In recent times, due to the tense relationship between Japan and China, a group of real IP addresses originating from China have become active again. They are attempting to influence public opinion by posting their own content to impact internet users’ awareness. Several informed sources have mentioned that a significant portion of these individuals come from various prisons, with one person able to control dozens or even hundreds of accounts simultaneously, gaining an advantage in public opinion by disguising their identities and generating false traffic.
In recent years, multiple international cybersecurity agencies, research teams, and large social media platforms have disclosed the presence of information warfare networks originating from China active on overseas social media platforms for an extended period. These networks utilize fake accounts, anonymous connections, and content manipulation to influence emotions, intervene in international discussions, and promote the values system constructed by the Chinese Communist Party in the global public opinion space.
Between 2019 and 2024, Meta released several “Coordinated Inauthentic Behavior” (CIB) reports, repeatedly unveiling a Chinese-background account network known as “Spamouflage,” noting its ongoing activity on platforms like Facebook, YouTube, Twitter, and TikTok. The research institution Graphika has been publishing reports since 2020, designating a more organized segment as “Dragonbridge” and continuously monitoring its cross-platform dissemination and coordinated operational characteristics.
Mr. Liu, a network security expert from Hebei province with over a decade of experience in cybersecurity research, shared insights based on recent observations on overseas social media. On November 26th, he told Epoch Times reporters, “From a technical viewpoint, these accounts often rely on overseas proxies or cloud servers for their activities. The account source nodes are dispersed across data centers in the United States, Japan, Singapore, and Europe. The use of proxy pools and rotating proxies enables account sources to jump between different countries, making them difficult to trace.”
Recently, X platform introduced mechanisms for source transparency such as “account registration country labels” and “general tweet source regions.” Although not displaying real IP addresses, this update allows external viewers to compare account self-descriptions with the system displays. Following the update, some accounts that have long claimed to reside in the United States, Europe, or Australia were labeled as originating from within China, sparking discussions about their identity authenticity.
In response to this, Mr. Liu stated, “While some accounts present themselves as ‘overseas,’ the language style, usage habits, and online times are consistent with users within China. I noticed in a small group discussion that some individuals were discussing how certain overseas social media accounts are actually controlled by certain authorities, and their actions are aggressive, which is definitely not random behavior.”
Frequent X platform user Zhao Ming mentioned that this update has made it challenging for many accounts that adopt false identities to maintain their narratives. He remarked that some accounts have been commenting for years from the perspective of “overseas Chinese,” but their source nodes indicate they are based within China, contradicting their self-introductions. He believes that while the source labels may not prove actual identities, they can reveal the operational nature and discourse objectives of the accounts.
Another X user, Citron, shared an experience that further deepened public scrutiny of information warfare. They stated that shortly after releasing a list of accounts, their Apple ID experienced numerous abnormal logins and was automatically banned by Apple’s security mechanisms. Claiming their Apple ID was registered with a dedicated email not used on other sites, the source of the attack could not be determined. There is contention that when accounts related to information warfare are exposed, the organizers themselves may face retaliatory attacks.
Ms. Liu, a visitor from Liaoning, provided insights from the perspective of the prison system. She recounted that during her time in the East Ling Prison in Liaoning, she heard that young inmates were selected to enter the so-called “internet rooms”: “They spend around ten hours online every day. One inmate quietly told me that she anonymously posts content favorable to China or denigrating the United States on overseas social media platforms.”
Ms. Liu also mentioned that a portion of the prison internet army is focused on promoting to the domestic population, while another targets overseas audiences: “She said that these inmates also leave comments on platforms like Sina Weibo, Tencent Weibo, and various video websites, praising government policies, applauding Xi Jinping’s published works, or expressing support for Russia.”
A department head of a company specializing in providing cybersecurity products for enterprises, Mr. Shi Jin, shared similar observations. He informed Epoch Times that during platform security checks, he analyzed the source data of some accounts on Weibo and found that the IP addresses of certain accounts matched those of prison networks. “I remember there were quite a few of these accounts, and the content they posted mostly consisted of propaganda slogans, including praising China’s economic achievements and government policies, as well as mentioning Taiwan as Chinese territory and supporting the reunification of the motherland.”
He mentioned that his initial reaction was, “How could prisoners use computers?” Later, he was informed that it was a task arranged within the prisons, but there is no public data to confirm this.
The international community has long been monitoring the cognitive warfare launched by the Chinese Communist Party overseas. Some believe it may involve an irregular team that covers multiple levels of society, with the possibility of participation from institutions to local units. Some researchers estimate the scale could reach millions, but lacking official data, judgments are based more on observations by long-term observers.
Network observer Mr. Mao believes that the “Chinese internet army” differs significantly from the “little pink” phenomenon. He stated that “little pink” is more about emotional expression, while what he refers to as the “Chinese internet army” is characterized by organization, mission orientation, and goal setting. He suggests that the main force of this team is not the commonly seen nationalist youth online but includes “wumao” (internet commentators), institutional employees, and even inmates from various prisons. These individuals form a structured information intervention force through collective actions and executing directives.
With the increased source transparency on the X platform, some accounts recently discovered have been found to frequently rely on proxy methods, while others directly indicate being from within China and accessible on X without the need for any wall-climbing tools. The posting patterns and user behavior of these accounts have alerted outsiders that they may be tasked with missions different from regular users. However, these assessments are difficult to fully verify through public data and will require long-term behavior analysis to understand their characteristics.
In recent years, international platforms have been enhancing their monitoring efforts. Meta and X have repeatedly removed accounts related to Chinese information warfare networks, and YouTube has taken down numerous channels linked to Spamouflage. Researchers believe these actions are aimed at shaping an international public opinion environment favorable to the Chinese government, weakening critical voices, and creating the impression of “natural support from overseas users.”
With the rapid development of artificial intelligence and automation tools, the speed of generating fake accounts and their deception capabilities might further strengthen. The automation of generating avatars, texts, and local language model usage makes fake accounts more realistic and harder to identify. Experts point out that in the future, public discussion spaces will increasingly rely on transparency tools and identification mechanisms to prevent the proliferation of large-scale manipulation phenomena.
Public data indicates that China continues to promote political content overseas through concealed means. The previous source tag update on the X platform has left some disguised accounts exposed, making the tracks of these related information warfare networks clearer. Against the backdrop of increasingly fierce global public opinion competition, this phenomenon will continue to be a significant issue of international concern.