CINXE.COM

<!doctype html>     <html lang="en-US" prefix="og: https://ogp.me/ns#"> <head> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <title>PAPERWALL: Chinese Websites Posing as Local News Outlets Target Global Audiences with Pro-Beijing Content - The Citizen Lab</title> <meta name="HandheldFriendly" content="True"> <meta name="MobileOptimized" content="320"> <meta name="viewport" content="width=device-width, initial-scale=1"/> <link rel="apple-touch-icon" sizes="57x57" href="https://citizenlab.ca/wp-content/themes/citizenlab-2.1.5/library/images/apple-icon-57x57.png"> <link rel="apple-touch-icon" sizes="60x60" href="https://citizenlab.ca/wp-content/themes/citizenlab-2.1.5/library/images/apple-icon-60x60.png"> <link rel="apple-touch-icon" sizes="72x72" href="https://citizenlab.ca/wp-content/themes/citizenlab-2.1.5/library/images/apple-icon-72x72.png"> <link rel="apple-touch-icon" sizes="76x76" href="https://citizenlab.ca/wp-content/themes/citizenlab-2.1.5/library/images/apple-icon-76x76.png"> <link rel="apple-touch-icon" sizes="114x114" href="https://citizenlab.ca/wp-content/themes/citizenlab-2.1.5/library/images/apple-icon-114x114.png"> <link rel="apple-touch-icon" sizes="120x120" href="https://citizenlab.ca/wp-content/themes/citizenlab-2.1.5/library/images/apple-icon-120x120.png"> <link rel="apple-touch-icon" sizes="144x144" href="https://citizenlab.ca/wp-content/themes/citizenlab-2.1.5/library/images/apple-icon-144x144.png"> <link rel="apple-touch-icon" sizes="152x152" href="https://citizenlab.ca/wp-content/themes/citizenlab-2.1.5/library/images/apple-icon-152x152.png"> <link rel="apple-touch-icon" sizes="180x180" href="https://citizenlab.ca/wp-content/themes/citizenlab-2.1.5/library/images/apple-icon-180x180.png"> <link rel="icon" type="image/png" sizes="192x192" href="https://citizenlab.ca/wp-content/themes/citizenlab-2.1.5/library/images/android-icon-192x192.png"> <link rel="icon" type="image/png" sizes="32x32" href="https://citizenlab.ca/wp-content/themes/citizenlab-2.1.5/library/images/favicon-32x32.png"> <link rel="icon" type="image/png" sizes="96x96" href="https://citizenlab.ca/wp-content/themes/citizenlab-2.1.5/library/images/favicon-96x96.png"> <link rel="icon" type="image/png" sizes="16x16" href="https://citizenlab.ca/wp-content/themes/citizenlab-2.1.5/library/images/favicon-16x16.png"> <link rel="manifest" href="https://citizenlab.ca/wp-content/themes/citizenlab-2.1.5/library/images/manifest.json"> <meta name="msapplication-TileColor" content="#ffffff"> <meta name="msapplication-TileImage" content="/ms-icon-144x144.png"> <meta name="theme-color" content="#ffffff">  <link rel="pingback" href="https://citizenlab.ca/xmlrpc.php"> <style>img:is([sizes="auto" i], [sizes^="auto," i]) { contain-intrinsic-size: 3000px 1500px }</style>  <meta name="description" content="A network of at least 123 websites operated from within the People鈥檚 Republic of China while posing as local news outlets in 30 countries across Europe, Asia, and Latin America, disseminates pro-Beijing disinformation and ad hominem attacks within much larger volumes of commercial press releases. We name this campaign PAPERWALL. We attribute the PAPERWALL campaign to Shenzhen Haimaiyunxiang Media Co., Ltd., aka Haimai, a PR firm in China based on digital infrastructure linkages between the firm鈥檚 official website and the network. These findings confirm the increasingly important role private firms play in the realm of digital influence operations and the propensity of the Chinese government to make use of them."/> <meta name="robots" content="follow, index, max-snippet:-1, max-video-preview:-1, max-image-preview:large"/> <link rel="canonical" href="https://citizenlab.ca/2024/02/paperwall-chinese-websites-posing-as-local-news-outlets-with-pro-beijing-content/" /> <meta property="og:locale" content="en_US" /> <meta property="og:type" content="article" /> <meta property="og:title" content="PAPERWALL: Chinese Websites Posing as Local News Outlets Target Global Audiences with Pro-Beijing Content - The Citizen Lab" /> <meta property="og:description" content="A network of at least 123 websites operated from within the People鈥檚 Republic of China while posing as local news outlets in 30 countries across Europe, Asia, and Latin America, disseminates pro-Beijing disinformation and ad hominem attacks within much larger volumes of commercial press releases. We name this campaign PAPERWALL. We attribute the PAPERWALL campaign to Shenzhen Haimaiyunxiang Media Co., Ltd., aka Haimai, a PR firm in China based on digital infrastructure linkages between the firm鈥檚 official website and the network. These findings confirm the increasingly important role private firms play in the realm of digital influence operations and the propensity of the Chinese government to make use of them." /> <meta property="og:url" content="https://citizenlab.ca/2024/02/paperwall-chinese-websites-posing-as-local-news-outlets-with-pro-beijing-content/" /> <meta property="og:site_name" content="The Citizen Lab" /> <meta property="article:tag" content="Disinformation" /> <meta property="article:section" content="Targeted Threats" /> <meta property="og:updated_time" content="2024-11-21T14:39:55-05:00" /> <meta property="og:image" content="https://citizenlab.ca/wp-content/uploads/2024/02/paperwall-featuredimage@2x.png" /> <meta property="og:image:secure_url" content="https://citizenlab.ca/wp-content/uploads/2024/02/paperwall-featuredimage@2x.png" /> <meta property="og:image:width" content="980" /> <meta property="og:image:height" content="552" /> <meta property="og:image:alt" content="paperwall" /> <meta property="og:image:type" content="image/png" /> <meta property="article:published_time" content="2024-02-07T07:59:10-05:00" /> <meta property="article:modified_time" content="2024-11-21T14:39:55-05:00" /> <meta name="twitter:card" content="summary_large_image" /> <meta name="twitter:title" content="PAPERWALL: Chinese Websites Posing as Local News Outlets Target Global Audiences with Pro-Beijing Content - The Citizen Lab" /> <meta name="twitter:description" content="A network of at least 123 websites operated from within the People鈥檚 Republic of China while posing as local news outlets in 30 countries across Europe, Asia, and Latin America, disseminates pro-Beijing disinformation and ad hominem attacks within much larger volumes of commercial press releases. We name this campaign PAPERWALL. We attribute the PAPERWALL campaign to Shenzhen Haimaiyunxiang Media Co., Ltd., aka Haimai, a PR firm in China based on digital infrastructure linkages between the firm鈥檚 official website and the network. These findings confirm the increasingly important role private firms play in the realm of digital influence operations and the propensity of the Chinese government to make use of them." /> <meta name="twitter:site" content="@citizenlab" /> <meta name="twitter:creator" content="@citizenlab" /> <meta name="twitter:image" content="https://citizenlab.ca/wp-content/uploads/2024/02/paperwall-featuredimage@2x.png" /> <meta name="twitter:label1" content="Written by" /> <meta name="twitter:data1" content="Mari Zhou" /> <meta name="twitter:label2" content="Time to read" /> <meta name="twitter:data2" content="30 minutes" /> <script type="application/ld+json" class="rank-math-schema-pro">{"@context":"https://schema.org","@graph":[{"@type":["CollegeOrUniversity","Organization"],"@id":"https://citizenlab.ca/#organization","name":"The Citizen Lab","url":"https://citizenlab.ca","sameAs":["https://twitter.com/citizenlab"],"logo":{"@type":"ImageObject","@id":"https://citizenlab.ca/#logo","url":"https://citizenlab.ca/wp-content/uploads/2019/02/citlablogo.png","contentUrl":"https://citizenlab.ca/wp-content/uploads/2019/02/citlablogo.png","caption":"The Citizen Lab","inLanguage":"en-US","width":"7824","height":"5216"}},{"@type":"WebSite","@id":"https://citizenlab.ca/#website","url":"https://citizenlab.ca","name":"The Citizen Lab","publisher":{"@id":"https://citizenlab.ca/#organization"},"inLanguage":"en-US"},{"@type":"ImageObject","@id":"https://citizenlab.ca/wp-content/uploads/2024/02/paperwall-featuredimage@2x.png","url":"https://citizenlab.ca/wp-content/uploads/2024/02/paperwall-featuredimage@2x.png","width":"980","height":"552","inLanguage":"en-US"},{"@type":"WebPage","@id":"https://citizenlab.ca/2024/02/paperwall-chinese-websites-posing-as-local-news-outlets-with-pro-beijing-content/#webpage","url":"https://citizenlab.ca/2024/02/paperwall-chinese-websites-posing-as-local-news-outlets-with-pro-beijing-content/","name":"PAPERWALL: Chinese Websites Posing as Local News Outlets Target Global Audiences with Pro-Beijing Content - The Citizen Lab","datePublished":"2024-02-07T07:59:10-05:00","dateModified":"2024-11-21T14:39:55-05:00","isPartOf":{"@id":"https://citizenlab.ca/#website"},"primaryImageOfPage":{"@id":"https://citizenlab.ca/wp-content/uploads/2024/02/paperwall-featuredimage@2x.png"},"inLanguage":"en-US"},{"@type":"Person","@id":"https://citizenlab.ca/author/mari/","name":"Mari Zhou","url":"https://citizenlab.ca/author/mari/","image":{"@type":"ImageObject","@id":"https://secure.gravatar.com/avatar/72f4596237397ca9746be85b709c00aa?s=96&d=mm&r=g","url":"https://secure.gravatar.com/avatar/72f4596237397ca9746be85b709c00aa?s=96&d=mm&r=g","caption":"Mari Zhou","inLanguage":"en-US"},"worksFor":{"@id":"https://citizenlab.ca/#organization"}},{"@type":"BlogPosting","headline":"PAPERWALL: Chinese Websites Posing as Local News Outlets Target Global Audiences with Pro-Beijing Content -","keywords":"paperwall, disinformation","datePublished":"2024-02-07T07:59:10-05:00","dateModified":"2024-11-21T14:39:55-05:00","author":{"@id":"https://citizenlab.ca/author/mari/","name":"Mari Zhou"},"publisher":{"@id":"https://citizenlab.ca/#organization"},"description":"A network of at least 123 websites operated from within the People\u2019s Republic of China while posing as local news outlets in 30 countries across Europe, Asia, and Latin America, disseminates pro-Beijing disinformation and ad hominem attacks within much larger volumes of commercial press releases. We name this campaign PAPERWALL. We attribute the PAPERWALL campaign to Shenzhen Haimaiyunxiang Media Co., Ltd., aka Haimai, a PR firm in China based on digital infrastructure linkages between the firm\u2019s official website and the network. These findings confirm the increasingly important role private firms play in the realm of digital influence operations and the propensity of the Chinese government to make use of them.","name":"PAPERWALL: Chinese Websites Posing as Local News Outlets Target Global Audiences with Pro-Beijing Content -","@id":"https://citizenlab.ca/2024/02/paperwall-chinese-websites-posing-as-local-news-outlets-with-pro-beijing-content/#richSnippet","isPartOf":{"@id":"https://citizenlab.ca/2024/02/paperwall-chinese-websites-posing-as-local-news-outlets-with-pro-beijing-content/#webpage"},"image":{"@id":"https://citizenlab.ca/wp-content/uploads/2024/02/paperwall-featuredimage@2x.png"},"inLanguage":"en-US","mainEntityOfPage":{"@id":"https://citizenlab.ca/2024/02/paperwall-chinese-websites-posing-as-local-news-outlets-with-pro-beijing-content/#webpage"}}]}</script>  <link rel="alternate" type="application/rss+xml" title="The Citizen Lab » Feed" href="https://citizenlab.ca/feed/" /> <link rel="alternate" type="application/rss+xml" title="The Citizen Lab » Comments Feed" href="https://citizenlab.ca/comments/feed/" /> <script type="text/javascript"> /* <![CDATA[ */ window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/svg\/","svgExt":".svg","source":{"concatemoji":"https:\/\/citizenlab.ca\/wp-includes\/js\/wp-emoji-release.min.js"}}; /*! This file is auto-generated */ !function(i,n){var o,s,e;function c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(o,JSON.stringify(t))}catch(e){}}function p(e,t,n){e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(t,0,0);var t=new Uint32Array(e.getImageData(0,0,e.canvas.width,e.canvas.height).data),r=(e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(n,0,0),new Uint32Array(e.getImageData(0,0,e.canvas.width,e.canvas.height).data));return t.every(function(e,t){return e===r[t]})}function u(e,t,n){switch(t){case"flag":return n(e,"\ud83c\udff3\ufe0f\u200d\u26a7\ufe0f","\ud83c\udff3\ufe0f\u200b\u26a7\ufe0f")?!1:!n(e,"\ud83c\uddfa\ud83c\uddf3","\ud83c\uddfa\u200b\ud83c\uddf3")&&!n(e,"\ud83c\udff4\udb40\udc67\udb40\udc62\udb40\udc65\udb40\udc6e\udb40\udc67\udb40\udc7f","\ud83c\udff4\u200b\udb40\udc67\u200b\udb40\udc62\u200b\udb40\udc65\u200b\udb40\udc6e\u200b\udb40\udc67\u200b\udb40\udc7f");case"emoji":return!n(e,"\ud83d\udc26\u200d\u2b1b","\ud83d\udc26\u200b\u2b1b")}return!1}function f(e,t,n){var r="undefined"!=typeof WorkerGlobalScope&&self instanceof WorkerGlobalScope?new OffscreenCanvas(300,150):i.createElement("canvas"),a=r.getContext("2d",{willReadFrequently:!0}),o=(a.textBaseline="top",a.font="600 32px Arial",{});return e.forEach(function(e){o[e]=t(a,e,n)}),o}function t(e){var t=i.createElement("script");t.src=e,t.defer=!0,i.head.appendChild(t)}"undefined"!=typeof Promise&&(o="wpEmojiSettingsSupports",s=["flag","emoji"],n.supports={everything:!0,everythingExceptFlag:!0},e=new Promise(function(e){i.addEventListener("DOMContentLoaded",e,{once:!0})}),new Promise(function(t){var n=function(){try{var e=JSON.parse(sessionStorage.getItem(o));if("object"==typeof e&&"number"==typeof e.timestamp&&(new Date).valueOf()<e.timestamp+604800&&"object"==typeof e.supportTests)return e.supportTests}catch(e){}return null}();if(!n){if("undefined"!=typeof Worker&&"undefined"!=typeof OffscreenCanvas&&"undefined"!=typeof URL&&URL.createObjectURL&&"undefined"!=typeof Blob)try{var e="postMessage("+f.toString()+"("+[JSON.stringify(s),u.toString(),p.toString()].join(",")+"));",r=new Blob([e],{type:"text/javascript"}),a=new Worker(URL.createObjectURL(r),{name:"wpTestEmojiSupports"});return void(a.onmessage=function(e){c(n=e.data),a.terminate(),t(n)})}catch(e){}c(n=f(s,u,p))}t(n)}).then(function(e){for(var t in e)n.supports[t]=e[t],n.supports.everything=n.supports.everything&&n.supports[t],"flag"!==t&&(n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&n.supports[t]);n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&!n.supports.flag,n.DOMReady=!1,n.readyCallback=function(){n.DOMReady=!0}}).then(function(){return e}).then(function(){var e;n.supports.everything||(n.readyCallback(),(e=n.source||{}).concatemoji?t(e.concatemoji):e.wpemoji&&e.twemoji&&(t(e.twemoji),t(e.wpemoji)))}))}((window,document),window._wpemojiSettings); /* ]]> */ </script> <style id='wp-emoji-styles-inline-css' type='text/css'> img.wp-smiley, img.emoji { display: inline !important; border: none !important; box-shadow: none !important; height: 1em !important; width: 1em !important; margin: 0 0.07em !important; vertical-align: -0.1em !important; background: none !important; padding: 0 !important; } </style> <link rel='stylesheet' id='wp-block-library-css' href='https://citizenlab.ca/wp-includes/css/dist/block-library/style.min.css' type='text/css' media='all' /> <style id='co-authors-plus-coauthors-style-inline-css' type='text/css'> .wp-block-co-authors-plus-coauthors.is-layout-flow [class*=wp-block-co-authors-plus]{display:inline} </style> <style id='co-authors-plus-avatar-style-inline-css' type='text/css'> .wp-block-co-authors-plus-avatar :where(img){height:auto;max-width:100%;vertical-align:bottom}.wp-block-co-authors-plus-coauthors.is-layout-flow .wp-block-co-authors-plus-avatar :where(img){vertical-align:middle}.wp-block-co-authors-plus-avatar:is(.alignleft,.alignright){display:table}.wp-block-co-authors-plus-avatar.aligncenter{display:table;margin-inline:auto} </style> <style id='co-authors-plus-image-style-inline-css' type='text/css'> .wp-block-co-authors-plus-image{margin-bottom:0}.wp-block-co-authors-plus-image :where(img){height:auto;max-width:100%;vertical-align:bottom}.wp-block-co-authors-plus-coauthors.is-layout-flow .wp-block-co-authors-plus-image :where(img){vertical-align:middle}.wp-block-co-authors-plus-image:is(.alignfull,.alignwide) :where(img){width:100%}.wp-block-co-authors-plus-image:is(.alignleft,.alignright){display:table}.wp-block-co-authors-plus-image.aligncenter{display:table;margin-inline:auto} </style> <style id='classic-theme-styles-inline-css' type='text/css'> /*! This file is auto-generated */ .wp-block-button__link{color:#fff;background-color:#32373c;border-radius:9999px;box-shadow:none;text-decoration:none;padding:calc(.667em + 2px) calc(1.333em + 2px);font-size:1.125em}.wp-block-file__button{background:#32373c;color:#fff;text-decoration:none} </style> <style id='global-styles-inline-css' type='text/css'> :root{--wp--preset--aspect-ratio--square: 1;--wp--preset--aspect-ratio--4-3: 4/3;--wp--preset--aspect-ratio--3-4: 3/4;--wp--preset--aspect-ratio--3-2: 3/2;--wp--preset--aspect-ratio--2-3: 2/3;--wp--preset--aspect-ratio--16-9: 16/9;--wp--preset--aspect-ratio--9-16: 9/16;--wp--preset--color--black: #000000;--wp--preset--color--cyan-bluish-gray: #abb8c3;--wp--preset--color--white: #ffffff;--wp--preset--color--pale-pink: #f78da7;--wp--preset--color--vivid-red: #cf2e2e;--wp--preset--color--luminous-vivid-orange: #ff6900;--wp--preset--color--luminous-vivid-amber: #fcb900;--wp--preset--color--light-green-cyan: #7bdcb5;--wp--preset--color--vivid-green-cyan: #00d084;--wp--preset--color--pale-cyan-blue: #8ed1fc;--wp--preset--color--vivid-cyan-blue: #0693e3;--wp--preset--color--vivid-purple: #9b51e0;--wp--preset--gradient--vivid-cyan-blue-to-vivid-purple: linear-gradient(135deg,rgba(6,147,227,1) 0%,rgb(155,81,224) 100%);--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan: linear-gradient(135deg,rgb(122,220,180) 0%,rgb(0,208,130) 100%);--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange: linear-gradient(135deg,rgba(252,185,0,1) 0%,rgba(255,105,0,1) 100%);--wp--preset--gradient--luminous-vivid-orange-to-vivid-red: linear-gradient(135deg,rgba(255,105,0,1) 0%,rgb(207,46,46) 100%);--wp--preset--gradient--very-light-gray-to-cyan-bluish-gray: linear-gradient(135deg,rgb(238,238,238) 0%,rgb(169,184,195) 100%);--wp--preset--gradient--cool-to-warm-spectrum: linear-gradient(135deg,rgb(74,234,220) 0%,rgb(151,120,209) 20%,rgb(207,42,186) 40%,rgb(238,44,130) 60%,rgb(251,105,98) 80%,rgb(254,248,76) 100%);--wp--preset--gradient--blush-light-purple: linear-gradient(135deg,rgb(255,206,236) 0%,rgb(152,150,240) 100%);--wp--preset--gradient--blush-bordeaux: linear-gradient(135deg,rgb(254,205,165) 0%,rgb(254,45,45) 50%,rgb(107,0,62) 100%);--wp--preset--gradient--luminous-dusk: linear-gradient(135deg,rgb(255,203,112) 0%,rgb(199,81,192) 50%,rgb(65,88,208) 100%);--wp--preset--gradient--pale-ocean: linear-gradient(135deg,rgb(255,245,203) 0%,rgb(182,227,212) 50%,rgb(51,167,181) 100%);--wp--preset--gradient--electric-grass: linear-gradient(135deg,rgb(202,248,128) 0%,rgb(113,206,126) 100%);--wp--preset--gradient--midnight: linear-gradient(135deg,rgb(2,3,129) 0%,rgb(40,116,252) 100%);--wp--preset--font-size--small: 13px;--wp--preset--font-size--medium: 20px;--wp--preset--font-size--large: 36px;--wp--preset--font-size--x-large: 42px;--wp--preset--spacing--20: 0.44rem;--wp--preset--spacing--30: 0.67rem;--wp--preset--spacing--40: 1rem;--wp--preset--spacing--50: 1.5rem;--wp--preset--spacing--60: 