Graphika Finds Evidence of Anti-Falun Gong, Shen Yun Disinformation Linked to China

WASHINGTON— A new report by Graphika has uncovered a network of 43 domains and 37 subdomains used to push pro–Beijing messaging while posing as major Western media outlets, including the New York Times, The Guardian, The Wall Street Journal, United Nations News and others. Established in 2013, Graphika is an American social network analysis company known for tracking online disinformation. 

The report, “Glass Onion: Peeling Back the Layers of a Pro-China Online Ecosystem,” documents how Spamouflage—a Chinese government-aligned influence operation also known as “Taizi Flood” and “DRAGONBRIDGE”—amplified links to spoofed (or imitation) news sites that published articles targeting Falun Gong in what Graphika assesses as a coordinated effort to seed and spread disinformation on Western platforms. The report notes the spiritual group Falun Gong, Shen Yun, and Falun Gong’s founder, “Li Hongzhi (李洪志), are perennial targets of PRC-backed influence operations and transnational repression.”

Falun Gong, also known as Falun Dafa, is a peaceful spiritual practice rooted in Buddhist tradition that has been persecuted in China since 1999. In recent years, the Falun Dafa Information Center has documented how Beijing’s repression increasingly extends beyond China through propaganda, disinformation, and coordinated influence activity aimed at stigmatizing Falun Gong and undermining Shen Yun Performing Arts—a classical Chinese dance company founded and run by Falun Gong practitioners in the United States.

“This is not simply online disinformation. The campaign we see today is a blueprint for how a hostile influence operation run by Beijing can launder propaganda through fake ‘news’ brands and then use coordinated inauthentic accounts to push it into Western information ecosystems,” said Levi Browde, Executive Director of the Falun Dafa Information Center.

“When malign actors spoof trusted outlets and amplify smear narratives through coordinated networks, it destabilizes public trust and can help legitimize transnational repression. It can also help recruit unwitting allies in the West by inflaming sentiments based on false narratives to disparage Falun Gong and Shen Yun. This is literally how the CCP shapes the thoughts and feelings of Americans. Platforms, policymakers, and researchers should treat these findings as a clear warning sign, and a call to strengthen detection and accountability.”

Key findings from investigation

Graphika’s analysis began while monitoring Spamouflage-linked activity and identified 41 Spamouflage accounts repeatedly posting links to two articles hosted on alpeninsulatv[.]top and weeklytimesnet[.]com, both titled “Breaking News: Falun Gong’s Shen Yun Art Troupe Under Investigation by U.S. Government.” The report describes how these domains hosted mixed content, ranging from commercial promotions to pro-Beijing themes, while also serving as vehicles for anti–Falun Gong and anti–Shen Yun narratives.

Further analysis found that the same Falun Gong–targeting content appeared across an additional eight domains spoofing English-language media brands, including: globalviewlife[.]com, uaenewsnet[.]com, uswiredmagazine[.]com, worldnewstimesnet[.]com, ukguardiannet[.]com, newyorkdailynet[.]com, losangelestimesnet[.]com, and wallstreet-daily[.]com.

The spoofed sites also carried additional false claims, including assertions that Falun Gong practitioners’ deaths are tied to “pseudoscientific” beliefs discouraged medical care; that Falun Gong is “falling apart”; and that Shen Yun’s performances primarily advance “specific ideological agendas.” These are identical to unsubstantiated claims by Chinese government sources, including Chinese consulate websites.

In multiple cases, these spoofed domains were presented together as “reputable” overseas outlets, including a January 2025 article from a Chinese tea culture research institute that claimed “overseas official media” broadcast an interview and linked to multiple spoofed domains. The article included links to spoofed articles that denigrated Falun Gong.

Coordinated infrastructure since 2020

Graphika identified clusters of domains that mimic mainstream international outlets and found shared technical indicators, including overlapping IP addresses, registrant information, and Autonomous System Numbers (ASNs) tied to major Chinese technology companies and infrastructure.

For one set of spoofed mainstream media domains, Graphika observed multiple sites sharing the same IP address 47.254.83.83, with ASN 45102, assigned to Alibaba’s U.S. subsidiary, and registrant locations listed in Beijing, China. Several of these domains were created in a tight window on Dec. 15–16, 2020, with additional registrations in Sept. 2022. Fifty-eight domains, including spoofed websites of the New York Times, The Los Angeles Times, The Wall Street Journal, Wired, The Guardian, New York Daily, and UAE News, listed in the report were tied to Alibaba.

Furthermore, Graphika identified another connected network of country-themed “news” domains, such as canannews[.]com, linked through a shared IP address and ASN tied to Tencent. These domains were created around June 27–28, 2022. At least 99 domains that appear to be spoofing international news outlets, including the BBC, are hosted on this same IP address.

These findings match a 2025 Taiwanese Criminal Investigation Bureau (CIB) investigation, which found the source of multiple bomb threats targeting Shen Yun performances was the Huawei Research Institute in Xi’an, Shaanxi Province.

Content laundering and obfuscation

According to the report, underlying source code for the identified sites showed many images displayed on the spoofed “news” domains were not hosted on those domains, but instead were pulled from external content-hosting providers. This setup can make it harder to trace who is posting and managing the content and may indicate that multiple administrators had access to the broader network.

For the Spamouflage-amplified articles targeting Falun Gong and Shen Yun, Graphika found that images were hosted on a private Alibaba Cloud server in Hangzhou and assessed that this may have been an effort to obscure the origin of the content and related infrastructure. The use of Alibaba Cloud infrastructure does not, by itself, establish that Alibaba created the content or directed the influence operation, however.

Coordinated social media amplification

Graphika assessed with medium confidence that a set of 41 X accounts and three Facebook pages linked to Spamouflage coordinated to share links to the spoofed domains. Graphika notes these accounts displayed indicators consistent with inauthentic behavior, including randomly generated usernames, stock profile photos, minimal follower networks, and simultaneous posting of identical content, all while focusing on casting Falun Gong and Shen Yun in a negative light. In 2025, X took down thousands of bot accounts that were attacking Falun Gong.

Additionally, researchers noted that Mandiant (now Google Threat Intelligence Group) previously observed overlap between spoofed media domains and Spamouflage activity in the HaiEnergy campaign, and that these combined indicators suggest the anti–Falun Gong content was likely placed on behalf of a covert actor, possibly one aligned with Beijing.

“The Chinese Communist Party has spent decades demonizing Falun Gong with flagrant lies inside China,” Browde added. “What Graphika documents is how similar narratives can be repackaged for global audiences. These findings should concern anyone who cares about free speech, religious freedom, and the integrity of democratic information spaces.”

About the Falun Dafa Information Center

The Falun Dafa Information Center is a New York-based research and advocacy organization that documents the persecution of Falun Gong and transnational repression targeting practitioners. Since 2000, the Center has provided reporting, analysis, and briefings to policymakers, media, and civil society stakeholders to support accountability and the protection of freedom of religion or belief.

Media Contact:
Levi Browde, Executive Director
Falun Dafa Information Center
[email protected]