link to another source. Other than Ryan Sit, the owners of the other accounts did not respond to questions from BuzzFeed News sent via Reddit.

“The users you pointed out all match the pattern of spamming, and they're very obvious,” said the source after being sent links to these and other profiles that repeatedly shared Newsweek content.

Twitter / Via Twitter: @AsianWifeHaver

It has nothing to do with the film.

Some trolls are using images of battered women to make their false claims. This tweet includes photos of an 18-year-old woman who was locked in an apartment by her boyfriend and assaulted for four hours. He later pled guilty to two charges of assault.

Twitter / Via Twitter: @Hardcorial

This troll account used a photo of the ex-wife of former White House staffer Rob Porter.

Twitter / Via Twitter: @DSA_boi_pucci

Here's a sample of the other kinds of tweets sent by the same account...

Twitter / Via Twitter: @DSA_Boi_Pucci

This Twitter user used a photo from 2009 to make a false claim about being assaulted at a showing. It's generated over 400 retweets.

Twitter / Via Twitter: @Kinda6t

Unfortunately, the fake tweets keep coming. This account used the name and photo of Paul Nehlen, a racist and anti-Semitic man in Wisconsin who is trying to defeat Rep. Paul Ryan in a Republican primary there. Nehlen's Twitter account was recently banned.

Twitter / Via Twitter: @NorthlandsOwn

The photo this tweet used is actually taken from a viral 2013 video made in Serbia that used special effects makeup to raise awareness about spousal abuse.

YouTube / Via youtube.com

This tweet made a false claim of an assault while including a video from a South Korean pop group called BlackPink.

Twitter / Via Twitter: @shaarmuta

Some troll accounts also tried to circulate claims that people in MAGA hats were attacking theatergoers at Black Panther screenings. Also not true.

Twitter / Via Twitter: @ZionistGangster

Remember: If you see an image online and want to check where it came from, do a reverse image search. If you use Chrome as your browser, just right click on an image and select "Search Google for Image."

It's free and fast, and will help you fight back against fakes.

4mysquad / Tumblr

Russian trolls posed as black activists on Tumblr and generated hundreds of thousands of interactions for content that ranged from calling Hillary Clinton a “monster” to supporting Bernie Sanders and decrying racial injustice and police violence in the US, according to new findings from researcher Jonathan Albright and BuzzFeed News.

While Facebook and Twitter continue to face intense public and congressional pressure over the activity from trolls working for the Russian Internet Research Agency, Tumblr has somehow managed to escape scrutiny. But the blogging platform was in fact home to a powerful, largely unrevealed network of Russian trolls focused on black issues and activism.

“The evidence we've collected shows a highly engaged and far-reaching Tumblr propaganda-op targeting mostly teenage and twenty-something African Americans. This appears to have been part of an ongoing campaign since early 2015,” said Albright, research director of the Tow Center for Digital Journalism at Columbia University.

Tumblr and its parent company, Oath, did not reply to multiple emails with questions from BuzzFeed News. Despite not responding, tracking software shows the emails were opened more than 290 times, and the included links were clicked more than 70 times.

BuzzFeed News also did not receive a response from the office of Sen. Mark Warner, the Democratic chair of the Senate Intelligence Committee, which is investigating Russian interference in the 2016 election.

The Russian-run Tumblr accounts used the same, or very similar, usernames as the account names contained on a list of confirmed IRA accounts Twitter submitted to congressional investigators. In some cases, the Tumblr and Twitter account has the same profile image or linked to each other in their bios. Some IRA Tumblrs and Twitter accounts also cross-promoted content between platforms, further linking them together.

For example, the 4mysquad Tumblr posted a screencap of a tweet from the @4mysquad Twitter account and invited people to “support me on #twitter.” The Twitter account’s bio also contained a link to the 4mysquad Tumblr, and they both used the same profile image.

Tumblr

In another example, a post that originated on the blackmattersus Tumblr directed readers to the Blackmattersus.com website, a confirmed IRA property.

4mysquad appears to have been the most successful of the accounts, racking up multiple posts that each generated hundreds of thousands of notes on Tumblr. (The number of notes is the total of all reblogs, likes, replies, and answers that a post receives.) The account also sparked a wave of outrage after it took a video of a black girl being sexually assaulted by a police officer, turned it into a set of GIFs, and propagated the false claim that the video showed an NYPD officer.

Bleepthepolice is another other Tumblr identified by Albright and BuzzFeed News that shared the same username as an IRA account on Twitter and that shared similar content. Similarly, the 1-800-gloup Tumblr had the same profile image as the @gloed_up Twitter account run by the IRA. The Tumblr also posted content from the Twitter account.

IRA Twitter accounts and their associated Tumblrs.

Twitter / Tumblr

Another Tumblr account, dontshootus, was first identified by CNN late last year as being linked to the IRA. It too shared a related Twitter handle. Blacktolive is yet another Tumblr with a matching Twitter handle and was first identified as an IRA blog by ThinkProgress.

Along with those Tumblrs, Albright and BuzzFeed News identified others that consistently propagated posts from IRA Tumblrs and which were later removed, much like several of the troll blogs. One is fomysquad, which, along with having a similar name, consistently reblogged 4mysquad and seemed to exist to help spread its content. (As shown above, it also reblogged the post from 4mysquad promoting its Twitter account. )

Another account of note is lagonegirl, which was a key propagator of 4mysquad content and vice versa, and has a name similar to the @lagonehoe IRA Twitter account. Tumblr did not respond to questions about these accounts.

It's likely that more IRA Tumblers exist, according to Albright, who questioned why Tumblr has not disclosed anything publicly about trolls on its platform.

"I feel that there is a responsibility here for them to look into this more," he said. "Has not one person at this huge company taken a look at the [list of IRA Twitter accounts released to congress] and said, 'Maybe we should cross reference user names on Tumblr?'"

Tumblr

All of the accounts identified by Albright and BuzzFeed News thus far focused on black issues and established a following among that community on Tumblr. When some of these Tumblrs disappeared, people posted on the platform to note their sudden removal. One such person is the man who runs the alwaysbewoke Tumblr. In late December, he wrote that “a bunch of pro-black news and opinion blogs disappeared and i think something fisy [sic] is going on.” Lagonegirl was on his list of recently disappeared Tumblrs.

In an interview with BuzzFeed News, the owner of alwaysbewoke said he followed 4mysquad and was shocked to learn that it, and possibly others, were run by Russian trolls. (He asked not to be named in order to keep his professional life as a technology consultant separate from this blog.)

“There was actually some nuance to the things they were posting. It wasn’t your run of the mill ‘white people are vile’ kind of stuff. It was far more nuanced than that,” said the man, who described himself as a 35-year-old living in Brooklyn.

He said he later unfollowed 4mysquad after the blog began “rooting” for Trump.

“I unfollowed him and the thing that was a red flag was that it was supposedly a black liberal blog that at some point started rooting for Trump to win,” he said. “That kind of pissed a lot of people off, so I kind of backed off and unfollowed.”

Among 4mysquad’s most viral content were posts that promoted Bernie Sanders, criticized Hillary Clinton, or that highlighted examples of police violence against black people. It also regularly shared and reblogged content about the experience of racialized communities in the United States, as well as an occasional post critical of white people:

Tumblr / Via web.archive.org

Anti-Clinton posts were a consistent theme on 4mysquad from 2016 on. Early that year, it posted the infamous video of Clinton calling young black gang members “superpredators.”

“She is a monster,” wrote 4mysquad. That post has over 50,000 notes on Tumblr.

4mysquad also published a photo of Clinton embracing former Sen. Robert Byrd, who had been a leader of the KKK, with the caption, “Hillary Clinton embracing KKK leader Robert Byrd, where is the media on this?” That post has over 23,000 notes to date.

Another post, which generated over 36,000 notes, is a video that shows Clinton speaking about Africa. “Sec. Clinton on colonialism in Africa: ‘Get over it,’” wrote 4mysquad.

Another successful 4mysquad format was to contrast Clinton with Sanders. A bird landed on Sanders’ podium in March of 2016 as he was speaking, creating a viral moment. 4mysquad then posted a photo of Clinton covered in slices of bread as a ploy to attract birds:

4mysquad / Tumblr

It earned close to 185,000 notes. Another hit, with, more than 240,000 notes, was a video post featuring Sanders reacting to a Saturday Night Live clip that lampooned Clinton for adopting some of his messaging.

The pro-Sanders content kept coming: In mid-2016 4mysquad called out the media for not giving fair coverage to a Sanders rally that drew more than 20,000 people. Another post showed an archival photo of a college-age Sanders being arrested by police in Chicago at a civil rights demonstration.

“This is why Bernie has my vote,” wrote the troll(s) behind 4mysquad. “He’s not some old White man who just decided that #BlackLivesMatter yesterday. He’s BEEN fighting. STILL fighting, 40+ years later.” The post generated over 112,00 notes.

The man who runs alwaysbewoke said that 4mysquad’s anti-Clinton tone mixed with Sanders boosterism didn’t strike him as strange, given that he felt the same way.

“It seemed to be par for the course,” he said. But he said things began to change on 4mysquad after Clinton secured the nomination. Suddenly the Tumblr began promoting Trump. BuzzFeed News and Albright did not find pro-Trump 4mysquad posts in online archives or on existing Tumblrs. This suggests that perhaps these posts did not gain as much traction as earlier messages from the blog.

There was, however, a post from 2016 that noted that Donald Trump had pointed out how unfairly Sanders was being treated by the “establishment.” It has over 200,000 notes to date.

Along with election posts, 4mysquad and others that Albright and BuzzFeed News linked to the IRA focused on blogging about police brutality and racial inequality. Blackmattersus got just under 40,000 notes for a post showing photos of black men killed by police in the US, and more than 30,000 notes for a post with tweets by a former NFL player that described his experience being stopped by police. Lagonegirl, which displays signs of being an IRA account, also generated over 370,000 notes for a post about sex trafficking.

“Black Community we have to be careful. Protect our Girls! Spread this!” the post said. The versions of the post that continue to be reblogged on Tumblr include the note from 4mysquad that soon followed lagonegirls’s original post: “IMPORTANT.”

4mysquad and fomysquad consistently reblogged content from lagonegirl and vice versa. Albright said they were part of a tight network of blogs that helped propagate each other’s content. He also documented hundreds of still-available Facebook posts and thousands of tweets with their content, as well as a surprising number of posts on Google Plus and Pinterest. The 1-800-gloup Tumblr also scored a hit on Reddit with a post about slavery that generated 3,600 upvotes and over 800 comments.

Pinterest / 4mysquad

“This operation links Tumblr to thousands of still-remaining Twitter posts, black culture blogs, at least several hundred still-remaining Facebook posts, sign-ups for online petitions, and a number of Reddit threads related to pro-Bernie news, Hillary conspiracies, and in-classroom racial matters,” Albright said.

Along with the content created natively on the platform by troll accounts, Tumblr is also home to content that originated on IRA-run Instagram accounts. A search of the #blackmattersus hashtag on the site reveals a handful of posts that originated on the blackmattersus Instagram, and that were automatically shared to Tumblr using reporting apps such as Regrann. The role of these apps in helping spread troll content across platforms was previously revealed by Albright and BuzzFeed News.

In the fall of 2016, 4mysquad generated outrage when it published a post about a black teenager being sexually assaulted by a white police officer. What appeared to be a surveillance video showing the rape was circulating online, and 4mysquad sliced the video into a series of GIFs showing the attack. It added the description, “Shocking video shows Black teenage girl being sexually assaulted by NYPD officer.”

At the time, a South African police officer had been charged with raping a 15-year-old girl in a holding cell. Snopes and other sites debunked the claim that the video showed an NYPD officer, and noted that it was unclear where the video actually came from.

As people began to talk about the South African officer being charged, the Blackmattersus.com website, which is run by the IRA, published an article that attempted to refute claims that the video was connected to South Africa. The goal of sowing mistrust and confusion was therefore achieved on multiple platforms from different IRA accounts as they sought to link the video to the NYPD.

“The effort made by 4mysquad to divide and conquer is clear,” Albright said.

Part of 4mysquad's post about a black girl being sexually assaulted by a police officer, and the blog's ensuing apology.

