They look at first glance like ordinary news outlets serving up headlines from around the world. The hundreds of websites, seemingly unconnected to one another, come in six languages and purport to cover far-flung cities such as Paris, London and Chicago.
But beneath the surface, the sites have something in common: They host frothy stories about clients of a little-known reputation-management company that promises to remake the online images of its customers.
The network of fake news sites is one part of a complex apparatus the Spain-based firm Eliminalia uses to manipulate online information on behalf of a global roster of clients, an investigation by The Washington Post and other media partners found. The firm employs elaborate, deceptive tactics to remove or drown out unflattering news stories and other content, the investigation revealed. Eliminalia had close to 1,500 clients over six years, including businesses, minor celebrities, and suspected or convicted criminals.
The investigation, based on nearly 50,000 internal company records, shows that the firm made millions of dollars by selling these disinformation services. And it illuminates a shadowy corner of the online reputation-management industry - a sector that, at its extreme, relies on subterfuge to alter the digital landscape, experts said. The investigation also reveals how laws meant to protect intellectual property and privacy are being misused to distort online discourse, efforts that tech companies sometimes fail to detect.
Eliminalia's methods are laid bare in documents that were leaked to Forbidden Stories, a Paris-based journalism nonprofit organization that shared the records with The Post and more than two dozen other media partners for a project called "Story Killers." The records include emails, client names, partial contracts and other legal documents. More than 600 fake news websites were linked to Eliminalia by researchers at a Swedish nonprofit called Qurium that provides web hosting and digital security services to investigative journalists and human rights organizations.
Between 2015 and 2021, Eliminalia sent thousands of bogus copyright-infringement complaints to search engines and web hosting companies, falsely claiming that negative articles about its clients had previously been published elsewhere and stolen, and so should be removed or hidden, the company records show. The firm sent the legal notices under made-up company names, the examination found.
Eliminalia also tried to make embarrassing information about its clients harder to find by burying it under false, flattering stories.
Those stories, published on the network of fake news sites, are designed to show up prominently in internet searches of the clients' names, the review found.
To accomplish this, the firm exploited a glitch in the websites of dozens of U.S. government agencies and universities, including Stanford University, to make the fake news sites appear more legitimate to search engine algorithms, the review revealed.
"It's hugely significant that this stuff is happening," Adam Holland, a project manager at Harvard University's Berkman Klein Center for the Internet and Society, said after being told of The Post's findings. "This is information warfare."
Eliminalia and its founder, 30-year-old Diego "Dídac" Sánchez of Spain, did not respond to detailed questions for this story.
Lawyers representing Eliminalia said the company would not provide answers to the questions, in part because the inquiries concern "business secrecy or a request for information on customers about whom our client could not in any case answer."
Eliminalia's internal records show that it worked for clients in at least 50 countries, sometimes as a subcontractor for other reputation-management firms. Two-thirds of Eliminalia's clients were individuals and the rest were corporations.
Its U.S. clients included a popular reality-TV personality publicly accused of sexual misconduct and a California biotech entrepreneur who had been convicted of financial fraud and is now fighting charges he hired a hit man to kill a business associate. The leader of a major religious charity in Chicago that faced criticism over its executives' salaries also turned to Eliminalia, the records show.
Eliminalia did work for an Italian spyware company that had been fined for selling surveillance technology to Syria's autocratic regime, and for a Swiss bank that had drawn public scrutiny over Venezuelan clients who were suspected of money laundering. It also worked on behalf of a well-known traveling circus clown who had been convicted of sexually assaulting a 14-year-old girl in Switzerland.
- - -
The firm's Barcelona office is in a high-end building in the city's center, near the famed Las Ramblas boulevard. A woman who answered the door at the office in January, after The Post and partner news organizations began contacting Eliminalia's clients, told a reporter that the company had changed its name to iData Protection and that its new focus was data security. Three people were in the office. A person who answered the phone told a reporter that Sánchez was not in Barcelona.
Sánchez has said that Eliminalia grew out of his efforts to rewrite his own past.
Sánchez grew up poor and spent part of his childhood in a state-run children's home in Barcelona, shoplifting and taking little interest in school, he wrote in an autobiography.
When he was 12, he accused a local businessman of molesting him multiple times. The man was convicted of sexual abuse in a highly publicized trial and was imprisoned in 2007.
