Domains Clustered via Infrastructure Overlap Within the domains shared by the pages, two primary clusters of domains could be identified via shared infrastructure, analytics codes, and hosting providers. Other domains did not immediately share any tangible connection to these two groups (referred to below as Group A and Group B). Generally the domains used domain anonymization services for registration, and common hosting providers. Group A was the largest set of domains, centered around a small registration company and hosting provider; 31 domains were confirmed to be within this cluster. Seventeen of these domains shared the same IP address, and 14 used the same registrar. Group B consisted of 17 domains; these tended to use large scale hosting providers such as GoDaddy. These domains were shown to be linked via overlapping Google Analytics accounts. Top 10 domain shwewiki.com was in this cluster. Among the other domains, there were a few that shared some details with the Group clusters but at a low level of confidence. These multiple and distinct clusters support the hypothesis that multiple operators were responsible for the domains, instead of a single operator coordinating the effort. Topics The majority of the pages focused on celebrity-related news and, more recently, Covid-19-related content -- always with clickbait-style titles and imagery. More rarely, the pages mixed in pseudo-health content, as well as political, pro-Buddhist, pro-Government and pro-military links. Celebrities and Clickbait Content The pages posted a variety of content about local celebrities, covering life events such as disputes between celebrities staged on social media platforms or on TV. Overall, celebrity content was the most common type they shared: many of the pages featured “cele” or “celeb” in their names, indicating their primary focus. 21

Select target paragraph3