4mysquad / Tumblr

Bob Roe, the editor-in-chief, and Kenneth Li, the executive editor, were both let go today, along with senior politics writer Celeste Katz and senior writer Josh Saul.

Josh Keefe, a reporter with the International Business Times, initially had his access to company resources such as the CMS and email removed like the others. But Keefe later said on Twitter he had not been fired, "although that was very clearly the plan."

Both Newsweek and IBT are owned by Newsweek Media Group. This latest turmoil at the company follows a recent raid in its New York offices by the Manhattan District Attorney; BuzzFeed News revealing that NMG's top editor, Dayan Candappa, was fired from a previous job over sexual harassment allegations; and that the International Business Times has been buying traffic and engaging in ad fraud.

In the wake of the above events, the company's chair and finance director both stepped down last week.

Hours after the firings went public, the company announced in an internal staff email that cofounder Jonathan Davis would return as interim Chief Content Officer until the investigation into Candappa is completed, and that Nancy Cooper, the managing editor of IBT, is now acting editor of Newsweek.

"The company will not be commenting any further on these personnel changes at this time," the email, which was obtained by BuzzFeed News, said.

"Newsweek Media Group does not comment on personnel matters," the company said in a statement to BuzzFeed News.

A Newsweek staffer told BuzzFeed News the hours of delay between firing Roe and Li and an announcement of the new leadership showed a lack of planning on the part of company executives.

"If you’re going to fire the editor in chief you would think you’d have a staff meeting and say, 'Here's what we did, here's why we did it, and here's how we want to show our commitment to you,'" they said.

Saul and Katz, the two fired Newsweek reporters, shared a byline on the magazine's story about the DA's raid of its offices. They, along with Keefe, wrote a follow-up story about the company chair and finance director stepping down. Li was overseeing the coverage, and the New York Post reported that Roe was as well.

The Newsweek staffer said the firings now "look like retribution."

Sources told BuzzFeed News that staff in the magazine's New York office initially withheld work in the wake of the firings to wait for more information. "There's no official instruction or organized effort to withhold work, it's just sad, scared people waiting to hear more," said one staffer.

The source also said that staff in New York were told they could go home for the day, though not everyone left.

CNN reported that Newsweek senior writer Matthew Cooper resigned by email after the firings were made. "It's the installation of editors, not Li and Roe, who recklessly sought clicks at the expense of accuracy, retweets over fairness, that leaves me most despondent not only for Newsweek but for other publications that don't heed the lessons of this publication's fall," Cooper wrote.

He later posted his resignation email on Twitter:

His resignation was followed by that of David Sirota, an investigative reporter for IBT:

Pathmatics / IBT

The publisher of Newsweek and the International Business Times has been engaging in fraudulent online traffic practices that helped it secure a major ad buy from a US government agency, according to a new report released today by independent ad fraud researchers.

IBTimes.com, the publisher’s US business site, last year won a significant portion of a large video and display advertising campaign for the Consumer Financial Protection Bureau, a federal agency. Social Puncher, a consulting firm that investigates online ad fraud, alleges in its report that the ads were displayed to an audience on IBTimes.com that includes a significant amount of “cheap junk traffic with a share of bots.”

The CFPB’s ad budget was the subject of criticism from Republican lawmakers after the Daily Caller reported last year that it had awarded more than $40 million in contracts to a single ad agency, GMMB, which is one of the top Democratic media strategists. (A portion of money in those contracts was used to pay media outlets for advertising space, and was not kept by GMMB.)

The CFPB was created in 2011 as a result of the Dodd–Frank Wall Street Reform and Consumer Protection Act. President Trump recently tweeted that the bureau “has been a total disaster,” and installed his budget director, Mick Mulvaney, as its new director.

Neither the CFPB or GMMB are accused of taking part in, or having knowledge of, ad fraud on IBTimes.com.

A CFPB spokesperson told BuzzFeed News the bureau is looking into the allegations raised in Social Puncher’s report.

“We take allegations of fraud very seriously. Acting Director Mulvaney is actively looking into the work done by GMMB, and these allegations [of ad fraud by IBTimes.com] will be investigated as part of that process,” the spokesperson said.

In a statement to BuzzFeed News, GMMB acknowledged that IBTimes.com was part of the media buy, but disputed the report’s estimate of the money spent.

“While we don’t provide specific details about our client work, many of the assertions in the report—including all of the numbers reported for the ad buy—are inaccurate,” the statement said.

A source familiar with the campaign said that sites were selected based on data obtained from a third party audience measurement and media planning platform.

When it comes to IBT’s fraudulent traffic practices, Social Puncher’s findings align with reporting from BuzzFeed News on IBT India, and with separate data gathered by Pixalate, an ad fraud detection company, and DoubleVerify, a digital media measurement company. (Social Puncher and BuzzFeed News previously collaborated on ad fraud investigations, but worked separately in this case.)

Based on what it described as a detailed investigation, DoubleVerify this week classified IBT’s US, UK, India, and Singapore sites as “as having fraud or sophisticated invalid traffic,” according COO Matt McLaughlin. DoubleVerify is now blocking all ad impressions on these sites on behalf of customers.

In response to questions from BuzzFeed News, Newsweek Media Group, the parent company of IBT, acknowledged it purchases audiences from ad networks that sell pop-up and pop-under traffic. It said this traffic represents a “small percentage of traffic on our sites” and denied any fraudulent activity.

“We use third-party platforms to verify and filter this traffic to ensure it is of the highest quality. This verification process prevents poor-quality traffic being redirected to our sites and we consistently score highly on various third-party ad verification platforms,” the company said. It declined to name the third-party verification partners it works with.

NMG declined to comment on the CFPB ad campaign and Social Puncher’s report, and it declined to respond to DoubleVerify’s designation of its sites as fraudulent.

The exposure of IBT’s fraudulent traffic practices is just the latest problem to hit NMG in what has been two years of turbulence at the company. On Monday, BuzzFeed News reported that NMG’s top editor, Dayan Candappa, was hired there after being fired from Reuters over allegations of sexual harassment. As a result of the story, Newsweek Media Group placed Candappa on leave pending an investigation.

“They are being so reckless that you worry about people’s jobs and the brand."

This follows an October report from BuzzFeed News that revealed local content for IBT Australia is produced by writers in the Philippines, and its offices in Sydney were occupied by people who say they do not work for the company.

Two weeks ago, investigators from the Manhattan District Attorney's office raided Newsweek’s New York offices and hauled off computer servers as part of an ongoing investigation. Subsequent reporting from the company's own journalists found that the IRS filed $2 million worth of tax liens against NMG’s cofounders. Multiple Newsweek freelancers also told BuzzFeed News they have to wait months to get paid.

This all comes on the heels of layoffs in 2016 and ongoing questions about why the company has funneled millions of dollars to a university founded by a controversial Korean cleric with ties to NMG’s founders and executives.

Current and former employees told BuzzFeed News that company leadership is putting the business and Newsweek brand at risk with questionable hires, unreasonable traffic goals for staffers, by issuing late payments to contractors, and using dubious traffic-generating practices for the IBT sites.

"The fact that they have been engaging in this really unsavory stuff does not surprise me at all," a former top-level editor for IBT told BuzzFeed News.

“They are being so reckless that you worry about people’s jobs and the brand," said a current Newsweek employee.

In its statement, NMG acknowledged it has been slow to pay contributors. It cited pay processing issues and debt it took on to acquire Newsweek in 2013 as factors. “It is a priority of our company to pay all outstanding bills,” the statement said, noting that “Newsweek is now reaching its highest-ever global audience and it is now also our highest revenue-generating site.” (Newsweek.com was not implicated or named in Social Puncher’s report about fraudulent traffic on IBT sites.)

“The company is well-positioned for further growth across our portfolio in 2018 as we strive to extend our reach and serve new and existing audiences with a voracious appetite for news and current affairs analysis,” the statement said.

Even with its recent history of turmoil, IBT managed to land a big slice of a lucrative US federal government ad buy last year.

Beginning in early 2017, the Consumer Financial Protection Bureau spent millions on digital display and video ads that aimed to educate consumers about their rights when it comes to college tuition and home loans. This money was placed directly on a select group of websites, and not programmatically via an ad exchange. Along with IBTimes.com and Newsweek, the ads ran on two CNN Digital properties as well as Business Insider, according to data form Pathmatics, a platform that tracks digital advertising.

Pathmatics

The CFPB was created with the dual mandate of educating consumers about their rights with regard to the financial industry, as well as to hold the industry accountable via investigations and other action. Democratic Sen. Elizabeth Warren was instrumental in its creation. In recent years, the bureau has been the subject of criticism from Republicans for how it spends its funds and the fact that it’s not subject to traditional oversight from Congress.

“This unaccountable agency’s lavish spending is a prime example of how unelected bureaucrats in the swamp will spend money without common sense Congressional oversight,” Rep. Sean Duffy, chair of the House Subcommittee on Insurance, Housing and Community Opportunity, told the Daily Caller after the publication reported on cost overruns on renovations to CFPB headquarters.

At the core of Social Puncher’s report is the finding that the audience on IBT that saw CFPB’s ads was disproportionally made up of cheap traffic purchased from ad networks. The traffic is generated via pop-up or pop-under browser windows on file sharing and pirated video streaming websites.

When a user visits one of these piracy sites, a new browser window is automatically opened during their session, and this new window is used to load a different website or an ad. In some cases, the user sees the content in this new window, but in other cases, the window is hidden behind the original site they are browsing. This traffic does involve a human user, but it’s acknowledged to be of low quality because the content loaded in the pop-up window was not requested by the user, and, in many cases, they may never see it.

Data from SimilarWeb show that IBTimes.com began purchasing traffic from pop-up and pop-under windows as early as the fall of 2016. Social Puncher found that as the site’s organic search traffic declined, it replaced the audience with purchased traffic.

This paid traffic also served to increase the portion of US visitors going to the site, according to SimilarWeb data. Before purchasing traffic, just over half of all visitors to IBTimes.com were from the US. But that percentage increased to 80% during the critical period when the CFPB campaign ran. SimilarWeb also shows that, during the period of the campaign, almost a third of the IBTimes.com audience came from purchased traffic.

Social Puncher’s report concludes that IBTimes.com purchased the audience it needed to ensure it met the campaign’s requirements.

NMG declined to comment on the specifics of the Social Puncher report. In earlier statements to BuzzFeed News the company emphasized that it uses third-party verification services to measure the quality of its traffic.

Vlad Shevtsov, Social Puncher’s director of investigations, told BuzzFeed News he believes the CFPB received no real value for its IBT ad spend.

“The CFPB paid for laundered visits from pirate sites. It means that value of their ad spend [on IBT] is zero,” he said.

A lawyer with the Cause of Action Institute, a conservative group that has obtained CFPB documents via Freedom of Information requests, criticized the bureau and in a statement to BuzzFeed News.

“Such wasteful spending demonstrates that CFPB desperately needs more effective oversight and scrutiny,” said CAI counsel Eric Bolinder.

In addition to the low-quality traffic, Social Puncher’s report also alleges that one site selling traffic to IBTimes.com displays signs of bots. NMG’s statement to BuzzFeed News said it uses third-party verification services to analyze the traffic it purchases in order to keep bots off its sites.

“All our traffic and inventory is authenticated by multiple ad verification companies and we are confident of its quality,” the company said.

Separate from concerns about bots, Social Puncher, BuzzFeed News, Pixalate, and DoubleVerify each documented IBT sites attempting to camouflage the nature of their purchased traffic to have it appear organic.

Before loading IBTimes.com in a pop-up or pop-under window, the traffic is first routed through at least one other domain. This practice helps obscure the fact that the traffic originated via a paid arrangement on an illegal streaming or file-sharing website. Using this method, the traffic appears to analytics software as if the user came via a referral from another website — a much more valuable form of organic traffic. The practice of redirecting pop-up or pop-under traffic through domains before hitting the ultimate destination was detailed in a recent BuzzFeed News investigation.

Pixalate examined the IBT websites late last year and confirmed the use of pop-under traffic and multiple redirects to obscure the nature of the traffic.

“Through these redirects, the original referrer is scrubbed. This process makes the traffic appear to be organic when measured by traditional impression-level tracking technology,” the company said in a statement.

