Cash-for-Disinformation in Bulgaria: The Share4Pay Case

by Olga K. Nanova, HSSF-Sofia researcher

1. Introduction: Bulgaria's Political and Media Situation

Since 1989, Bulgaria transitioned from communist rule to democracy amid political turbulence and media liberalization, though both spheres have faced persistent challenges like corruption and oligarchic influence.

The country's political transition began with the fall of Todor Zhivkov on November 10, 1989, which triggered democratic protests and the formation of the Union of Democratic Forces (UDF). A new constitution in 1991 enshrined freedoms, leading to multi-party elections, EU accession in 2007, and governments alternating between the Bulgarian Socialist Party (BSP, ex-communists), GERB (center-right under Boyko Borissov), and figures like former King Simeon II. Instability was and is a constant factor, with eight governments by 2003, 2013 anti-corruption protests, and mostly GERB dominance from 2009 amid clientelism.

Post-1989 reforms enabled private media, foreign investment, and the 1998 Radio and Television Act, fostering pluralism but also market concentration and politicization. Outlets proliferated initially, shifting to internet expansion, yet faced capture by political-oligarchic interests, self-censorship, and threats to journalists, especially under GERB rule. The system balances democracy and capitalism in perpetual crisis. 

Bulgaria faces a significant challenge with disinformation and fake news, driven by pro-Russian narratives, low media literacy, and networks of low-quality websites. These issues have intensified since Russia's invasion of Ukraine, exploiting political polarization and media capture. 

Pro-Russian disinformation spreads via "mushroom websites"—cheap, disposable sites mimicking news outlets—that amplify clickbait, conspiracy theories, and Kremlin-aligned propaganda on topics like NATO, Ukraine, and EU policies. Factors facilitating the spread of disinformation include state-media capture, weak regulations, social media echo chambers (Facebook, TikTok, Telegram), and historical vulnerabilities to Russian influence.

Content proliferates through social platforms, bots, and ads (e.g., AdRain.bg networks), monetizing lies on vaccines, euro adoption, corruption, and Roma stereotypes. Public exposure is high—55% of Bulgarians encounter misinformation often, the EU's highest rate—eroding trust (63% avoid news) and fueling protests. Challenges persist due to inaction by platforms and low trust in institutions. 

A few democratic media outlets help counter the decline in press freedom. They play a key role in tackling sensitive stories (that many local journalists avoid due to safety threats or government pressure), while also combating Russian disinformation in the region.

2. The Svobodna Evropa Article

Svobodna Evropa was one of these democratic media outlets. It was the Bulgarian service of Radio Free Europe/Radio Liberty (RFE/RL), and it ceased operations on March 31 2026 due to budget cuts. Both the Bulgarian and the Romanian services were affected by funding cuts ordered by the U.S. Agency for Global Media (USAGM), which oversees the RFE/RL. The closures are viewed as a setback for media pluralism in Eastern Europe. Thankfully, Svodobna Evropa was able to reinvent itself in Bulgaria as Svobodna tochka, published by an NGO with the same name.

In 2024, Svobodna Evropa’s journalist Georgi A. Angelov wrote an insightful piece on disinformation, “I Worked For The 'Mushroom Machine': Inside Bulgaria's Cash-For-Disinformation Network”. He covered his experience registering on Share4Pay, a website that offered minimal pay in exchange for promoting online “news” stories, which amounted to disinformation, misinformation, fake news, tabloid content, and clickbait. 

The article describes a network called "The Machine", consisting of hundreds or thousands of fake news sites that copy content to spread disinformation, primarily Russian propaganda, after the 2022 invasion of Ukraine, later shifting to topics like Bulgarian politician Delyan Peevski. 

These sites replicate identical headlines and narratives across at least 25 Bulgarian domains, amplifying reach without journalistic oversight. 

Key disinformation examples include:

• NATO Aggression Claim: A story on Poland's "Dragon 24" military exercise falsely portrayed it as NATO planning to attack Russia, echoing Kremlin talking points. 
• Pro-Russian War Narratives: Early content pushed ideas like the West provoking the Ukraine war, Bulgaria blindly following NATO/USA, and supporting Kyiv risking Bulgarian involvement—narratives that multiplied visibility 400-fold via aggregators. 
• Peevski Promotion: Later articles praised or defended Delyan Peevski (leader of the Movement for Rights and Freedoms party, who is sanctioned for corruption by the US/UK), suggesting paid promotion by network operators. 

