For users of the nascent internet of the late-90s and early-2000s, it was a much simpler time. Text-based web design. Pixelated graphics. Dancing babies and hamsters. Remember those lame attempts by corporations to make website tie-ins to popular products or movies? (Space Jam, anyone?) Captured by the digital novelty of it all, you might have even made a first clunky website of your very own.
Well, many of those early websites have lived a long life in the first two decades of the digital age, but have evolved; others have stayed the same. Famously, the original site promoting the classic duo of Michael Jordan and Bugs Bunny is still going strong—an unchanged monument to mid-90s nostalgia that Rolling Stone once called “The Website that Wouldn’t Die.” But what of the early websites that lived a short, grainy life and did die, abandoned by their creators as associated businesses and products folded? While most of those early websites have been buried in the graveyard of digital history, purveyors of disinformation working to game search engine optimization have exhumed some of these sites, cleaned them up, and weaponized them. This appears to now include peddlers of Russian disinformation narratives, who have reanimated moldering sites as rudimentary propaganda platforms.
Simply put: welcome to the dawn of the era of zombie disinformation websites. While digital security and disinformation experts have focused on the proliferation of Russian bot and troll social media accounts in the aftermath of the Kremlin’s interference in the 2016 election, zombie disinformation websites have begun to lurk among the search results for legitimate media platforms on search engines. But with so many dubious disinformation sources floating around, what makes these sites uniquely concerning?
ADVERTISEMENT
The potential use and reach of the zombie sites could be a possible new front for those wanting to wage low-cost information warfare. Search engines return ranked keyword search results based on an array of site characteristics. While search engines like Google value recency and timeliness in their results, attributes like click-through rate, key word usage, backlinks, site domain and registration age all appear to count, too. Since it would take a significant amount of organic click traffic for these sites to be regularly boosted to appear among legitimate news sites, the fact that these sites already have years or decades of web presence in the bank means that they may be returned in searches more readily than new, home-grown disinformation sites. Although these platforms appear to only receive limited click traffic, the mere fact that their specious headlines appear next to legitimate headlines may already satisfy a common objective of disinformation peddlers: creating a veneer of debate among widely agreed-upon fact-based reporting (say, an election result). The cost of reviving an older domain with a history of attributes that would help boost search rankings might be lower than traditional influence operations that rely on bot and troll armies (or advanced algorithms) to push disinformation narratives into the mainstream.
So what might these zombie sites look like? Let’s consider a pair of domains: “micetimes.asia” and “robertwoodbrokers.com.” According to the Wayback Machine internet archive, micetimes started its life as far back as July 2014 as a Singapore-based business eNewspaper, where the ‘MICE’ in the URL stood for the industry of ‘Meeting,’ ‘Incentive,’ ‘Convention’, and ‘Exhibition.’ Micetimes in this form appears to have met an untimely death in late 2015, appeared briefly as a food blog in 2016, before reappearing in its current format in mid-2017. This time, the meaning of the acronym ‘MICE’ was discarded in favor of a logo of an actual mouse, with the site titling itself “The MiceTimes of Asia” claiming to offer “fresh and independent news and opinions from Singapore and Bangkok” with “widest news coverage and fastest delivery.” The offerings of the site stand in stark contrast to this self-description, however, instead offering a distinct mix of narratives – primarily stories featuring low quality, unintentionally comedic machine translations and articles that spark more questions than answers.
Nearly every story on the site is supposedly written by a single (apparently prolific) author named “paradox” who the site claims wrote the over 140,000 articles appearing on micetimes since its 2017 “founding.” One common story type is ‘reporting’ under columns titled “INCREDIBLE” or “The incident,” which generally consist of clickbait of shocking or apocryphal tales, often including animals engaged in some level of dubious hijinks or attacking humans. Several stories tell of alleged elephant attacks on humans, including the tragic story of “Amorn Morakot (Morakot Amorn)” (paradox apparently isn’t sure which) whose elephant killed him and attempted to hide his body. Others tell of a Vancouver-based “celebrity raven” who allegedly stole a knife from a crime scene after having allegedly stole the F6 key from a police laptop. (Both the elephant and raven stories, as it turns out, are convoluted retellings of true stories.)