DoubleVerify independently made the same finding.

Socal Puncher found that paid traffic was being redirected to ex.IBT.com and then onto the main US site. This obscured the fact that the traffic originated as a pop-up or pop-under on pirate streaming sites such as Watchfree.co or Afdah.to. (The company also uses ex.IBT.co.uk to redirect traffic to its UK edition.)

Social Puncher

Some of the companies that run the pirated streaming sites sending traffic to IBTimes.com were recently called out in the Office of the United States Trade Representative’s 2017 report about “notorious markets” for commercial piracy. This means that some money from a federal government agency ultimately ended up in the hands of entities and people that the US government has called out for “Commercial-scale copyright piracy.”

One former Newsweek employee told BuzzFeed News they personally encountered pop-up windows that opened the IBT US website when visiting a pirated content site.

“I brought it to my manager and to their manager and said, ‘This is a clearly dirty thing that’s happening here,’” the former employee said.

BuzzFeed News documented the same practice on IBTimes.co.in, the Indian edition of the site. After browsing to Kissanime.ru and pressing play on a pirated anime video, a new browser tab opened up automatically. It first loaded a domain for the PopAds ad network before redirecting to Newsplatter.com, and finally landing on IBTimes.co.in.

Newsplatter is a website that appears to exist solely to route traffic from ad networks to IBT India. SimilarWeb data show the site had no traffic until it sprung to life in July 2017, racking up over 20 million visits since then. Even though the homepage of the site features auto-generated links to stories from a variety of media outlets, SimilarWeb found that 99% of its outgoing traffic is directed to IBT India.

“IBTimes India is a standalone operation and is not under the direct control of Newsweek Media Group,” the company said in a statement.

This gif shows a user browsing to Kissanime.ru, clicking on a video, and then having the IBT India site open automatically in a pop-up window.

BuzzFeed News

Along with referrals from pirate streaming sites, Pixalate told BuzzFeed News that data collected on IBT’s sites so far this month show that “roughly 40%” of the traffic coming via referrals from YouTube and LinkedIn is in fact the result of redirect chains.

“Note that this does not mean that YouTube, LinkedIn, etc. are 'in on' anything — it simply suggests that their sites are likely often used in the redirect loop meant to scrub the original referral (a pop-under ad),” said the Pixalate statement. “Traffic coming from YouTube appears to advertisers as more legitimate than traffic coming from a pop-under ad.”

Google, which owns YouTube, published a blog post last summer to make it clear that it would not allow sites that are loaded via pop-ups or pop-unders to be part of its AdSense ad network. The company also forbids sites using AdSense to be “loaded by any software that triggers pop-ups, modifies browser settings, redirects users to unwanted sites, or otherwise interferes with normal site navigation.”

NMG did not respond when asked if it was concerned about IBT sites being banned from AdSense as a result of using these practices. If the sites are kicked out of AdSense, it would mean a loss of critical revenue for a company that employees say remains on unsteady financial footing.

"We've been told that the company is on the brink of collapse so many times, and been put under huge pressure to meet ever-rising traffic targets as a result,” said one current Newsweek employee.

IBT and Newsweek have largely been run as separate operations, with Newsweek positioned as the higher-quality offering. But last March, a crisis hit the company that caused the two properties to become more intertwined.

Current and former employees — all of whom asked not to be named due to fear of repercussions from NMG management — said the key moment came in early 2017, when the CFPB ad buy was live on IBTimes.com.

Between February and March, organic search traffic to that and other IBT properties took a nosedive, according to the employees. Data from search engine optimization dashboard SEMrush confirms the huge drop:

SEMrush

Twitter refers to the process of blocking accounts (and individual tweets) in specific countries as “withholding.” All content from withheld accounts in Germany, for example, cannot be seen by Twitter users in Germany, but remain accessible to all other users.

Twitter regularly publishes a transparency report in which it shares the number of requests received from different governments, as well as from “trusted flaggers/reporters” such as NGOs and other social or industry groups in Europe that help report violations of the EU’s Code of Conduct against online hate speech. The company’s policy for withholding accounts and tweets says it will take action in response to court orders, or requests from government officials and law enforcement that meet the company’s criteria.

Twitter’s transparency report lists statistics about accounts and tweets that were withheld — but the company has never published a list of the specific accounts it has muzzled, and it almost never comments on individual decisions.

In order to gain insight into the withholding program, BuzzFeed News built a data set of more than 1,700 Twitter accounts observed to have been withheld in at least one of seven countries — Germany, France, Turkey, Russia, the United Kingdom, Brazil, and India — between October 2017 and early January 2018. Because Twitter publishes no official list of such accounts, and because many historically withheld accounts have since disappeared from the platform, the data set is incomplete. It does, however, appear to be the the most detailed and globally diverse list of withheld accounts ever published. (For an explanation of how the data was collected, see the “How we got the data” section at the end of this article.)

BuzzFeed News’ data and analysis offer an unprecedented glimpse into Twitter's collaboration with national groups and governments — democratic and authoritarian alike — and provide a stark reminder of Twitter's ability to shape political conversations, and of governments' attempts to influence that process. It also illustrates that the Twitter experience for users is not the same from one country to the next, and that a range of accounts ranging from malicious to harmless be blocked, especially when it comes to reading opposition voices in Turkey or viewing Nazi and white supremacist content in France and Germany.

Accounts @Duffys44 and @SteveRo56399233 are withheld in Germany and France, and @Adolf_Hess1488 is withheld in Germany. They can be seen by Twitter users in all other countries.

BuzzFeed News

In the second half of 2017, German authorities and trusted flaggers significantly increased the number of requests submitted to Twitter to block specific accounts and content, and that the company complied with hundreds of these requests.

At the end of June last year, just 35 Twitter accounts had been withheld in Germany, according to the company’s transparency report.

But by mid-October, just a few weeks after the German federal election, BuzzFeed News was able to identify more than 600 accounts withheld in the country, a massive increase. (Click here for the code behind BuzzFeed News’ analyses.)

Both Twitter and the German agency responsible for making requests to remove content declined to comment on the spike in blocked accounts around the election. However, a source familiar with Twitter’s policies told BuzzFeed News that globally the company typically sees a spike in requests for account and content removals around elections, in the wake of terrorist attacks, or during periods of civil unrest. Twitter has operated its withholding program since 2012. (The company withheld its first account in November that year, when it blocked a neo-Nazi group from being seen in Germany.)

Like Germany, France went on a withholding spree in the fall of 2017. Through the end of June, Twitter had withheld fewer than 25 accounts in France. But by mid-October, BuzzFeed News had identified more than 200 accounts withheld there.

BuzzFeed News identified 119 accounts that have been withheld in both Germany and France together, by far the most common combination of any two countries in the data set. An examination of the usernames, bios, and some of the content posted by the accounts withheld in those two countries found that a significant portion of them espouse Nazi and white nationalist ideology and related imagery. France and Germany each have relatively strict hate speech laws, but accounts can also be blocked in those countries for running afoul of legislation unrelated to hate speech.

Based on data collected by BuzzFeed News between October 2017 and early January 2018.

BuzzFeed News

More than 100 withheld accounts in the data set overall have included swastikas, “Nazi,” or “Hitler” in their username or bio. (Additional accounts have used allusions to Nazism, such as “14/88” and “ϟϟ.”)

Rather than ban these accounts outright, Twitter chose to withhold them when authorities made requests to do so. This aligns with the frequent criticism that Twitter has allowed these groups to flourish on its platform, and also fits with the company’s stance first articulated in 2011 that “we keep the information flowing irrespective of any view we may have about the content,” unless laws in specific countries prevent the company from doing so.

"Twitter together with Facebook have become the long-arm of the Turkish law enforcement machinery."

Another country of note in the data is Turkey, which stands out for its use of the content withholding policy as a means to silence opposition voices on the platform. Twitter’s own transparency reports also show that between 2014 and mid-2017, Turkey made more requests to remove accounts or content than any other country — by far.

"Twitter together with Facebook have become the long-arm of the Turkish law enforcement machinery," Yaman Akdeniz, a cyber-rights activist and law professor at Istanbul Bilgi University, told BuzzFeed News.

Twitter has not yet released transparency data for the second half of 2017. But the most recent data indicates that Turkish authorities inundated the company with more than 2,700 removal requests in the first six months of 2017 alone. (Twitter withheld 204 accounts and 497 tweets in response to those requests.) Turkey has in total made at least 11,887 requests to withhold accounts or specific tweets since the creation of the program, according to Twitter’s transparency reports.

A review of more than 700 accounts withheld in Turkey found that more than 600 belonged to those connected with militant pro-Kurdish movements as well as accounts affiliated with exiled Islamic Turkish preacher Fethullah Gülen. The Turkish government blames Gülen and his followers for having a role in the failed 2016 coup, and also declared his movement a terrorist organization.

Another notable group of accounts on the withheld list are journalists. The third-most-popular withheld account identified by BuzzFeed News belongs to Ekrem Dumanlı, who was editor-in-chief of the Gülen-linked newspaper Zaman until Turkish authorities commandeered the publication in 2015.

That year, Akdeniz coauthored a letter to Twitter that called for it to stop blocking accounts and tweets in Turkey. He is particularly critical of withholding entire accounts, as opposed to specific tweets. “Once an account is withheld everything that is written through or shared through that account, past, present and future is withheld. So, in my view that amounts to censorship,” he said.

Twitter declined to answer questions sent by BuzzFeed News, and did not comment on the data set and related findings. It also declined to explain why it does not list specific accounts withheld in different countries. The Turkish government agency that makes requests to remove accounts and content did not respond to multiple emails or phone calls, or a request via Twitter. The German body responsible for account removal requests also did not respond to multiple emails and phone calls.

A Twitter spokesperson pointed to Twitter’s transparency report and cited its “country withheld content” policy available online.

“Many countries, including the United States, have laws that may apply to Tweets and/or Twitter account content. In our continuing effort to make our services available to users everywhere, if we receive a valid and properly scoped request from an authorized entity, it may be necessary to reactively withhold access to certain content in a particular country from time to time,” the policy states.

Based on data collected by BuzzFeed News between October 2017 and early January 2018.

BuzzFeed News

Withheld around the world

The country with the most withheld accounts in the data set is Germany with 758, followed by with Turkey with 721, and France with 261. BuzzFeed News also identified 78 accounts withheld in Russia, 11 in India, 4 in the United Kingdom, and 2 in Brazil.

The most popular “withheld” account identified in the data belongs to Gurmeet Ram Rahim, who has more than 3.5 million followers. He is withheld from users in India.

Rahim’s account was blocked in early September at the request of police in the state of Haryana, according to the Times of India, shortly after the spiritual leader was convicted on two counts of rape. Apart from Rahim, at least five of the 10 other withheld accounts in India identified by BuzzFeed News make a reference to the disputed region of Kashmir in their Twitter bios.

The second-most-popular account in the data, with more than 1.4 million followers, is Twitter’s very own @PeriscopeCo, which has been withheld in Turkey since March. At the time it was reportedly blocked due to a copyright/trademark complaint filed against the service by a Turkish ad agency that was already operating under the name Periscope.

The most popular account that’s withheld in multiple countries belongs to “Amy Mek,” who is withheld in both Germany and France. The account’s bio identifies her as a psychotherapist from the US, and her timeline is full of anti-Muslim videos, images, and messages. She has also shared fake stories such as the fabricated claim that the leader of ISIS told people to vote for Hillary Clinton. Often the account shares videos and gives false or misleading descriptions of them. The frequency of its posts and other details have caused some to accuse it of using a fake name and identity, and of being a Russian sock puppet. The Mek account was once quoted in the New York Times.

After CNN’s Jake Tapper shared a link to a story that raised questions about its authenticity, the Mek account responded by offering to appear on his program. Tapper did not respond to the offer.

Twitter

The Mek account did not respond to direct messages from BuzzFeed News asking to speak for this article. The account, however, has tweeted many times about being withheld:

When Twitter decides to withhold an account, its owner is notified by email about why and where it’s being restricted.

Accounts that are withheld often tweet about their status when they are first notified. BuzzFeed News also identified that the word “withheld” has appeared in at least 105 bios of accounts that have been blocked in specific countries. The majority of the accounts use this text (with their specific country) in their bio: “This account has been withheld in: [country name].” That is the same language that Twitter uses to inform users that an account has been withheld in their country, suggesting many users copy and paste it into their bio.