Years later, as a teenager, Sánchez publicly recanted his story, saying he had made it up. A panel of judges declined to overturn the conviction, however, citing additional evidence in the case, court records show.
Sánchez got news accounts of the abuse allegations removed from the internet, he wrote in the autobiography. He did not say how he did it, or what specifically was removed, but he wrote that he recognized a business opportunity.
In 2013, at age 20, Sánchez launched Eliminalia, offering a clean start to others with blemished histories.
"We erase your past," the tagline on its website pledges.
In his early 20s, Sánchez built a public image as a brash entrepreneur, starting a string of ventures that included a child surrogacy clinic and firms focused on marketing and finance. He frequently appeared in local media accounts, and he wrote his autobiography - called "Secret of Success: If I can be successful at 23, so can you" - at that very age, in 2016.
Sánchez also strengthened his ties with the family of the man he had once accused of abuse. He employed the man's son at the surrogacy business - and the man himself, after he was released from prison.
In the years after its creation, Eliminalia quickly expanded its footprint, with a hub in Kyiv, Ukraine, and offices in Miami; Milan; Manchester, England; Guayaquil, Ecuador; and a dozen other cities, according to its website.
The reputation-management industry grew in parallel, experts said. Although measuring the industry is difficult, dozens of firms with names such as Reputation Defense Network, Guaranteed Removals and Reputation Resolutions advertise online-content-removal services. Few provide details about their methods.
"There are ethical reputation-management companies that try to use methods that are entirely on the up and up," said Matt Cutts, formerly a top engineer at Google and administrator of the U.S. Digital Service, a unit of the executive branch that advises federal agencies on information technology. "It is also safe to say that there are many unethical companies."
Such companies are often called "black hat" firms because they use deceptive or legally dubious tactics. Cutts and other experts said they would put Eliminalia in that group.
"They are clearly using black-hat techniques," said Zach Edwards, a data privacy researcher who reviewed The Post's findings. "It's unethical and may even be illegal in some cases."
Eliminalia has been the subject of previous reporting, but the internal documents examined by The Post and its partners - including the Guardian, Le Monde and El País - provide the most comprehensive account of its tactics to date.
The documents include contracts with clients that define Eliminalia's services as making "unwanted content . . . disappear forever" or, alternatively, pushing it down to the "third page" of internet search results "so it is more difficult to find."
Most customers paid the company several thousand dollars, although three paid more than $200,000, the records show. The cost of targeting a single webpage was as little as 550 euros, or $590, according to a 2018 contract. The firm sought to remove hundreds of webpages for its highest-paying clients, records show.
Eliminalia reported combined revenue of just over 2.5 million euros, or roughly $2.7 million, in 2020 and 2021, according to public records it filed with the Spanish government.
The contracts do not spell out Eliminalia's techniques, and how much the firm tells its customers is unclear.
The Post examined three cases in detail that illustrate Eliminalia's methods.
- - -
In 2017, federal authorities in Argentina announced that they had unmasked an international crime ring. They alleged that the owner of an IT business with operations in Buenos Aires and Miami doubled as the leader of a major money-laundering and drug-trafficking operation for the infamous Sinaloa cartel in Mexico.
Stories about Hernán Gabriel Westmann flooded the web. The businessman's lawyers appealed the criminal charges in federal court in Argentina. Two years later, the court dismissed the charges, citing insufficient evidence, records show.
In March 2021, Westmann, who had a seaside condo in Sunny Isles, Fla., hired Eliminalia, according to internal records.
In an interview, Westmann said that he was "falsely charged" and that he "never had anything to do with narcotrafficking." He said he agreed to pay Eliminalia 15,000 euros, roughly equivalent to that amount in dollars, to remove the negative stories about him from the web.
When Eliminalia employees ran a Google search on Westmann's name on March 8, 2021, the top five results were about the criminal charges and mentioned money laundering, according to a screenshot of search results from the company's files.
Within months, a new crop of headlines prominently featuring Westmann's name began popping up on Spanish-language sites, all of them published by news outlets purportedly based in Ecuador.
The stories bordered on the farcical. They promoted Westmann as a commentator on a range of subjects - the traits of Chihuahuas, the rules of football and the tenets of philosophy.