2.25rem;--wp--preset--spacing--70: 3.38rem;--wp--preset--spacing--80: 5.06rem;--wp--preset--shadow--natural: 6px 6px 9px rgba(0, 0, 0, 0.2);--wp--preset--shadow--deep: 12px 12px 50px rgba(0, 0, 0, 0.4);--wp--preset--shadow--sharp: 6px 6px 0px rgba(0, 0, 0, 0.2);--wp--preset--shadow--outlined: 6px 6px 0px -3px rgba(255, 255, 255, 1), 6px 6px rgba(0, 0, 0, 1);--wp--preset--shadow--crisp: 6px 6px 0px rgba(0, 0, 0, 1);}:where(.is-layout-flex){gap: 0.5em;}:where(.is-layout-grid){gap: 0.5em;}body .is-layout-flex{display: flex;}.is-layout-flex{flex-wrap: wrap;align-items: center;}.is-layout-flex > :is(*, div){margin: 0;}body .is-layout-grid{display: grid;}.is-layout-grid > :is(*, div){margin: 0;}:where(.wp-block-columns.is-layout-flex){gap: 2em;}:where(.wp-block-columns.is-layout-grid){gap: 2em;}:where(.wp-block-post-template.is-layout-flex){gap: 1.25em;}:where(.wp-block-post-template.is-layout-grid){gap: 1.25em;}.has-black-color{color: var(--wp--preset--color--black) !important;}.has-cyan-bluish-gray-color{color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-color{color: var(--wp--preset--color--white) !important;}.has-pale-pink-color{color: var(--wp--preset--color--pale-pink) !important;}.has-vivid-red-color{color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-color{color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-color{color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-light-green-cyan-color{color: var(--wp--preset--color--light-green-cyan) !important;}.has-vivid-green-cyan-color{color: var(--wp--preset--color--vivid-green-cyan) !important;}.has-pale-cyan-blue-color{color: var(--wp--preset--color--pale-cyan-blue) !important;}.has-vivid-cyan-blue-color{color: var(--wp--preset--color--vivid-cyan-blue) !important;}.has-vivid-purple-color{color: var(--wp--preset--color--vivid-purple) !important;}.has-black-background-color{background-color: var(--wp--preset--color--black) !important;}.has-cyan-bluish-gray-background-color{background-color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-background-color{background-color: var(--wp--preset--color--white) !important;}.has-pale-pink-background-color{background-color: var(--wp--preset--color--pale-pink) !important;}.has-vivid-red-background-color{background-color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-background-color{background-color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-background-color{background-color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-light-green-cyan-background-color{background-color: var(--wp--preset--color--light-green-cyan) !important;}.has-vivid-green-cyan-background-color{background-color: var(--wp--preset--color--vivid-green-cyan) !important;}.has-pale-cyan-blue-background-color{background-color: var(--wp--preset--color--pale-cyan-blue) !important;}.has-vivid-cyan-blue-background-color{background-color: var(--wp--preset--color--vivid-cyan-blue) !important;}.has-vivid-purple-background-color{background-color: var(--wp--preset--color--vivid-purple) !important;}.has-black-border-color{border-color: var(--wp--preset--color--black) !important;}.has-cyan-bluish-gray-border-color{border-color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-border-color{border-color: var(--wp--preset--color--white) !important;}.has-pale-pink-border-color{border-color: var(--wp--preset--color--pale-pink) !important;}.has-vivid-red-border-color{border-color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-border-color{border-color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-border-color{border-color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-light-green-cyan-border-color{border-color: var(--wp--preset--color--light-green-cyan) !important;}.has-vivid-green-cyan-border-color{border-color: var(--wp--preset--color--vivid-green-cyan) !important;}.has-pale-cyan-blue-border-color{border-color: var(--wp--preset--color--pale-cyan-blue) !important;}.has-vivid-cyan-blue-border-color{border-color: var(--wp--preset--color--vivid-cyan-blue) !important;}.has-vivid-purple-border-color{border-color: var(--wp--preset--color--vivid-purple) !important;}.has-vivid-cyan-blue-to-vivid-purple-gradient-background{background: var(--wp--preset--gradient--vivid-cyan-blue-to-vivid-purple) !important;}.has-light-green-cyan-to-vivid-green-cyan-gradient-background{background: var(--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan) !important;}.has-luminous-vivid-amber-to-luminous-vivid-orange-gradient-background{background: var(--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange) !important;}.has-luminous-vivid-orange-to-vivid-red-gradient-background{background: var(--wp--preset--gradient--luminous-vivid-orange-to-vivid-red) !important;}.has-very-light-gray-to-cyan-bluish-gray-gradient-background{background: var(--wp--preset--gradient--very-light-gray-to-cyan-bluish-gray) !important;}.has-cool-to-warm-spectrum-gradient-background{background: var(--wp--preset--gradient--cool-to-warm-spectrum) !important;}.has-blush-light-purple-gradient-background{background: var(--wp--preset--gradient--blush-light-purple) !important;}.has-blush-bordeaux-gradient-background{background: var(--wp--preset--gradient--blush-bordeaux) !important;}.has-luminous-dusk-gradient-background{background: var(--wp--preset--gradient--luminous-dusk) !important;}.has-pale-ocean-gradient-background{background: var(--wp--preset--gradient--pale-ocean) !important;}.has-electric-grass-gradient-background{background: var(--wp--preset--gradient--electric-grass) !important;}.has-midnight-gradient-background{background: var(--wp--preset--gradient--midnight) !important;}.has-small-font-size{font-size: var(--wp--preset--font-size--small) !important;}.has-medium-font-size{font-size: var(--wp--preset--font-size--medium) !important;}.has-large-font-size{font-size: var(--wp--preset--font-size--large) !important;}.has-x-large-font-size{font-size: var(--wp--preset--font-size--x-large) !important;} :where(.wp-block-post-template.is-layout-flex){gap: 1.25em;}:where(.wp-block-post-template.is-layout-grid){gap: 1.25em;} :where(.wp-block-columns.is-layout-flex){gap: 2em;}:where(.wp-block-columns.is-layout-grid){gap: 2em;} :root :where(.wp-block-pullquote){font-size: 1.5em;line-height: 1.6;} </style> <link rel='stylesheet' id='bigfoot-number-css' href='https://citizenlab.ca/wp-content/plugins/bigfoot_footnotes/library/bigfoot-number.css' type='text/css' media='all' /> <link rel='stylesheet' id='__EPYT__style-css' href='https://citizenlab.ca/wp-content/plugins/youtube-embed-plus/styles/ytprefs.min.css' type='text/css' media='all' /> <style id='__EPYT__style-inline-css' type='text/css'> .epyt-gallery-thumb { width: 33.333%; } </style> <link rel='stylesheet' id='bones-base-stylesheet-css' href='https://citizenlab.ca/wp-content/themes/citizenlab-2.1.5/library/css/tachyons.css' type='text/css' media='all' /> <link rel='stylesheet' id='bones-stylesheet-css' href='https://citizenlab.ca/wp-content/themes/citizenlab-2.1.5/library/css/style.css' type='text/css' media='all' />  <link rel='stylesheet' id='fontawesome-css' href='https://citizenlab.ca/wp-content/themes/citizenlab-2.1.5/library/fontawesome/css/fontawesome.min.css' type='text/css' media='all' /> <link rel='stylesheet' id='fontawesome-brands-css' href='https://citizenlab.ca/wp-content/themes/citizenlab-2.1.5/library/fontawesome/css/brands.min.css' type='text/css' media='all' /> <link rel='stylesheet' id='fontawesome-solid-css' href='https://citizenlab.ca/wp-content/themes/citizenlab-2.1.5/library/fontawesome/css/solid.min.css' type='text/css' media='all' /> <script type="text/javascript" src="https://citizenlab.ca/wp-includes/js/jquery/jquery.min.js" id="jquery-core-js"></script> <script type="text/javascript" src="https://citizenlab.ca/wp-includes/js/jquery/jquery-migrate.min.js" id="jquery-migrate-js"></script> <script type="text/javascript" id="__ytprefs__-js-extra"> /* <![CDATA[ */ var _EPYT_ = {"ajaxurl":"https:\/\/citizenlab.ca\/wp-admin\/admin-ajax.php","security":"bde6679a30","gallery_scrolloffset":"20","eppathtoscripts":"https:\/\/citizenlab.ca\/wp-content\/plugins\/youtube-embed-plus\/scripts\/","eppath":"https:\/\/citizenlab.ca\/wp-content\/plugins\/youtube-embed-plus\/","epresponsiveselector":"[\"iframe.__youtube_prefs__\",\"iframe[src*='youtube.com']\",\"iframe[src*='youtube-nocookie.com']\",\"iframe[data-ep-src*='youtube.com']\",\"iframe[data-ep-src*='youtube-nocookie.com']\",\"iframe[data-ep-gallerysrc*='youtube.com']\"]","epdovol":"1","version":"14.2.1.3","evselector":"iframe.__youtube_prefs__[src], iframe[src*=\"youtube.com\/embed\/\"], iframe[src*=\"youtube-nocookie.com\/embed\/\"]","ajax_compat":"","maxres_facade":"eager","ytapi_load":"light","pause_others":"","stopMobileBuffer":"1","facade_mode":"","not_live_on_channel":"","vi_active":"","vi_js_posttypes":[]}; /* ]]> */ </script> <script type="text/javascript" src="https://citizenlab.ca/wp-content/plugins/youtube-embed-plus/scripts/ytprefs.min.js" id="__ytprefs__-js"></script> <script type="text/javascript" src="https://citizenlab.ca/wp-content/themes/citizenlab-2.1.5/library/js/libs/modernizr.custom.min.js" id="bones-modernizr-js"></script> <link rel="https://api.w.org/" href="https://citizenlab.ca/wp-json/" /><link rel="alternate" title="JSON" type="application/json" href="https://citizenlab.ca/wp-json/wp/v2/posts/80376" /><link rel='shortlink' href='https://citizenlab.ca/?p=80376' /> <link rel="alternate" title="oEmbed (JSON)" type="application/json+oembed" href="https://citizenlab.ca/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fcitizenlab.ca%2F2024%2F02%2Fpaperwall-chinese-websites-posing-as-local-news-outlets-with-pro-beijing-content%2F" /> <link rel="alternate" title="oEmbed (XML)" type="text/xml+oembed" href="https://citizenlab.ca/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fcitizenlab.ca%2F2024%2F02%2Fpaperwall-chinese-websites-posing-as-local-news-outlets-with-pro-beijing-content%2F&format=xml" /> <script type="text/javascript" id="google_gtagjs" src="https://www.googletagmanager.com/gtag/js?id=G-RCDQQLPVF0" async="async"></script> <script type="text/javascript" id="google_gtagjs-inline"> /* <![CDATA[ */ window.dataLayer = window.dataLayer || [];function gtag(){dataLayer.push(arguments);}gtag('js', new Date());gtag('config', 'G-RCDQQLPVF0', {'anonymize_ip': true} ); /* ]]> */ </script> </head> <body itemscope itemtype="http://schema.org/WebPage">  <header id="header" role="banner" itemscope itemtype="http://schema.org/WPHeader"> <div id="header__inner" class="flex-ns items-center justify-between"> <div class="v-mid flex justify-between items-center"> <div class="mr-auto"> <a href="https://citizenlab.ca" rel="nofollow" id="logo" itemscope itemtype="http://schema.org/Organization"> <img src="https://citizenlab.ca/wp-content/themes/citizenlab-2.1.5/library/images/CL-logo-3-headed.png" alt="The Citizen Lab"/> </a> <img src="https://citizenlab.ca/wp-content/themes/citizenlab-2.1.5/library/images/MunkSchool-WHT.png" class="munk-logo" alt="Munk School of Global Affairs & Public Policy | University of Toronto" /> </div>  <a href="#main-menu" id="homepage" aria-label="Open main menu"> <span class="fa-solid fa-bars-staggered white dib" title="Open Menu"></span> <span class="screen-reader-text">Open main menu</span> </a> </div>  <a class="skip-main" href="#main">Skip to main content</a> <div class="flex-ns main-menu" id="main-menu"> <a href="#homepage" id="homepage" class="menu-close" aria-label="Close main menu"> <span class="fa-solid fa-x white dib" title="Close Menu"></span> <span class="screen-reader-text">Close main menu</span> </a> <nav id="nav-main" role="navigation" itemscope itemtype="http://schema.org/SiteNavigationElement" class="tc tl-l"> <ul id="menu-top-menu" class="list ma0 mt2 mt0-ns pa0 b dib-ns"><li id="menu-item-29705" class="menu-item menu-item-type-taxonomy menu-item-object-category current-post-ancestor menu-item-has-children menu-item-29705 dib-ns f5-l f4 ttu pv2 "><a href="https://citizenlab.ca/category/research/" class="white no-underline h-underline pr2 ml0">Research</a> <ul class="sub-menu"> <li id="menu-item-72358" class="menu-item menu-item-type-taxonomy menu-item-object-category current-post-ancestor current-menu-parent current-post-parent menu-item-72358 dib-ns f5-l f4 ttu pv2 "><a href="https://citizenlab.ca/category/research/targeted-threats/" class="white no-underline h-underline pr2">Targeted Threats</a></li> <li id="menu-item-72357" class="menu-item menu-item-type-taxonomy menu-item-object-category menu-item-72357 dib-ns f5-l f4 ttu pv2 "><a href="https://citizenlab.ca/category/research/free-expression-online/" class="white no-underline h-underline pr2 mr0">Free Expression Online</a></li> <li id="menu-item-72359" class="menu-item menu-item-type-taxonomy menu-item-object-category menu-item-72359 dib-ns f5-l f4 ttu pv2 "><a href="https://citizenlab.ca/category/research/transparency/" class="white no-underline h-underline pr2">Transparency and Accountability</a></li> <li id="menu-item-72360" class="menu-item menu-item-type-taxonomy menu-item-object-category menu-item-72360 dib-ns f5-l f4 ttu pv2 "><a href="https://citizenlab.ca/category/research/app-privacy-and-security/" class="white no-underline h-underline pr2">App Privacy and Controls</a></li> <li id="menu-item-72362" class="menu-item menu-item-type-taxonomy menu-item-object-category menu-item-72362 dib-ns f5-l f4 ttu pv2 "><a href="https://citizenlab.ca/category/research/global-research-network/" class="white no-underline h-underline pr2">Global Research Network</a></li> <li id="menu-item-72385" class="menu-item menu-item-type-taxonomy menu-item-object-category menu-item-72385 dib-ns f5-l f4 ttu pv2 "><a href="https://citizenlab.ca/category/research/tools-resources/" class="white no-underline h-underline pr2">Tools & Resources</a></li> <li id="menu-item-72361" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-72361 dib-ns f5-l f4 ttu pv2 "><a href="https://citizenlab.ca/publications/" class="white no-underline h-underline pr2">Publications</a></li> </ul> </li> <li id="menu-item-29706" class="menu-item menu-item-type-taxonomy menu-item-object-category menu-item-has-children menu-item-29706 dib-ns f5-l f4 ttu pv2 "><a href="https://citizenlab.ca/category/lab-news/" class="white no-underline h-underline pr2">News</a> <ul class="sub-menu"> <li id="menu-item-72363" class="menu-item menu-item-type-taxonomy menu-item-object-category menu-item-72363 dib-ns f5-l f4 ttu pv2 "><a href="https://citizenlab.ca/category/lab-news/mentions/" class="white no-underline h-underline pr2">In the Media</a></li> <li id="menu-item-72364" class="menu-item menu-item-type-taxonomy menu-item-object-category menu-item-72364 dib-ns f5-l f4 ttu pv2 "><a href="https://citizenlab.ca/category/lab-news/events/" class="white no-underline h-underline pr2">Events</a></li> <li id="menu-item-72365" class="menu-item menu-item-type-taxonomy menu-item-object-category menu-item-72365 dib-ns f5-l f4 ttu pv2 "><a href="https://citizenlab.ca/category/lab-news/opportunities/" class="white no-underline h-underline pr2">Opportunities</a></li> </ul> </li> <li id="menu-item-29707" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children menu-item-29707 dib-ns f5-l f4 ttu pv2 "><a href="https://citizenlab.ca/about/" class="white no-underline h-underline pr2">About</a> <ul class="sub-menu"> <li id="menu-item-72367" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-72367 dib-ns f5-l f4 ttu pv2 "><a href="https://citizenlab.ca/about/" class="white no-underline h-underline pr2">About The Citizen Lab</a></li> <li id="menu-item-72368" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-72368 dib-ns f5-l f4 ttu pv2 "><a href="https://citizenlab.ca/media/" class="white no-underline h-underline pr2">Media Resources</a></li> <li id="menu-item-72369" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-72369 dib-ns f5-l f4 ttu pv2 "><a href="https://citizenlab.ca/people/" class="white no-underline h-underline pr2">People</a></li> <li id="menu-item-72370" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-72370 dib-ns f5-l f4 ttu pv2 "><a href="https://citizenlab.ca/teaching/" class="white no-underline h-underline pr2">Teaching</a></li> <li id="menu-item-72387" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-72387 dib-ns f5-l f4 ttu pv2 "><a href="https://engage.utoronto.ca/site/SPageServer?pagename=donate#/fund/847" class="white no-underline h-underline pr2">Donate</a></li> <li id="menu-item-74537" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-74537 dib-ns f5-l f4 ttu pv2 "><a href="https://citizenlab.ca/disclosure-of-security-vulnerabilities/" class="white no-underline h-underline pr2">Security Vulnerabilities</a></li> </ul> </li> </ul> </nav>  <div class="flex items-start justify-center searchbar"> <form class="db-l ma0 pa0 b0 lh0 f5" role="search" method="get" id="menuSearchform" action="https://citizenlab.ca/"> <div id="menuSearchContainer" class="ml3 dib w0 transition-width overflow-hidden"> <input type="search" id="menuSearch" name="s" value="" class="b--none ma0 pa1 w-100" placeholder="Search"/> </div>  </form> <div id="menuSearchButton" class="db-l ml3 pointer items-end"> <span class="fa-solid fa-magnifying-glass white f5" aria-label="Search" title="Search"></span> </div> </div>  </div>  </div>  </header>  <div id="container" class="pa3 pv4-l ph5-l">  <main id="main" role="main" itemscope itemprop="mainContentOfPage" itemtype="http://schema.org/Blog"> <section id="content" class="container"> <article id="post-80376" dir="ltr" 80376role="article" itemscope itemprop="blogPost" itemtype="http://schema.org/BlogPosting" class="lh-copy"> <header> <span class="f6 mt0" dir="ltr"><a href="https://citizenlab.ca/category/research/" class="breadcrumbs"><a href="https://citizenlab.ca/category/research/" class="breadcrumbs">Research</a><span class="fa-solid fa-chevron-right mh2" aria-hidden="true"></span></a><a href="https://citizenlab.ca/category/research/targeted-threats/" class="breadcrumbs">Targeted Threats</a></span> <h1 itemprop="headline" rel="bookmark" class="ma0 mt5 lh-title">  <span class="db f2 f1-ns black lh-solid no-hyphen">PAPERWALL</span>  <span class="db f4 f2-ns mid-gray mt2 lh-title oswald-regular mb2-ns no-hyphen"> Chinese Websites Posing as Local News Outlets Target Global Audiences with Pro-Beijing Content</span> </h1> <div dir="ltr" class="mt2"> <div class="f5 mr4 b dark-gray dib">By <a href="https://citizenlab.ca/author/alberto-fittarelli/" title="Posts by Alberto Fittarelli" class="author url fn" rel="author">Alberto Fittarelli</a></div> <time class="dark-gray dib f5 mr4" datetime="2024-02-07" itemprop="datePublished">February 7, 2024</time>  </div>  </header> <section itemprop="articleBody" class="article-body mb4 mt4 pt2 bt b--light-gray"> <h2 id="key-findings" class="lh-solid mb3">Key Findings</h2> <ul class="mt0"> <li class="mt2">A network of at least 123 websites operated from within the People’s Republic of China while posing as local news outlets in 30 countries across Europe, Asia, and Latin America, disseminates pro-Beijing disinformation and ad hominem attacks within much larger volumes of commercial press releases. We name this campaign PAPERWALL.