Disclaimer: This article was inspired by Judd Legum’s Popular Information article, “Senate Republicans Launch Network of Fake News Sites.” Read the original article. This article is not intended to advocate for or criticize any political party, organization, or viewpoint. It uses the case solely for educational purposes to demonstrate investigative methodologies for identifying, validating, and mapping connections between websites and their broader networks.
In the original article, Judd Legum identified six U.S.-based website domains that appeared to present themselves as independent news or media outlets ahead of the November midterm elections. The report highlighted the following six domains:
- ohiopulse.org
- thealaskanavigator.com
- peachstatepost.com
- mainepolicyupdates.com
- theiowavoice.com
- newhampshiredaily.org
In this blog post, building on Judd Legum’s findings, we’ll investigate additional websites connected to the six domains he identified. Using various open-source intelligence (OSINT) methods, we’ll trace connections through website source code and examine publicly available information in the Google Ads Transparency Center.
Our first step is to examine website tracking codes to identify other potentially connected websites. Tracking codes are, in simple terms, unique strings embedded in a webpage’s source code. They are typically added to help website owners or marketing teams measure traffic, manage analytics, track content performance, or connect a site to third-party services. There are many different types, depending on the analytics, advertising, or website management tools being used.
For this investigation, we will focus on one of the most common: the Google Tag ID. A Google Tag ID connects a website to Google services such as Google Analytics and Google Ads, allowing website operators to collect data and manage measurement across one or multiple domains.
From an OSINT perspective, these identifiers can also provide useful hints about relationships between websites. If the same Google Tag ID appears across multiple domains, it may indicate that the websites share a common administrator, analytics account, digital infrastructure, or organization behind them. However, a shared tracking ID is not definitive proof of common ownership. It should be treated as an investigative lead and verified with other evidence, such as domain records, hosting infrastructure, or source-code similarities.
Now, let’s begin!
We examined the source-code tags across the six previously identified domains in Maltego Graph (Desktop). Using BuiltWith Transforms, we uncovered seven additional domains linked to One Nation, an organization that describes itself as a “501(c)(4) issue advocacy organization dedicated to promoting commonsense conservative policies.”
The seven new domains are:
- 40yearsisenough.com
- thenorthcarolinian.org
- meetjoshturek.com
- meettroyjackson.com*
- onenationamerica.org
- grahamplatner.org*
- slfsites.com
*Both meettroyjackson.com and grahamplatner.org are now password-protected.
However, the website’s content, essentially a negative campaign ad, remains visible in the source code.
Source code from meettroyjackson.com showing the website’s content.
Source code from grahamplatner.org showing the website’s content.The website is still accessible through the Wayback Machine.
Another website we identified, meetjoshturek.com, is still live. Like the other two sites, it features the same disclaimer: “Paid for by SLF PAC. Not authorized by any candidate or candidate’s committee.”
This connection extends beyond the website itself. meetjoshturek.com also links directly to the Senate Leadership Fund’s YouTube channel, where its most-watched video racked up 14 million views in just nine days.
So far, the websites identified in this investigation fall into three broad categories:
-
Websites targeting political candidates
- 40yearsisenough.com
- meettroyjackson.com
- meetjoshturek.com
- grahamplatner.org
-
Websites presenting themselves as independent news outlets
- newhampshiredaily.org
- theiowavoice.com
- thenorthcarolinian.org
- ohiopulse.org
- mainepolicyupdates.com
- thealaskanavigator.com
-
Websites explicitly linked to political organizations
- onenationamerica.org
- slfsites.com
The final domain on our list, slfsites.com, displays the logo of the Senate Leadership Fund (SLF), a Republican-aligned super PAC. The Lexington Herald-Leader and InfluenceWatch have previously reported on ties between SLF and One Nation.
The connections extend further: One Nation and an SLF branch are reported to share an office building in Haymarket, Virginia, while Caleb Crosby has also been associated with both organizations.
Some websites, such as thenorthcarolinian.org, describe themselves as providing “independent journalism” while also displaying the disclosure “Paid for by SLF PAC,” which also appears on websites focused on political candidates. Other sites display the disclosure “Paid for by One Nation.” Notably, onenationamerica.org is one of the domains identified as sharing the same GTM codes as websites in our original dataset.
Of all the domains mentioned in this blog post, only onenationamerica.org and 40yearsisenough.com were registered before 2026, in 2014 and 2012 respectively. All the other domains were registered in 2026, in the months leading up to the U.S. midterm elections.
According to the Meta Ad Library, SLF spent between $87,200 and $112,821 promoting 40yearsisenough.com. One Nation and SLF have also run Meta ads promoting other domains cited in this blog post, including thenorthcarolinian.org.
According to the Google Ads Transparency Center, One Nation has spent as much as $200,000 per day on advertising.
Another way to discover these websites, beyond analyzing tracking codes, is to examine the ads run by the organizations behind them. Using the Google Ads Transparency Center, we identified an ad promoting a website focused on Abdul El-Sayed, the Democratic nominee for Michigan’s 2026 U.S. Senate election.
This website, elsayedmi.com, shares the same Google Tag ID as several of the other websites identified so far.
Conclusion 🔗︎
What began with six domains ultimately revealed a broader network of connected websites. By examining shared Google Tag IDs, website source code, and publicly available advertising data from the Google Ads Transparency Center, we were able to identify additional domains and uncover connections that would not necessarily be apparent when looking at each website individually.
The investigation also shows how different types of websites can form part of the same broader digital ecosystem. Some presented themselves as independent news outlets, others were built around political campaigns, while others were explicitly associated with political organizations. Despite these differences in appearance and purpose, common technical infrastructure, funding disclosures, and advertising activity provided ways to connect them.
Most importantly, this investigation demonstrates the value of combining multiple OSINT methods. A tracking code alone may provide an investigative lead rather than definitive proof of ownership or coordination. But by combining technical indicators with other publicly available information, such as archived websites, corporate registries, and ad transparency records, investigators can develop a much clearer picture of the infrastructure and relationships behind a network.
The same investigative approach can extend well beyond politically focused websites. OSINT analysts and practitioners can apply similar techniques to other use cases, such as mapping networks associated with extremist narratives, tracking the spread of disinformation or misinformation, or investigating coordinated influence or adversary activity. The underlying principle remains the same: follow technical and digital traces, validate findings against multiple sources, and combine the evidence to uncover relationships that may otherwise remain hidden.
Happy Investigating!