"Despite its small size, the Chihuahua breed has a versatile personality, explains Hernan Gabriel Westmann," began one story on a site called La Prensa Ecuatoriana. The story and another featuring purported soccer commentary by Westmann were among the top results when The Post searched for Westmann's full name on Google in January.
Westmann acknowledged to The Post that the firm created "fake stories" about him in an effort to drown out the negative headlines, but he said Eliminalia did so without his permission. He provided The Post with an email he sent Sánchez last year saying he was withholding partial payment because Eliminalia had not removed all the fake stories.
Researchers from Qurium linked the 600 fake news websites to Eliminalia's parent company, Maidan Holding, according to Tord Lundstrom, Qurium's technical director. The websites' IP addresses - each a string of numbers identifying where a site is hosted - are clustered together sequentially, Lundstrom said, and registration data from the websites' hosting providers show that the IP addresses were assigned to Maidan.
The fake news sites contain real news copied from legitimate media organizations, and many have names that are similar to real outlets - the London New Times, CNNEWS Today and Le Monde France. But tucked amid those headlines are at least 3,800 articles that prominently feature the names of customers identified in the Eliminalia records, according to an analysis by the nonprofit Organized Crime and Corruption Reporting Project, a global investigative reporting group that partnered with Forbidden Stories and The Post.
The stories are similar in tone and substance: short and superficial essays that portray the clients - or someone with their exact name - as experts in the areas of sports, business, pets and other mundane topics. Many are optimized for search, featuring the name of the clients in the headlines.
"They realized if you have enough websites . . . and you flood the internet with these news articles talking about a person, Google very quickly will pick up this cluster of fake websites as a priority," Lundstrom said.
A Google spokesman said that the search engine has policies against using deceptive tactics to manipulate results and that automated systems aimed at detecting those tactics are constantly improving.
"While there are bad actors who attempt to manipulate search engine rankings, Google designs our systems to rank high quality information at the top of search results and to fight spam and malicious behavior," the spokesman wrote in a statement.
Eliminalia provided similar services to the Italian spyware company Area SpA, which in 2014 agreed to pay the U.S. Commerce Department $100,000 to settle charges it improperly sold U.S.-made spyware components to Syria. Fake news sites that are part of Eliminalia's network prominently feature the company's name in stories about the martial art sambo and a dance school.
In response to detailed questions, a lawyer for Area SpA said in a statement that the firm hired Eliminalia to remove content it believed was "not completely truthful and accurate." The statement did not cite specific stories.
Researchers at Qurium also uncovered an apparent effort to get the fake stories to rank higher in search results by making them appear to be promoted by legitimate websites, including those of U.S. government agencies and universities.
To retrieve and order search results, search engines rely on complex and closely held algorithms that are always evolving. One major factor in those algorithms is a website's perceived credibility, experts said. If search engines detect that trusted institutions such as universities and government agencies frequently refer to a website or direct traffic to it, the site is more likely to be prominent in search results, experts said.
The researchers at Qurium discovered that over 2 million links to the 600 fake news outlets were posted in a little-used student discussion forum on the website of a two-year college in Worcester, Mass. Although the web forum was meant for Black students at Quinsigamond Community College, anyone from the public could post there.
It's not clear who posted the links to the fake news sites. But experts said it appeared to be an attempt to trick search engine algorithms into interpreting the links as referrals from an academic institution.
The links had another feature that experts said appeared designed to make search engines give prominence to the fake news outlets. They were crafted to piggyback on the URLs of legitimate websites, including those of Stanford University, NASA and the Federal Highway Administration.
That was possible because of a security flaw within the websites of the reputable institutions that allows what is called an "open redirect," permitting anyone to modify an institution's URLs by adding characters to them so they automatically redirect users to other specified webpages.
After The Post contacted them, Stanford, NASA and the Federal Highway Administration fixed the vulnerabilities in their websites. Representatives of all three said the entities respond quickly to reports that their websites are being misused.
The Quinsigamond forum was closed to the public in October, and the posted links were removed, the college, known as QCC, said in a statement.
"It is incredibly disheartening that these online 'fake actors' can use reputable academic institutions such as QCC to help propagate misinformation," said QCC President Luis G. Pedraja. "This goes against the essence of higher education, which values open dialogue, honesty, truth, and knowledge."