</li> <li class="mt2">PAPERWALL has similarities with HaiEnergy, an influence operation first reported on in 2022 by the cybersecurity company Mandiant. However, we assess PAPERWALL to be a distinct campaign with different operators and unique techniques, tactics and procedures.</li> <li class="mt2">PAPERWALL draws significant portions of its content from Times Newswire, a newswire service that was previously linked to HaiEnergy. We found evidence that Times Newswire regularly seeds pro-Beijing political content, including ad hominem attacks, by concealing it within large amounts of seemingly benign commercial content.</li> <li class="mt2">A central feature of PAPERWALL, observed across the network of websites, is the ephemeral nature of its most aggressive components, whereby articles attacking Beijing’s critics are routinely removed from these websites some time after they are published.</li> <li class="mt2">We attribute the PAPERWALL campaign to Shenzhen Haimaiyunxiang Media Co., Ltd., aka Haimai, a PR firm in China based on digital infrastructure linkages between the firm’s official website and the network.</li> <li class="mt2">While the campaign’s websites enjoyed negligible exposure to date, there is a heightened risk of inadvertent amplification by the local media and target audiences, as a result of the quick multiplication of these websites and their adaptiveness to local languages and content.</li> <li class="mt2">These findings confirm the increasingly important role private firms play in the realm of digital influence operations and the propensity of the Chinese government to make use of them.</li> </ul> <h2 id="premise-why-exposing-this-type-of-campaign-matters" class="lh-solid mb3">Why Exposing this Type of Campaign Matters</h2> <p class="mt0">Beijing is increasing its <a href="https://thediplomat.com/2023/09/chinas-increasingly-aggressive-tactics-for-foreign-disinformation-campaigns/" class="pointer" target="_blank" rel="noopener"><u>aggressive</u></a> activities in the spheres of influence operations (IOs), both online and <a href="https://www.washingtonpost.com/world/2023/09/21/china-global-influence-takeaways/" class="pointer" target="_blank" rel="noopener"><u>offline</u></a>. In the online realm, relevant to the findings in this report, Chinese IOs are <a href="https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RW1aFyW" class="pointer" target="_blank" rel="noopener"><u>shifting</u></a> their tactics and increasing their volume of activity. For example, in November 2023 Meta – owner of the social media platforms Facebook, Instagram, and WhatsApp – announced the removal of five networks engaging in “coordinated inauthentic behavior” (i.e. influence operations) and targeting foreign audiences. Meta <a href="https://transparency.fb.com/en-gb/integrity-reports-q3-2023/" class="pointer" target="_blank" rel="noopener"><u>noted</u></a> it as a <strong>marked increase in IO activity by China</strong>, stating that “for comparison, between 2017 and November 2020, we took down two CIB networks from China, and both mainly focused on the Asia-Pacific region. This represents the most notable change in the threat landscape, when compared with the 2020 [US] election cycle.”</p> <p>Seeding ad hominem attacks on Beijing’s critics can result in <strong>particularly harmful consequences</strong> for the targeted individuals, especially when, as in PAPERWALL’s case, it happens within much larger amounts of ostensibly benign news or promotional content that lends credibility to and expands the reach of the attacks. The consequences to these individuals can include, but are not limited to, their delegitimization in the country that hosts them; the loss of professional opportunities; and even verbal or physical harassment and intimidation by communities sympathetic to the Chinese government’s agenda.</p> <p>This report adds yet more evidence, to what has been reported by other researchers, of the increasingly important role played by <strong>private firms in the management of digital IOs</strong> on behalf of the Chinese government. For example, an October 2023 <a href="https://www.rand.org/pubs/commentary/2023/10/dismantling-the-disinformation-business-of-chinese.html" class="pointer" target="_blank" rel="noopener"><u>blog post</u></a> by the RAND corporation summarized recent public findings on this issue, and advocated for the disruption of the disinformation-for-hire industry through the use of sanctions or other available legal and policy means.</p> <p>It should be noted that disinformation-for-hire companies, driven <strong>by revenue, not ideology,</strong> tend not to be discerning about the motivations of their clients. As major <a href="https://www.theguardian.com/world/2023/feb/15/revealed-disinformation-team-jorge-claim-meddling-elections-tal-hanan" class="pointer" target="_blank" rel="noopener"><u>recent press investigations have shown</u></a>, both their origin and their client base can truly be global. Exposing this actor type, and its tactics, can help understand how governments seek plausible deniability through the hiring of corporate proxies. It can also refocus research on the latter, increasing deterrence by exposing their actions.</p> <h2 id="background" class="lh-solid mb3">Background</h2> <p class="mt0">On October 25, 2023, the Italian newspaper <strong>Il Foglio</strong> published an <a href="https://www.ilfoglio.it/esteri/2023/10/25/news/la-fabbrica-dei-contenuti-pro-cina-5826677" class="pointer" target="_blank" rel="noopener"><u>article</u></a>, summarized in English <a href="https://decode39.com/8109/network-fake-china-news-websites-italy/" class="pointer" target="_blank" rel="noopener"><u>here</u></a>, that exposed a small network of six websites posing as news outlets for Italian audiences that did not correspond to any real newsrooms in Italy. Il Foglio’s investigation confirmed that the websites were not registered as news outlets in the national registry, as legally required for any information organization operating within the country.</p> <p>The identified domains used a specific naming convention: the name of an Italian city in the local spelling (i.e. “Roma”, or “Milano”), followed by mundane terms (for example, “moda”, meaning fashion; “money”; or “journal”). The websites hosted on those domains were all similar in structure, layout, and content, with generic political, crime, and entertainment articles interspersed with a relatively high amount of news related to China, or even directly derived from Chinese news organizations.</p> <p>Il Foglio claimed that the network was being operated from China, and possibly by the Chinese government, based on content analysis and on the six domains resolving to an unspecified IP address owned by Tencent Computer Systems Inc., a major Chinese corporation. The Italian newspaper also hinted at the possible existence of a broader set of websites linked to the six presented, without publicly disclosing further information.</p> <p>On November 13, 2023, the South Korean <strong>National Cyber Security Center (NCSC)</strong>, a governmental agency, also published a <a href="https://www.ncsc.go.kr:4018/main/cop/bbs/selectBoardArticle.do?bbsId=SecurityAdvice_main&nttId=88028&menuNo=020000&subMenuNo=020200&thirdMenuNo=" class="pointer" target="_blank" rel="noopener"><u>report</u></a> exposing eighteen Korean-language websites posing as local news outlets. The report attributed these sites to a Chinese PR firm called <strong>Haimai</strong>, based on the firm itself advertising the opportunity for its clients to publish press releases on these same sites. These websites presented strong similarities with the six Italian-language ones exposed by Il Foglio, from their technical structure to the modus operandi utilized.</p> <p>We set out to research the whole network, with the objective of discovering additional websites, their tactics, targeting, and impact; and of verifying the attribution of the activity to its operators.</p> <h2 id="an-extensive-network-of-websites" class="lh-solid mb3">An Extensive Network of Websites</h2> <h3 id="the-initial-set" class="lh-solid mb3">The Initial Set</h3> <p class="mt0">Based on DNS infrastructure overlaps, we were able to expand the network identified by Il Foglio to an <strong>initial total of 74 domains</strong>. The majority of the domains could be identified through a relatively small set of three IP addresses they resolved to.</p> <p>The number of domains hosted on these IP addresses is relatively low: they featured a total of less than 100 domain resolutions, while theoretically, each could have hosted thousands of domains. This could indicate that the IPs are only linked to one operator, rather than multiple clients of the provider.</p> <p>We started from the following six domains, identified in the original news article:</p> <figure class="center mw-100 table-overflow" style="min-width:50%; width: min-content; margin: 0px auto"><div class="center" style="min-width: 100%; width: fit-content"><table border="0" cellspacing="0" style="width: max-content; height: unset" class="ba b--light-gray"> <tbody> <tr class="striped--light-gray"> <th>DOMAINS</th> </tr> <tr class="striped--light-gray"> <td>italiafinanziarie[.]com</td> </tr> <tr class="striped--light-gray"> <td>napolimoney[.]com</td> </tr> <tr class="striped--light-gray"> <td>romajournal[.]org</td> </tr> <tr class="striped--light-gray"> <td>torinohuman[.]com</td> </tr> <tr class="striped--light-gray"> <td>milanomodaweekly[.]com</td> </tr> <tr class="striped--light-gray"> <td>veneziapost[.]com</td> </tr> </tbody> </table></div><figcaption class="figcaption pa2 bt b--gray bw2 bg-light-gray"><p class="ma0"><em>Table 1: List of 6 domains hosting Italian-language websites as identified by Il Foglio</em></p></figcaption></figure> <p>Based on Passive DNS resolution data made available by <a href="https://community.riskiq.com/" class="pointer" target="_blank" rel="noopener"><u>RiskIQ</u></a>, we found that the above domains resolved, during the last two years, to at least one of the following three IP addresses:</p> <figure class="center mw-100 table-overflow" style="min-width:50%; width: min-content; margin: 0px auto"><div class="center" style="min-width: 100%; width: fit-content"><table border="0" cellspacing="0" style="width: max-content; height: unset" class="ba b--light-gray"> <colgroup> <col style="width: 18%;"> <col style="width: 31%;"> <col style="width: 24%;"> <col style="width: 26%;"> </colgroup> <tbody> <tr class="header striped--light-gray"> <th><strong>IP</strong></th> <th><strong>OWNED BY</strong></th> <th><strong>FIRST SEEN</strong></th> <th><strong>LAST SEEN</strong></th> </tr> <tr class="odd striped--light-gray"> <td>3.12.149[.]243</td> <td>Amazon Web Services (AWS)</td> <td>2021-08-14</td> <td>2023-07-06</td> </tr> <tr class="header striped--light-gray"> <td>162.62.225[.]65</td> <td>Tencent Computer Systems Company Limited, Shenzhen</td> <td>2023-07-07</td> <td>2023-07-08</td> </tr> <tr class="odd striped--light-gray"> <td>43.157.63[.]199</td> <td>Tencent Computer Systems Company Limited, Shenzhen</td> <td>2023-07-09</td> <td>2023-10-28<br> <em>(date of the last check)</em></td> </tr> </tbody> </table></div><figcaption class="figcaption pa2 bt b--gray bw2 bg-light-gray"><p class="ma0"><em>Table 2: List of IP addresses to which the 6 domains resolved since 2021</em></p></figcaption></figure> <p>We found other domains that had pointed to at least one of those three IP addresses since April 2018, obtaining the following list of 74 domains:</p> <div> <table style="border-collapse: collapse; width: 100%; height: 538px;" border="0" cellspacing="0" class="ba b--light-gray"> <tbody> <tr style="height: 24px;" class="striped--light-gray"> <td style="width: 33.3333%; height: 24px;">alpsbiz[.]com</td> <td style="width: 33.3333%; height: 24px;">sevillatimes[.]com</td> <td style="width: 33.3333%; height: 24px;">froneplus[.]com</td> </tr> <tr style="height: 24px;" class="striped--light-gray"> <td style="width: 33.3333%; height: 24px;">vtnay[.]org</td> <td style="width: 33.3333%; height: 24px;">guellherald[.]com</td> <td style="width: 33.3333%; height: 24px;">it[.]euleader[.]org</td> </tr> <tr style="height: 24px;" class="striped--light-gray"> <td style="width: 33.3333%; height: 24px;">stptb[.]org</td> <td style="width: 33.3333%; height: 24px;">aksaydaily[.]com</td> <td style="width: 33.3333%; height: 24px;">benmorning[.]com</td> </tr> <tr style="height: 10px;" class="striped--light-gray"> <td style="width: 33.3333%; height: 10px;">tarragonapost[.]com</td> <td style="width: 33.3333%; height: 10px;">veneziapost[.]com</td> <td style="width: 33.3333%; height: 10px;">conanfinance[.]com</td> </tr> <tr style="height: 24px;" class="striped--light-gray"> <td style="width: 33.3333%; height: 24px;">ekaterintech[.]com</td> <td style="width: 33.3333%; height: 24px;">vtnay[.]org</td> <td style="width: 33.3333%; height: 24px;">cordovapress[.]org</td> </tr> <tr style="height: 24px;" class="striped--light-gray"> <td style="width: 33.3333%; height: 24px;">cordovapress[.]org</td> <td style="width: 33.3333%; height: 24px;">londonclup[.]com</td> <td style="width: 33.3333%; height: 24px;">economyfr[.]com</td> </tr> <tr style="height: 24px;" class="striped--light-gray"> <td style="width: 33.3333%; height: 24px;">napolimoney[.]com</td> <td style="width: 33.3333%; height: 24px;">euleader[.]org</td> <td style="width: 33.3333%; height: 24px;">fftribune[.]com</td> </tr> <tr style="height: 24px;" class="striped--light-gray"> <td style="width: 33.3333%; height: 24px;">sevillatimes[.]com</td> <td style="width: 33.3333%; height: 24px;">bmhtoday[.]com</td> <td style="width: 33.3333%; height: 24px;">ulstergrowth[.]com</td> </tr> <tr style="height: 24px;" class="striped--light-gray"> <td style="width: 33.3333%; height: 24px;">glasgowtr[.]com</td> <td class="bg-yellow" style="width: 33.3333%; height: 24px;">kupit-skorost-mdpv-lipeck[.]gaba[.]biz</td> <td style="width: 33.3333%; height: 24px;">louispress[.]org</td> </tr> <tr style="height: 24px;" class="striped--light-gray"> <td style="width: 33.3333%; height: 24px;">ulstergrowth[.]com</td> <td style="width: 33.3333%; height: 24px;">alpsbiz[.]com</td> <td style="width: 33.3333%; height: 24px;">it[.]wdpp[.]org</td> </tr> <tr style="height: 24px;" class="striped--light-gray"> <td style="width: 33.3333%; height: 24px;">eiffelpost[.]com</td> <td style="width: 33.3333%; height: 24px;">kazanculture[.]com</td> <td style="width: 33.3333%; height: 24px;">volgogradpost[.]com</td> </tr> <tr style="height: 24px;" class="striped--light-gray"> <td style="width: 33.3333%; height: 24px;">euleader[.]org</td> <td style="width: 33.3333%; height: 24px;">tarragonapost[.]com</td> <td style="width: 33.3333%; height: 24px;">bmhtoday[.]com</td> </tr> <tr style="height: 24px;" class="striped--light-gray"> <td style="width: 33.3333%; height: 24px;">tulunet[.]com</td> <td style="width: 33.3333%; height: 24px;">samaraindustry[.]com</td> <td style="width: 33.3333%; height: 24px;">glasgowtr[.]com</td> </tr> <tr style="height: 24px;" class="striped--light-gray"> <td style="width: 33.3333%; height: 24px;">provencedaily[.]com</td> <td style="width: 33.3333%; height: 24px;">guellherald[.]com</td> <td style="width: 33.3333%; height: 24px;">deiniolnews[.]com</td> </tr> <tr style="height: 24px;" class="striped--light-gray"> <td style="width: 33.3333%; height: 24px;">uk[.]wdpp[.]org</td> <td style="width: 33.3333%; height: 24px;">doyletimes[.]com</td> <td style="width: 33.3333%; height: 24px;">fr[.]wdpp[.]org</td> </tr> <tr style="height: 24px;" class="striped--light-gray"> <td style="width: 33.3333%; height: 24px;">froneplus[.]com</td> <td style="width: 33.3333%; height: 24px;">italiafinanziarie[.]com</td> <td style="width: 33.3333%; height: 24px;">fftribune[.]com</td> </tr> <tr style="height: 24px;" class="striped--light-gray"> <td style="width: 33.3333%; height: 24px;">eiffelpost[.]com</td> <td style="width: 33.3333%; height: 24px;">milanomodaweekly[.]com</td> <td class="bg-yellow" style="width: 33.3333%; height: 24px;">gtad2[.]iranianhosting[.]com</td> </tr> <tr style="height: 24px;" class="striped--light-gray"> <td style="width: 33.3333%; height: 24px;">romajournal[.]org</td> <td style="width: 33.3333%; height: 24px;">deiniolnews[.]com</td> <td style="width: 33.3333%; height: 24px;">friendlyparis[.]com</td> </tr> <tr style="height: 24px;" class="striped--light-gray"> <td style="width: 33.3333%; height: 24px;">britishft[.]com</td> <td style="width: 33.3333%; height: 24px;">rmtcityfr[.]com</td> <td style="width: 33.3333%; height: 24px;">findmoscow[.]com</td> </tr> <tr style="height: 24px;" class="striped--light-gray"> <td style="width: 33.3333%; height: 24px;">britishft[.]com</td> <td style="width: 33.3333%; height: 24px;">rmtcityfr[.]com</td> <td style="width: 33.3333%; height: 24px;">conanfinance[.]com</td> </tr> <tr style="height: 24px;" class="striped--light-gray"> <td style="width: 33.3333%; height: 24px;">economyfr[.]com</td> <td style="width: 33.3333%; height: 24px;">uk[.]euleader[.]org</td> <td style="width: 33.3333%; height: 24px;">provencedaily[.]com</td> </tr> <tr style="height: 24px;" class="striped--light-gray"> <td style="width: 33.3333%; height: 24px;">frnewsfeed[.]com</td> <td class="bg-yellow" style="width: 33.3333%; height: 24px;">ec2-3-12-149-243[.]us-east-2[.]compute[.]amazonaws[.]com</td> <td style="width: 33.3333%; height: 24px;">frnewsfeed[.]com</td> </tr> <tr style="height: 24px;" class="striped--light-gray"> <td style="width: 33.3333%; height: 24px;">friendlyparis[.]com</td> <td style="width: 33.3333%; height: 24px;">benmorning[.]com</td> <td class="bg-yellow" style="width: 33.3333%; height: 24px;"><i>[REDACTED]<a id="fnref1" class="footnote-ref pointer" role="doc-noteref" href="#fn1"><sup>1</sup></a></i></td> </tr> <tr class="striped--light-gray"> <td style="width: 33.3333%;">londonclup[.]com</td> <td style="width: 33.3333%;">doyletimes[.]com</td> <td style="width: 33.3333%;">torinohuman[.]com</td> </tr> <tr class="striped--light-gray"> <td style="width: 33.3333%;">gorodbusiness[.]com</td> <td style="width: 33.3333%;"></td> <td style="width: 33.3333%;"></td> </tr> </tbody> </table> </div> <div class="f5 gray tc">Table 3: List of 74 domains also resolving to the same 3 IP addresses as the domains identified by Il Foglio</div> <p>We verified that — with only four exceptions, highlighted in table 3 — the domains hosted websites posing as news outlets in several countries. <em>The four highlighted exceptions resolved to one or more of the three examined IP addresses before or after the rest of the network was present on them, making their affiliation to PAPERWALL questionable.</em> Additionally, many of them appeared to utilize the naming convention identified for the Italian-language domains (city name, followed by a generic term).</p> <h3 id="the-broader-network" class="lh-solid mb3">The Broader Network</h3> <p class="mt0">By replicating the same process on the websites highlighted in the NCSC report, we were able to identify additional domains, and confirm them as fully matching the PAPERWALL signature features.