Some accounts wear their status as a badge of honor, while others cite it to protest what they see as unfair censorship.

BuzzFeed News

According to the data Twitter has published in its transparency reports, as well as examples gathered from other sources, the company rejects many official requests to block accounts or tweets. For example, late last year the Russian government contacted the platform to demand that it remove the account of OpenRussia, a pro-democracy group funded by Mikhail Khodorkovsky, an exiled Russian oligarch and opponent of President Vladimir Putin. Twitter was provided with a court order and informed OpenRussia of the demand. But Twitter took no action against the account. (OpenRussia has since transitioned to a new account, @MBKhMedia.)

Twitter’s withholding program for the most part operates under the radar. But it recently attracted a measure of attention when some US users claimed they saw fewer Nazi and white nationalist accounts in their mentions after changing their Twitter settings to say they are based in Germany. Author and Los Angeles Times columnist Virginia Heffernan went viral with a tweet telling people they could disappear Nazi accounts by changing their settings.

BuzzFeed News also found that it’s apparently possible for an account that has been withheld to have its ban lifted. As of early January, nine accounts that BuzzFeed News had previously identified as being withheld were found to have been “un-withheld” — made visible to all users regardless of location. It’s unclear why these accounts were unblocked, and Twitter would not comment on specific accounts. BuzzFeed News reached out the owners of several active accounts on Twitter but did not hear back.

Additionally, 193 accounts that were identified as being withheld in an earlier scan were no longer accessible as of early January — in some cases because they had been fully suspended, and in others because they had deleted their accounts. Another 84 accounts were, according to Twitter’s website and data, “temporarily unavailable because [the account] violates the Twitter Media Policy.”

On Dec. 18, Twitter began implementing what it said were stricter rules against accounts that spread hate. The new policy means the company is now fully suspending certain types of accounts that it may previously have only withheld. Soon after the new rules took effect, for example, Twitter banned @theAmericanNazi, @NaziParty45, and @FuckthoseJews from its platform.

Twitter and Instagram accounts unconnected to Russian trolls spread their content to both platforms.

Twitter / Instagram

Twitter stated publicly on Friday that it had removed content posted by more than 50,000 Russian propaganda accounts from its platform, but Russian troll content continues to live on it and other social platforms. New data provided to BuzzFeed News shows there are more than 3,700 active tweets, generated by third-party apps, that quote or cite Russian troll accounts and link back to active content on Instagram originally posted by trolls.

The thousands of tweets and Instagram posts were shared by apparently genuine users who installed one of two popular social media apps, Regrann and Repost. These apps enable Instagram users to regram other people’s content to their profile with credit, in effect creating a retweet button for Instagram. The apps also allow users to automatically tweet these new Instagram posts.

The result was that users reposted content from Russian trolls on their Instagram account, and then automatically posted a link to it on Twitter.

“Real people were reposting this content; it was not necessarily bots reposting,” Jonathan Albright, research director of the Tow Center of Digital Journalism, and the researcher who gathered the data, told BuzzFeed News. “We found a police department that had reposted content from a veterans account [run by Russian trolls].”

The findings show that major social platforms still host or point users to significant amounts of propaganda created by Russian trolls, despite major efforts to remove troll accounts and content. The data also reveals how reposting apps unwittingly became powerful disseminators of Russian propaganda by enabling content to easily flow between different accounts and platforms.

“This is very problematic because Twitter does claim that since they already suspended the [troll] accounts the content is gone,” Albright said.

A Twitter spokesperson told BuzzFeed News that the company's blog post was specific to the more than 50,000 troll accounts and the content they posted. They said Twitter does not remove troll content that was cited or reposted by other accounts.

"We suspended the accounts that we identified through our review, and the content within a suspended account is no longer available by viewing that account," the spokesperson said in an email. "It is not against our rules to have the content elsewhere on Twitter."

In an email sent after this story was first published, a spokesperson for Facebook, which owns Instagram, said the platform removed IRA accounts but will not remove troll content reposted by others unless it violates Instagram's terms of service.

“We take this issue very seriously and continue to fight efforts to stop foreign interference on any of our platforms," the spokesperson said. "As part of our investigation into this issue during the 2016 election, we found and removed around 170 IRA accounts on Instagram that were responsible for approximately 120,000 posts. Our review of this activity is ongoing and we continue to monitor for and remove fake Instagram accounts.”

Albright said he’s concerned that Twitter’s plan to email over 670,000 users who interacted with Russian troll accounts on its platform is incomplete given that it does not include these users.

“Can you not find the thousands of posts that are still there before making a huge effort to contact these people? How could Twitter not know about this?” he said.

The Twitter spokesperson said the company's emails will go to users that directly interacted with troll accounts, and not users who reposted or cited troll content.

"The reason behind our email notice was to inform users/provide transparency into specific account-level interactions with the identified accounts. In other words: We provided notice based on engagement with the accounts," the spokesperson said.

An example of the reposting scenario identified by Albright involved the @dangerousnegro Instagram account, which has with no apparent links to Russia. It used the Repost app to share a meme that originally appeared on the @blackmattersus Instagram account, which was run by the Russian Internet Research Agency. The regram by @dangerousnegro generated over 1,000 likes on Instagram:

Instagram / Via instagram.com

The @dangerousnegro Instagram account then used Repost to automatically share a link to its post on Twitter:

Twitter / Via Twitter: @dangerousNEGRO

With just a few clicks, an image created by a Russian troll account flowed to accounts on Instagram and Twitter with more than 35,000 followers between them. (BuzzFeed News contacted emails connected to the @dangerousnergo accounts but did not hear back.)

The chain of resharing and posting to multiple platforms highlights just how interconnected seemingly separate social networks can be, according to Albright.

“They are all connected. All these third-party apps allow for linking together of accounts and that allows ways for the propaganda to circulate,” Albright said.

This pattern repeats itself again and again in the data gathered by Albright in a project he led at the University of Amsterdam. The more than 3,746 tweets that fit this pattern are drawn from tweets that cite one of 20 high-profile troll accounts. Albright says there are more tweets and Instagram posts in the dataset that cite and repost content from IRA accounts.

A Twitter and Instagram user reposted troll content to Instagram and Twitter.

Twitter / Instagram

Albright believes this content was missed in the investigations conducted by Twitter and Instagram because reposting apps do not use the native retweet or regram features built by the platforms themselves.

“This is a huge problem for propaganda because [the reposting apps] are actually keeping all of this stuff in a zombie state, a state of suspended animation, and it’s often getting reshared months after the fact,” Albright said.

However, Albright also said it wasn’t hard to find the content once they understood the role reposting apps had played. “Literally you can get on Twitter, type in the names of the [IRA] accounts like we did with ‘Regrann’ or “Repost’ and find them.”

Ultimately, he said, the continued presence of so much Russian propaganda on Twitter and Instagram says more about social platforms than it does about the trolls who created it.

“The entire point is that there is a lack of safeguards in how these platforms work, and they are easily exploitable,” he said. “That is the fundamental problem, not Russia. It’s a lack of consideration for these bigger problems. This is a perfect example of this kind of oversight.”

LINK: More Than 50,000 Russia-Linked Bots Tweeted About The Election During The 2016 Campaign

Loic Venance / AFP / Getty Images

Twitter continues to approve malicious ads that, in at least one case, masqueraded as an offer from Twitter itself to help users get their accounts verified.

The ads led users to a website that asked for account information such as their email address and Twitter password, in addition to requesting details about the user's online payment accounts.

"These are nothing less than phishing attempts designed to steal users’ credentials as well as their financial information," Jérôme Segura, the lead malware intelligence analyst for Malwarebytes, told BuzzFeed News. "The harvested data is typically resold in bulk on various darkweb marketplaces."

When combined with the email address and other information collected in the form, the payment details could be used to break into a user's online payment accounts.

Segura said this type of phishing attack has been running on Twitter "for years," and frequently exploits the platform's Promoted Tweets advertising product. A similar scheme was identified early last year. Twitter's Promoted Tweets product enables a user to take a tweet from their account and turn it into an ad that can appear in other people's timelines.

This attack could be also used to target specific users in order to gain access to their Twitter account, as well as related online accounts, according to Segura.

"Because promoted tweets can be configured to be displayed for a particular audience, they could in theory be used for more targeted phishing campaigns as well," Segura said.

The form used to steal user information.

Nancy Levine

Twitter's advertising policies are already under scrutiny after it acknowledged late last year that Russian government broadcaster RT spent $1.9 million on the platform since 2011. Twitter announced in October that it would no longer accept advertising from RT or Sputnik.

"We don't comment on individual accounts for privacy and security reasons," a Twitter spokesperson told BuzzFeed News.

The company's online FAQ about the ad approval process says that ads "are submitted for approval on an automatic basis, based on an account’s advertising status, its historical use of Twitter, and other evolving factors."

At least two different Twitter accounts were able to buy promoted tweets that told users they could get their accounts verified by visiting Verifiedreview.today. That site displayed a form made to look like it was hosted on the official Twitter website. Users were asked for their name, email address, Twitter username, password, and company names, as well as to indicate whether they use any online payment services. Once submitted, the hackers on the other end would be able to login to the person's Twitter account and take it over, or to sell the information.

Verifiedreview.today is no longer online, and the two accounts that shared the link in promoted Tweets have been removed from Twitter. One of them was designed to look like an account run by Twitter itself:

Nancy Levine

Another account that spread the link via a different ad looked more like a regular user:

@ajchavar / Twitter / Via Twitter: @ajchavar

The first ad ran on Jan. 5, and the second appeared two days later, showing that the attack was executed over multiple days using at least two different accounts. In both cases Twitter did not block the ads.

Some said the ability of hackers to run these ads reveals flaws in Twitter's ad approval system.

Nancy Levine, an author based in California, told BuzzFeed News she saw one of the malicious ads in her timeline and clicked through because she thought it came from Twitter.

"I filled out their form, and started typing my password when I became suspicious,' she said in an email. "Looked more closely, then reported it to Twitter as 'spam' — [the] closest available complaint among their menu choices."

Levine said Twitter's opaque rules for verifying user accounts create an opportunity for these scammers.

"As for Twitter verification, I've had four books published by Penguin Books, bylines include Sports Illustrated, AlterNet, and others, but Twitter has declined my application for verification twice," she said. "The scammers played on Twitter users' frustration around verification IMHO."

That tweet was one of the first times I publicly used the term “fake news” to refer to completely false information that was created and spread for profit.

By then I was running a research project and associated website that tracked and analyzed the spread of misinformation on social media and in the news. I kept encountering sites like nationalreport.net and began calling them and their content “fake news.” It seemed like a natural description; I didn’t put a lot of thought into it. Over time I played a role in helping popularize the term.

That was 2014. Here’s where we are now:

Twitter / Via Twitter: @SheriffClarke

Perhaps nothing illustrates what’s happened to the term “fake news” over the past year better than that tweet, from prominent Trump supporter David A. Clarke Jr. In just a few words, he labels reporting on verified court documents about him as fake news and presents a completely fabricated Hillary Clinton quote as real, all while painting the media and liberals as too dumb to recognize the truth.

Three years after that tweet about National Report, I cringe when I hear anyone say “fake news.” Yet thanks to my work on the subject, I’m inextricably linked to the term. (This isn’t bragging: In fact, to some it’s an indictment. “How BuzzFeed Editor Craig Silverman Helped Generate the ‘Fake News’ Crisis,” read a Breitbart headline from almost exactly a year ago.)

Ironically, I started doing this work in criticism of the mainstream media: tracking incidents of plagiarism and fabrication, publishing annual lists calling out the errors and apologies of the year, and pestering editors who refused to explain what happened when major errors took place in their newsroom.

The press still gets a lot wrong, and that certainly includes the coverage of the Trump administration. (Put me squarely in the corner of those who think CNN and other outlets need to disclose much more about how they and their sources completely botched a report about when the Trump campaign learned of WikiLeaks’ cache of DNC documents. The same goes for the retracted Fox News story about Seth Rich.) But it’s possible — and essential — to delineate between errors made in the course of actual reporting and people or entities who consciously lie for profit and propaganda. Yet, today, any form of media mistake is weaponized, with willful fabrications treated the same as sloppy errors.

