Technical Analysis Reveals Coordinated Network of Chinese-Language News Sites in Canada
Investigation finds common WordPress accounts, shared servers, and identical content distribution across Chinese-language news websites covering Canadian elections and local community affairs
Background
As a Chinese-speaking immigrant living in Canada, like many others, I often use Chinese keywords to search for news on Google. This is how I stumbled upon a series of Chinese-language websites that appear to be local Chinese news platforms. These sites are frequently updated and have strong ties to local Chinese communities and organizations, particularly those connected to Beijing. The news content on these websites generally supports Beijing’s perspective, presenting themselves as official news sources to the Chinese community in Canada, portraying an image of authoritative news providers in Chinese.
An initial investigation of backlinks and keyword analysis has discovered that around 200 websites, featuring similar content in Chinese and targeting a global audience, potentially share a common agenda. It’s important to note that this analysis report has not verified all ~200 websites, as our focus was only on a small subset of them.
Note: In February 2024, the Citizen Lab at the University of Toronto revealed that at least 123 websites, originating from the People’s Republic of China and masquerading as local news outlets in 30 countries across Europe, Asia, and Latin America, were spreading pro-Beijing disinformation and ad hominem attacks amidst a plethora of commercial press releases. This operation was named “Paperwall.” However, the Chinese websites discussed in our specific analysis are not part of the “Paperwall” campaign identified by the Citizen Lab. They are all Chinese-language publications and do not share any characteristics with the “Paperwall” websites. There is no clear evidence to suggest any connection between them.
An analysis of the infrastructure and content of a small subset of these websites has been performed below, focusing primarily on those targeting Canada, especially the Greater Toronto Area. We will explore how these websites have been used to influence the ideologies within the Chinese Canadian communities and affect the political landscape.
Key Findings
Widespread Network: The analysis identified over 200 potentially related websites actively publishing content that aligns with Beijing’s geopolitical interests. This analysis examined a small subset of these outlets. These outlets not only target local communities but also connect with global audiences, suggesting a coordinated effort to shape perceptions on a larger scale.
Centralized Control and Common Infrastructure: Evidence from technology stack analysis, such as shared WordPress themes and user accounts across multiple sites, suggests a centralized operational structure. This commonality points to a concerted effort to maintain and control the narrative dispersed through these channels.
Direct Ties to Pro-Beijing Organizations: Links have been established between these media outlets and organizations like CTCCO and Easyca.ca, which are known for their pro-Beijing stances. Such associations are indicative of an organized attempt to utilize community media as a tool for political influence and community manipulation.
Potential Impact on Local Elections and Community Relations: The content distributed by these outlets often focuses on promoting specific political figures and policies favorable to Beijing, which could influence voter perceptions and decisions in local Canadian elections.
A Network of Pro-Beijing News Websites Originating from Canada
An initial search uncovered the following websites, which represent just a subset of hundreds of similar sites. These were identified through connections such as backlinks, identical DNS infrastructure, site builders, user accounts, or WHOIS records.
CC.NEWS - ccmedia[.]news/国际艺术新闻网 -- International Arts News: Arts without Borders - www[.]artnewsnet[.]com/加拿大和世界报道 -- Canada & World Report - www[.]canadanewsreport[.]com/多伦多新闻网 -- 连接多伦多和世界 - www[.]torontonewsnet[.]com/纽约都市新闻网 -- 来自世界之都的深度报道 - www[.]newyorknewsnet[.]com/世界华文媒体-World Chinese Media -- 全球中文媒体之媒体 - www[.]worldchinesemedia[.]com/ChineseCanadianVoice[.]ca - www[.]chinesecanadianvoice[.]ca/国家电视新闻网 - www[.]ntvnewsnet[.]com/健康生活报道-健康、体育、生活新闻 -- Health Life Report - www[.]healthlifereport[.]com/美国西部新闻 -- 西部新闻尽收眼底 - www[.]uswestnews[.]com/环球华语新闻中心 - www[.]cgctv[.]com/
Mimicking Legitimacy: The Strategic Naming and Presentation of Pro-Beijing News Sites
An important aspect of the influence exerted by the network of pro-Beijing news sites in Canada is their strategic naming and presentation, which meticulously mimics the appearance of legitimate and authoritative news sources. This tactic is evidently designed to enhance credibility and trust among the target audiences, particularly within the Chinese Canadian community.
Packaging to Appear Authoritative
Another site, cntvcanada[.]com, styles itself as “加拿大国家电视台 (Canada National Television),” packaging itself in a manner that closely mirrors China’s state broadcaster, CCTV.