</p> <p>These include:</p> <h4 id="the-website-structure" class="lh-solid mb3">The websites’ structure</h4> <p class="mt0">All of them were built on WordPress, and utilized a (<a href="https://trends.builtwith.com/widgets/WPBakery" class="pointer" target="_blank" rel="noopener"><u>highly popular</u></a>) page builder plugin – <a href="https://wpbakery.com/" class="pointer" target="_blank" rel="noopener"><u>WPBakery</u></a> – for their setup.</p> <h4 id="the-domain-infrastructure" class="lh-solid mb3">The domains’ infrastructure</h4> <p class="mt0">As spotted by Il Foglio, the current hosting infrastructure for the six Italian-language domains linked back to Tencent, a Chinese-based company. In fact, the relevant service being utilized is Tencent Cloud; and we could verify that all the currently active domains were being hosted on a Tencent Cloud IP address.</p> <ul> <li class="mt2">It is important however to note that this is something that any private customer can request, provided that certain requirements given by the host provider are satisfied.</li> <li class="mt2">We confirmed in the Tencent Cloud service <a href="https://www.tencentcloud.com/document/product/378/17985" class="pointer" target="_blank" rel="noopener"><u>documentation</u></a> that the requirements imposed by the company are minimal: the identity of the individual or company subscribing to the service, a mobile phone number (to be verified through a security code sent via SMS), and a credit or debit card.</li> <li class="mt2">This effectively means that any private or corporate subscriber operating the network of websites could have pointed their domains to a Tencent IP address by subscribing to their Cloud service.</li> </ul> <h4 class="lh-solid mb3"><strong>The WordPress users</strong></h4> <p class="mt0">We analyzed the usernames utilized to post content on the PAPERWALL websites through a technique called <a href="https://nixintel.info/osint/osint-techniques-whos-behind-a-wordpress-site/" class="pointer" target="_blank" rel="noopener"><u>user enumeration</u></a>. This technique revealed that the whole network shared a small number of content author names, visible in the table below.</p> <figure class="center mw-100 table-overflow" style="min-width:50%; width: min-content; margin: 0px auto"><div class="center" style="min-width: 100%; width: fit-content"><table border="0" cellspacing="0" style="width: max-content; height: unset" class="ba b--light-gray"> <colgroup> <col style="width: 33%;"> <col style="width: 33%;"> <col style="width: 33%;"> </colgroup> <tbody> <tr class="header striped--light-gray"> <th><strong>USERNAME</strong></th> <th><strong># OF WEBSITES</strong></th> <th><strong>NOTES</strong></th> </tr> <tr class="odd striped--light-gray"> <td>Tina</td> <td>44</td> <td>European, Asian, Latin American websites</td> </tr> <tr class="header striped--light-gray"> <td>Chunqt</td> <td>28</td> <td>Asian websites only</td> </tr> <tr class="odd striped--light-gray"> <td>Sophia</td> <td>26</td> <td>European websites only</td> </tr> <tr class="header striped--light-gray"> <td>Peter</td> <td>12</td> <td>Russian websites only</td> </tr> <tr class="odd striped--light-gray"> <td><em>[Others]</em></td> <td>11</td> <td>All eleven users except one were associated with the domain napolimoney[.]com, in a complete departure from the usual pattern. We could not locate evidence that any of those users correspond to an existing person.</td> </tr> <tr class="header striped--light-gray"> <td><em>[Undetermined]</em></td> <td>12</td> <td>Websites whose user list was not accessible; or that were not online (including in an archived version) at the moment of writing this report.</td> </tr> </tbody> </table></div><figcaption class="figcaption pa2 bt b--gray bw2 bg-light-gray"><p class="ma0"><em>Table 4: WordPress usernames identified as used on the PAPERWALL websites</em></p></figcaption></figure> <h3 id="the-content" class="lh-solid mb3">The content</h3> <p class="mt0">All of the identified websites had almost identical homepage menus, typically including (translated in the target language): Politics, Economy, Culture, Current Affairs, and Sport. The actual content being posted was a mix of scraped and reposted content from local media in the targeted country; press releases; and occasional Chinese state media articles, or anonymous disinformation content. The content could typically be observed as being simultaneously cross-posted across several of the websites at once. We analyze the content in more detail <a href="#the-content" class="pointer"><u>later in this report</u></a>.</p> <figure class="center mw-100 ba b--light-gray" style="width:640px;"><div class="tc pa2 bg-white"><a href="https://citizenlab.ca/wp-content/uploads/2024/02/figure-1.png" class="pointer"><img fetchpriority="high" decoding="async" class="size-large wp-image-80382" src="https://citizenlab.ca/wp-content/uploads/2024/02/figure-1-1024x327.png" alt="Examples of a commercial press release related to a company called Great Wall Motor being posted to six different PAPERWALL websites within the span of six days (25 to 31 October 2023). Note: we did not find any evidence that GWM was aware of its content being promoted as part of a deceptive coordinated campaign." width="640" height="204" title="PAPERWALL: Chinese Websites Posing as Local News Outlets Target Global Audiences with Pro-Beijing Content 1" srcset="https://citizenlab.ca/wp-content/uploads/2024/02/figure-1-1024x327.png 1024w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-1-300x96.png 300w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-1-768x245.png 768w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-1-1536x491.png 1536w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-1-605x193.png 605w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-1-297x95.png 297w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-1-500x160.png 500w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-1-180x58.png 180w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-1.png 1806w" sizes="(max-width: 640px) 100vw, 640px" /></a></div><figcaption class="f5-ns f6 black-70 pa2 bg-light-gray">Figure 1: Combo of examples of a commercial press release related to a company called <a href="https://en.wikipedia.org/wiki/Great_Wall_Motor" class="pointer" target="_blank" rel="noopener">GWM (Great Wall Motor)</a>, being posted to six different PAPERWALL websites within the span of six days (25 to 31 October 2023). Note: we did not find any evidence that GWM was aware of its content being promoted as part of a deceptive coordinated campaign.</figcaption></figure> <p><strong>As of December 21, 2023, we were able to identify a total of 123 domains</strong>, almost all of which are hosting websites posing as news outlets. A full list of these domains is available in the <a href="#confirmed-domains" class="pointer"><u>Appendix</u></a>.</p> <h3 id="target-audiences" class="lh-solid mb3">Target Audiences</h3> <p class="mt0">Based on the language utilized, as well as on the sourcing of the local news content reposted by PAPERWALL websites – an aspect that we will also describe in more detail <a href="#the-content" class="pointer"><u>later in this report</u></a> – we observed the network as mimicking local news outlets in <strong>30 different countries</strong>, as shown in the map below. A full list of the target countries, with the number of websites addressing each, is available in the <a href="#lt1mh5mnitfc" class="pointer"><u>Appendix</u></a>.</p> <figure class="center mw-100 ba b--light-gray" style="width:640px;"><div class="tc pa2 bg-white"><a href="https://citizenlab.ca/wp-content/uploads/2024/02/figure-2.png" class="pointer"><img decoding="async" class="size-large wp-image-80383" src="https://citizenlab.ca/wp-content/uploads/2024/02/figure-2-1024x536.png" alt="The PAPERWALL target audiences, showing the distribution of websites per each country targeted" width="640" height="335" title="PAPERWALL: Chinese Websites Posing as Local News Outlets Target Global Audiences with Pro-Beijing Content 2" srcset="https://citizenlab.ca/wp-content/uploads/2024/02/figure-2-1024x536.png 1024w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-2-300x157.png 300w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-2-768x402.png 768w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-2-1536x804.png 1536w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-2-2048x1071.png 2048w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-2-605x316.png 605w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-2-297x155.png 297w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-2-500x262.png 500w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-2-180x94.png 180w" sizes="(max-width: 640px) 100vw, 640px" /></a></div><figcaption class="f5-ns f6 black-70 pa2 bg-light-gray">Figure 2: Map of the PAPERWALL target audiences, showing the distribution of websites per each country targeted</figcaption></figure> <p>To appear as legitimate local news outlets, PAPERWALL websites typically utilized local references as part of their names. For example, “Eiffel” or “Provence” for French-language websites; “Viking” for the Norwegian one; or city names, commonly used for Italian and Spanish websites.</p> <figure class="center mw-100 ba b--light-gray" style="width:640px;"><div class="tc pa2 bg-white"><a href="https://citizenlab.ca/wp-content/uploads/2024/02/figure-3-1.png" class="pointer"><img decoding="async" class="size-large wp-image-80401" src="https://citizenlab.ca/wp-content/uploads/2024/02/figure-3-1-1024x512.png" alt="Headers of napolimoney[.]com (Italy), eiffelpost[.]com (France), and sevillatimes[.]com (Spain) shown as examples of the nomenclature pattern used by PAPERWALL" width="640" height="320" title="PAPERWALL: Chinese Websites Posing as Local News Outlets Target Global Audiences with Pro-Beijing Content 3" srcset="https://citizenlab.ca/wp-content/uploads/2024/02/figure-3-1-1024x512.png 1024w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-3-1-300x150.png 300w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-3-1-768x384.png 768w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-3-1-605x303.png 605w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-3-1-297x149.png 297w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-3-1-500x250.png 500w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-3-1-180x90.png 180w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-3-1.png 1474w" sizes="(max-width: 640px) 100vw, 640px" /></a></div><figcaption class="f5-ns f6 black-70 pa2 bg-light-gray">Figure 3: Headers of napolimoney[.]com (Italy), eiffelpost[.]com (France), and sevillatimes[.]com (Spain) shown as examples of the nomenclature pattern used by PAPERWALL</figcaption></figure> <p>A broader look at the domains’ registration timeline shows how the websites were set up in waves, one target country (or region) at a time. In July 2019, updatenews[.]info became the first PAPERWALL domain to be registered. However, due to registration data patterns and <a href="https://web.archive.org/web/20200815000000*/updatenews.info" class="pointer" target="_blank" rel="noopener">archived captures</a> on the Wayback Machine, we can only establish affiliation with PAPERWALL beginning May 2020. The hosted website primarily published news relevant to American readers.</p> <p>Meanwhile, in April 2020, the domain wdpp[.]org (presumably abbreviated for “World Development Press”) was registered. The website located on a Tencent IP address, which is also linked to updatenews[.]info and 16 other PAPERWALL domains, will be critical to our <a href="#attribution-haimai" class="pointer">attribution</a>.</p> <p>In July 2020, we saw the first group registrations. That month, nine domains were registered, with each hosting a website aimed at Japanese audiences. One of them, <b>fujiyamatimes[.]com</b>, has a footer linking it to <b>“Updatenews”</b>.</p> <figure class="center mw-100 ba b--light-gray" style="width:958px;"><div class="tc pa2 bg-white"><a href="https://citizenlab.ca/wp-content/uploads/2024/02/figure-4.png" class="pointer"><img loading="lazy" decoding="async" class="size-full wp-image-80385" src="https://citizenlab.ca/wp-content/uploads/2024/02/figure-4.png" alt="Footer on fujiyamatimes[.]com, showing the line “Support: FUJIYAMA TIMES by Updatenews.”" width="958" height="72" title="PAPERWALL: Chinese Websites Posing as Local News Outlets Target Global Audiences with Pro-Beijing Content 4" srcset="https://citizenlab.ca/wp-content/uploads/2024/02/figure-4.png 958w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-4-300x23.png 300w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-4-768x58.png 768w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-4-605x45.png 605w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-4-297x22.png 297w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-4-500x38.png 500w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-4-180x14.png 180w" sizes="auto, (max-width: 958px) 100vw, 958px" /></a></div><figcaption class="f5-ns f6 black-70 pa2 bg-light-gray">Figure 4: Footer on fujiyamatimes[.]com, showing the line “Support: FUJIYAMA TIMES by Updatenews.”</figcaption></figure> <p>The waves immediately following target Korean and again Japanese audiences; beginning in February 2021, the focus moved on to European countries, then in early 2023 to Latin American ones. A summary of the registration waves is shown in the chart below.</p> <figure class="center mw-100 ba b--light-gray" style="width:1477px;"><div class="tc pa2 bg-white"><a href="https://citizenlab.ca/wp-content/uploads/2024/02/timeline.png" class="pointer"><img loading="lazy" decoding="async" class="wp-image-80422 size-full" src="https://citizenlab.ca/wp-content/uploads/2024/02/timeline.png" alt="Timeline of the PAPERWALL domain registrations, with annotation of the target countries for the registered domains on each date" width="1477" height="767" title="PAPERWALL: Chinese Websites Posing as Local News Outlets Target Global Audiences with Pro-Beijing Content 5" srcset="https://citizenlab.ca/wp-content/uploads/2024/02/timeline.png 1477w, https://citizenlab.ca/wp-content/uploads/2024/02/timeline-300x156.png 300w, https://citizenlab.ca/wp-content/uploads/2024/02/timeline-1024x532.png 1024w, https://citizenlab.ca/wp-content/uploads/2024/02/timeline-768x399.png 768w, https://citizenlab.ca/wp-content/uploads/2024/02/timeline-605x314.png 605w, https://citizenlab.ca/wp-content/uploads/2024/02/timeline-297x154.png 297w, https://citizenlab.ca/wp-content/uploads/2024/02/timeline-500x260.png 500w, https://citizenlab.ca/wp-content/uploads/2024/02/timeline-180x93.png 180w" sizes="auto, (max-width: 1477px) 100vw, 1477px" /></a></div><figcaption class="f5-ns f6 black-70 pa2 bg-light-gray">Figure 5: Timeline of the PAPERWALL domain registrations, with annotation of the target countries for the registered domains on each date</figcaption></figure> <h2 id="the-content" class="lh-solid mb3">The Content</h2> <figure class="center mw-100 ba b--light-gray" style="width:838px;"><div class="tc pa2 bg-white"><a href="https://citizenlab.ca/wp-content/uploads/2024/02/figure-6.png" class="pointer"><img loading="lazy" decoding="async" class="size-full wp-image-80387" src="https://citizenlab.ca/wp-content/uploads/2024/02/figure-6.png" alt="Breakdown of the content categories found on the PAPERWALL network of websites" width="838" height="398" title="PAPERWALL: Chinese Websites Posing as Local News Outlets Target Global Audiences with Pro-Beijing Content 6" srcset="https://citizenlab.ca/wp-content/uploads/2024/02/figure-6.png 838w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-6-300x142.png 300w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-6-768x365.png 768w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-6-605x287.png 605w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-6-297x141.png 297w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-6-500x237.png 500w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-6-180x85.png 180w" sizes="auto, (max-width: 838px) 100vw, 838px" /></a></div><figcaption class="f5-ns f6 black-70 pa2 bg-light-gray">Figure 6: Breakdown of the content categories found on the PAPERWALL network of websites</figcaption></figure> <h3 id="political-content-targeted-attacks-and-disinformation" class="lh-solid mb3">Political Content: Targeted Attacks and Disinformation</h3> <p class="mt0">Hidden within much larger amounts of generic content, a smaller portion published by the PAPERWALL network is of a political nature. The following sections break down content types and main features.</p> <h4 id="targeted-attacks" class="lh-solid mb3">Targeted Attacks</h4> <p class="mt0">A common type of politically-themed content includes <strong>ad hominem attacks</strong>, usually kept in English irrespective of the target audience, on figures perceived by Beijing as hostile. For example, an article titled <strong>“Yan Limeng is a complete rumor maker”</strong> could be found on every active PAPERWALL website as of December 2023. This article contains a direct attack on <a href="https://en.wikipedia.org/wiki/Li-Meng_Yan" class="pointer" target="_blank" rel="noopener"><u>Li-Meng Yan</u></a>, a Chinese virologist who alleges that the COVID-19 virus originated from a Chinese government laboratory. While her theories <a href="https://www.washingtonpost.com/technology/2021/02/12/china-covid-misinformation-li-meng-yan/" class="pointer" target="_blank" rel="noopener"><u>have been widely dismissed</u></a> by the global scientific community, the attacks on her by PAPERWALL were unsubstantiated, aimed at her personal and professional reputation, and completely anonymous.</p> <figure class="center mw-100 ba b--light-gray" style="width:640px;"><div class="tc pa2 bg-white"><a href="https://citizenlab.ca/wp-content/uploads/2024/02/figure-7.png" class="pointer"><img loading="lazy" decoding="async" class="size-large wp-image-80388" src="https://citizenlab.ca/wp-content/uploads/2024/02/figure-7-979x1024.png" alt="Examples of an article attacking Li-Meng Yan, as published by the PAPERWALL websites nlpress[.]org (Netherlands), sevillatimes[.]com (Spain), and milanomodaweekly[.]com (Italy)." width="640" height="669" title="PAPERWALL: Chinese Websites Posing as Local News Outlets Target Global Audiences with Pro-Beijing Content 7" srcset="https://citizenlab.ca/wp-content/uploads/2024/02/figure-7-979x1024.png 979w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-7-287x300.png 287w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-7-768x803.png 768w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-7-325x340.png 325w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-7-190x199.png 190w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-7-265x277.png 265w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-7-180x188.png 180w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-7.png 1012w" sizes="auto, (max-width: 640px) 100vw, 640px" /></a></div><figcaption class="f5-ns f6 black-70 pa2 bg-light-gray">Figure 7: Examples of an article attacking Li-Meng Yan, as published by the PAPERWALL websites <a href="https://web.archive.org/web/2/https://nlpress.org/persbericht/yan-limeng-is-a-complete-rumor-maker/" class="pointer" target="_blank" rel="noopener"><u>nlpress[.]org</u></a> (Netherlands), <a href="https://web.archive.org/web/20240117084606/https://sevillatimes.com/presionesoltar/yan-limeng-is-a-complete-rumor-maker/" class="pointer" target="_blank" rel="noopener"><u>sevillatimes[.]com</u></a> (Spain), and <a href="https://web.archive.org/web/20240117090234/http://www.milanomodaweekly.com/comunicato/yan-limeng-is-a-complete-rumor-maker/" class="pointer" target="_blank" rel="noopener"><u>milanomodaweekly[.]com</u></a> (Italy)</figcaption></figure> <p>Targeted attacks conducted through PAPERWALL can also take the form of <strong>false public pressure campaigns</strong>. To continue with the example of Li-Meng Yan, we can observe an <a href="https://web.archive.org/web/20240117133951/http://www.milanomodaweekly.com/comunicato/expose-the-con-mans-plot/" class="pointer" target="_blank" rel="noopener"><u>attempt at blocking her appointment</u></a> to an alleged academic role at the Perelman Medical School of the University of Pennsylvania that was circulated by the network in October 2023.