While a few such stories might happen to have a mention of southeast Asia, the majority of stories deal with regions and topics the Kremlin might consider it’s “near abroad.” This includes a litany of alleged security incidents, often set in Eastern European nations with alarming headlines like “In Warsaw, a massive explosion” and including convoluted phrases like “it is noted that as a result of the incident, none of the engineers were not injured.” Still others have pushed anti-Western, Kremlin-friendly narratives on divisive issues like Gazprom’s Nord Stream 2 pipeline. On this topic, there are dozens of articles that appear to be machine translated from Russian, sometimes done so poorly that several words in the article appear to have failed software translation, instead appearing in the original Cyrillic. Others, like the articles with bellicose titles like “Superpower knocked his fist on the table relative to Nord Stream 2. The world shuddered,” and “About gas, there are two news: good and bad…” include figures and images whose text are entirely in Russian.
The story of robertwoodbrokers appears to follow a similar digital pathology, only with an even longer period between death and zombification. In this case, the Wayback Machine shows that the site originated in mid-2002, and was the web platform for “Robert Wood Brokers, Inc,” a real, U.S.-based business whose site at the time claimed that it provided services for the “real estate needs of people living in and moving to and from the metro Atlanta area.” The website was either abandoned or moved to another domain in late 2007, before remaining dormant for over a decade according to Wayback Machine. Then in 2018, the site was reanimated, and titled “RWB News – News of the World” with a similar distribution of automatically translated stories ranging from clickbait, to pieces with pro-Kremlin narratives like that titled “Five Matters In Russia Are Far Better Than In the United States.”
Both of these domains have come up near the top of web searches for a variety of European security topics, especially on energy and geopolitical issues involving Russia. There are many other domains that exhibit these similar traits: original text that has been apparently machine translated into the English language, no apparent human operator or reporter on the site, and appearing on domains that were created for entirely different purposes. Others appearing to exhibit these zombified characteristics include once legitimate web addresses for a Texas-based order of Catholic nuns, a German professional photography website, and Mumbai-based supplier of high-conductivity copper terminals. It’s unclear if these sites are in fact part of a coordinated network and who may be creating them to begin with, but their commonalities are striking, sometimes carrying identical articles across several of the domains.
Also concerning: these sites have been picked up from time-to-time by legitimate news outlets, creating the potential for their false narratives to be laundered into the legitimate news stream. For example, Ukraine’s Kyiv Post has linked to a few micetimes articles that appear to carry fairly ordinary reporting on Ukrainian pop culture, like this 2017 repost on a creative break a Ukrainian band was planning to take that year. Social media monitoring platform CrowdTangle also shows how articles from these sites have been spread by legitimate accounts. This includes micetimes articles shared on Facebook by the accounts of governments and organizations, including the Embassy of Finland in Singapore, the Slovenian Consulate in Southern Australia, and the Romanian-American Chamber of Commerce. While these were benign outcomes, where in each case the articles shared don’t appear to have been targeted disinformation pieces, the incident reveals the potential for broader impact should a disinformation narrative be accidentally amplified instead.
It remains to be seen how zombie disinformation websites might be used in the future, however the potential of using them in a coordinated action is troubling. Imagine if in an election season, instead of these sites sputtering out a wide mix of disparate stories in which they are only returned on certain keyword searches (as they are now), they instead were used as a swarm, all simultaneously pushing the same false story questioning the legitimacy of an election. Given their ability to game search engine results, they might clog news search results for certain keywords with so many similar false stories that it at least temporarily creates mass confusion. The range of situations for which such an attack could be used by an array of malign actors across the globe is broad, and the impact could be significant. It is therefore vital that the zombie phenomenon is included in digital disinformation monitoring studies so that we can better prepare in case they are one day unleashed as a tool of a broader influence campaign. Until then, unless your Space Jam-aged site is still going strong, you might want to check that your old homepage has not become the next disinformation walking dead.
