Date published: January 2026 Investigation focus: Coordinated inauthentic "fan page" networks across NFL, NBA, WNBA, MLB, NHL, NASCAR, F1, IndyCar, professional tennis Persona × scenario tags:

• CCO × reputational flare-up driven by AI-generated content

• CCO × deepfake / fabricated content circulating

• CCO × commercial spam masquerading as fan community

• CISO × coordinated inauthentic behavior detected

• CISO × adversarial AI-output narrative manipulation

Executive summary

Alethea uncovered a sprawling ecosystem of inauthentic, coordinated "fan page" networks pushing rage bait, commercial spam, and AI-generated misinformation across social platforms, targeting nearly every major U.S. professional sports league. The pages present themselves as community hubs, but function as high-volume attention farms designed to monetize reactions — funneling traffic to scam sites, collecting ad revenue, and siphoning engagement from leagues, teams, broadcasters, and legitimate publishers.

Their operating goal is friction, virality, and revenue — driven by an attention-monetization model that depends on emotional reactions. The pages churn out a steady stream of fabricated quotes, AI-generated imagery, false scheduling updates, and culture-war storylines designed for maximum reaction. When the reaction comes, the machine monetizes it, siphoning attention and ad revenue from legitimate sources and forcing athletes like Jason Kelce and George Kittle to publicly correct words they never said.

The mechanics of the operation

The content factory

Fake content follows four formulaic categories that are easily reproducible across leagues:

The monetization engine

The tactics are remarkably consistent across the ecosystem:

• Manufacture urgency through fake schedule alerts and "BREAKING NEWS" prompts that force fans to respond before verifying

• Recycle narrative templates across leagues, reskinning teams or athlete names to scale content with minimal effort

• Exploit parasocial loyalty through fabricated quotes and AI-generated photos using authentic fan intimacy as an accelerant

• Drive monetization through outbound links to ad-stuffed scam domains and low-quality content farms

• Evade moderation through stolen U.S. business phone numbers, fake Instagram handles, fabricated "About Us" pages, and misappropriated U.S. business addresses

Two major operational clusters

Cluster A — India / Mexico / U.S., linked to Sportskeeda and Absolute Sports Pvt Ltd

These pages frequently include administrators in India and appear tied to broader content-monetization networks. Some leverage Sportskeeda's distributed content model — which pays writers based on article traffic — to seed click-driven copy across platforms. Sportskeeda is owned by Nazara Technologies, which leverages Sportskeeda to drive traffic across its other gaming and esports properties (HalaPlay, WCC), creating a network effect across Nazara's portfolio. Writers are paid based on article performance, with geography affecting payouts since traffic from developed countries generates higher advertising revenue.

Cluster B — Vietnam, the larger and more coordinated inauthentic infrastructure

Vietnam-run pages exhibit:

• Shared outbound links

• Matching posting templates

• Reused imagery

• Identical scam domains (Boonovel.com, HitTracks.us, topnewsource.com)

• Fake "About Us" pages

• Misappropriated U.S. business addresses to appear stateside

Suspension-evasion tactics include posting outbound links only in comment replies, using fake phone numbers and addresses, listing random small businesses in bios, and linking to non-existent Instagram accounts to appear legitimate.

Most outbound links lead to low-quality, ad-stuffed, or outright fraudulent websites. Topnewsource.com in particular bears the hallmarks of known scam operations:

• Copy-and-paste "About Us" content used across known scam networks

• Hidden WHOIS / short domain age

• Automated, thin, low-quality content structure typical of AI-rewritten or scraped articles

• Use of ad/affiliate funnels and user reports of popups, iframes, redirections, or "free prize/virus" warnings

• Low trust scores or "suspicious" labels from ScamAdviser and Gridinsoft

The business impact

Beyond reputational and fan-experience harm, these networks quietly divert engagement and ad dollars away from legitimate sports media:

• Reputational risk for players, teams, and sponsors

• Declining trust in official updates and league channels

• Siphoned ad revenue and reduced share-of-voice for real publishers

• Increased moderation cost and operational load for platforms

• Volatility for communications teams forced into shorter reaction windows and bogged down by content spam

The result is a parallel attention economy. Teams and leagues spend heavily to build audience trust, yet fake content siphons that investment by generating more friction, more outrage, and more clicks.

A growing security and fraud dimension is also present. Some outbound links have been flagged for phishing, malicious redirects, and malvertising — presenting real fraud risk to fans and increasing takedown viability for leagues or teams. Misappropriated player likeness, logos, and schedules could open pathways for legal action or platform removal when tied to brand impersonation or consumer harm.

Real-world impact on named athletes

When narratives jump platforms, the burden shifts to the players themselves:

• Jason Kelce had to publicly refute a fake quote that spread widely enough to reach sports media cycles

• George Kittle faced similar spread tied to fabricated political commentary; just one instance of his fabricated words garnered over 5,000 likes and 744 comments in the 48 hours after first being posted, forcing a public response

Methodology

Alethea's investigation combined:

1. Network mapping of Facebook pages claiming to represent fan communities

2. Cross-page content analysis to identify duplicated narratives, AI-generated graphics, and coordinated posting patterns — via the Artemis platform

3. Attribution review of admin locations, reused contact info, foreign-managed accounts, and impersonation patterns

4. Open-source intelligence on outbound links, domain registration, and scam monetization infrastructure

5. Fan sentiment analysis through public comments and user-report patterns

This multi-layered approach revealed a large, multi-region content operation exploiting sports fandom for attention, traffic, and monetization.

Persona takeaways

For CCOs at sports leagues, broadcasters, and consumer brands: This case is the worked example of how AI-generated content and coordinated inauthentic networks combine to compress comms-team reaction windows and create reputational volatility that exceeds traditional PR-structure capacity. Operational visibility into the upstream network — the international admin clusters, shared scam domains, coordinated posting templates — is what supports the choice between correction, takedown escalation, and full disclosure.

For CISOs and brand-protection teams: The infrastructure layer here (international admin networks, shared scam domains, coordinated posting templates, identical outbound-link patterns) is the standard fingerprint of commercial inauthentic operations. The same analytical signatures apply to other brand-impersonation environments.

For consumer-brand sponsors and athletes' representatives: When a player or sponsor finds their image used in fabricated content, knowing the network and monetization infrastructure behind the post is the entry point for legal, platform, and PR response.

Source links

• Full Alethea report (PDF) — alethea.com/hubfs/alethea-report-nfl-fan-free-zone.pdf

• Insight summary — alethea.com/insights/report-nfl-fan-free-zone

• External coverage citing the report — alethea.com/insights/reuters-cites-alethea-report-nfl-fan-free-zone