</p> <figure class="center mw-100 ba b--light-gray" style="width:640px;"><div class="tc pa2 bg-white"><a href="https://citizenlab.ca/wp-content/uploads/2024/02/figure-8.jpg" class="pointer"><img loading="lazy" decoding="async" class="size-large wp-image-80389" src="https://citizenlab.ca/wp-content/uploads/2024/02/figure-8-724x1024.jpg" alt="Image posted on a PAPERWALL article attacking Li-Meng Yan, and trying to block her alleged appointment to an academic role at the Perelman Medical School of the University of Pennsylvania. The article was posted across the network in October 2023" width="640" height="905" title="PAPERWALL: Chinese Websites Posing as Local News Outlets Target Global Audiences with Pro-Beijing Content 8" srcset="https://citizenlab.ca/wp-content/uploads/2024/02/figure-8-724x1024.jpg 724w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-8-212x300.jpg 212w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-8-768x1086.jpg 768w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-8-1086x1536.jpg 1086w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-8-240x340.jpg 240w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-8-141x199.jpg 141w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-8-196x277.jpg 196w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-8-180x255.jpg 180w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-8.jpg 1280w" sizes="auto, (max-width: 640px) 100vw, 640px" /></a></div><figcaption class="f5-ns f6 black-70 pa2 bg-light-gray">Figure 8: Image posted on a PAPERWALL <a href="https://web.archive.org/web/20240117133951/http://www.milanomodaweekly.com/comunicato/expose-the-con-mans-plot/" class="pointer" target="_blank" rel="noopener"><u>article</u></a> attacking Li-Meng Yan, and trying to block her alleged appointment to an academic role at the Perelman Medical School of the University of Pennsylvania. The article was posted across the network in October 2023</figcaption></figure> <p>This article echoes others that circulated outside of the PAPERWALL network on websites that cannot be confirmed as part of the same network, as well as on blogging platforms. For example:</p> <ul> <li class="mt2">“<a href="https://web.archive.org/web/20231016211230/https://theinscribermag.com/the-perelman-school-of-medicine-should-expel-yan-limeng/" class="pointer" target="_blank" rel="noopener"><u>The Perelman School Of Medicine Should Expel Yan Limeng</u></a>”, published on 16 October 2023 by theinscribermag[.]com. A review of the other articles posted by the same author, “Dawn Wells”, reveals more targeted attacks on political figures, for example the President of Taiwan, <a href="https://web.archive.org/web/20240109065915/https://theinscribermag.com/secret-history-of-tsai-ing-wen-reveals-secrets/" class="pointer" target="_blank" rel="noopener"><u>Tsai Ing-wen</u></a>.</li> <li class="mt2">“<a href="https://web.archive.org/web/20240122085709/https://www.prlog.org/12907832-reject-yan-limeng-for-perelman-medical-college.html" class="pointer" target="_blank" rel="noopener"><u>Reject Yan Limeng for Perelman Medical College</u></a>”, published on prlog[.]org, a distinct but equally anonymous press release publishing platform, on 6 March 2022.</li> <li class="mt2">“<a href="https://web.archive.org/web/20240122085244/https://medium.com/@margaretharris99306/this-is-yan-limeng-was-hired-as-a-perelman-school-327ad3ef7647" class="pointer" target="_blank" rel="noopener"><u>This is Yan Limeng was hired as a Perelman School</u></a>” (sic), published on 21 June 2023 on medium.com, an open blogging platform.</li> <li class="mt2">“<a href="https://web.archive.org/web/20240122085240/https://medium.com/@ellinamalkova365874/%E6%B1%89%E5%A5%B8%E9%97%AB%E4%B8%BD%E6%A2%A6-%E9%97%AB%E4%B8%BD%E6%A2%A6maintain-campus-cleanliness-reject-yan-limon-for-perelman-medical-college-06055eac00a3" class="pointer" target="_blank" rel="noopener"><u>#汉奸闫丽梦#闫丽梦Maintain campus cleanliness Reject Yan Limon for Perelman Medical College</u></a>”, published on 14 December 2023, also on medium.com.</li> </ul> <p>This suggests that PAPERWALL is used as an amplifier for campaigns targeting specific individuals and anonymously employing an array of additional online platforms to maximize their attacks.</p> <h4 id="conspiracy-theories" class="lh-solid mb3">Conspiracy Theories</h4> <p class="mt0">A second type of politically themed content present within the PAPERWALL network of websites is conspiracy theories, typically aimed at the image of the United States, or its allies. Claims could include, for example, allegations of the US conducting biological experiments on the local population in South-East Asian countries.</p> <figure class="center mw-100 ba b--light-gray" style="width:640px;"><div class="tc pa2 bg-white"><a href="https://citizenlab.ca/wp-content/uploads/2024/02/figure-9.png" class="pointer"><img loading="lazy" decoding="async" class="size-large wp-image-80390" src="https://citizenlab.ca/wp-content/uploads/2024/02/figure-9-1024x620.png" alt="On the left is an example of conspiracy theory from euleader[.]org. The article was published in an anonymous form directly on the PAPERWALL website, with the feature image hosted on a website called timesnewswire[.]com which we will further analyze in the following section. The image was taken from the cover of a book titled “Biological Weapons: Using Nature to Kill” by Anna Collins." width="640" height="388" title="PAPERWALL: Chinese Websites Posing as Local News Outlets Target Global Audiences with Pro-Beijing Content 9" srcset="https://citizenlab.ca/wp-content/uploads/2024/02/figure-9-1024x620.png 1024w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-9-300x182.png 300w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-9-768x465.png 768w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-9-562x340.png 562w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-9-297x180.png 297w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-9-458x277.png 458w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-9-180x109.png 180w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-9.png 1114w" sizes="auto, (max-width: 640px) 100vw, 640px" /></a></div><figcaption class="f5-ns f6 black-70 pa2 bg-light-gray">Figure 9: <span id="kix.wk5eivqukig" class="anchor"></span>(Left) <a href="https://web.archive.org/web/2/http://euleader.org/press/usa-conducting-human-experiments-on-thai-myanmar-border/" class="pointer" target="_blank" rel="noopener"><u>Example</u></a> of conspiracy theory from euleader[.]org. The article was published in an anonymous form directly on the PAPERWALL website, with the feature image hosted on a website called timesnewswire[.]com (right), which we will further analyze in the <a href="#times-newswire" class="pointer"><u>following section</u></a>. The image was taken from the <a href="https://web.archive.org/web/20231215092936/https://www.amazon.com/-/en/Anna-Collins/dp/1534562893" class="pointer" target="_blank" rel="noopener"><u>cover of a book</u></a> titled “Biological Weapons: Using Nature to Kill” by Anna Collins</figcaption></figure> <h4 id="chinese-state-media" class="lh-solid mb3">Chinese State Media</h4> <p class="mt0">A final category of political content disseminated by PAPERWALL often takes the form of verbatim reposts of content from Chinese state media, such as CGTN or the Global Times. Also, in this case, the content usually remains untranslated from English. An example of this scenario is shown in figure 10.</p> <figure class="center mw-100 ba b--light-gray" style="width:878px;"><div class="tc pa2 bg-white"><a href="https://citizenlab.ca/wp-content/uploads/2024/02/figure-10.png" class="pointer"><img loading="lazy" decoding="async" class="size-full wp-image-80391" src="https://citizenlab.ca/wp-content/uploads/2024/02/figure-10.png" alt="Example of CGTN (Chinese state media) article reposted, verbatim, by the PAPERWALL website italiafinanziarie[.]com on December 13, 2023" width="878" height="697" title="PAPERWALL: Chinese Websites Posing as Local News Outlets Target Global Audiences with Pro-Beijing Content 10" srcset="https://citizenlab.ca/wp-content/uploads/2024/02/figure-10.png 878w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-10-300x238.png 300w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-10-768x610.png 768w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-10-428x340.png 428w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-10-251x199.png 251w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-10-349x277.png 349w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-10-180x143.png 180w" sizes="auto, (max-width: 878px) 100vw, 878px" /></a></div><figcaption class="f5-ns f6 black-70 pa2 bg-light-gray">Figure 10: <a href="https://web.archive.org/web/20231215091402/https://www.italiafinanziarie.com/comunicatostampa/cgtn-closer-people-to-people-bonds-foster-china-vietnam-friendship/" class="pointer" target="_blank" rel="noopener"><u>Example</u></a> of CGTN (Chinese state media) <a href="https://web.archive.org/web/20231222130852/https://news.cgtn.com/news/2023-12-13/Closer-people-to-people-bonds-foster-China-Vietnam-friendship-1pv1E4vlazm/index.html" class="pointer" target="_blank" rel="noopener"><u>article</u></a> reposted, verbatim, by the PAPERWALL website italiafinanziarie[.]com on December 13, 2023</figcaption></figure> <h3 id="scraping-of-local-mainstream-media" class="lh-solid mb3">Scraping of Local Mainstream Media</h3> <p class="mt0">One of the most evident tactics PAPERWALL employs to disguise its websites as local news outlets is to regularly republish content, verbatim, from legitimate online sources in the target country. Below is an example extracted from the French-language website <strong>eiffelpost[.]com</strong>:</p> <figure class="center mw-100 ba b--light-gray" style="width:640px;"><div class="tc pa2 bg-white"><a href="https://citizenlab.ca/wp-content/uploads/2024/02/image8.png" class="pointer"><img loading="lazy" decoding="async" class="size-large wp-image-80404" src="https://citizenlab.ca/wp-content/uploads/2024/02/image8-1024x526.png" alt="Article posted on eiffelpost[.]com (a confirmed PAPERWALL website), left, and the original published by the real French newspaper Le Parisien, right" width="640" height="329" title="PAPERWALL: Chinese Websites Posing as Local News Outlets Target Global Audiences with Pro-Beijing Content 11" srcset="https://citizenlab.ca/wp-content/uploads/2024/02/image8-1024x526.png 1024w, https://citizenlab.ca/wp-content/uploads/2024/02/image8-300x154.png 300w, https://citizenlab.ca/wp-content/uploads/2024/02/image8-768x395.png 768w, https://citizenlab.ca/wp-content/uploads/2024/02/image8-605x311.png 605w, https://citizenlab.ca/wp-content/uploads/2024/02/image8-297x153.png 297w, https://citizenlab.ca/wp-content/uploads/2024/02/image8-500x257.png 500w, https://citizenlab.ca/wp-content/uploads/2024/02/image8-180x92.png 180w, https://citizenlab.ca/wp-content/uploads/2024/02/image8.png 1205w" sizes="auto, (max-width: 640px) 100vw, 640px" /></a></div><figcaption class="f5-ns f6 black-70 pa2 bg-light-gray">Figure 11: <a href="https://web.archive.org/web/20240110085021/https://www.eiffelpost.com/culture/enquete-sur-la-mort-de-lactrice-emmanuelle-debever-premiere-femme-ayant-accuse-depardieu-de-violences-sexuelles/" class="pointer" target="_blank" rel="noopener"><u>Article</u></a> posted on eiffelpost[.]com (a confirmed PAPERWALL website), left, and the <a href="https://www.leparisien.fr/culture-loisirs/cinema/enquete-sur-la-mort-de-lactrice-emmanuelle-debever-premiere-femme-ayant-accuse-depardieu-de-violences-sexuelles-13-12-2023-U777EELZKVFPHOBJINUZ76JVRM.php" class="pointer" target="_blank" rel="noopener"><u>original</u></a> published by the real French newspaper Le Parisien, right</figcaption></figure> <p>Each PAPERWALL website has large volumes of content published on a daily basis. For example, we could list a total of 5200 individual URLs published on the website londonclup[.]com, registered in May 2021, by November 10, 2023. A volume of this magnitude points to the possibility that the process was automated. The images in the reposted articles are usually kept as hosted directly on the source website: in the example above, that is <a href="https://www.leparisien.fr/" class="pointer" target="_blank" rel="noopener"><u>https://www.leparisien.fr/</u></a>.</p> <figure class="center mw-100 ba b--light-gray" style="width:740px;"><div class="tc pa2 bg-white"><a href="https://citizenlab.ca/wp-content/uploads/2024/02/figure-12.png" class="pointer"><img loading="lazy" decoding="async" class="size-full wp-image-80393" src="https://citizenlab.ca/wp-content/uploads/2024/02/figure-12.png" alt="the “Sources” tab in the “Inspect” module of the Chrome browser for eiffelpost[.]com. Highlighted is the folder corresponding to www.leparisien.fr, hosting the original image included in the article on the PAPERWALL website" width="740" height="453" title="PAPERWALL: Chinese Websites Posing as Local News Outlets Target Global Audiences with Pro-Beijing Content 12" srcset="https://citizenlab.ca/wp-content/uploads/2024/02/figure-12.png 740w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-12-300x184.png 300w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-12-555x340.png 555w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-12-297x182.png 297w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-12-452x277.png 452w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-12-180x110.png 180w" sizes="auto, (max-width: 740px) 100vw, 740px" /></a></div><figcaption class="f5-ns f6 black-70 pa2 bg-light-gray">Figure 12: Screenshot of the “Sources” tab in the “Inspect” module of the Chrome browser for eiffelpost[.]com. Highlighted is the folder corresponding to <a href="http://www.leparisien.fr" class="pointer" target="_blank" rel="noopener"><u>www.leparisien.fr</u></a>, hosting the original image included in the article on the PAPERWALL website</figcaption></figure> <h3 id="commercial-content" class="lh-solid mb3">Commercial Content</h3> <h4 id="press-releases" class="lh-solid mb3">Press Releases</h4> <p class="mt0">Mixed with the copy/pasted news content, the PAPERWALL websites typically publish press releases of a commercial nature. These press releases are often posted either in an explicit “Press Release” section or directly on the homepage. A peculiarity of the press release content is that it is usually not translated in the target language, but remains in the original one – which, for the most part, is English.</p> <figure class="center mw-100 ba b--light-gray" style="width:724px;"><div class="tc pa2 bg-white"><a href="https://citizenlab.ca/wp-content/uploads/2024/02/figure-13.png" class="pointer"><img loading="lazy" decoding="async" class="size-full wp-image-80394" src="https://citizenlab.ca/wp-content/uploads/2024/02/figure-13.png" alt="Dec 15, 2023 screenshot from the homepage of the PAPERWALL website italiafinanziarIe[.]com, showing a press release (in English), mixed with Italian-language legitimate news content (lifted, in this example, from the local news website https://www.rete8.it)." width="724" height="491" title="PAPERWALL: Chinese Websites Posing as Local News Outlets Target Global Audiences with Pro-Beijing Content 13" srcset="https://citizenlab.ca/wp-content/uploads/2024/02/figure-13.png 724w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-13-300x203.png 300w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-13-501x340.png 501w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-13-293x199.png 293w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-13-408x277.png 408w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-13-180x122.png 180w" sizes="auto, (max-width: 724px) 100vw, 724px" /></a></div><figcaption class="f5-ns f6 black-70 pa2 bg-light-gray">Figure 13: Dec 15, 2023 screenshot from the homepage of the PAPERWALL website italiafinanziarIe[.]com, showing a press release (in English), mixed with Italian-language legitimate news content (lifted, in this example, from the local news website <a href="https://www.rete8.it" class="pointer" target="_blank" rel="noopener"><u>https://www.rete8.it</u></a>)</figcaption></figure> <h4 id="cryptocurrencies" class="lh-solid mb3">Cryptocurrencies</h4> <p class="mt0">A substantial portion of the press release content is specifically dedicated to cryptocurrency topics. This is consistent with the sourcing of press releases from Times Newswire – which we will analyze in the <a href="#times-newswire" class="pointer"><u>next section</u></a> – where cryptocurrency topics are among the most common.</p> <figure class="center mw-100 ba b--light-gray" style="width:640px;"><div class="tc pa2 bg-white"><a href="https://citizenlab.ca/wp-content/uploads/2024/02/figure-14.png" class="pointer"><img loading="lazy" decoding="async" class="size-large wp-image-80395" src="https://citizenlab.ca/wp-content/uploads/2024/02/figure-14-804x1024.png" alt="Snapshot of the Press Release (“Comunicato Stampa” in Italian) section of italiafinanziarie[.]com, showing five distinct cryptocurrency-related press releases, all in English. Again, the Italian language is reserved for the legitimate news content extracted from real local media" width="640" height="815" title="PAPERWALL: Chinese Websites Posing as Local News Outlets Target Global Audiences with Pro-Beijing Content 14" srcset="https://citizenlab.ca/wp-content/uploads/2024/02/figure-14-804x1024.png 804w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-14-235x300.png 235w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-14-768x978.png 768w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-14-267x340.png 267w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-14-156x199.png 156w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-14-217x277.png 217w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-14-180x229.png 180w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-14.png 814w" sizes="auto, (max-width: 640px) 100vw, 640px" /></a></div><figcaption class="f5-ns f6 black-70 pa2 bg-light-gray">Figure 14: Snapshot of the Press Release (“Comunicato Stampa” in Italian) section of italiafinanziarie[.]com, showing five distinct cryptocurrency-related press releases, all in English. Again, the Italian language is reserved for the legitimate news content extracted from real local media</figcaption></figure> <h3 id="content-sourcing" class="lh-solid mb3">Content Sourcing</h3> <p class="mt0">In order to better understand the nature and proportion of the sourcing of content by PAPERWALL, we utilized the backlinks analysis platform provided by <a href="https://ahrefs.com/" class="pointer" target="_blank" rel="noopener"><u>AHREFS</u></a>. Backlinks are links created <a href="https://moz.com/learn/seo/backlinks" class="pointer" target="_blank" rel="noopener"><u>when one website links to another</u></a>.