The 加拿大国家电视台 (Canada National Television) website
A Canada National TV news truck (Source: China Daily)
This nomenclature and styling are likely intended to confer upon it an unwarranted level of credibility akin to that of a national broadcaster, leveraging the formal tone and visual presentation typical of government-run entities.
The TV Station is operated by the entity “CANADA NATIONAL TV INC.”, according to the Ontario Business Registry.
Imitation of Established Media Names
Many of the websites in this network have adopted names that resonate with well-known media outlets, both in style and substance.
The “国家电视新闻网 (National TV News Network)” website
For example, “国家电视新闻网 (National TV News Network)” at ntvnewsnet[.]com, suggests an affiliation with national television, potentially leading visitors to believe it is a legitimate state or national news service.
Unauthorized Use of Official Symbols
The use of official symbols or logos without authorization is another tactic employed to gain unwarranted legitimacy.
torontonewsnet[.]com uses the City of Toronto’s logo as its “favicon”
For instance, torontonewsnet[.]com uses the City of Toronto’s logo as its “favicon” without authorization, a clear strategy to mislead readers into associating the site with Toronto’s official communications.
Linguistic and Cultural Resonance
The names often include terms like “global,” “international,” “national,” or direct references to major cities or regions (e.g., New York, Toronto, Western U.S.), which are designed to resonate with diaspora communities from those regions.
Technology Stack Analysis
WordPress Themes / Site Builders
The majority of these sites employ the ‘colormag’ theme, albeit with different version updates. This commonality could suggest a shared preference or guidance in their website design choices, potentially indicating a coordinated effort or common source of technical support.
Username Enumeration
We examined each site’s user accounts using a method known as user enumeration. The scan identified that a single account might be managing at least six WordPress sites, as indicated by the consistent use of usernames across these websites.
The presence of common usernames across multiple sites, particularly when these usernames are associated with editorial roles, significantly strengthens the argument for a shared operational structure.
For instance, the username Editor is linked to six different websites, suggesting that either a single individual or a group operating under this generic username has control over the content on these platforms. Similarly, the username jzwgq is associated with six sites, and jzz with three, indicating a pattern of recurring usernames across multiple platforms, which is less likely to be coincidental.
Note: The username admin is often chosen by system administrators for new WordPress installations and does not necessarily signify a connection between sites. However, Editor is not a default administrator username for WordPress.Dataframe: Most frequent usernames and associated websites
The Infrastructure
DNS Analysis
The examination of A records, nameservers, and TXT records for the listed websites offers valuable insights into their infrastructural connections and potential control dynamics.
Ａ Records
The A records reveal that several websites share the same IP address (162.241.240[.]199), suggesting they are hosted on the same server or within the same hosting environment. This commonality in hosting could indicate a centralized operational structure or shared administrative resources. However, the presence of unique IP addresses for other sites (66.96.162[.]139, 50.62.182[.]6, and 52.60.232[.]75) means these sites might be independently managed or hosted with different intentions or levels of control.
Nameservers
The nameservers provide further evidence of potential connections between the sites. Many of the websites use the same pair of nameservers (ns1.server-602265.lifeandwealthhosting[.]com and ns2.server-602265.lifeandwealthhosting[.]com), reinforcing the notion of a shared hosting or management environment.
TXT records
TXT records, particularly those specifying SPF (Sender Policy Framework) settings, highlight how these websites manage email sending and potentially share similar security or email handling policies. The inclusion of the same domain (websitewelcome[.]com) in several SPF records points to a shared approach to email management or a common service provider.
WHOIS Records Analysis
The WHOIS records analysis reveals intriguing details about the registration and administrative contacts of the domains.
Registrant Location: A significant number of the domains are registered in Ontario, Canada, with the registrant’s province listed as
ONorONTARIOand the country asCA(Canada). This geographic clustering suggests a centralized operation or a targeted strategy focused on the Canadian context, particularly relevant for those websites aimed at the Chinese Canadian community.Registrar Consistency: Many of the domains are registered through
ENOM, INC., a common registrar, which could indicate a preferencewith this particular service provider.Domain Creation and Expiration Dates: The dates when these domains were created and their expiration dates provide a timeline of the network’s development.
The Content
Sustained presence since 2016
We structurely retrieved all posts across all target websites. The analysis illustrates the number of posts per month across the network of websites starting from 2016, according to WHOIS data.
The graph shows an initial period of growth in posting frequency, with a particularly sharp peak around 2020. Despite the fluctuations, there is a sustained presence of activity, which suggests a consistent effort to maintain an active content feed over multiple years.