A Post analysis also found that 48 of 86 stories about Westmann that Eliminalia's records show the firm targeted for removal are no longer available.
"I don't know how they did it," Westmann told The Post.
- - -
In October and November 2020, the company that owns WordPress, the popular publishing platform used by many bloggers, received legal notices purportedly sent by several obscure media companies. The companies claimed that their content had been republished without permission on the personal blog of a 71-year-old retiree in Maryland. They demanded that two of her blog posts be taken down.
In both posts, blogger Geri Ungurean had urged readers not to donate to a major Chicago charity, in part because its executives were collecting what she said were exorbitant salaries.
Although there was no way to tell from the notices, they were crafted by Eliminalia in a bid to remove stories critical of executives of the charity, the International Fellowship of Christians and Jews, or IFCJ, Eliminalia's internal records show.
Eliminalia had been hired that October and paid 6,000 euros, or about $6,400, to target stories about the charity's one-time president and chief executive, Rabbi Yechiel Eckstein, and his daughter, Yael Eckstein, who was also a top executive, the records show.
The IFCJ, which provides aid to impoverished Jews in Israel and other countries, raised more than $150 million in 2019 alone and paid the two executives a combined $4 million that year, its tax filings show. Rabbi Eckstein, identified in the internal records as Eliminalia's client, died that year, and his daughter assumed his leadership positions.
The IFCJ issued a statement after this story was published.
"The Fellowship has never engaged Eliminalia or any firm that engages in unethical practices, nor has its CEO Yael Eckstein," it said. "If there is a record of Rabbi Eckstein making such payment over five years ago, it was a personal decision made completely independent of The Fellowship. The Fellowship adheres to the highest ethical standards in all our work, which is supported by our continuing high marks as a trusted charity."
Ungurean's two blog posts, one from 2015 and the other from 2018, were both titled "Why Christians should Not Give Money to Rabbi Eckstein of IFCJ." The 2018 post showed up as the fifth result when an Eliminalia employee searched on Yahoo for the term "Yael Eckstein Salary" on Oct. 13, 2020, according to a screenshot of the results.
Copies of Eliminalia's takedown notices, as they are called, are included in the internal documents. One was filed on behalf of a purported company called State-Post LLC, and others on behalf of companies named for supposed bloggers - dougghall11 and Marinecas1999 LLC. They alleged Ungurean had copied their content.
But two of the websites cited as the original publishers were created the same month the notices were sent, a Post analysis found. Ungurean had written her posts years earlier.
And the media companies identified in the notices as the rightful copyright owners do not appear to exist in the states where they were said to be located, according to a search of incorporation records. The addresses Eliminalia supplied for those companies trace to Los Angeles City Hall, a noodle shop in Olathe, Kan., and a museum in New York City - entities with no apparent connection to the claims.
Ungurean learned about the effort from a Post reporter.
"I feel violated in a way," she said. "They tried to silence me and suppress the truth."
Such fraudulent copyright-infringement complaints are Eliminalia's go-to tactic for getting material removed from the web, according to the internal records.
The firm sent more than 2,000 similar legal notices to search engines and web hosting companies between 2015 and 2021, the review found. Eliminalia checked a box on the notices saying it had a "good-faith belief" that the targeted material was a copyright violation. On some, it checked an additional box swearing "under penalty of perjury" that the information in the notices was accurate.
In 2020, the firm filed bogus copyright claims targeting stories about the Swiss bank CBH Compagnie Bancaire Helvétique and possible money laundering involving a Russian oligarch and Venezuelan oil magnates, Eliminalia's records show.
Eliminalia was working as a subcontractor for another reputation-management firm called ReputationUP, a company with which CBH had signed a contract, according to the internal records. The CEO of ReputationUP, Andrea Baggio, said in a brief interview that his firm was collaborating with Eliminalia but terminated the relationship when he realized Eliminalia's business practices did not meet his firm's standards. He did not respond to subsequent inquiries.
CBH said in a statement through its attorney that it had hired ReputationUP and was not aware of, and did not authorize, any work Eliminalia may have done as a subcontractor. "CBH has never tolerated that any illegal actions be taken on its behalf by anyone," the attorney wrote. "If ReputationUp is found to have failed in its duties, CBH will react strongly to what would be an intolerable situation that it will firmly condemn."