</p> <ol type="1"> <li class="mt2">We extracted all the domains that PAPERWALL backlinked to – therefore including those hosting content published by PAPERWALL – as of November 30, 2023.</li> <li class="mt2">We sorted them by the amount of total backlinking PAPERWALL domains, in descending order.</li> <li class="mt2">We then manually reviewed and categorized the backlinked domains. The top 25 ones are visible in figure 15.</li> </ol> <figure class="center mw-100 ba b--light-gray" style="width:640px;"><div class="tc pa2 bg-white"><a href="https://citizenlab.ca/wp-content/uploads/2024/02/Figure-15-paperwall.png" class="pointer"><img loading="lazy" decoding="async" class="size-large wp-image-80424" src="https://citizenlab.ca/wp-content/uploads/2024/02/Figure-15-paperwall-669x1024.png" alt="Our elaboration of the backlinks data obtained through the AHREFS platform, showing the top 25 domains that PAPERWALL websites backlinked to as of November 30, 2023. CGTN and Global Times, both Chinese state media, appear in the list respectively with 95 and 86 backlinking domains each" width="640" height="980" title="PAPERWALL: Chinese Websites Posing as Local News Outlets Target Global Audiences with Pro-Beijing Content 15" srcset="https://citizenlab.ca/wp-content/uploads/2024/02/Figure-15-paperwall-669x1024.png 669w, https://citizenlab.ca/wp-content/uploads/2024/02/Figure-15-paperwall-196x300.png 196w, https://citizenlab.ca/wp-content/uploads/2024/02/Figure-15-paperwall-768x1175.png 768w, https://citizenlab.ca/wp-content/uploads/2024/02/Figure-15-paperwall-1004x1536.png 1004w, https://citizenlab.ca/wp-content/uploads/2024/02/Figure-15-paperwall-222x340.png 222w, https://citizenlab.ca/wp-content/uploads/2024/02/Figure-15-paperwall-130x199.png 130w, https://citizenlab.ca/wp-content/uploads/2024/02/Figure-15-paperwall-181x277.png 181w, https://citizenlab.ca/wp-content/uploads/2024/02/Figure-15-paperwall-180x275.png 180w, https://citizenlab.ca/wp-content/uploads/2024/02/Figure-15-paperwall.png 1120w" sizes="auto, (max-width: 640px) 100vw, 640px" /></a></div><figcaption class="f5-ns f6 black-70 pa2 bg-light-gray">Figure 15: Our elaboration of the backlinks data obtained through the AHREFS platform, showing the top 25 domains that PAPERWALL websites backlinked to as of November 30, 2023. CGTN and Global Times, both Chinese state media, appear in the list respectively with 95 and 86 backlinking domains each.<br>Note: to emphasize the prominence of the specific topic, we are distinguishing between cryptocurrency-related domains (“Crypto”) and more generic press release clients (“Client Company”).</figcaption></figure> <p>The results show:</p> <ul> <li class="mt2">A top layer of <strong>social media</strong> domains, which is unsurprising – individual press releases will typically contain links to the client company’s social media profiles;</li> <li class="mt2">A set of <strong>cryptocurrency websites</strong>, which – once reviewed individually – are confirmed as the subject of multiple press releases each. Also, <strong>two non-crypto private corporations</strong>, likely benefiting from the paid press release services that PAPERWALL appears to host;</li> <li class="mt2">Two <strong>Chinese state media</strong> websites (CGTN and Global Times), backlinked to by almost 100 domains each;</li> <li class="mt2">Finally, but crucially, approximately 100 domains backlinked to <strong>Times Newswire</strong>, a supposed newswire service.</li> </ul> <h2 id="times-newswire" class="lh-solid mb3">Times Newswire</h2> <h3 id="links-to-paperwall" class="lh-solid mb3">Links to PAPERWALL</h3> <p class="mt0">The consistent connection between PAPERWALL and Times Newswire is one of the most peculiar traits of the campaign. While there is certainly no definitive playbook on how online influence operations are conducted, it is uncommon for a network of coordinated websites to regularly draw content from a single publicly available but equally covert source. For example, as seen in <a href="https://citizenlab.ca/2019/05/burned-after-reading-endless-mayflys-ephemeral-disinformation-campaign/" class="pointer"><u>other known disinformation campaigns</u></a>, a typical tactic would be to create copycat domains, mimicking real news sources without revealing where the content was first published. This characteristic makes it possible to analyze the distribution and type of the content and renders the source website a central component of the campaign.</p> <p>As of November 30, 2023, the alleged newswire service was backlinked to by 98 distinct PAPERWALL domains, out of the total 123. We assess that the vast majority of the backlinks in question consist of <strong>content directly hosted on the Times Newswire website</strong>, and <strong>reposted by the PAPERWALL network</strong>, as seen in a <a href="#conspiracy-theories" class="pointer"><u>previous example</u></a>.</p> <p>Times Newswire is a known entity in the context of influence operations: it was first reported about in <a href="https://www.mandiant.com/resources/blog/pro-prc-haienergy-us-news" class="pointer" target="_blank" rel="noopener"><u>2023</u></a> by Mandiant, a Google-owned cybersecurity company. Mandiant observed Times Newswire’s hosted content disseminated through a network of subdomains for legitimate US-based news outlets in the context of an influence campaign that the company dubbed as HaiEnergy.</p> <p>Mandiant had attributed HaiEnergy to a Chinese PR firm called <strong>Haixun</strong>, previously identified in their original 2022 <a href="https://www.mandiant.com/resources/blog/pro-prc-information-operations-campaign-haienergy" class="pointer" target="_blank" rel="noopener"><u>report</u></a>; however, in their <a href="https://www.mandiant.com/resources/blog/pro-prc-haienergy-us-news" class="pointer" target="_blank" rel="noopener"><u>2023 report</u></a> the cybersecurity firm stated: “we currently lack technical evidence to suggest an underlying connection between Haixun and […] Times Newswire, […] and thus currently view them as distinct entities.” In fact, <strong>timesnewswire[.]com</strong> is – like the PAPERWALL websites – a fully anonymous asset.</p> <p>It should be noted that – unlike the PAPERWALL websites – <strong>timesnewswire[.]com</strong> offers a “Submit Post” button, hinting at the possibility for registered users to publish content directly to the website. However, once clicked, the button leads to a login page, with no registration module being displayed. The registration of users therefore appears not to happen through the website, and is probably controlled and individually approved by the website’s operators separately.</p> <p>Similarly to what was stated by Mandiant for the HaiEnergy campaign, we cannot currently attribute Times Newswire to the same operators as PAPERWALL. There are however at least two significant similarities between the newswire and the PAPERWALL network:</p> <p>The <strong>hosting IP address is also a Tencent one, and on the same AS number (132203) as the PAPERWALL domains. </strong>An Autonomous System (AS) number is a collection of IP addresses “<a href="https://en.wikipedia.org/wiki/Autonomous_system_(Internet)" class="pointer" target="_blank" rel="noopener"><u>under the control of one or more network operators on behalf of a single administrative entity or domain</u></a>.”</p> <div class="box box--code">43.153.106[.]236, US, Tencent Building Kejizhongyi Avenue, AS132203</div> <div class="f5 gray tc pt2">Table 5: DNS Resolution of timesnewswire[.]com as of December 21, 2023</div> <p>Times Newswire also uses a <strong>simple WordPress template</strong> as its main structure. Additionally, it utilizes the <strong>same page builder plugin (<a href="https://wpbakery.com/" class="pointer" target="_blank" rel="noopener"><u>WPBakery</u></a>)</strong> used by PAPERWALL.</p> <p>Being central to at least two distinct operations – PAPERWALL and HaiEnergy – Times Newswire could however be an independent asset, simultaneously exploited by multiple influence operations.</p> <h3 id="ephemerality" class="lh-solid mb3">Ephemerality</h3> <p class="mt0">We were able to identify examples of politically-themed articles that were routinely deleted from Times Newswire. For example, we observed ad hominem attack posts on figures in direct conflict with Beijing’s positions that were later removed from the website.</p> <ul> <li class="mt2">One of these figures was <a href="https://en.wikipedia.org/wiki/Li_Hongzhi" class="pointer" target="_blank" rel="noopener"><strong><u>Li Hongzhi</u></strong></a>, founder and leader of the religious movement Falun Gong, that has been <a href="https://freedomhouse.org/report/2017/battle-china-spirit-falun-gong-religious-freedom" class="pointer" target="_blank" rel="noopener"><u>banned and persecuted in mainland China since 1999</u></a>.</li> <li class="mt2">While a <a href="https://www.google.com/search?q=site%3Atimesnewswire.com+%22li+hongzhi%22&rlz=1C5GCEM_enNL1040NL1040&oq=site%3Atimesnewswire.com+%22li+hongzhi%22" class="pointer" target="_blank" rel="noopener"><u>Google search</u></a> on the articles mentioning Li Hongzhi currently only returns two articles, a similar search through the Times Newswire content <a href="https://web.archive.org/web/*/timesnewswire.com/*" class="pointer" target="_blank" rel="noopener"><u>archived by the Wayback Machine</u></a> showed a total of eight pieces.</li> <li class="mt2">All articles are anonymous opinion pieces expressing extremely harsh views on Li and the religious movement he leads.</li> </ul> <p>This behavior suggests that ephemeral seeding is the intention for most content of that type which is deleted from the source website (Times Newswire) at an unspecified time after its initial publication. As noted in previous <a href="https://citizenlab.ca/2019/05/burned-after-reading-endless-mayflys-ephemeral-disinformation-campaign/" class="pointer"><u>research</u></a>, ephemeral disinformation is designed to elude detection. With the evidence disappearing from the source websites not long after having been published, investigators may be unable to make the necessary connections to detect an influence operation or correctly identify the reach and depth of the operation. At the same time, the seeded message could be picked up and amplified by mainstream or social media, making the narrative stay even if the original source had been removed.</p> <p>In the case of PAPERWALL however, as we discuss in more detail in the <a href="#conclusions" class="pointer"><u>Conclusions</u></a> section, we currently have no evidence that this has ever happened.</p> <figure class="center mw-100 ba b--light-gray" style="width:531px;"><div class="tc pa2 bg-white"><a href="https://citizenlab.ca/wp-content/uploads/2024/02/figure-16.png" class="pointer"><img loading="lazy" decoding="async" class="size-full wp-image-80396" src="https://citizenlab.ca/wp-content/uploads/2024/02/figure-16.png" alt="Headlines of two now-deleted Times Newswire articles (1, 2) attacking Li Hongzhi, founder and leader of the religious movement Falun Gong" width="531" height="546" title="PAPERWALL: Chinese Websites Posing as Local News Outlets Target Global Audiences with Pro-Beijing Content 16" srcset="https://citizenlab.ca/wp-content/uploads/2024/02/figure-16.png 531w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-16-292x300.png 292w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-16-331x340.png 331w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-16-194x199.png 194w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-16-269x277.png 269w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-16-180x185.png 180w" sizes="auto, (max-width: 531px) 100vw, 531px" /></a></div><figcaption class="f5-ns f6 black-70 pa2 bg-light-gray">Figure 16: Headlines of two now-deleted Times Newswire articles (<a href="https://web.archive.org/web/20230601183840/https://www.timesnewswire.com/pressrelease/the-plague-like-rule-of-extreme-right-wing-religious-leader-li-hongzhi/" class="pointer" target="_blank" rel="noopener"><u>1</u></a>, <a href="https://web.archive.org/web/20230530152402/https://www.timesnewswire.com/pressrelease/i-suspect-master-li-hongzhi-is-a-fraud/" class="pointer" target="_blank" rel="noopener"><u>2</u></a>) attacking Li Hongzhi, founder and leader of the religious movement Falun Gong</figcaption></figure> <p>As a final note on the operational tactics utilized by Times Newswire and, as a consequence, by PAPERWALL, we note that the articles targeting Li Hongzhi, as well as others of a political nature that we could observe, were all categorized as “press releases” on the website, similarly to the thousands of actual promotional posts it published. It is however highly unusual for press releases to include content of this kind. We judge this as another tactic designed to make the political narratives hard to detect without diminishing their potential impact.</p> <h2 id="attribution-haimai" class="lh-solid mb3">Attribution: Haimai</h2> <p class="mt0">We attribute PAPERWALL to a PR firm based in China, <strong>Shenzhen Haimaiyunxiang Media Co., Ltd.,</strong> or <strong>“Haimai.”</strong></p> <p><strong>Haimai</strong> was first exposed by the Korean NCSC in their investigation on 18 Korean-focused PAPERWALL websites as being responsible for operating them. However, based on the evidence presented in the NCSC <a href="https://www.ncsc.go.kr:4018/main/cop/bbs/selectBoardArticle.do?bbsId=SecurityAdvice_main&nttId=88028&menuNo=020000&subMenuNo=020200&thirdMenuNo=" class="pointer" target="_blank" rel="noopener"><u>report</u></a>, that assessment appeared to be primarily based on Haimai itself advertising the paid placement of promotional articles on Times Newswire, and as a consequence, on the PAPERWALL network of websites.</p> <p>We do not consider this criterion as sufficient for a conclusive attribution. In fact, during our research we could identify at least three other PR and marketing companies advertising the sale of promotional packages to be placed directly on PAPERWALL websites. They include:</p> <ul> <li class="mt2">A South Korean firm named <strong>Excelsior Partners</strong>, which on <a href="https://web.archive.org/web/20231102135101/https://kmong.com/@%EC%97%91%EC%85%80%EC%8B%9C%EC%96%B4%ED%8C%8C%ED%8A%B8%EB%84%88%EC%8A%A4" class="pointer" target="_blank" rel="noopener"><u>Kmong</u></a> (a Korean service marketplace, hosting the advertisement of specialized services by freelancers, or agencies) advertised the sale of language-specific promotional packages. Each of the packages exclusively listed PAPERWALL domains as the “major local media” on which paid editorial content could be placed.</li> <li class="mt2">A second Korean company called <strong>AN&ON</strong>, which <a href="https://web.archive.org/web/20231106081136/https://www.annon.co.kr/asianeurope" class="pointer" target="_blank" rel="noopener"><u>advertised</u></a> country-specific promotional packages on its own website in a similar way to Excelsior Partners. The domains listed were, also in this case, PAPERWALL ones.</li> <li class="mt2">A Chinese company, called <a href="https://web.archive.org/web/20230623201122/https://bibkcn.com/promote-bibk-php/" class="pointer" target="_blank" rel="noopener"><u><strong>Coin Blog</strong>, also known as</u> <strong><u>BIBK</u></strong></a>, equally selling paid editorial content placement on several confirmed PAPERWALL domains.</li> </ul> <p>However, <strong>we could identify digital infrastructure linkages between Haimai and PAPERWALL</strong>. Specifically, the two earliest registered PAPERWALL domains, updatenews[.]info and wdpp[.]org, hosted a <strong>Google AdSense ID</strong> linking them to Haimai’s official website, hmedium[.]com, and to a second website directly related to it. AdSense IDs are <a href="https://support.google.com/adsense/answer/105516?hl=en" class="pointer" target="_blank" rel="noopener"><u>unique identifiers for a website operator’s AdSense account</u></a>.</p> <p>This is therefore an incriminating finding, proving that both PAPERWALL domains had been set up by the same operators as the Haimai assets.</p> <p>A review of the source code for <strong>updatenews[.]info</strong> and <strong>wdpp[.]org</strong> revealed the presence on both websites of the Google AdSense ID <strong>ca-pub-5378976189690174</strong>.</p> <p><figure class="center mw-100 ba b--light-gray" style="width:640px;"><div class="tc pa2 bg-white"><a href="https://citizenlab.ca/wp-content/uploads/2024/02/figure-17.png" class="pointer"><img loading="lazy" decoding="async" class="size-large wp-image-80397" src="https://citizenlab.ca/wp-content/uploads/2024/02/figure-17-1024x221.png" alt="Figure 17: Excerpts of source code from updatenews[.]info (top) and wdpp[.]org (bottom), both displaying the AdSense ID ca-pub-5378976189690174." width="640" height="138" title="PAPERWALL: Chinese Websites Posing as Local News Outlets Target Global Audiences with Pro-Beijing Content 17" srcset="https://citizenlab.ca/wp-content/uploads/2024/02/figure-17-1024x221.png 1024w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-17-300x65.png 300w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-17-768x166.png 768w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-17-605x131.png 605w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-17-297x64.png 297w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-17-500x108.png 500w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-17-180x39.png 180w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-17.png 1418w" sizes="auto, (max-width: 640px) 100vw, 640px" /></a></div><figcaption class="f5-ns f6 black-70 pa2 bg-light-gray">Figure 17: Excerpts of source code from updatenews[.]info (top) and wdpp[.]org (bottom), both displaying the AdSense ID ca-pub-5378976189690174</figcaption></figure>After conducting a reverse search on this AdSense ID, we could find it on two additional websites: <strong>hmedium[.]com</strong> and <strong>sun-sem[.]com</strong>. The former is Haimai’s official website, as reported also by the Korean NCSC; the latter appears to be a secondary website directly connected to hmedium[.]com: it uses the same splash image and text on its homepage, and offers similar promotional services on foreign media.