A functioning press and democracy require criticism, transparency, and consequences for journalistic mistakes. They also require that we’re able to collectively distinguish them from lies and deception. Otherwise, as the former sheriff's tweet showed, real information will be painted as fake, and manufactured bullshit gets presented as fact.

Jax10289 / Getty Images

Back when I encountered that fake Ebola story and others like it, I started building a list of the sites publishing exclusively false stories engineered to go viral. In 2014 I had identified about a dozen of these sites. (My 2017 list, which you can download here, has 167.) These sites peddle misinformation for money, and even back in 2014 they were doing gangbusters business thanks to Facebook and ad networks.

Then, as now, the success of this form of misinformation revealed how our media environment is more easy to manipulate than ever before. Fake news was a canary in the coal mine, but it’s by no means the only example of what some now label “information disorder.”

It became my beat and obsession to track these sites, expose who was running them, and to sound the alarm about what was going on. I wrote about Canadian teens earning money from Justin Trudeau hoaxes, the man behind that fake viral “Pope endorses Trump” headline, a comedian scoring viral hits with outlandish fake crime stories, and a network of websites propagating false news articles about terrorist attacks in cities around the world, among much more. And, of course, I wrote about those Macedonian teens who later became the poster kids for fake news. I (perhaps naively) assumed that there could be a sense of unified outrage and action about this issue.

After the election, fake news became a topic of concern and debate. My stories looking at viral fake election news posts and the Macedonians article achieved their own measure of virality, with the latter even ending up on Obama’s desk. But in retrospect, this is where the problem started. Fake news could not survive contact with the hyperpartisan world of the mid-2010s.

I should have realized that any person, idea, or phrase — however neutral in its intention — could be twisted into a partisan cudgel.

I should have realized that any person, idea, or phrase — however neutral in its intention — could be twisted into a partisan cudgel. I had always reported on fake news generated from both the left and the right. But after the 2016 election, shocked US Democrats, looking for explanations, adopted the concept as an easy answer to the puzzle of Donald Trump’s election. And in response, Trump and his supporters saw the term as a threat and an insult — and a weapon.

The end of “fake news” as I knew it came on Jan. 11, 2017, when Donald Trump — master of branding — redefined the term to mean, effectively, news reports he didn’t like. The previous day CNN and BuzzFeed News had reported on the existence of the Steele dossier.

Trump stood on stage during his first press conference since Election Day and pointed his finger at CNN’s Jim Acosta. “I’m not going to give you a question — you are fake news.” (He also called BuzzFeed a “failing pile of garbage.")

CNN/ YouTube / Via youtube.com

In that moment, fake news was conscripted to fight in the partisan wars, and was co-opted by Trump. This instantly made it harder to win the actual fight against the manipulation of platforms for profit and propaganda, the real challenges facing democracy in a connected age, and the risks of censorship from platforms and governments alike.

Political movements around the world recognized the genius of Trump’s tactic and adopted it. Now, “fake news” is a global phrase uttered by leaders and citizens alike. It’s emblazoned on T-shirts, used in memes, abused as a hashtag. It’s never been more ubiquitous and, as a result, more confused and manipulated. After a yearlong battle for its meaning and ownership, “fake news” is now both an empty slogan and a deeply troubling warning sign.

The story of “fake news” symbolizes how our current information environment operates and is manipulated, how reality itself is shaped and bent. It’s a testament to the fact that today a phrase or image can come to mean anything you want it to, so long as you have enough followers, propagators, airtime, attention — and the ability to coordinate all of them.

If you marshall these elements you can literally brand real things as fake. Repeat it often enough, and you manufacture reality for a portion of the population. Fake news means what your side says it does.

The paradox at the core of “fake news” getting famous is that what I think of as actual fake news — the stuff I’ve been weirdly obsessed with for at least three years — has become a sidebar in the discussion. Encouragingly, there is without question more interest, research, and public discussion about online misinformation and propaganda than ever before. Alarmingly, and as a direct result of its presence in the public conversation, it has become a politicized, polarized topic. This jeopardizes our ability to confront it.

Not being able to focus on actual fake news is a symptom of the ongoing collapse of a shared sense of reality and the related public conversation. Online misinformation, and the exploitation and manipulation of our information environment, are real, complex problems affecting global societies. By making the term "fake news" ubiquitous and muddled, we lost a battle in the actual war against completely false information.

Tow Center / Via towcenter.org

I recently reread my 2015 research paper about rumors, misinformation, and fake news. Though it dealt with serious falsehoods involving Ebola and ISIS, it reads as being from a different time, divorced from the current reality where reality itself seems under attack.

This week, two colleagues and I published a detailed analysis of 50 of the biggest fake news hits on Facebook in 2017. We showed that, even after a year of concerted effort by Facebook and major fact-checkers to battle this specific kind of misinformation, the stories in the 2017 list generated even more total engagement than those in the top 50 of 2016. “Fake news” is everywhere in the public discussion — but people seem to forget that fake news continues to run rampant.

Our story was posted to the BuzzFeed News Facebook page. As of this writing, it has a single comment:

Facebook / Via Facebook: BuzzFeedNews

BuzzFeed News

Facebook’s major effort to stop the spread of false articles on its platform did not result in less engagement for the most viral hoaxes in 2017, according to an analysis by BuzzFeed News. In fact, the analysis found that the 50 most viral fake news stories of 2017 generated more total shares, reactions, and comments than the top 50 hoaxes of 2016.

This highlights the challenge faced by Facebook to find ways to halt or arrest the spread of completely false stories on its platform, and raises questions about how much progress has been made in fighting this type of misinformation. After a year of working with fact-checkers such as PolitiFact and Snopes, and stating that related product efforts can reduce spread of a false news story by 80% once it’s been debunked, Facebook remains the home of massively viral hoaxes.

In response to the BuzzFeed News analysis, a Facebook spokesperson said the company’s initiatives continue to improve, and that the spread of pure fake news has been reduced on its platform.

“If the protections we added throughout 2017 were in place at the start of the year, this list would be shorter and the engagement would be substantially reduced,” they said. “We’re more effective today at stopping news hoaxes than we’ve ever been before. It isn’t perfect. There is a lot more work to do; but we’re better. Once a hoax has been fact-checked, it’s distribution immediately goes down by 80-percent.”

The top 50 fake stories of 2017 identified by BuzzFeed News generated a total of roughly 23.5 million shares, reactions, and comments on Facebook between Jan. 1 and Dec. 9, according to data from BuzzSumo. The top 50 fakes identified by BuzzFeed News in 2016 generated 21.5 million engagements during a similar timeframe. Go here to view the full list of top 50 hoaxes of 2017, and the list of sites used to compile it.

The top-performing fake news story in the analysis typifies the kind of hoax that succeeded on Facebook in 2017. “Babysitter transported to hospital after inserting a baby in her vagina,” read the headline from World News Daily Report. The story generated more than 1.2 million shares, reactions, and comments since being published in May.

BuzzFeed News

Additional analysis reveals a massive Facebook engagement gap between the top fake news stories and their corresponding fact checks. Snopes, PolitiFact, FactCheck.org, and ABC News were the initial US participants in Facebook’s fact-checking program, and together they produced at least one fact check for 31 of the 50 top stories in the data. Their debunkings generated a total of 127,543 engagements on Facebook — just .5% of the engagements generated by the hoaxes.

The Facebook spokesperson said the company’s new plan to surface fact checks as related articles in the News Feed will likely help with engagement for debunkings, and that the tools used by fact-checkers to notify Facebook of a new debunking have also improved.

The data gathered by BuzzFeed News also found that new sites focused on publishing completely false stories continued to be launched in 2017. Hoaxsters, conspiracy theorists, and viral deceivers are undeterred by Facebook’s stated goals of disrupting their financial incentives and suppressing the spread of their content.

David Mikkelson, the co-founder and executive editor of Snopes, told BuzzFeed News he wasn’t surprised to see fake news outperform fact checks in 2017.

“The fake news purveyors had a huge lead going into 2017,” he said. “They had a great deal of practical experience and well-established strategies and mechanisms for spreading and monetizing fake news, while entities such as Facebook were just getting their feet wet trying to devise strategies and mechanisms for dealing with the phenomenon.”

“The fake news purveyors had a huge lead going into 2017.”

Tessa Lyons, a Facebook product manager helping lead the company’s anti-misinformation effort told BuzzFeed News her team recently shipped new products that will attack the type of hoaxes and publishers featured on the BuzzFeed News list.

"When I look over the list, honestly, I feel like the things we launched in the last quarter in particular are going to address at the viral hoaxes you identified,” she said. “I’m certain that the list next year will be smaller [in terms of engagement], but the tactics being used will be different."

BuzzFeed News used social analytics service BuzzSumo to identify the top-performing Facebook content from 167 websites that entirely or consistently publish articles with a completely false central claim. The data set excluded any articles that were based on false insinuations, misreported news, or partisan misrepresentations of real events. This is therefore meant to represent exactly the type of completely false stories that Facebook and its fact-checking partners focused on in 2017. For a more detailed description of the methodology and its limits, see the “How we got the data” section at the bottom of this story.

Top fake stories

Not surprisingly, fake stories about US politics dominated the list in 2016 as a result of the presidential election. Twenty-three of the 50 top-performing fake news hoaxes identified by BuzzFeed News that year were focused on US politics. In 2017, only 11 of the top 50 hoaxes were about politics. Instead, outlandish crime stories were the most common category of hoax in the top 50 list this year, accounting for 20 of the posts.

Top categories for viral hoaxes in 2017

BuzzFeed News

When it came to crime hoaxes, World News Daily Report dominated the genre. That helped it secure its spot as the publisher with the most articles on the top 50 list. It had 12. Viral fake crime hits from other sites include, “Popeyes manager arrested for allegedly dipping chicken in cocaine based flour to increase business sales,” “Hendersonville Man Caught Molesting Pig after his penis gets stuck,” and “Angry Woman Cuts Off Man's Penis for Not Making Eye Contact During Sex.”

Along with taking the top spot, World News Daily Report also scored the second-biggest viral fake news hit of the year, according to the data. Headlined “FBI seizes over 3,000 penises during raid at morgue employee’s home,” it generated more than 1.1 million engagements.

Eight of WNDR’s 12 articles on the top 50 list were the subject of debunkings by Snopes; none of the corresponding Snopes links received more than 7,300 Facebook engagements. Most received far less. The Snopes debunkings of the top two WNDR hoaxes on the list received a total of just 1,748 engagements between them. The hoaxes generated more than 2.3 million engagements.

World News Daily Report

A Facebook spokesperson said in some cases the Snopes fact checks were not submitted via the tool Facebook provides its fact-checking partners. This means they were not used to algorithmically reduce the spread of the hoax. The spokesperson said the company is working on eliminating the need for each link to be submitted by fact-checkers.

Janick Murray-Hall runs WNDR from Montreal. At this time last year he was worried about the prospects of his site due to it being kicked out of Google’s lucrative advertising network, and because of Facebook’s plan to work with fact-checkers. He believed fake news would still continue to exist but predicted that “Facebook’s new measures will definitely kill the momentum of many viral hoaxes when they get reported to third parties and flagged by Facebook.”

A year later, Murray-Hall says that wasn’t the case. He and other savvy publishers also found a way to ensure their sites can continue to earn revenue and remain largely undisturbed.

“It's been a challenging year for sure because of all the witch hunt surrounding fake news because of the left-wing mainstream media seeking a scapegoat after Trump's election, but at the end, I think it has made things easier for us,” he told BuzzFeed News.

Murray-Hall pointed to an April BuzzFeed News article that analyzed the advertising networks used by different sites that publish fake news. The lesson he took from that story, based on comments made by Google and Taboola, is that he would be able to earn ad revenue if he labeled his stories as satirical on every page.

“Since then, we no longer have had any problems with ad networks and are very happy to be branded as one of the most notorious hoax news/satirical news sites on the internet,” he said.