European regulators in 2021 found the bank "in breach of obligations to combat money laundering" and required that it take steps to address the matter. CBH said in a statement at the time that it had already taken action to enhance its internal controls.
The copyright tactic exploits a 1998 U.S. law that was meant to protect intellectual property rights on the web. The Digital Millennium Copyright Act, or DMCA, requires online service providers, including web hosting companies and search engines, to provide the public with a way to notify them of allegedly stolen content. The online service providers then have to decide whether to remove the content after giving the alleged violators a chance to respond. But experts say the law provides a strong incentive for removal: It frees an online service provider of any liability in the event of a subsequent copyright infringement lawsuit.
The law has opened the door to an increasing number of bad-faith complaints, experts said.
"The scale of fraudulent notices is unknown, but it's huge and getting huger still," said Shreya Tewari, a research fellow at Harvard University's Berkman Klein Center who has studied fake DMCA complaints. The center collects DMCA complaints in a database called Lumen.
It is illegal to knowingly file a false DMCA complaint, but experts say it is difficult to catch the perpetrators if they shield their identities. And the potential repercussion - a fine covering the legal fees of anyone who proves the deception in court - is a weak deterrent, they say.
It's unclear how often Eliminalia's fake DMCA complaints worked, but the internal records include copies of webpages that are marked "eliminated" after the firm filed a DMCA complaint; The Post checked dozens of those pages and found that they no longer exist. Bogus DMCA complaints can be particularly effective with small news organizations, independent journalists and bloggers who may lack the resources to fight them, experts said.
After Ungurean learned from The Post about the DMCA complaints, she contacted WordPress's parent company, Automattic. The company told her it had suspected that the complaints were fraudulent and so did not act on them or alert her, according to emails she provided.
In a statement to The Post, Automattic declined to comment on any specific cases but acknowledged that "there's a lot of potential for abuse as a way to censor speech and legitimate criticism."
The company said it scrutinizes each copyright complaint it receives "in order to process valid infringement claims and to push back on those that we believe to be abusive." About 10 percent of the complaints the company receives are deemed not to be valid, it said.
Nevertheless, the 2015 blog post about IFCJ ended up being taken down. Automattic told Ungurean in emails she shared with The Post that its records showed that the blog post was deleted in January of last year by someone using her log-in credentials. Ungurean said she did not delete the post and believes that her account was hacked.
Automattic told Ungurean that it could not determine whether her account had been hacked because the company does not retain detailed data, such as the location of a log-in, after 30 days.
In mid-January, The Post ran a search for the term "Yael Eckstein Salary" on Yahoo, just as Eliminalia had done in 2020. No record of Ungurean's deleted blog post or the one from 2018 appeared in the first 100 results.
The top result was from a website called Global Banking & Finance Review that discloses that its articles are paid-for advertisements. The story - under the headline "Yael Eckstein: Salary, Spending and the Non-Profit Double Standard" - argues that charities' salaries should be similar to those of for-profit companies.
"At The Fellowship we have worked hard to foster a meritocracy where outstanding employees can be appropriately rewarded for their contribution to our organization's mission, while staying within reason of industry standards," Yael Eckstein is quoted as saying.
- - -
Eliminalia also sent bogus complaints attempting to exploit consumer privacy laws.
In January 2021, after facing sexual misconduct allegations, the reality-TV personality and former model Carter Oosterhouse hired Eliminalia, personally signing an agreement and paying the firm 3,000 euros, or about $3,200, according to the company records. Oosterhouse had gained fame as the star carpenter on HGTV's home improvement show "Trading Spaces."
Kailey Kaminsky, a former makeup artist for Oosterhouse, had publicly accused him in 2017 of repeatedly coercing her years earlier to perform oral sex. At the time, Oosterhouse denied any impropriety but acknowledged an "intimate relationship" that he said in a statement was "100% mutual and consensual."
On Jan. 21, 2021, Eliminalia's internal files show, the firm performed internet searches for the terms "Carter Oosterhouse oral sex," "Carter Oosterhouse sexual misconduct" and "Carter Oosterhouse accused." Ranking second in each of the searches was a story in the Hollywood Reporter, an entertainment publication. Its headline said Oosterhouse's wife, the actress Amy Smart, was defending him against the allegations. She was quoted as saying the allegations were "taking it too far and boundaries are being crossed."