The sites mimic legitimate media but lack editors, and often retroactively "clean" pro-Russian articles (e.g., post-exposure in 2024). This infrastructure serves external (Russian) or local political interests on demand. 

3. The Share4Pay Project

Share4Pay and its associated websites were first examined by the Human and Social Studies Foundation (HSSF) in Sofia. Through screenshots and explanations below, one can observe how Share4Pay presented itself in Bulgaria.

Share4Pay[.]com is now down, but has been handily archived. We can examine the website using the Wayback Machine snapshot from 29 March 2024, the last one before May when the Svobodna Evropa article came out.

Share4Pay snapshot from 29 March 2024, the Wayback Machine.

The heading says “Make Money in Your Free Time”, and in a smaller font below, “Work without A Boss and Working Hours”. The registration form on the right requires a full name, an email address, and the desired site name, which is shown as a subdomain of share4pay[.]com. As Georgi Angelov explains in his article, the subdomain will also be created under a disinformation “news” website. The suggested subdomain names in the text below the form translate from Bulgarian as “thenewtoday” and “news365”.

Terms & Conditions section of the referenced Share4Pay snapshot.

Under the Terms section, the platform claims to have 15,000 happy subscribers. If we imagine, for a moment, that this is correct, then somewhere there is a handy database of personal data of gullible Bulgarians. Considering these people were being paid, the data on them also includes payment information.

Journalist Maya Dimitrova from the Bulgarian National Television (BNT) interviews one of these human “bots” in her movie Architects of Chaos. The person, a state employee with a low salary, shares that she earns pennies at Share4Pay, but that still adds up to some welcome additional income. The woman, Radka, directly identifies the model as a financial pyramid, but says that everything nowadays is a pyramid. She daily took any links to new stories from the “news” website, assigned to her by Share4Pay, and posted them in Facebook groups that tolerated such behavior. Thus, the platform attracted people willing to earn an extra penny by posting links to “news” from a designated website.

How-It-Works section of the Share4Pay website, showing points 1 and 2.

In the How It Works section, Share4Pay explains its business model. In point 2, it claims that it will create a site for the user, and that its employees will start to add news and articles to the site 24/7. The site is a disinformation domain with a custom subdomain. The subdomain simply mirrors the main domain’s content, there is no difference except sometimes adding the subdomain’s name somewhere visible on the main page. Hold that thought that the subdomain-dot-domain construct is actually a separate site – it comes in handy later when we explore brands' infringement.

Image of the twitter subdomain of the disinformation domain bgvest[.]eu. Taken using Selenium.

The partners’ program on the Share4Pay website features a clear pyramid diagram and identifies itself as multi-level marketing. If one reads the text carefully, there are typos and errors here and there. 

Image of the partners’ program information on Share4Pay’s website.

So you are not only invited to self-identify psychologically through the chosen subdomain name with the daily disinformation in bulk, but also to bring friends. Since the system preserves this information, now someone somewhere has a database of personal information that no longer stops at the individual level. There is knowledge of relations among individuals.

Share4Pay and its associated “news” sites were particularly active around elections. At the beginning of 2026, elections took place in Bulgaria again. Share4Pay, however, died about a year ago and is still dead. This is due to a large extent to the work of HSSF, the Center for the Study of Democracy (CSD), DFRLab, and media like Svobodna Evropa that wrote about researchers’ findings and built on them. 

4. Subdomains

Returning to “I Worked For The 'Mushroom Machine”, it should be noted that the Bulgarian version and the English version of the article differ. The English one appears to be abridged. For example, it does not mention the subdomain Angelov chose and the domain he was allocated, patriot[.]allbg[.]eu. I based my work on the details that are absent in the English version.

After reading the article, I decided to see how many subdomains I could locate under each of the mentioned disinformation domains. Then I expanded my research to disinformation domains from the referenced HSSF newsletters. Over time, the most useful tool turned out to be sublist3r. In this article, I will only cover the disinformation domains that had hundreds to thousands of subdomains at the time of my research – please see the following table.

These are the sites that HSSF had been monitoring the longest. Based on tool results as of 13 January 2026, we had a total of around 4592 disinformation human “bots”, far from the claimed 15000 at Share4Pay. Almost one-third is definitely bad enough, though.