Along with the type of crime hoax favored by Murray-Hall, fake stories about current events also performed well. A hoax about Charles Manson being released on parole was the third-biggest hit of the year, according to the data. A completely false story, “Police: Chester Bennington Was Murdered,” was the fourth-biggest hit, with just over 1 million engagements.

The latter is a story from Your News Wire, a site run by two men in Los Angeles who publish a range of completely false news articles about current events, stories that mix real information with false claims, as well as aggregated political news. The site had 9 articles on the top 50 list, the second most of any publisher.

The men who run YNW were the subject of a credulous profile in the Hollywood Reporter that said they are “emerging alongside the more high-profile Breitbart as an integral player in the Trump era's L.A. alt-media axis.”

Along with making up a story about a musician who died by suicide, the site falsely reported there were multiple shooters involved in the Las Vegas shooting, that “over 25 million Hillary Clinton votes were completely fraudulent,” and that Justin Bieber told a Bible study group that pedophiles run the music industry.

BuzzFeed News / Via Your News Wire

BuzzFeed News contacted YNW cofounder Sean Adl-Tabatabai, who used to work for British conspiracy theorist David Icke, for a comment on his site’s presence on the top 50 fake news stories list.

“The number one spot surely has to go to the Trump Russian dossier unverified report published by Buzzfeed in January?” he said in an email. (As his reply helpfully noted, the information in the Steele dossier is unverified, rather than fabricated, and is still the subject of investigation by law enforcement and Congress.)

Adl-Tabatabai also included a screenshot of a YouTube video titled “BuzzFeed Is Cancer” in his email.

BuzzFeed News

Fake news networks

Even though Facebook has made its effort to stamp out false stories well known, many new sites emerged in 2017 to publish hoaxes and false stories. Some of these sites were new projects from existing fake news publishers; others were newly launched domains by new players. Of the 167 sites analyzed in 2017, 119 were not present on the 2016 list. (Note: A PolitiFact list published in April includes seven fake news sites that would have qualified for our 2016 list if we had known about them at the time.)

One big 2017 success was a Cleveland man named Korry Scherer. He launched a new network of at least 19 create-your-own-fake-news sites this year, and he had five fake stories in the top 50. BuzzFeed News previously reported on him and another man who both run websites that enable anyone to write a fake story, add an image, and then share it to Facebook. In one case, an Indian restaurant in London almost went out of business after a fake story about it serving human meat went viral.

“Initially I never really set out trying to mess with fake news,” Scherer told BuzzFeed News at the time. “This prank site for the most part is people making stories that affect them and their friends ... I definitely took advantage of online hoaxes and viral hoaxes over the years, I can’t deny that. It’s a way to make money.”

Channel23News.com

Another 11 create-your-own-fake-news sites, with domains such as React365.com, 12minutos.com, and Actualite.co, are owned by Nicolas Gouriou, a man based in Belgium. His first such site was started in 2015 and he now operates them in multiple languages. He scored five hits on the top 50 list this year, of which one was in English, three were in Spanish, and one in French.

Lyons from Facebook said the company recently took steps to prevent people from using these sites to spread hoaxes, rather than to simply prank their friends.

“We give them far less distribution as a genre, but we still enable you to see them on people’s profiles,” she said.

Another big network to emerge in 2017 is a group of sites that appear to be local newspaper websites but are filled with fake stories. These sites have domains such as borderherald.com and abcnews-us.com, and specialized in fake viral stories tied to different locations. “Tainted buffet at Jacksonville strip club blamed after severe diarrhea incident on stage,” is one story that made the top 50 list. These sites have been reported on by Lead Stories and others, and after racking up impressive Facebook engagement this year the sites were taken offline.

This chart shows that these networks join World News Daily Report and Your News Wire as the publishers with the most stories on the top 50 list. (The Celebtricity network is another network of fake news sites that was exposed by BuzzFeed News earlier this year.)

Most common publishers/networks

BuzzFeed News

Copycat hoaxes

Along with new networks, another key trend in the 2017 data is the existence of copycat sites run by young spammers based in Eastern Europe, among others. A site called Redcountry.us earned almost 250,000 engagements for a false story claiming that Sharia law had been banned in all 50 states. (The article page consisted of nothing more than that headline, a user poll, and tons of junky ads all over the page.) That site is registered to Marko Cvetkovski, who lives in Veles, Macedonia, which BuzzFeed News previously reported has become a hub for pro-Trump websites run by local spammers. They often plagiarize fake news from US-based sites.

At least three sites that BuzzFeed News analyzed for this story are registered to people in Macedonia. The owners of these sites consistently copy and paste fake news stories from other sites. Their favorite frequent source of material is a group of sites run by a self-described liberal troll using the online moniker Busta Troll.

His real name is Christopher Blair and he lives in Maine. His sites include Thelastlineofdefense.online, Ladiesofliberty.net, and Reaganwasright.com. He had one hoax in the top 50 list, “BREAKING: NFL Fines Pittsburgh Steelers $1m Each For Skipping National Anthem,” which was published on Thelastlineofdefense.org. Blair claims he is creating fake news aimed at American conservatives to expose their gullibility. Earlier this year he grew tired of seeing his articles plagiarized by Macedonians and began reporting them for copyright violations, which resulted in some of their websites and Facebook pages being shut down.

Facebook: OurLandOfTheFreeIsGreat

Social Puncher / Via ozy.com

This summer, Ozy.com, a news site that’s raised more than $35 million in funding from high-profile investors, published a group of articles in an ongoing series about how companies and entrepreneurs are trying to be a positive force in their communities. The content was created as part of a partnership with JPMorgan Chase, whose logo appears on each article.

The stories appeared to be a big hit: Between May and October, the sponsored content ranked among Ozy’s most-viewed articles, according to traffic data from analytics service SimilarWeb.

It’s the kind of success a publisher and brand would celebrate — except that the vast majority of traffic to the articles was in fact fraudulent, according to ad industry standards. Those stories, as well as other Ozy articles that carried ads from Amazon and Visa, received traffic that was purchased and delivered via a system that automatically loads specific webpages and redirects traffic between participating websites to quickly rack up views without any human action.

JPMorgan told BuzzFeed News it had no idea its sponsored content was receiving paid traffic from the source in question, and Ozy said it believed the audience was valid when it purchased it. Ozy has since told the bank that the resulting traffic was not counted as part of the campaign.

“We’re committed to only working with reputable and brand-safe publishers, and we don’t take this sort of thing lightly,” Erich Timmerman, a JPMorgan spokesperson, told BuzzFeed News.

The incident is the latest glimpse at the roots of a crisis of trust in online publishing. Blue-chip advertisers increasingly doubt whether their online ad spending reaches real audiences, and JPMorgan in particular has taken steps to ensure its ads only appear on quality sites. But even quality sites present risks.

Working in collaboration with ad-fraud consultancy Social Puncher, BuzzFeed News identified several other reputable publishers who also received the same invalid traffic during a similar timeframe as Ozy. They include Funny or Die, a video comedy site founded by actor Will Ferrell and several Hollywood producers; Community Newspaper Holdings Inc., a publisher of local newspapers in more than 20 states, which receives the traffic as part of a deal with video company Tout; Bustle Digital Group, a fast-growing digital publisher focused on young women; and PCMag, the venerable computing publication. All except CNHI say they have stopped using the traffic in question.

The audience delivery system used by these publishers was first detailed in an October BuzzFeed News investigation that revealed how subdomains on Myspace and more than 150 newspaper websites belonging to GateHouse Media generated massive amounts of fraudulent video views and ad impressions. (Both companies blamed partners who operated the offending subdomains and said they did not profit from fraudulent views or ads. They shut down the subdomains.)

How the system generates traffic through redirects between websites.

BuzzFeed News

An estimated $16 billion will be lost to ad fraud this year, and a significant portion of that will go to criminals who use bots and other nefarious means to siphon money out of the digital ad ecosystem. But this example shows how legitimate publishers contribute to fraud when they knowingly or unknowingly use invalid traffic and other illegitimate means to grow their audiences and increase ad revenue.

“Illegitimate traffic sourcing occurs when a publisher pays a traffic supplier for a fixed number of visits to their website,” said a recent white paper about ad fraud published by the Alliance for Audited Media, a not-for-profit media auditing organization. “Publishers often buy traffic at the end of the month or quarter to ‘make its numbers.’ Traffic sellers often promise the publisher that the traffic is human and will pass through all ad fraud detection filters.”

Got a tip about ad fraud? You can email tips@buzzfeed.com. To learn how to reach us securely, go to tips.buzzfeed.com.

In the case of Ozy, it subsequently told JPMorgan it used the paid traffic to try to grow an email subscription list, according to a source with knowledge of conversations between the companies.

BuzzFeed News provided Ozy with a detailed list of questions, in addition to video evidence showing how JPMorgan articles, as well as other content featuring premium ad units from Amazon and Visa, were receiving fraudulent traffic. The company replied with an emailed statement.

“We're always testing new ways to share our quality content with new, premium audiences. Unfortunately, our digital ecosystem harbors audience sources that don't always fit OZY's target, and in some cases, exhibit behavior that is not authentic,” the statement said. “We are constantly monitoring our network for fraudulent activity, and immediately suspend any traffic sources that would devalue OZY and our partnerships.”

The statement concluded, “We are proud to consistently overdeliver for our advertising partners across platforms, and it goes without saying that our partners only pay for quality delivery.”

As with Myspace, GateHouse, and Ozy, all publishers contacted by BuzzFeed News said they had no idea there were issues with the traffic in question, and that it was deemed safe by different third-party verification companies. Some publishers ceased using the traffic after reading the BuzzFeed News article that revealed its origins, the system generating automated redirects, and the fact that verification company DoubleVerify deemed it fraudulent after a detailed investigation. Prior to that, it appears the publishers did not investigate the origin of the traffic they sourced for their websites.

Mike Zaneis leads the Trustworthy Accountability Group, an ad industry initiative to fight fraud. He said a publisher is ultimately responsible for what happens on their site, and they need to engage in proper due diligence and monitoring.

“Publishers have a responsibility here to monitor their websites. If you see wild spikes in traffic coming from strange places, or at strange times, you have a responsibility there,” he told BuzzFeed News.

Sourcing traffic from ScreenRush

Social Puncher / Via Ozy.com

Ozy displays all the hallmarks of a premium digital publisher. But along with the illegitimate traffic going to JPMorgan’s and other content, data from SimilarWeb shows Ozy recently bought a portion of its audience from low-quality sources, including ad networks that specialize in pop-under browser windows that are opened on users as they visit other websites.

Ozy employs journalists to create content and says on its website that it reaches an aggregate of 40 million people a month through various channels. Data from Quantcast, a service Ozy uses to measure its traffic, says its website reaches 2.5 million people per month. Ozy also works with partners to syndicate its content and produces a TV show for PBS, among other non-web-based efforts. The PBS show is hosted by Ozy cofounder Carlos Watson, a former CNN commentator and MSNBC host who had a previous career as an entrepreneur.

Ozy’s investors include Silicon Valley luminaries Laurene Powell Jobs, Ron Conway, and David Drummond, a senior vice president of Alphabet, Google’s parent company. Ozy also received a $20 million investment from German media conglomerate Axel Springer in 2014. Earlier this year it raised an additional $10 million from GSV Capital Corp.

A few months after closing its latest financing, Ozy.com started receiving a significant increase in desktop visitors. Between June and October, roughly 2 million visits came from domains connected to a company called ScreenRush, according to SimilarWeb. This traffic was sent to specific articles on Ozy, many of which were part of the JPMorgan-sponsored content campaign. Other articles receiving visits via ScreenRush displayed special video ad units from Amazon and Visa, according to video compiled by ad-fraud consultancy Social Puncher. (BuzzFeed News contacted Visa and Amazon for comment but did not receive a reply.)

Using SimilarWeb, BuzzFeed News examined the most-popular content on Ozy between June and October and found that 8 of the 10 most-popular article pages received the vast majority of their visits using URLs that attributed the traffic to ScreenRush. For example (emphasis added):

• http://www.ozy.com/immodest-proposal/-is-this-holiday-better-for-the-planet-than-earth-day/76915?utm_medium=cpc&utm_source=SR

• http://www.ozy.com/acumen/what-does-it-take-for-a-large-corporation-to-go-green/80281?utm_medium=cpc&utm_source=SR

• http://www.ozy.com/acumen/would-you-swim-with-a-crocodile/64792?utm_medium=cpc&utm_source=SR

This was also the case for an article on Ozy written by the head of property management for JPMorgan Chase Global Real Estate. These ScreenRush URLs accounted for nearly all traffic to the JPMorgan-sponsored content.

