SOFIA -- It only took a few minutes to set up my propaganda site, a virtual carbon copy of another site in Bulgarian that was already mixing tabloid news with pro-Russian headlines.
I was joining the so-called Mushroom Site Machine, a network of websites that malevolent actors use to spread misleading stories, disinformation, and propaganda.
Crucially, there's no need for recruits to have any ideological stake in what they're peddling. By using a cash-for-clicks model, small-time profit-seekers are enlisted in the spread of disinformation by setting up websites known as "mushrooms."
The Bulgarian-based content-sharing platform share4pay.com is greasing the wheels of the machine, according to a recent study by the Foundation for Humanitarian and Social Research Sofia (HSSF).
The platform promises hassle-free income from personal websites in return for replicating stories around the clock. Share4pay.com's statistics claim that it has a corps of more than 10,000 registered individuals for whom it has set up one or more sites to "monetize every minute of your free time."
Could it really be that easy?
For a day in February, thanks to share4pay.com, I found out.
Registration was quick and free. Within minutes, the site had been created and share4pay's employees were populating it with news and articles so that I could share them on social networks. "The more news and articles you share on Facebook groups, Facebook pages, your Facebook wall, forums, Twitter, Google+, the more money you will earn," the company promised.
Getting links to the websites to appear in as many locations as possible is crucial to making money, especially on Facebook, the most popular social media platform in Bulgaria.
On that, I was failing miserably. I deliberately chose headlines that were neither propaganda nor misinformation and posted fewer than 10 stories. But my attempts were ignored by the moderators of Facebook groups who were otherwise welcoming dubious content from sites like mine.
As a result, I was never offered any money in exchange for my "work." It turned out, I wasn't the only one. Dozens of other share4pay.com users had posted complaints on social networks and forums saying they had never received any compensation either. I wrote to several people who shared share4pay.com links and articles from group sites after tracking them down via CrowdTangle, a content-discovery tool that is currently being phased out over access and data-sharing issues.
One woman, Radka Georgieva, said she had registered for a share4pay.com site in April 2022 but had since walked away. "I got nothing," she said. "It was a scam."
One user bragged of earning 100-200 lev ($56-112) per month, but it was unclear whether that was from a real individual or simply part of an advertising scheme.
But with share4pay.com boasting of more than 10,000 users, surely someone was making money somewhere?
Changing The Topic
The HSSF identified nearly 94,000 social media posts between July and September 2023 that it said used "standard keywords" for pro-Russian topics. Those included "anti-Russia," "Russian world," and "Banderite," a reference to alleged supporters of the controversial World War II and postwar Ukrainian nationalist killed by a Soviet assassin in 1959.
Eighty percent of those posts, according to the report, were products of the Mushroom Site Machine, which was first detected in the months after Russia launched its full-scale invasion of Ukraine in February 2022.
Pro-Russian propaganda, however, wasn't the only focus of the machine.
Many of the websites shared content initially published by the Bulgarian tabloid Blitz. The paper's catchy headlines and focus on what some might call "yellow journalism" have made it one of the most popular news sources in the country. Blitz is also a favored outlet for the public statements of controversial lawmaker and magnate Delyan Peevski, a leader of the Movement for Rights and Freedoms party who has been sanctioned by the United States for "significant corruption." (RFE/RL reached out to Blitz for comment but has not yet received a response.)
The media watchdog Reporters Without Borders (RSF) once described Peevski as "the most notorious embodiment" of the "corruption and collusion between media, politicians, and oligarchs" in Bulgaria. And critics have accused Blitz, which is officially owned by one of its journalists, of hewing close to Peevski's political views and routinely attacking his opponents and supporting his allies.
By mid-2023, the Mushroom Site Machine was reproducing far fewer of the Moscow-inspired stories in what one of the authors of the HSSF report, Dimitar Vatsov, told RFE/RL was a "sharp change" that appeared to reflect other priorities. When it wasn't promoting stories on the Ukraine war, it was publishing positive articles about Peevski. "Over 200,000 articles in the last quarter recycled Peevski's name," Vatsov said.
The trend deepened fears among researchers that the amorphous array of hundreds or even thousands of mushroom sites could ultimately be weaponized to suit any agenda.
After Vatsov was quoted in interviews discussing the mushroom network and the rise of Peevski-related content, he told RFE/RL that he had been called in for questioning by the State Agency for National Security (DANS). "I'm waiting to see if it's a form of harassment or if they're going to do something real," Vatsov said.
A Long And Winding Digital Trail
By November 2023, Vatsov said, the Sensika tool had identified 370 sites that "run the same content…but at the moment it can be assumed that there are about 700."
Many of the cookie crumbs scattered throughout the registration and advertising processes suggested that even the higher figure is an extremely conservative estimate.
In a study of "suspicious Facebook assets" published in March, the Atlantic Council's DFRLab found heavy overlap between more than 100 Facebook pages, groups, and profiles piggybacking on the name "Dragon 24" -- NATO military exercises in Poland -- and a single individual on share4pay.com.
The link hints at a double-barrel effect whereby specific content is amplified by not only share4pay.com users seeking profits from sharing the articles but also by paid promotions on Facebook that push those same articles out to an even wider audience.
In many cases, there was an incontrovertible link between sites identified by DFRLab and other, newer ones running similar content. For example, the kabina.eu domain was registered via a Gmail address, Ralitsa.d******va81@gmail.com , which was also used to register eight other sites. Another frequently used e-mail address was katsarov.mir*****@gmail.com.
Miroslav Katsarov is one of the co-owners of AdRain, a Bulgarian online advertising platform that targets websites and audiences in the same way that, say, Google AdSense does.
Katsarov is also a co-owner and manager of a company called Index Info OOD, whose indexinifo.org extension was seen in an e-mail address used to register another domain that turned up in the DFRLab's research, themainline.bg. The Index Info's company website is no longer active, but an archived version includes a contact listed as Miroslav Katsarov. The same archived site displayed a portfolio of nine Index Info websites that, in turn, led to at least five others. Ultimately, the search returned over 40 websites, including another cluster of 10 sites with code pointing to AdRain.
Todor Galev from the Center for the Study of Democracy in Sofia, a public-policy think tank, has noted links such as shared code between many of the Mushroom Site Machine's websites and AdRain. Other clues include identical e-mails used in the registration of websites whose domains appeared to have been purchased by Miroslav Katsarov.
In Bulgaria's business registry, we found a phone contact for Katsarov, who initially responded by saying that "AdRain does not own or have any ownership [of] the listed sites [and] AdRain's business is limited to management only of advertising." Advertising management, he stressed, "is the only point of contact."
After RFE/RL provided him with a list of sites that appeared to have ties to him and a link to the DFRLab study, Katsarov denied having anything to do with them. Referring to one of the sites, he said, they "belong to different clients of AdRain."
He acknowledged that articles on some of the websites appeared to have been "copied en masse" from Blitz and other publications. "My personal opinion," Katsarov said, "is that these are sites that copy and paste information from larger sources and these machines etc. are fiction and don't correspond to reality."