Proliferation of Repetitive Content Across the Network
One of the most interesting characteristics of the network of pro-Beijing news websites is their widespread use of identical articles across multiple platforms. This tactic not only amplifies the message but also suggests a coordinated approach to content distribution, designed to create an echo chamber effect. This analysis has identified several articles that have been repeatedly published across different sites, often verbatim. This pattern is indicative of a strategic dissemination aimed at maximizing reach and influence among Chinese-speaking audiences globally.
Framing the Hong Kong Protests
The examination of article titles from the network’s coverage of the Hong Kong protests provides a clear insight into the ideological tilt and narrative framing employed by these pro-Beijing news outlets operating within the Canadian Chinese community.
Relevant collection of articles from the “shadow network”:
The articles themselves are revealing, showcasing a strong alignment with Beijing’s rhetoric regarding Hong Kong’s political dynamics.
Political Mobilization in the Chinese Canadian Community
One striking example of how these pro-Beijing websites attempt to influence the voting behaviors of the Chinese Canadian community is evident across multiple sites.
Relevant collection of articles from the “shadow network”:
One particularly notable article from the network of pro-Beijing news websites targets the Chinese Canadian community’s political engagement in Canada. Published on “Canada News Report,” the article titled “积极助选投票，支持华裔候选人黄素梅竞选连任安省议员“ directly appeals to readers to support Su-Mei Huang, a Chinese Canadian incumbent running for re-election as an Ontario provincial legislator.
Su-Mei Huang is portrayed as a self-made politician who climbed the ranks from a nurse to a university professor and ultimately a provincial legislator, all without any political family background. The article highlights her dedication to vulnerable groups, healthcare, education, and public services, and outlines her achievements and future policy goals.
Media Influence in Toronto’s Mayoral Election: The Case of Xiaohua Gong
The 2023 Toronto mayoral race showcased an intriguing examination of media influence and strategy, particularly through the campaign of Xiaohua Gong, a Chinese-Canadian businessman with a controversial past. His campaign’s extensive use of both Chinese and English media platforms highlighted unique approaches to targeting diverse demographic segments within Toronto’s electorate.
Relevant collection of articles from the “shadow network”:
The network of pro-Beijing news outlets operating within Canada has shown a keen interest in the Toronto mayoral election, particularly in supporting the candidacy of Xiaohua Gong. The series of articles published across various platforms demonstrates a concerted effort to positively influence public perception of Gong within the Chinese Canadian community.
The “Shadow Network” and Its Ties to Local Pro-Beijing Organizations
This investigation into the network of pro-Beijing Chinese news outlets in Canada reveals a complex web of media influence and associations. Particularly notable is the strong connection these sites have with Easyca.ca, a prominent Chinese-language media company in Canada. Further scrutiny shows that Easyca.ca is closely tied to significant Chinese business and community organizations like the Canada Toronto Fuqing Business Association (加拿大多伦多福清商会) and the Confederation of Toronto Chinese Canadian Organizations (多伦多华人团体联合总会, CTCCO).
Read more:
Media Influence and Business Ties
Easyca.ca has established itself as a major player in the Chinese media landscape in Canada. However, it’s not just a media powerhouse; it also serves as a nexus connecting various elements of the Chinese community in Toronto, including business associations that have shown allegiance to Beijing.
Role of CTCCO in the Network
CTCCO’s frequent appearances in these outlets are particularly significant. As an organization, CTCCO has been known to foster close ties with Chinese consular offices and promote events and viewpoints that are strategically beneficial to China. The consistent coverage of CTCCO by the shadow network suggests a coordinated effort to bolster CTCCO’s credibility and influence among Chinese Canadians, which in turn supports Beijing’s diplomatic and cultural outreach initiatives.
Conclusion of the Investigation into Pro-Beijing Influence Operations in Canadian Chinese-Language Media
This report has unveiled a sophisticated network of Chinese-language news outlets operating in Canada, which appear to systematically propagate pro-Beijing narratives and potentially influence the Chinese Canadian communities, particularly within the Greater Toronto Area. The findings from this investigation highlight several key issues that pose concerns for both the integrity of local media landscapes and the broader democratic processes in Canada.
Final Word
As Canada navigates the complex landscape of global politics and local demographic changes, the importance of safeguarding the informational integrity and independence of its diverse communities cannot be overstated. This investigation into the shadow network of Chinese-language media serves as a critical call to action, urging all stakeholders---from government regulators to community leaders---to take decisive steps to protect the foundational principles of democracy and the diverse fabric of Canadian society.