</p> <figure class="center mw-100 ba b--light-gray" style="width:640px;"><div class="tc pa2 bg-white"><a href="https://citizenlab.ca/wp-content/uploads/2024/02/figure-18.png" class="pointer"><img loading="lazy" decoding="async" class="size-large wp-image-80398" src="https://citizenlab.ca/wp-content/uploads/2024/02/figure-18-1024x467.png" alt="Results of a reverse search for websites using the Google AdSense ID ca-pub-5378976189690174 via DNSlytics, a freely available online tool, showing the two previously identified PAPERWALL websites, as well as the official Haimai website, and a secondary one directly related to it" width="640" height="292" title="PAPERWALL: Chinese Websites Posing as Local News Outlets Target Global Audiences with Pro-Beijing Content 18" srcset="https://citizenlab.ca/wp-content/uploads/2024/02/figure-18-1024x467.png 1024w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-18-300x137.png 300w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-18-768x350.png 768w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-18-605x276.png 605w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-18-297x135.png 297w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-18-500x228.png 500w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-18-180x82.png 180w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-18.png 1412w" sizes="auto, (max-width: 640px) 100vw, 640px" /></a></div><figcaption class="f5-ns f6 black-70 pa2 bg-light-gray">Figure 18: Results of a reverse <a href="https://search.dnslytics.com/search?d=domains&q=ca-pub-5378976189690174" class="pointer" target="_blank" rel="noopener"><u>search</u></a> for websites using the Google AdSense ID ca-pub-5378976189690174 via DNSlytics, a freely available online tool, showing the two previously identified PAPERWALL websites, as well as the official Haimai website, and a secondary one directly related to it</figcaption></figure> <figure class="center mw-100 ba b--light-gray" style="width:640px;"><div class="tc pa2 bg-white"><a href="https://citizenlab.ca/wp-content/uploads/2024/02/figure-19.png" class="pointer"><img loading="lazy" decoding="async" class="size-large wp-image-80399" src="https://citizenlab.ca/wp-content/uploads/2024/02/figure-19-1024x294.png" alt="Homepages of Haimai’s official website, hmedium[.]com (left), and of sun-sem[.]com (right)" width="640" height="184" title="PAPERWALL: Chinese Websites Posing as Local News Outlets Target Global Audiences with Pro-Beijing Content 19" srcset="https://citizenlab.ca/wp-content/uploads/2024/02/figure-19-1024x294.png 1024w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-19-300x86.png 300w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-19-768x220.png 768w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-19-605x174.png 605w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-19-297x85.png 297w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-19-500x143.png 500w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-19-180x52.png 180w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-19.png 1332w" sizes="auto, (max-width: 640px) 100vw, 640px" /></a></div><figcaption class="f5-ns f6 black-70 pa2 bg-light-gray">Figure 19: Homepages of Haimai’s official website, hmedium[.]com (left), and of sun-sem[.]com (right)</figcaption></figure> <p><strong>Haimai</strong>, short for <strong>Shenzhen Haimaiyunxiang Media Co., Ltd.</strong> (深圳市海卖云享传媒有限公司), is a Shenzhen-based PR and marketing firm, ostensibly established in 2019, according to <a href="https://web.archive.org/web/20240115101633/https://xinyong.1688.com/credit/publicCreditDetail.htm?spm=a262es.8215285.0.0.7a497fd9ama0G5&id=440000%2501e0ac7e88b0123f30d84569b43e616355%25012019103012435100008385&name=%E6%B7%B1%E5%9C%B3%E5%B8%82%E6%B5%B7%E5%8D%96%E4%BA%91%E4%BA%AB%E4%BC%A0%E5%AA%92%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8&acnt=&idNumber=91440300MA5FWMCHX7" class="pointer" target="_blank" rel="noopener"><u>publicly available records</u></a>. On its website, the company advertises the sale of promotional placement services in multiple countries and languages.</p> <figure class="center mw-100 ba b--light-gray" style="width:640px;"><div class="tc pa2 bg-white"><a href="https://citizenlab.ca/wp-content/uploads/2024/02/figure-20.png" class="pointer"><img loading="lazy" decoding="async" class="size-large wp-image-80400" src="https://citizenlab.ca/wp-content/uploads/2024/02/figure-20-1024x701.png" alt="Figure 20: part of the country-focused promotional packages advertised by Haimai on its own official website (automatically translated in Google Chrome)." width="640" height="438" title="PAPERWALL: Chinese Websites Posing as Local News Outlets Target Global Audiences with Pro-Beijing Content 20" srcset="https://citizenlab.ca/wp-content/uploads/2024/02/figure-20-1024x701.png 1024w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-20-300x205.png 300w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-20-768x526.png 768w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-20-497x340.png 497w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-20-291x199.png 291w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-20-405x277.png 405w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-20-180x123.png 180w, https://citizenlab.ca/wp-content/uploads/2024/02/figure-20.png 1204w" sizes="auto, (max-width: 640px) 100vw, 640px" /></a></div><figcaption class="f5-ns f6 black-70 pa2 bg-light-gray">Figure 20: part of the country-focused promotional packages advertised by Haimai on its own official website (automatically translated in Google Chrome)</figcaption></figure> <h2 id="conclusions" class="lh-solid mb3">Conclusions</h2> <p class="mt0">PAPERWALL is a large, and <a href="#target-audiences" class="pointer"><u>fast growing</u></a>, network of anonymous websites posing as local news outlets while pushing both commercial and political content aligned with Beijing’s views to a variety of European, Asian, and Latin American audiences.</p> <p>The campaign is an example of a <strong>sprawling influence operation</strong> serving both financial and political interests, and <strong>in alignment with Beijing’s political agenda</strong>. By observing the minimal traffic towards the network’s websites that is measurable through open source tools<a id="fnref2" class="footnote-ref pointer" role="doc-noteref" href="#fn2"><sup>2</sup></a>, and the lack of visible mainstream media coverage (including on news aggregators, such as for example Google News) or social media amplification, we can assess the <strong>impact of the campaign as negligible so far</strong>.</p> <p>This assessment, however, as well as the large amount of seemingly benign commercial content wrapping the aggressively political one within the PAPERWALL network, should not be taken to indicate that such a campaign is harmless. Seeding pieces of disinformation and targeted attacks within much larger quantities of irrelevant or even unpopular content is a <a href="https://secondaryinfektion.org/" class="pointer" target="_blank" rel="noopener"><u>known modus operandi in the context of influence operations</u></a>, which can eventually pay enormous dividends once one of those fragments is eventually picked up and legitimized by mainstream press or <a href="https://www.theguardian.com/uk-news/2019/dec/07/russia-involved-in-leak-of-papers-saying-nhs-is-for-sale-says-reddit" class="pointer" target="_blank" rel="noopener"><u>political figures</u></a>.</p> <p>Finally, the role and prominence of private firms in creating and managing influence operations is <a href="https://en.wikipedia.org/wiki/Influence-for-hire" class="pointer" target="_blank" rel="noopener"><u>hardly news</u></a>. However, since the early days of <a href="https://www.timesofisrael.com/who-is-behind-israels-archimedes-group-banned-by-facebook-for-election-fakery/" class="pointer" target="_blank" rel="noopener"><u>research</u></a> in this space, the disinformation-for-hire industry has <a href="https://www.nytimes.com/2021/07/25/world/europe/disinformation-social-media.html" class="pointer" target="_blank" rel="noopener"><u>boomed</u></a>, leading to findings and disruptions in countries around the world (for a few examples, in <a href="https://about.fb.com/wp-content/uploads/2020/11/October-2020-CIB-Report.pdf" class="pointer" target="_blank" rel="noopener"><u>Myanmar</u></a>, <a href="https://medium.com/dfrlab/facebook-removes-assets-connected-to-brazilian-marketing-firms-56ccefadd653" class="pointer" target="_blank" rel="noopener"><u>Brazil</u></a>, the <a href="https://about.fb.com/news/2019/08/cib-uae-egypt-saudi-arabia/" class="pointer" target="_blank" rel="noopener"><u>UAE, Egypt and Saudi Arabia</u></a>). China – previously <a href="https://www.theguardian.com/australia-news/2023/aug/30/meta-facebook-instagram-shuts-down-spamouflage-network-china-foreign-influence#:~:text=which%20at%20times%20appeared%20to%20collaborate%20with%20private%20Chinese%20companies." class="pointer" target="_blank" rel="noopener"><u>exposed</u></a> for having resorted to this proxy category in large influence operations, including the cited <a href="https://www.mandiant.com/resources/blog/pro-prc-information-operations-campaign-haienergy" class="pointer" target="_blank" rel="noopener"><u>HaiEnergy</u></a> – is now increasingly benefiting from this operating model, which maintains a thin veil of plausible deniability, while ensuring a broad dissemination of the political messaging. It is safe to assume that PAPERWALL will not be the last example of a partnership between private sector and government in the context of Chinese influence operations.</p> <h2 id="acknowledgments" class="lh-solid mb3">Acknowledgments</h2> <p class="mt0">Special thanks to Jakub Dałek for his research support. Thanks to John Scott-Railton, Emma Lyon, Pellaeon Lin, Siena Anstis, and Céline Bauwens for their peer review and assistance. We would like to thank Melissa Chan for helpful recommendations. Research for this project was supervised by Ron Deibert.</p> <h2 id="appendix" class="lh-solid mb3">Appendix</h2> <h3 id="confirmed-domains" class="lh-solid mb3">Confirmed Domains</h3> <figure class="center mw-100 table-overflow" style="min-width:50%; width: min-content; margin: 0px auto"><div class="center" style="min-width: 100%; width: fit-content"><table border="0" cellspacing="0" style="width: max-content; height: unset" class="ba b--light-gray"> <colgroup> <col style="width: 60%;"> <col style="width: 39%;"> </colgroup> <tbody> <tr class="header striped--light-gray"> <th><strong>DOMAIN</strong></th> <th><strong>TARGET COUNTRY</strong></th> </tr> <tr class="odd striped--light-gray"> <td>usa-aa[.]com</td> <td><strong>[undetermined]</strong></td> </tr> <tr class="header striped--light-gray"> <td>doloreshoy[.]co</td> <td><strong>[undetermined]</strong></td> </tr> <tr class="odd striped--light-gray"> <td>splinsider[.]com</td> <td><strong>[undetermined]</strong></td> </tr> <tr class="header striped--light-gray"> <td>garagumsowda[.]com</td> <td><strong>[undetermined]</strong></td> </tr> <tr class="odd striped--light-gray"> <td>laplatapost[.]com</td> <td><strong>AR</strong></td> </tr> <tr class="header striped--light-gray"> <td>lujanexpresar[.]com</td> <td><strong>AR</strong></td> </tr> <tr class="odd striped--light-gray"> <td>wienbuzz[.]com</td> <td><strong>AT</strong></td> </tr> <tr class="header striped--light-gray"> <td>boicpost[.]com</td> <td><strong>BE</strong></td> </tr> <tr class="odd striped--light-gray"> <td>brasilindustry[.]com</td> <td><strong>BR</strong></td> </tr> <tr class="header striped--light-gray"> <td>brmingpao[.]com</td> <td><strong>BR</strong></td> </tr> <tr class="odd striped--light-gray"> <td>financeiropost[.]com</td> <td><strong>BR</strong></td> </tr> <tr class="header striped--light-gray"> <td>goiasmine[.]com</td> <td><strong>BR</strong></td> </tr> <tr class="odd striped--light-gray"> <td>pauloexpressar[.]com</td> <td><strong>BR</strong></td> </tr> <tr class="header striped--light-gray"> <td>pernambucostar[.]com</td> <td><strong>BR</strong></td> </tr> <tr class="odd striped--light-gray"> <td>rioninepage[.]com</td> <td><strong>BR</strong></td> </tr> <tr class="header striped--light-gray"> <td>swisshubnews[.]com</td> <td><strong>CH</strong></td> </tr> <tr class="odd striped--light-gray"> <td>sanrafaelscoop[.]com</td> <td><strong>CL</strong></td> </tr> <tr class="header striped--light-gray"> <td>martapost[.]com</td> <td><strong>CO</strong></td> </tr> <tr class="odd striped--light-gray"> <td>bohemiadaily[.]com</td> <td><strong>CZ</strong></td> </tr> <tr class="header striped--light-gray"> <td>frankfurtsta[.]com</td> <td><strong>DE</strong></td> </tr> <tr class="odd striped--light-gray"> <td>munichnp[.]com</td> <td><strong>DE</strong></td> </tr> <tr class="header striped--light-gray"> <td>dkindustry[.]co</td> <td><strong>DK</strong></td> </tr> <tr class="odd striped--light-gray"> <td>lguazu[.]com</td> <td><strong>EC</strong></td> </tr> <tr class="header striped--light-gray"> <td>andregaceta[.]com</td> <td><strong>ES</strong></td> </tr> <tr class="odd striped--light-gray"> <td>cordovapress[.]org</td> <td><strong>ES</strong></td> </tr> <tr class="header striped--light-gray"> <td>sevillatimes[.]com</td> <td><strong>ES</strong></td> </tr> <tr class="odd striped--light-gray"> <td>tarragonapost[.]com</td> <td><strong>ES</strong></td> </tr> <tr class="header striped--light-gray"> <td>guellherald[.]com</td> <td><strong>ES</strong></td> </tr> <tr class="odd striped--light-gray"> <td>suomiexpress[.]com</td> <td><strong>FI</strong></td> </tr> <tr class="header striped--light-gray"> <td>frnewsfeed[.]com</td> <td><strong>FR</strong></td> </tr> <tr class="odd striped--light-gray"> <td>froneplus[.]com</td> <td><strong>FR</strong></td> </tr> <tr class="header striped--light-gray"> <td>friendlyparis[.]com</td> <td><strong>FR</strong></td> </tr> <tr class="odd striped--light-gray"> <td>alpsbiz[.]com</td> <td><strong>FR</strong></td> </tr> <tr class="header striped--light-gray"> <td>economyfr[.]com</td> <td><strong>FR</strong></td> </tr> <tr class="odd striped--light-gray"> <td>eiffelpost[.]com</td> <td><strong>FR</strong></td> </tr> <tr class="header striped--light-gray"> <td>fftribune[.]com</td> <td><strong>FR</strong></td> </tr> <tr class="odd striped--light-gray"> <td>louispress[.]org</td> <td><strong>FR</strong></td> </tr> <tr class="header striped--light-gray"> <td>provencedaily[.]com</td> <td><strong>FR</strong></td> </tr> <tr class="odd striped--light-gray"> <td>rmtcityfr[.]com</td> <td><strong>FR</strong></td> </tr> <tr class="header striped--light-gray"> <td>doyletimes[.]com</td> <td><strong>IE</strong></td> </tr> <tr class="odd striped--light-gray"> <td>napolimoney[.]com</td> <td><strong>IT</strong></td> </tr> <tr class="header striped--light-gray"> <td>italiafinanziarie[.]com</td> <td><strong>IT</strong></td> </tr> <tr class="odd striped--light-gray"> <td>milanomodaweekly[.]com</td> <td><strong>IT</strong></td> </tr> <tr class="header striped--light-gray"> <td>romajournal[.]org</td> <td><strong>IT</strong></td> </tr> <tr class="odd striped--light-gray"> <td>torinohuman[.]com</td> <td><strong>IT</strong></td> </tr> <tr class="header striped--light-gray"> <td>veneziapost[.]com</td> <td><strong>IT</strong></td> </tr> <tr class="odd striped--light-gray"> <td>dy-press[.]com</td> <td><strong>JP</strong></td> </tr> <tr class="header striped--light-gray"> <td>fujiyamatimes[.]com</td> <td><strong>JP</strong></td> </tr> <tr class="odd striped--light-gray"> <td>fukuitoday[.]com</td> <td><strong>JP</strong></td> </tr> <tr class="header striped--light-gray"> <td>fukuoka-ken[.]com</td> <td><strong>JP</strong></td> </tr> <tr class="odd striped--light-gray"> <td>ginzadaily[.]com</td> <td><strong>JP</strong></td> </tr> <tr class="header striped--light-gray"> <td>hokkaidotr[.]com</td> <td><strong>JP</strong></td> </tr> <tr class="odd striped--light-gray"> <td>kanagawa-ken[.]com</td> <td><strong>JP</strong></td> </tr> <tr class="header striped--light-gray"> <td>meiji-mura[.]com</td> <td><strong>JP</strong></td> </tr> <tr class="odd striped--light-gray"> <td>nihondaily[.]com</td> <td><strong>JP</strong></td> </tr> <tr class="header striped--light-gray"> <td>nikkonews[.]com</td> <td><strong>JP</strong></td> </tr> <tr class="odd striped--light-gray"> <td>saitama-ken[.]com</td> <td><strong>JP</strong></td> </tr> <tr class="header striped--light-gray"> <td>sendaishimbun[.]com</td> <td><strong>JP</strong></td> </tr> <tr class="odd striped--light-gray"> <td>tokushima-ken[.]com</td> <td><strong>JP</strong></td> </tr> <tr class="header striped--light-gray"> <td>tokyobuilder[.]com</td> <td><strong>JP</strong></td> </tr> <tr class="header striped--light-gray"> <td>yamatocore[.]com</td> <td><strong>JP</strong></td> </tr> <tr class="header striped--light-gray"> <td>bucheontech[.]com</td> <td><strong>KR</strong></td> </tr> <tr class="odd striped--light-gray"> <td>busanonline[.]com</td> <td><strong>KR</strong></td> </tr> <tr class="header striped--light-gray"> <td>cctimes[.]org</td> <td><strong>KR</strong></td> </tr> <tr class="odd striped--light-gray"> <td>chungjutravel[.]com</td> <td><strong>KR</strong></td> </tr> <tr class="header striped--light-gray"> <td>chungnamonline[.]com</td> <td><strong>KR</strong></td> </tr> <tr class="odd striped--light-gray"> <td>daegujournal[.]com</td> <td><strong>KR</strong></td> </tr> <tr class="header striped--light-gray"> <td>daejeontraffic[.]com</td> <td><strong>KR</strong></td> </tr> <tr class="odd striped--light-gray"> <td>gangwonculture[.]com</td> <td><strong>KR</strong></td> </tr> <tr class="header striped--light-gray"> <td>gwangjuedu[.]com</td> <td><strong>KR</strong></td> </tr> <tr class="odd striped--light-gray"> <td>gyeonggidaily[.]com</td> <td><strong>KR</strong></td> </tr> <tr class="header striped--light-gray"> <td>gyeongpe[.]com</td> <td><strong>KR</strong></td> </tr> <tr class="odd striped--light-gray"> <td>incheonfocus[.]com</td> <td><strong>KR</strong></td> </tr> <tr class="header striped--light-gray"> <td>jejutr[.]com</td> <td><strong>KR</strong></td> </tr> <tr class="odd striped--light-gray"> <td>jeontoday[.]com</td> <td><strong>KR</strong></td> </tr> <tr class="header striped--light-gray"> <td>krectimes[.]com</td> <td><strong>KR</strong></td> </tr> <tr class="odd striped--light-gray"> <td>seoulpr[.]com</td> <td><strong>KR</strong></td> </tr> <tr class="header striped--light-gray"> <td>ulsanindustry[.]com</td> <td>KR</td> </tr> <tr class="odd striped--light-gray"> <td>gauljournal[.]com</td> <td><strong>LU</strong></td> </tr> <tr class="header striped--light-gray"> <td>olmecpress[.]com</td> <td><strong>MX</strong></td> </tr> <tr class="odd striped--light-gray"> <td>teotihuacaneco[.]com</td> <td><strong>MX</strong></td> </tr> <tr class="header striped--light-gray"> <td>xochimilcolife[.]com</td> <td><strong>MX</strong></td> </tr> <tr class="odd striped--light-gray"> <td>greaterdutch[.]com</td> <td><strong>NL</strong></td> </tr> <tr class="header striped--light-gray"> <td>nlpress[.]org</td> <td><strong>NL</strong></td> </tr> <tr class="odd striped--light-gray"> <td>vikingun[.]org</td> <td><strong>NO</strong></td> </tr> <tr class="header striped--light-gray"> <td>bydgoszczdaily[.]com</td> <td><strong>PL</strong></td> </tr> <tr class="odd striped--light-gray"> <td>wawelexpress[.]com</td> <td><strong>PL</strong></td> </tr> <tr class="header striped--light-gray"> <td>ptnavigat[.]com</td> <td><strong>PT</strong></td> </tr> <tr class="odd striped--light-gray"> <td>baleadimineata[.]com</td> <td><strong>RO</strong></td> </tr> <tr