Vlad Shevtsov, director of investigations for Social Puncher, said his team documented behavior on Ozy that saw ScreenRush load and remain on a page for 90 seconds before the system automatically redirected to the next domain in the scheme.

"This is not sophisticated artificial traffic, just a dumb programming script," he said in an email. "The first question about these visits should be, How is it even possible that visitors went to other ScreenRush client sites if Ozy's pages have no links to any of these other sites?"

youtube.com

As detailed in the previous BuzzFeed investigation, the traffic ScreenRush sent to publishers largely originated from a group of more than 20 websites that purport to be online arcades. These sites all use the same design template and had their domains registered around the same time. The arcade sites also have nearly identical traffic patterns, as they are redirecting the same audience among them before passing it along to domains owned by ScreenRush — which, in turn, sends the traffic to publisher clients. (This method of redirecting traffic through domains to obscure its origins was detailed in a more recent BuzzFeed News story.)

Separate investigations by DoubleVerify and Social Puncher both determined the traffic coming from ScreenRush meets industry definitions for invalid, fraudulent traffic. They documented automated redirects being triggered by ScreenRush’s code without any human action on the page, as well as the presence of multiple video players running simultaneously.

“You’ve got websites that are getting some sort of inbound traffic and then this begins a cycle of autoplaying videos with ad pages refreshing and sometimes redirecting to other pages,” Roy Rosenfeld, DoubleVerify’s vice president of product management, previously told BuzzFeed News.

Social Puncher

Instead of using video players to generate ad impressions, ScreenRush traffic was directed to Ozy pages that were part of specific campaigns. A spokesperson for DoubleVerify told BuzzFeed News it identified invalid traffic and ad impressions on a portion of Ozy’s users during the period the site received ScreenRush traffic.

Daniel Aharonoff, the general manager of ScreenRush, disputed the conclusions of DoubleVerify and Social Puncher, and the reporting of BuzzFeed News. He said the traffic coming through his system passes the filters of multiple verifications companies and is therefore human and valid.

“In all cases, the traffic is pre-screened by the ad-verification service chosen by the advertiser, and must be approved as valid in order to be delivered, so neither I nor any of the clients had any reason to believe the traffic wasn’t valid, at least until your article came out saying that DV had a different opinion on certain supply partners,” he said in an email.

He said the redirects documented by DoubleVerify and Social Puncher (as shown in the above video) are in fact the result of a real-time bidding process that determines which site the traffic goes to next, and that the content is shown to engaged, human users.

"We have a range of methods that assure us that supply is coming from 'real humans' and that the content discovery experience is in full 'viewability,'" he said. "Inherently this means if a 'user' wants to opt out they can 'simply' close the browser window that is present."

Aharonoff offered a lengthy email response and his explanation of the activity shown in the Social Puncher video. It can be read in full here. He also said BuzzFeed News and DoubleVerify are unfairly targeting his company.

“You are managing more than anything to scare partners with this singular view by DV which is hardly the industry standard,” Aharonoff said. He added that DoubleVerify is “clearly striving for relevance in a market dominated by their core competitors such as Moat & IAS among several others including various new entrants in the market.”

Moat did not reply to questions from BuzzFeed News about ScreenRush traffic, but did note that a website connected to Aharonoff’s company incorrectly claims it is a Moat customer. IAS also said its logo was improperly listed on that site. It also said it flagged several domains used by ScreenRush to refer traffic to clients for “high brand risk.”

Ozy stopped working directly with ScreenRush at the end of October. The next month, the site experienced a significant drop in desktop referral traffic, according to SimilarWeb. With ScreenRush gone, Ozy’s November traffic sources included ad networks that specialize in selling traffic generated via pop-under windows, according to SimilarWeb. These windows open behind the main browsing window as a user accesses the desired content. Publishers pay to have their content loaded in this pop-under window in the hope that the user will eventually see it. A recent BuzzFeed News story detailed how this form of low-quality traffic is often “laundered” through other domains before ending up on mainstream sites.

Ozy did not respond to a question about the use of pop-unders to generate traffic. It also didn't comment on the fact that until November it was also buying audience via go.bistroapi.com, a traffic source that Social Puncher investigated and found to be selling fake traffic to a variety of publishers.

Funny or Die and other sites got traffic, too

Social Puncher / Via funnyordie.com

Facebook / Via medium.com

Facebook will stop flagging content that’s been declared false by external fact-checkers, and will instead surface fact-checks as related articles in the News Feed, the social media giant announced Wednesday.

The move represents the biggest outward facing change to Facebook’s year-old partnership with fact-checkers. The company said this new approach will be more effective in stopping the spread of misinformation, while also making it easier to scale its effort to other markets and content types.

Tessa Lyons, a News Feed product manager, told BuzzFeed News that surfacing fact-checks as related articles proved more effective in tests than applying a disputed flag to stories in the News Feed.

“Related articles outperformed disputed flags in giving people more information so they could understand what was true or false,” she said. “Hoaxes that had related article fact checks had fewer shares than those with the disputed flag.”

The related articles module appears underneath a piece of content in the News Feed, and was first rolled out in April.

BuzzFeed

Lyons wrote in a blog post announcing the change that “putting a strong image, like a red flag, next to an article may actually entrench deeply held beliefs — the opposite effect to what we intended. Related Articles, by contrast, are simply designed to give more context, which our research has shown is a more effective way to help people get to the facts.”

Brendan Nyhan, a political scientist at Dartmouth College who researches misinformation, said he was “optimistic” about the change.

“I have always been concerned that [disputed flags] were not being widely deployed and were not politically feasible to scale up,” he told BuzzFeed News. “Surfacing fact-checks in related articles seems less intrusive and thus is likely to be more palatable to users.”

Aside from the difference users will see in the News Feed, the change could make it easier for Facebook to surface different kinds of fact-checks. The disputed flag was only applied to links deemed completely false by at least two fact-checkers. Related articles will show fact-checks with more nuanced ratings, such as “mostly true,” and will instantly surface a single fact-check. Internal data from Facebook found that on average it took three days for the multi-party disputed label to be applied to a piece of content.

“The disputed flag was difficult to scale to other markets, to scale where there are not as many fact checkers,” Lyons said.

It also only worked with links shared on Facebook. The company recently indicated that in the coming year, it plans to tackle misinformation in the form of photos and videos on its platform Surfacing a fact-check as a piece of related content to a meme is more feasible than applying a disputed flag, according to the company.

Facebook

As part of the announcement, Facebook published a Medium post by three employees who over the last year “traveled around the world, from Germany to Indonesia, talking with people about their experiences with misinformation.” They cited four reasons why the disputed label was ineffective, including the fact that it took several clicks for users to get to the fact-check. The post also noted that Facebook’s fact-checking partners will be highlighted with a special “badge” in the related articles module.

Since its launch was announced almost exactly a year ago, the disputed flag has been a source of scrutiny and criticism. Some reports suggested it could actually make people more inclined to share an article. A study by two Yale researchers also questioned whether the label had any effect of users’ perceptions of the accuracy of the flagged content.

With the new change, Facebook has confirmed this initial attempt wasn’t the best solution. Lyons told BuzzFeed News the related articles approach is an improvement, but one that will need to be tested and studied over time.

“The fight against misinformation is an ongoing one that’s going to take us doing our own research,” she said. “It’s an iterative process.”

“DingIt.tv is a global eSports gaming platform with 30m monthly active users and 350m video avails,” the rep wrote in an email provided to BuzzFeed News by an executive who received it.

DingIt does have impressive traffic. Alexa, a web analytics service, currently ranks it as one of the top 200 sites in the US. SimilarWeb says DingIt attracts more monthly visits than the websites for the Boston Globe, Atlanta Journal-Constitution, Nascar, and the heavily advertised travel site Travelocity.com.

In the email, the sales rep made a point to address any concerns about the quality of DingIt’s traffic. He wrote that three verification companies measured the site’s traffic and found that “under 3%” of DingIt’s traffic is attributed to bots.

Bots are widely considered to be the scourge of ad fraud. They can generate massive amounts of fake traffic and ad impressions by automatically clicking on websites and ads in large numbers, thereby siphoning off an estimated billions of dollars a year from the digital advertising industry.

"Like so many things on the internet, the technique traces some of its origins to porn."

DingIt may have a low level of bots coming to its site, but that doesn’t mean it’s safe from ad fraud. Reporting by BuzzFeed News and an independent investigation by verification firm DoubleVerify found that DingIt uses an increasingly popular method of generating fraudulent ad impressions and traffic that fools some verification companies precisely because it doesn’t involve bots. And like so many things on the internet, the technique and even some of the traffic used to execute this burgeoning method of ad fraud, traces some of its origins to porn.

“Unlike bot traffic of the past, this new type of fraud utilizes legitimate user-generated traffic to deliver thousands of fraudulent impressions,” Roy Rosenfeld, the VP of product management at DoubleVerify, told BuzzFeed News.

Rosenfeld said DoubleVerify classified DingIt as a fraud site according to industry definitions after a detailed investigation by his company’s ad fraud lab. BuzzFeed News and independent ad fraud researcher Augustine Fou separately documented the same activity.

Adam Simmons, the VP of content and marketing for DingIt, told BuzzFeed News that the site uses “4 independent traffic verification tools that monitor each view on our video player” and prevents any fraudulent traffic from viewing content or ads on the site.

“Should we identify patterns or sources of low quality traffic (such as a partner), we not only cease any commercial relationship with them but also block any traffic from those sources,” he said in an email.

Simmons then ceased communications with BuzzFeed News after being presented with information linking the original parent company and CEO of DingIt to a network of 86 sites referring fraudulent traffic to DingIt for more than a year, and after being sent the conclusions of the DoubleVerify report.

BuzzFeed News

Traffic “out of thin air”

The technique used by DingIt, as well as a growing number of mainstream sites, is outlined in a presentation published today by Fou. He has for weeks been documenting what he calls “Bot-Free Traffic Origination Redirect Networks.”

Fou told BuzzFeed News these networks can “originate traffic out of thin air” and direct it to a specific site thanks to code that instructs them when to load a specific webpage, and how long to keep it open before automatically loading the next website in the chain. No human action is required to load webpages or redirect to the next site — it’s a perpetual-motion machine for web traffic and ad impressions.

Got a tip about ad fraud? You can email tips@buzzfeed.com. To learn how to reach us securely, go to tips.buzzfeed.com.

Ad fraud detection company Pixalate documented this activity in a recent investigation and dubbed the web properties using it “zombie sites” due to their ability to automatically generate traffic without human activity.

This form of ad fraud was also detailed in two recent BuzzFeed News investigations, which serve to highlight how the technique is growing in popularity and is now being used on more mainstream sites.

In one case, Myspace and roughly 150 local newspaper websites owned by GateHouse Media said they were unwittingly part of redirect networks that racked up millions of fraudulent video ad impressions. Both companies told BuzzFeed News the offending subdomains on their sites were managed by third parties, and that Myspace and GateHouse received no revenue from any fraudulent impressions. The pages have since been shut down.

“How were [these subdomains] getting all those video views? Well, they just originated it. A user is not doing anything, but the page is just redirecting by itself,” Fou said.

View Video ›

video-player.buzzfeed.com

He said the industry focus on detecting bot traffic leaves it vulnerable to attacks such as this, which simply automates the loading of different webpages to generate ad impressions and obscure the origins and nature of the traffic. That element of obfuscation is key because in many cases the traffic that kicks off the cycle of redirects comes from porn sites.

On porn sites, as well as on many illegal streaming and file-sharing sites, it starts with a visitor clicking anywhere on the page. Regardless of what they meant to click, the site clickjacks the action and uses it to open a pop-under window behind the user’s main browser tab.

As the user watches porn or other content in the main window, unscrupulous ad networks use the hidden window to load different websites at timed intervals, racking up views and ad impressions. A user often has no idea this is happening in the background, and in some cases porn sites load the pop-under as an invisible window that can’t be seen. (That window will load websites and ad impressions until the entire browser is closed, or until the computer loses its internet connection.)