Eliminalia targeted the story, documents show, sending an online service provider a legal notice identifying itself as the "Brussels EU Commission" and claiming that Oosterhouse's privacy rights had been violated. The notice was sent to the content-delivery company Cloudflare, and then forwarded to Amazon Web Services, the company that hosts the Hollywood Reporter website.
It cited a California privacy law intended to give consumers more control over the personal information that businesses collect about them - a law that is similar to privacy regulations in Europe. The notice demanded: "Complete removal or modification of the name and surname of: Carter Oosterhouse."
Eliminalia's internal records show it also sent a privacy complaint citing the same law, the California Consumer Privacy Act, to the parent company of the Hollywood Reporter, Penske Media Corp. It was signed by a "Tony Edison" in Brussels.
"I don't think this is what the law was intended to help with," Sarah Bruno, a privacy and entertainment media lawyer at the firm Reed Smith, said of using the privacy law to remove negative headlines.
Reached by phone, Oosterhouse, 46, declined to answer questions about Eliminalia or the allegations of sexual misconduct. "I try to put that in the rearview mirror," he said.
Kaminsky said in an interview that she was not surprised by the attempts to remove stories about her allegations. "I think it's deceitful, but at the end of the day, he knows what he did," she told The Post.
The Hollywood Reporter article about Smart defending her husband is no longer up.
Brooke Jaffe, a spokeswoman for Penske, said the article was not taken down in response to the privacy complaint but was "inaccessible due to a technical glitch."
When The Post did the same search Eliminalia did in 2021, the results included no record of the Hollywood Reporter article.
Amazon Web Services declined to comment. (The company is a subsidiary of Amazon, whose founder, Jeff Bezos, owns The Washington Post.)
Eliminalia filed privacy complaints under fake names on behalf of other people, including the California biotech entrepreneur and the traveling circus clown, the records show.
Serhat Gumrukcu, the California entrepreneur, hired Eliminalia in March 2021 to neutralize stories about his 2017 conviction on white-collar fraud charges, the records show. Gumrukcu has pleaded not guilty to the murder charges brought in May in the hit man case. His lawyer, David Kirby, declined to comment.
In 2019, Eliminalia worked to take down stories about David Larible, the Italian circus clown who was convicted of sexually assaulting a 14-year-old girl in Switzerland in 2017. He has publicly denied the allegations. Larible declined through his attorney to comment for this article.
- - -
Eliminalia has taken steps over the years to shroud its inner workings while projecting a virtuous image to the outside world.
In contracts with its clients, it not only promises to keep the firm's work confidential but also requires that customers maintain "confidentiality of the information provided and created" by the firm, according to internal records.
Eliminalia's employees must sign a nondisclosure agreement that threatens a penalty of 30,000 euros, roughly equivalent to $32,000, if they divulge the firm's secrets, according to a copy of a 2017 agreement provided by a former worker.
Meanwhile, the company's code of ethics, posted on its website, says employees embrace "honesty, care, diligence, professionalism, impartiality and integrity" and comply with all "laws, regulations and professional standards."
In his autobiography, Sánchez took a defiant tone against critics of the company.
"Eliminalia's activities have bothered a lot of people on the Internet," Sánchez wrote in Spanish, without offering specifics. "They believe we veto freedom of expression, that we censor. But they forget that the freedom of expression has a limit: truth."
"Not everything published in black and white is certain, and that's why the activities of companies like Eliminalia are necessary," he wrote.
- - -
The Washington Post's Diana Duran and Andrew Ba Tran contributed to this report.
- - -
"Story Killers" is a project led by Forbidden Stories, a Paris-based consortium of investigative journalists that pursues the work of assassinated and threatened reporters and editors worldwide. The investigation was inspired by the work of Gauri Lankesh, an editor fatally shot in 2017, a time when she was reporting on disinformation and political extremism in India. This project involved more than 100 journalists from 30 news organizations, including The Washington Post, the Guardian, Der Spiegel, Le Monde, Haaretz and El País.
Related Content
McClellan projected to become first Black woman to represent Virginia in Congress
Inside the collapse of the Trump-DeSantis 'alliance of convenience'
More states scrutinizing AP Black studies after Florida complaints