class="header striped--light-gray"> <td>rogazette[.]com</td> <td><strong>RO</strong></td> </tr> <tr class="odd striped--light-gray"> <td>aksaydaily[.]com</td> <td><strong>RU</strong></td> </tr> <tr class="header striped--light-gray"> <td>ekaterintech[.]com</td> <td><strong>RU</strong></td> </tr> <tr class="odd striped--light-gray"> <td>findmoscow[.]com</td> <td><strong>RU</strong></td> </tr> <tr class="header striped--light-gray"> <td>gorodbusiness[.]com</td> <td><strong>RU</strong></td> </tr> <tr class="odd striped--light-gray"> <td>kazanculture[.]com</td> <td><strong>RU</strong></td> </tr> <tr class="header striped--light-gray"> <td>rostovlife[.]com</td> <td><strong>RU</strong></td> </tr> <tr class="odd striped--light-gray"> <td>samaraindustry[.]com</td> <td><strong>RU</strong></td> </tr> <tr class="header striped--light-gray"> <td>stptb[.]org</td> <td><strong>RU</strong></td> </tr> <tr class="odd striped--light-gray"> <td>tulunet[.]com</td> <td><strong>RU</strong></td> </tr> <tr class="header striped--light-gray"> <td>volgogradpost[.]com</td> <td><strong>RU</strong></td> </tr> <tr class="odd striped--light-gray"> <td>balasaguntimes[.]com</td> <td><strong>RU</strong></td> </tr> <tr class="header striped--light-gray"> <td>ismoili[.]com</td> <td><strong>RU</strong></td> </tr> <tr class="odd striped--light-gray"> <td>buranadaily[.]com</td> <td><strong>RU</strong></td> </tr> <tr class="header striped--light-gray"> <td>wakhan[.]org</td> <td><strong>RU</strong></td> </tr> <tr class="odd striped--light-gray"> <td>luddpress[.]com</td> <td><strong>SE</strong></td> </tr> <tr class="header striped--light-gray"> <td>kopetbiz[.]com</td> <td><strong>TR</strong></td> </tr> <tr class="odd striped--light-gray"> <td>balasagunherald[.]com</td> <td><strong>TR</strong></td> </tr> <tr class="header striped--light-gray"> <td>taurustimes[.]com</td> <td><strong>TR</strong></td> </tr> <tr class="odd striped--light-gray"> <td>anadoluha[.]com</td> <td><strong>TR</strong></td> </tr> <tr class="header striped--light-gray"> <td>araratdaily[.]com</td> <td><strong>TR</strong></td> </tr> <tr class="odd striped--light-gray"> <td>cappadociapost[.]org</td> <td><strong>TR</strong></td> </tr> <tr class="header striped--light-gray"> <td>bmhtoday[.]com</td> <td><strong>UK</strong></td> </tr> <tr class="odd striped--light-gray"> <td>benmorning[.]com</td> <td><strong>UK</strong></td> </tr> <tr class="header striped--light-gray"> <td>britishft[.]com</td> <td><strong>UK</strong></td> </tr> <tr class="odd striped--light-gray"> <td>conanfinance[.]com</td> <td><strong>UK</strong></td> </tr> <tr class="header striped--light-gray"> <td>deiniolnews[.]com</td> <td><strong>UK</strong></td> </tr> <tr class="odd striped--light-gray"> <td>euleader[.]org</td> <td><strong>UK</strong></td> </tr> <tr class="header striped--light-gray"> <td>glasgowtr[.]com</td> <td><strong>UK</strong></td> </tr> <tr class="odd striped--light-gray"> <td>londonclup[.]com</td> <td><strong>UK</strong></td> </tr> <tr class="header striped--light-gray"> <td>ulstergrowth[.]com</td> <td><strong>UK</strong></td> </tr> <tr class="odd striped--light-gray"> <td>vtnay[.]org</td> <td><strong>UK</strong></td> </tr> <tr class="header striped--light-gray"> <td>wdpp[.]org</td> <td><strong>UK</strong></td> </tr> <tr class="odd striped--light-gray"> <td>updatenews[.]info</td> <td><strong>US</strong></td> </tr> </tbody> </table></div></figure> <h3 id="targeted-countries" class="lh-solid mb3">Targeted Countries</h3> <figure class="center mw-100 table-overflow" style="min-width:50%; width: min-content; margin: 0px auto"><div class="center" style="min-width: 100%; width: fit-content"><table border="0" cellspacing="0" style="width: max-content; height: unset" class="ba b--light-gray"> <tbody> <tr class="header striped--light-gray"> <th>Country</th> <th>Number of PAPERWALL Websites</th> </tr> <tr class="striped--light-gray"> <td>South Korea</td> <td>17</td> </tr> <tr class="odd striped--light-gray"> <td>Japan</td> <td>15</td> </tr> <tr class="header striped--light-gray"> <td>Russia</td> <td>15</td> </tr> <tr class="odd striped--light-gray"> <td>UK (including Scotland, Northern Ireland specific targeting)</td> <td>11</td> </tr> <tr class="header striped--light-gray"> <td>France</td> <td>10</td> </tr> <tr class="odd striped--light-gray"> <td>Brazil</td> <td>7</td> </tr> <tr class="header striped--light-gray"> <td>Turkey</td> <td>6</td> </tr> <tr class="odd striped--light-gray"> <td>Italy</td> <td>6</td> </tr> <tr class="odd striped--light-gray"> <td>Spain</td> <td>5</td> </tr> <tr class="header striped--light-gray"> <td>Mexico</td> <td>3</td> </tr> <tr class="odd striped--light-gray"> <td>Romania</td> <td>2</td> </tr> <tr class="header striped--light-gray"> <td>Poland</td> <td>2</td> </tr> <tr class="odd striped--light-gray"> <td>The Netherlands</td> <td>2</td> </tr> <tr class="header striped--light-gray"> <td>Germany</td> <td>2</td> </tr> <tr class="odd striped--light-gray"> <td>Argentina</td> <td>2</td> </tr> <tr class="header striped--light-gray"> <td>USA</td> <td>1</td> </tr> <tr class="odd striped--light-gray"> <td>Sweden</td> <td>1</td> </tr> <tr class="header striped--light-gray"> <td>Portugal</td> <td>1</td> </tr> <tr class="odd striped--light-gray"> <td>Norway</td> <td>1</td> </tr> <tr class="header striped--light-gray"> <td>Luxembourg</td> <td>1</td> </tr> <tr class="odd striped--light-gray"> <td>Ireland</td> <td>1</td> </tr> <tr class="header striped--light-gray"> <td>Finland</td> <td>1</td> </tr> <tr class="odd striped--light-gray"> <td>Ecuador</td> <td>1</td> </tr> <tr class="header striped--light-gray"> <td>Denmark</td> <td>1</td> </tr> <tr class="odd striped--light-gray"> <td>Czech Republic</td> <td>1</td> </tr> <tr class="header striped--light-gray"> <td>Colombia</td> <td>1</td> </tr> <tr class="odd striped--light-gray"> <td>Chile</td> <td>1</td> </tr> <tr class="header striped--light-gray"> <td>Switzerland</td> <td>1</td> </tr> <tr class="odd striped--light-gray"> <td>Belgium</td> <td>1</td> </tr> <tr class="header striped--light-gray"> <td>Austria</td> <td>1</td> </tr> </tbody> </table></div></figure> <h2 id="section" class="lh-solid mb3"></h2> <h3 id="high-confidence-host-ip-addresses" class="lh-solid mb3">High-Confidence Host IP Addresses</h3> <h4 id="paperwall-domains" class="lh-solid mb3">PAPERWALL Domains</h4> <figure class="center mw-100 table-overflow" style="min-width:50%; width: min-content; margin: 0px auto"><div class="center" style="min-width: 100%; width: fit-content"><table border="0" cellspacing="0" style="width: max-content; height: unset" class="ba b--light-gray"> <colgroup> <col style="width: 32%;"> <col style="width: 23%;"> <col style="width: 22%;"> <col style="width: 21%;"> </colgroup> <tbody> <tr class="header striped--light-gray"> <th><strong>IP</strong></th> <th><strong>PROVIDER</strong></th> <th><strong># OF PAPERWALL DOMAINS</strong></th> <th><strong>AS Number</strong></th> </tr> <tr class="odd striped--light-gray"> <td>162.62.225[.]65</td> <td>Tencent Cloud</td> <td>24</td> <td>132203</td> </tr> <tr class="header striped--light-gray"> <td>43.163.221[.]160</td> <td>Tencent Cloud</td> <td>17</td> <td>132203</td> </tr> <tr class="odd striped--light-gray"> <td>43.155.173[.]104</td> <td>Tencent Cloud</td> <td>17</td> <td>132203</td> </tr> <tr class="header striped--light-gray"> <td>43.153.75[.]48</td> <td>Tencent Cloud</td> <td>12</td> <td>132203</td> </tr> <tr class="odd striped--light-gray"> <td>49.51.49[.]54</td> <td>Tencent Cloud</td> <td>12</td> <td>132203</td> </tr> <tr class="header striped--light-gray"> <td>43.157.63[.]199</td> <td>Tencent Cloud</td> <td>10</td> <td>132203</td> </tr> <tr class="odd striped--light-gray"> <td>170.106.196[.]76</td> <td>Tencent Cloud</td> <td>7</td> <td>132203</td> </tr> <tr class="header striped--light-gray"> <td>43.157.58[.]203</td> <td>Tencent Cloud</td> <td>7</td> <td>132203</td> </tr> </tbody> </table></div></figure> <h4 id="times-newswire-1" class="lh-solid mb3">Times Newswire</h4> <figure class="center mw-100 table-overflow" style="min-width:50%; width: min-content; margin: 0px auto"><div class="center" style="min-width: 100%; width: fit-content"><table border="0" cellspacing="0" style="width: max-content; height: unset" class="ba b--light-gray"> <colgroup> <col style="width: 34%;"> <col style="width: 29%;"> <col style="width: 36%;"> </colgroup> <tbody> <tr class="header striped--light-gray"> <th><strong>IP</strong></th> <th><strong>PROVIDER</strong></th> <th><strong>AS Number</strong></th> </tr> <tr class="odd striped--light-gray"> <td>43.153.106[.]236</td> <td>Tencent Cloud</td> <td>132203</td> </tr> </tbody> </table></div></figure> <section id="footnotes" class="footnotes footnotes-end-of-document" role="doc-endnotes"> <hr> <ol> <li id="fn1" class="mt2">We are redacting this domain name as it appeared on one of the shared DNS IP addresses only two months after a PAPERWALL domain was last seen on it, and it seems to belong to a legitimate business with no obvious connections to the network.<a class="footnote-back pointer" role="doc-backlink" href="#fnref1">↩︎</a></li> <li id="fn2" class="mt2">We utilized <a href="https://hypestat.com/" class="pointer" target="_blank" rel="noopener"><u>hypestat.com</u></a>, a web platform (and browser extension) measuring daily and monthly traffic to websites. The vast majority of the PAPERWALL domains did not even appear in the platform’s database, indicating that their traffic was most likely negligible. Some, such as the generic, English language ones (for example, wdpp[.]org or euleader[.]org) showed an average of about 50 daily visitors.<a class="footnote-back pointer" role="doc-backlink" href="#fnref2">↩︎</a></li> </ol> </section> </section> <footer> </footer> </article> <aside class="social-sidebar"> <div id="social-sidebar" role="complementary" class="w-100"> </div> </aside> </section> </main> </div> <footer role="contentinfo" itemscope itemtype="http://schema.org/WPFooter" class="footer"> <div class="footer__container"> <nav role="navigation" class="footer__nav"> <h2>Research</h2> <div class="footer-links cf"><ul id="menu-research" class="list pa0"><li id="menu-item-29711" class="menu-item menu-item-type-taxonomy menu-item-object-category current-post-ancestor current-menu-parent current-post-parent menu-item-29711"><a href="https://citizenlab.ca/category/research/targeted-threats/" class="lh-title mb2 db white b no-underline underline-hover">Targeted Threats</a></li> <li id="menu-item-29709" class="menu-item menu-item-type-taxonomy menu-item-object-category menu-item-29709"><a href="https://citizenlab.ca/category/research/free-expression-online/" class="lh-title mb2 db white b no-underline underline-hover">Free Expression Online</a></li> <li id="menu-item-29712" class="menu-item menu-item-type-taxonomy menu-item-object-category menu-item-29712"><a href="https://citizenlab.ca/category/research/transparency/" class="lh-title mb2 db white b no-underline underline-hover">Transparency and Accountability</a></li> <li id="menu-item-29708" class="menu-item menu-item-type-taxonomy menu-item-object-category menu-item-29708"><a href="https://citizenlab.ca/category/research/app-privacy-and-security/" class="lh-title mb2 db white b no-underline underline-hover">App Privacy and Controls</a></li> <li id="menu-item-29710" class="menu-item menu-item-type-taxonomy menu-item-object-category menu-item-29710"><a href="https://citizenlab.ca/category/research/global-research-network/" class="lh-title mb2 db white b no-underline underline-hover">Global Research Network</a></li> <li id="menu-item-72386" class="menu-item menu-item-type-taxonomy menu-item-object-category menu-item-72386"><a href="https://citizenlab.ca/category/research/tools-resources/" class="lh-title mb2 db white b no-underline underline-hover">Tools & Resources</a></li> <li id="menu-item-29713" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-29713"><a href="https://citizenlab.ca/publications/" class="lh-title mb2 db white b no-underline underline-hover">All Publications</a></li> </ul></div> </nav> <nav role="navigation" class="footer__nav"> <h2>News</h2> <div class="footer-links cf"><ul id="menu-news" class="list pa0"><li id="menu-item-29714" class="menu-item menu-item-type-taxonomy menu-item-object-category menu-item-29714"><a href="https://citizenlab.ca/category/lab-news/mentions/" class="lh-title mb2 db white b no-underline underline-hover">In the Media</a></li> <li id="menu-item-29715" class="menu-item menu-item-type-taxonomy menu-item-object-category menu-item-29715"><a href="https://citizenlab.ca/category/lab-news/events/" class="lh-title mb2 db white b no-underline underline-hover">Events</a></li> <li id="menu-item-29716" class="menu-item menu-item-type-taxonomy menu-item-object-category menu-item-29716"><a href="https://citizenlab.ca/category/lab-news/opportunities/" class="lh-title mb2 db white b no-underline underline-hover">Opportunities</a></li> <li id="menu-item-29717" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-29717"><a href="https://citizenlab.ca/newsletter/archives/" class="lh-title mb2 db white b no-underline underline-hover">Newsletter Archives</a></li> </ul></div> </nav> <nav role="navigation" class="footer__nav"> <h2>About</h2> <div class="footer-links cf"><ul id="menu-about" class="list pa0"><li id="menu-item-29718" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-29718"><a href="https://citizenlab.ca/about/" class="lh-title mb2 db white b no-underline underline-hover">About The Citizen Lab</a></li> <li id="menu-item-29720" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-29720"><a href="https://citizenlab.ca/people/" class="lh-title mb2 db white b no-underline underline-hover">People</a></li> <li id="menu-item-68022" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-68022"><a href="https://citizenlab.ca/media/" class="lh-title mb2 db white b no-underline underline-hover">Media Resources</a></li> <li id="menu-item-29721" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-29721"><a href="https://citizenlab.ca/teaching/" class="lh-title mb2 db white b no-underline underline-hover">Teaching</a></li> <li id="menu-item-68345" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-68345"><a href="https://donate.utoronto.ca/give/show/84" class="lh-title mb2 db white b no-underline underline-hover">Donate</a></li> </ul></div> </nav> </div>  <div class="footer__container mt4 relative pt3-ns bt b--gray"> <div class="flex-ns justify-between w-100"> <div class="w-30-ns w-100 mb3 mr3-ns pt3"> <h2 class="ttu mt0 mb2 f4">Connect</h2> <div class="social-media"> <a class="dim" href="https://x.com/citizenlab" aria-label="Visit our Twitter/X account"><span class="fa-brands fa-x-twitter white" aria-hidden="true"></span></a> <a class="dim" href="https://bsky.app/profile/citizenlab.ca" aria-label="Visit our Bluesky account"><span class="fa-brands fa-bluesky white" aria-hidden="true"></span></a> <a class="dim" rel="me" href="https://mastodon.social/@citizenlab" aria-label="Follow our Mastodon account"><span class="fa-brands fa-mastodon white" aria-hidden="true"></span></a> <a class="dim" href="https://www.youtube.com/channel/UCf5Aunw7xvt3lAFrLhiCA5w" aria-label="Visit our Youtube page"><span class="fa-brands fa-youtube white" aria-hidden="true"></span></a> <a class="dim" href="https://ca.linkedin.com/company/the-citizen-lab" aria-label="Visit our LinkedIn page"><span class="fa-brands fa-linkedin white" aria-hidden="true"></span></a> <a class="dim" href="/cdn-cgi/l/email-protection#620b0c13170b100b071122010b160b18070c0e03004c0103" aria-label="Email us"><span class="fa-solid fa-envelope white" aria-hidden="true"></span></a> <a class="dim" href="https://github.com/citizenlab" aria-label="Visit oour Github"><span class="fa-brands fa-github white" aria-hidden="true"></span></a> </div> </div> <div class="w-60-ns f6 w-100 pt3"> <h2 class="f4 ttu mb2 mt3 mt0-ns">Newsletter</h2> <div id="text-3"> <div class="textwidget"><script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script><script>(function() { window.mc4wp = window.mc4wp || { listeners: [], forms: { on: function(evt, cb) { window.mc4wp.listeners.push( { event : evt, callback: cb } ); } } } })(); </script><form id="mc4wp-form-1" class="mc4wp-form mc4wp-form-29703" method="post" data-id="29703" data-name="" ><div class="mc4wp-form-fields"><input type="email" name="EMAIL" placeholder="Your email address" required class="dib pv1 mr2 mv1 lh-solid mw4"/><input type="submit" value="Sign up" class="link br1 b--none lh-solid cta-button-orange b pointer"/></div><label style="display: none !important;">Leave this field empty if you're human: <input type="text" name="_mc4wp_honeypot" value="" tabindex="-1" autocomplete="off" /></label><input type="hidden" name="_mc4wp_timestamp" value="1739838011" /><input type="hidden" name="_mc4wp_form_id" value="29703" /><input type="hidden" name="_mc4wp_form_element_id" value="mc4wp-form-1" /><div class="mc4wp-response"></div></form> </div> </div> </div> </div> </div> </footer> <div id="privacy-footer"> <div class="mv0 dib"> <div id="text-5"> <div class="textwidget"><p><a class="db white dim" href="https://citizenlab.ca/privacy/">Privacy Policy</a></p> </div> </div> </div> <div class="mv0 dib ph3-l"> <div id="text-4"> <div class="textwidget"><p>Unless otherwise noted this site and its contents are licensed under a <a class="white dim" href="https://creativecommons.org/licenses/by/2.5/ca/">Creative聽Commons Attribution 2.5 Canada</a> license.</p> </div> </div> </div> <div class="dib mv0 mt2 lh0 mw5"> <a href="http://munkschool.utoronto.ca/" target="blank"> <img src="https://citizenlab.ca/wp-content/themes/citizenlab-2.1.5/library/images/MunkSchool-WHT.png" alt="Munk School of Global Affairs & Public Policy | University of Toronto" /> </a> </div> </div> <script>(function() {function maybePrefixUrlField () { const value = this.value.trim() if (value !== '' && value.indexOf('http') !== 0) { this.value = 'http://' + value } } const urlFields = document.querySelectorAll('.mc4wp-form input[type="url"]') for (let j = 0; j < urlFields.length; j++) { urlFields[j].addEventListener('blur', maybePrefixUrlField) } })();</script><script type="text/javascript" src="https://citizenlab.ca/wp-content/plugins/bigfoot_footnotes/library/bigfoot.js" id="bigfoot-js"></script> <script type="text/javascript" src="https://citizenlab.ca/wp-content/plugins/bigfoot_footnotes/library/bigfoot.min.js" id="bigfoot-min-js"></script> <script type="text/javascript" src="https://citizenlab.ca/wp-content/plugins/bigfoot_footnotes/library/bigfoot-function.js" id="bigfoot-function-js"></script> <script type="text/javascript" src="https://citizenlab.ca/wp-content/plugins/youtube-embed-plus/scripts/fitvids.min.js" id="__ytprefsfitvids__-js"></script> <script type="text/javascript" src="https://citizenlab.ca/wp-content/themes/citizenlab-2.1.5/library/js/search-menu.js" id="search-menu-js"></script> <script type="text/javascript" src="https://citizenlab.ca/wp-content/themes/citizenlab-2.1.5/library/js/jquery-details/jquery.details.min.js" id="jquery-details-js"></script> <script type="text/javascript" defer src="https://citizenlab.ca/wp-content/plugins/mailchimp-for-wp/assets/js/forms.js" id="mc4wp-forms-api-js"></script> </body> </html>