Sample results from a Sublist3r run on 17 February 2026 for zbox7.eu. Command used: “Sublist3r -n -o <outputfilename>.txt -d zbox7.eu”. “www” as a subsubdomain was not counted for the totals above.

Now, let’s further examine the data for the four domains mentioned, starting with the intersection.

Excluding administrative subdomains like cpanel and the like, we have subbdomains in common that are all related to news, except “pari”, which means “money”. 

“Novina”/”novini”/”vesti” are Bulgarian words for “news”. “Dnes” means “today” and is associated with “news” as well (if you google ‘dnes bg’, at least two news agencies come up).

If we wanted to prove the connection between these domains and Share4Pay, these would be the strings to look for: pay, share, money, pari, cash, rich, dohod (“income”), pech/pe4 (root for “to earn”, “winnings”), earn, priho (root for “income”), rabot (root for “work”).

Using these Share4Pay markers of sorts, the results for the domains are as follows:

It is unfortunately necessary to read Cyrillic somewhat to spot some of these, as for “prixot” (for zbox7), for example, the “h” sound is replaced by “x”, which has the same sound in Bulgarian.

Now, let’s look at the brand names that are also subdomain names. 

Why is this important? When we look at something on a phone screen, we often see only the subdomain part. Especially elderly users might believe the news they are seeing is from a different news source – when the chosen subdomain is of an established news agency.

For allbg.eu, we have about ten examples of brand names used as subdomain names. The obviously Bulgarian ones are mostly references to local news sources: Bulgaria Today, The BTV News, dnes.bg, NOVA TV, Novinar, and others. There is also the free classified ads website OLX.

For bg7.eu, we have around 33 examples. There are references to popular and not-so-popular websites: 24 Chasais a news website, ABV is a free web-based email, and Mama Ninja is a popular blog author.      

The situation is similar for the other two domains. 

Interestingly, as a subset of all subdomains for zbox7.eu, we have around 20 subdomains related to the COVID pandemic (e.g. “niamavirus” - “there is no virus”). Separately, there are around 15 subdomains that contain the year “2020”, and, for comparison, there is only 1 subdomain each for the years 2019, 2021, and 2022.

All this shows the Share4Pay model attempted to influence public opinion during the pandemic, too. (The Wayback Machine has begun tracking the website as early as 2017.)

Some subdomain data also seems to be mocking the system. Examples of this are “izmama” (“fraud”), “begaiottuk” (“get outta here”), “nonews”, “baiganio” (Bai Ganyo is a fictional character in Bulgarian literature, representing the uncouth and opportunistic), and “scare4pay” (my favorite, as disinformation news pieces often attempt to scare the reader).

I could also discuss the phone numbers and Bulgarian identifier numbers (EGNs) that were subdomains, too, but I will refrain from doing so, as this sensitive data has already been over-exposed.

5. Current Snapshots

As mentioned, Share4Pay is now dead, and hopefully permanently so. Subdomain data can still be collected for the four aforementioned disinformation websites, but the websites are not accessible in their former state, with the last check being on 3 April 2026. Allbg[.]eu is down. Bg7[.]eu is redirecting to Winbet, a Bulgarian betting website. News7[.] eu is down (and it was redirecting to Novax Group’s luxury swimming pools website in March 2026). Zbox7[.]eu remains as a mere shell of itself – the old news links on the main page lead to non-existent pages. Whether this new state of the websites is temporary or permanent remains to be seen.

For now, Share4Pay and its associated disinformation websites are no longer part of Bulgaria’s disinformation landscape, thanks to the hard work of researchers and journalists. The Bulgarian state apparatus unfortunately remains mostly inert, or, worse, targets the press and the NGOs and not the entities and people behind the spread of disinformation in the country.

It is important to note that the responsible state agencies should assist organizations and researchers who contact them with requests to close down disinformation domains. Often such requests are left without an answer, and it is time for this to change. If we had timely and swift actions, disinformation would be made costlier and harder to those who still profit from it.

Finally, it is now obvious that withdrawal of U.S. funding for counter-disinformation under the second Trump administration has had wide-ranging consequences abroad, affecting elections and media freedom. Many local outlets have been forced to lay off staff or shut down entirely. Without appropriate support, investigative journalists in Bulgaria already endure threats, harassment, SLAPPs from politicians and businesses, and self-censorship amid limited pluralism and market concentration.

Disinformation everywhere imposes steep economic, social, and democratic costs, and countering it is crucial for stability. The price tag of inaction is too high.