SINGAPORE: A Russia-linked inauthentic news site that was blocked by the Singapore government last year has resurfaced in a new guise, according to a local study.
Researchers from the S Rajaratnam School of International Studies (RSIS) found evidence that Asianews.io, which is accessible in Singapore as of Thursday (Jun 5), shares the same operator and similar content as blocked website Alamak.io.
"While Asianews.io's content does not appear hostile to Singapore, its creation and activation in the immediate aftermath of Alamak.io's deactivation raises many questions," RSIS senior fellow Benjamin Ang and associate research fellow Ms Dymples Leong said.
"There was no known response from the publishers of Alamak.io, but the MHA's (Ministry of Home Affairs') action seems to have prompted them to respond by rebranding rather than shutting down."
Alamak.io was one of 10 inauthentic sites set up by foreign actors that MHA and the Infocomm Media Development Authority (IMDA) announced on Oct 22, 2024 that they were blocking.
The authorities said at the time that those 10 sites could be used to mount hostile information campaigns in Singapore, although none had done so.
The RSIS researchers previously uncovered links between Alamak.io and 5plus1.ru, which is connected to 5+1 Media, a Russian communications agency.
They used open-source intelligence tools to establish the link between Alamak.io and Asianew.io.
Alamak.io and Asianew.io share the same internet protocol (IP) address, which a reverse IP search found is associated with 5plus1.ru. The country-code top-level domain ".ru" is for Russian entities.
Both sites also share the same identification number for Yandex Metrika, a web analytics service that tracks and reports online traffic.
The service is provided by Yandex, a Russian internet company that runs a widely used search engine.
Alamak.io was created on Mar 24, 2023 and masqueraded as a local site by using a colloquial expression in its domain name and carrying Singapore-related news.
It carried many articles that appeared to be AI-generated, as well as articles attributed to Russia's ambassador to Singapore.
Asianews.io was created a few days after the announcement that Alamak.io was being blocked.
"The oldest article on Asianews.io was dated Mar 30, 2023, even though the website was created only on Oct 25, 2024, a dead giveaway of its inauthenticity," said the RSIS duo.
On Asianews.io, they found articles by Russia's ambassador to Singapore that appear identical to those found on Alamak.io, such as a commentary on Russia-ASEAN cooperation.
But they observed that while Alamak.io positioned itself as a Singapore-focused news and lifestyle site, Asianews.io appeared to have pivoted to a focus on Southeast Asia.
CNA has asked MHA whether any action is being taken against Asianews.io.
Calling for vigilance, the RSIS researchers said the blocking of the 10 inauthentic sites last year appeared to have "stopped the people behind them from targeting Singapore directly".
However, the re-emergence of a blocked site in another guise shows that threat actors will continue to adapt to evade countermeasures, they said.
Continue reading...
Researchers from the S Rajaratnam School of International Studies (RSIS) found evidence that Asianews.io, which is accessible in Singapore as of Thursday (Jun 5), shares the same operator and similar content as blocked website Alamak.io.
"While Asianews.io's content does not appear hostile to Singapore, its creation and activation in the immediate aftermath of Alamak.io's deactivation raises many questions," RSIS senior fellow Benjamin Ang and associate research fellow Ms Dymples Leong said.
"There was no known response from the publishers of Alamak.io, but the MHA's (Ministry of Home Affairs') action seems to have prompted them to respond by rebranding rather than shutting down."
Alamak.io was one of 10 inauthentic sites set up by foreign actors that MHA and the Infocomm Media Development Authority (IMDA) announced on Oct 22, 2024 that they were blocking.
The authorities said at the time that those 10 sites could be used to mount hostile information campaigns in Singapore, although none had done so.
The RSIS researchers previously uncovered links between Alamak.io and 5plus1.ru, which is connected to 5+1 Media, a Russian communications agency.
They used open-source intelligence tools to establish the link between Alamak.io and Asianew.io.
Alamak.io and Asianew.io share the same internet protocol (IP) address, which a reverse IP search found is associated with 5plus1.ru. The country-code top-level domain ".ru" is for Russian entities.
Both sites also share the same identification number for Yandex Metrika, a web analytics service that tracks and reports online traffic.
The service is provided by Yandex, a Russian internet company that runs a widely used search engine.
Alamak.io was created on Mar 24, 2023 and masqueraded as a local site by using a colloquial expression in its domain name and carrying Singapore-related news.
It carried many articles that appeared to be AI-generated, as well as articles attributed to Russia's ambassador to Singapore.
Asianews.io was created a few days after the announcement that Alamak.io was being blocked.
"The oldest article on Asianews.io was dated Mar 30, 2023, even though the website was created only on Oct 25, 2024, a dead giveaway of its inauthenticity," said the RSIS duo.
On Asianews.io, they found articles by Russia's ambassador to Singapore that appear identical to those found on Alamak.io, such as a commentary on Russia-ASEAN cooperation.
But they observed that while Alamak.io positioned itself as a Singapore-focused news and lifestyle site, Asianews.io appeared to have pivoted to a focus on Southeast Asia.
CNA has asked MHA whether any action is being taken against Asianews.io.
Calling for vigilance, the RSIS researchers said the blocking of the 10 inauthentic sites last year appeared to have "stopped the people behind them from targeting Singapore directly".
However, the re-emergence of a blocked site in another guise shows that threat actors will continue to adapt to evade countermeasures, they said.
Continue reading...