This reinforces how porn websites overall are a critical part of the online infrastructure used by ad fraudsters to steal billions of dollars a year from advertisers. Along with generating fraudulent traffic and impressions through these redirect networks, porn sites often show visitors malicious ads that trick them into downloading malware that infects their computer. Once infected, these computers can become part of the botnets used to commit ad fraud.

"A user is not doing anything, but the page is just redirecting by itself."

“If it’s proven in porn, you can go mainstream with it,” Fou said.

This approach of generating automatic redirects using hidden browser windows has long been used by unscrupulous ad networks working with porn publishers, according to Jérôme Segura, the lead malware intelligence analyst for Malwarebytes.

“It’s easy to commit fraud by having those redirections cycle through or load legitimate websites, and it looks like the user has actually visited those sites,” he told BuzzFeed News.

The process of redirecting from one site to the next also helps erase the connection to a porn site, according to Fou.

“The point of redirects is to launder the traffic so that by time it hits the page you can’t tell it came from porn,” he said, noting that mainstream advertisers do not want to be on porn sites, or put in front of users browsing them.

A slide from Augustine Fou.

Augustine Fou / Via slideshare.net

At the heart of these redirect schemes are domains that direct the traffic from one participating site to the next while a pop-under window is open. The amount of traffic they can generate is astounding. Examples include rarbg.to (1.6 billion visits in the last 12 months, according to SimilarWeb), redirect2719.ws (5,377 million visits since launching in April), fedsit.com (812 million visits since launching in April), and u1trkqf.com (434 million visits since launching in July). Some redirect domains have homepage text that describes them as ad servers operated by ad networks, but many have no content and their ownership information is hidden in domain records.

“These are sites that come out of nowhere — there’s no content, and humans will not type in this alphanumeric [domain name] — and this traffic is made up through redirects,” Fou told BuzzFeed News, emphasizing that redirecting traffic to webpages is different from serving ads.

Because this method of generating traffic does not involve bots, it’s difficult for verification companies to recognize that the traffic is fraudulent, he said.

“It’s technically not bots, as in a fake browser hitting a page,” he said. “A lot of this is going to show up [in website analytics reports] as direct or referral traffic.”

Zak Tebbal for BuzzFeed News

DingIt and 86 esports highlight sites

It was the referral traffic going to DingIt that caught the attention of both DoubleVerify and Fou.

Just over a year ago DingIt began receiving traffic from a new network of more than 80 websites that, like DingIt, feature video clips from video game tournaments and other esports content. The sites have names such as dotahighlight.info, leaguehighlight.org, hearthstonehighlight.com, and leagueoflegendshighlight.com. They use the same design templates, and often feature the same content on their homepages. Domain registration records show that 74 of them were registered on the exact same day, Sept. 17, 2016.

BuzzFeed News

Data from SimilarWeb and Alexa shows that these sites constantly redirect traffic among themselves before a significant portion of it ends up on one site: DingIt.

This slide from Fou's presentation uses a graph generated by Alexa — an analytics service that DingIt itself uses to measure its traffic — to show how traffic is being redirected among the esports highlight sites and DingIt in two tight networks:

Augustine Fou

Data from Alexa and SimilarWeb show that the highlight sites share traffic patterns. Fou said this is a telltale sign of redirect domains because they are passing the same traffic among themselves and therefore have the same audience and traffic at roughly the same time. (Identical traffic patterns were also present in a previous BuzzFeed News investigation into a redirect scheme.)

BuzzFeed News

In order to kick off the chain of redirects, these esports highlight sites receive paid traffic generated from pop-unders on porn, file sharing, and illegal streaming sites, including Txxx.com, Kissanime.ru, and Openload.co, according to data from SimilarWeb.

The combination of the pop-under traffic and the redirect network ensures that by the time the traffic makes its way to DingIt it appears to analytics software and, most importantly, to verification companies as human traffic coming from esports sites.

“A significant portion of the traffic on DingIt.tv involved invalid traffic practices, including but not limited to low quality traffic sourced from auto redirects, pop-ups from adult/streaming/torrent sites, and malware,” according to the report produced by DoubleVerify’s ad fraud lab. "Moreover, when traffic is driven to DingIt.tv through one of these sources, the ads and videos auto-play without any user interaction.”

DoubleVerify found that DingIt uses a system that only engages the autoplay behavior when the invalid traffic is directed. This keeps an average user who navigates to DingIt on their own from seeing videos, and ads, displayed this way.

“If a user does innocently navigate directly to the site, that user will not see this forced redirect behavior, as it has to be triggered by the appropriate entry page from the redirect chains,” the report said.

When first contacted by BuzzFeed News, Adam Simmons, DingIt’s vice president of content and marketing, offered a lengthy reply to explain the ways in which DingIt analyzes traffic coming to its site to ensure it’s not fraudulent.

“As we are a premium ad-funded business, the balance for us is maximising our audience while still making sure that audience is human, engaged and high quality,” he said in an email. “In an ideal world (and internet ecosystem), all traffic would be perfect. Unfortunately, there are a minority of bad actors within the ecosystem who use grey or black hat methods to source traffic on behalf of publishers or their partners. This low quality traffic is an issue we deal with every day and have invested significant resources into blocking.”

"This low quality traffic is an issue we deal with every day and have invested significant resources into blocking.”

The “country withheld” program run by Twitter typically prevents users based in a specific country from seeing tweets sent by a withheld account. This was the first time people could recall the company withholding accounts globally, which was in effect a total ban for the user.

This is what the timeline for @KDScioscia, an account with more than 9,000 followers, showed until Twitter reactivated it shortly before this story was published:

Twitter

At the time of writing, BuzzFeed News had identified 21 accounts that were being withheld worldwide, and users on Twitter were beginning to wonder if this was a new method being used by the company to suspend accounts.

Twitter

But a Twitter spokesperson told BuzzFeed News the worldwide withholdings were in fact the result of a bug.

“We have identified a bug that incorrectly impacted certain accounts. We have identified a fix, are working to resolve the issue, and anticipate it will be fully resolved shortly,” the spokesperson told BuzzFeed News.

A source familiar with the company told BuzzFeed News the bug affected "a small amount of accounts."

While apparently not intentional, the sudden ban of users was seen by some as another example of the company’s stepped-up efforts to moderate content and behavior on its platform. Along with removing verified check marks from white nationalist accounts, the platform now appears to be quicker to suspend accounts for what it claims are violations of its policies. This has resulted in some confusion and criticism. An account belonging to a BuzzFeed News journalist was recently suspended for an old tweet she says was satirical, and which was mass reported by trolls trying to get her booted from Twitter.

One user whose account was withheld worldwide claimed she was given that status after sending a tweet critical of author J.K. Rowling. She shared a screenshot of a message from Twitter informing her that she “violated our rules against hateful conduct.”

Twitter / Via Twitter: @4lternate_facts

Her account, and the others identified by BuzzFeed News, are now back online.

But while views of the media are becoming even more divided along party lines, the researchers also found evidence that online media consumption habits of Democrats and Republicans may be less polarized than commonly believed.

“Trump has sparked unprecedented levels of polarization in views toward the media. In the period for which we have data, Democrats and Republicans have never had such disparate levels of trust and confidence in the media,” Brendan Nyhan, a professor of political science at Dartmouth College and coauthor of the study, told BuzzFeed News.

The research is based on a representative survey of 2,100 American adults conducted by YouGov in November, as well as an analysis of anonymized desktop web-browsing data collected from participants during a one-week period. Nyhan and his coauthors, Andrew Guess from Princeton and Jason Reifler from the University of Exeter, are presenting their paper today at a journalism ethics summit in Washington, DC, called The Press and the President: Trust and the Media in a New Era. The event is organized by the Poynter Institute for Media Studies, a nonpartisan, nonprofit journalism think tank and teaching institute. The research, which forms the basis for the first Poynter Media Trust Survey, was funded by Poynter and a grant from the Craig Newmark Philanthropies.

Nyhan said Trump’s negative approach to the press could be causing “the strongest relationship between presidential approval and media attitudes that has been observed to date.”

The survey found that 74% of respondents who identify as Democrats, or who lean Democratic, have “a great deal” (19%) or “a fair amount” (55%) of confidence in the media. A poll taken in September 2016 asked the same question and found that 51% of Democrats expressed the same level of support, meaning that their confidence has increased 23 percentage points in just one year.

Seventy-four percent confidence in the press is the highest level registered for Democrats since 1997, the earliest date for which similar data is available.

Poynter Media Trust Survey

Meanwhile, just 19% of respondents who identified as Republicans, or who lean Republican, expressed “a great deal” or “a fair amount” of confidence in the media.

“Democrats still do not love the press — only 19 percent express ‘a great deal’ of trust and confidence — but they are far more positive than in the past,” Nyhan said. “We interpret this increase as reflecting a recognition of the role of the media in holding an opposition president accountable, especially when his party controls both chambers of Congress.”

The surge in trust and confidence in the media among Democrats helped drive the overall results to “a level of support not seen since after the 2001 terrorist attacks,” the authors write.

Poynter Media Trust Survey

But that result masks a deeply polarized electorate whose party affiliation and level of support, or disapproval, of Trump increasingly dictates their view of the media. The researchers found that Republicans and Trump supporters are today “far more likely to endorse extreme claims about media fabrication, to describe journalists as an enemy of the people, and to support restrictions on press freedom.”

More than 60% of respondents who identified as approving of Trump agreed with the president’s statement that the media is an “enemy of the American people.” Among Trump disapprovers, roughly 15% agreed with the statement. When asked if they agree with the statement that the media “keep political leaders from doing their job,” the percentages were roughly the same.

Poynter Media Trust Survey

Nyhan said responses to these survey questions don’t indicate whether individual respondents would, for example, like to see reporters jailed. “It’s important not to get too hyper-literal about what they mean, but it’s certainly concerning that they are even willing to say [the press is the enemy of the people] and indicate it in a survey,” he said.

Overall more Americans endorsed these “extreme” positions than the researchers had expected.

“Most disturbingly, one in four Americans (25%) endorses draconian limitations on press freedom” that would give government officials the right to stop a media outlet from publishing a story, the researchers found.

The survey also revealed another way Republicans and Democrats differ when it comes to opinions of the media: Republicans with high level of knowledge about politics have less confidence in the press than Republicans with low levels of knowledge. For Democrats it’s the reverse — those with high knowledge are more likely to have confidence in the press, while those with low knowledge also have low confidence.

Poynter Media Trust Survey

The researchers believe this is likely a result of vastly different messages about the media coming from Democratic and Republican elites.

“If you're a politically aware Democrat, you've been exposed to a lot of ideas about the critical importance of the media and other mainstream institutions, especially in the past year,” Andrew Guess of Princeton told BuzzFeed News. “For politically aware Republicans, the message has often been quite different.”

Nyhan said “one of the principles of public opinion is that the most knowledgeable people are most likely to hear and follow cues from like-minded partisan elites.”

The level of political knowledge of respondents was determined based on their responses to a series of factual assertions such as “Rex Tillerson is the current US Secretary of State.”

Polarized News Consumption

In addition to asking questions, the researchers analyzed anonymized web-browsing data from survey participants. This enabled them to compare what people said about their online news consumption with data about the sites they actually visited using desktop computers.

One key finding is that respondents had a tendency to overreport their use of partisan news sources. “Democrats seem to overreport visiting the Huffington Post and Republicans tend to underreport doing so. The converse is true for Fox News — Republicans tend to overreport visiting the Fox News website while Democrats seem to underreport,” the researchers write.

Poynter Media Trust Survey

Nyhan said this shows that “people’s perceptions of what they’re reading and what they’re actually reading are different.”

Guess said it’s possible that people overreport their consumption of partisan media to reflect their political identity.

“Democrats are more likely to say they visit the Huffington Post than they actually do, for instance, because being a Huffington Post reader is possibly seen as part of being a good Democrat,” he said. “Put together, patterns like these suggest that the conventional wisdom is skewed toward thinking that people's media diets are more polarized than they actually are.”

Nyhan said this new data is “consistent with the notion that fears about ‘echo chambers’ may be overstated.”