Counterintelligence — 2026-07-11

FDD Discovers Network of Suspected Chinese Intelligence Front Companies Targeting Western Security Analysts

BLUFPublic exposure of shared infrastructure across these four suspected fronts likely triggers seizure or takedown of at least one domain within 90 days, given FBI precedent and actionable technical indicators now in open reporting.

FDD's Center on Cyber and Technology Innovation, following a June 30 X post from China specialist Bill Hayton questioning the Singapore-based site ieass[.]com, identified a cluster of four suspicious geopolitical-advisory websites: ieass[.]com, easi-policy[.]com, sgas-strategy[.]com, and northriver-asia[.]org 12. Domain infrastructure analysis via DomainTools and URLScan.io found ieass, easi-policy, and sgas-strategy share near-identical registration and hosting profiles and were all built on the Lovable AI website platform, registered March 21, May 9, and May 12, 2026 respectively, with sgas-strategy also listing Berlin coordinates as its "Paris Operations" address and anonymizing its staff page with initials only 2. Northriver-asia shares some but not all of those technical markers and shows additional signs of fabrication, including a UK charity registration number (No. 1149732) that actually belongs to the Kurdish Council of Imams and Preachers in Britain, fictitious London and Washington phone numbers falling within ranges reserved for entertainment use, and simplified Chinese text mistakenly left on its "People" page 12. Three of the four sites solicit resumes or partnerships from professionals with government, military, or diplomatic experience, and none of the four discloses any relationship to the others 12. The discovery follows the FBI's seizure last month of 13 fake consulting and nonprofit websites assessed to be linked to Chinese intelligence recruitment efforts 1.

Analysis
FDD's technical mapping of shared Lovable-platform hosting and registration data across three of the four sites, alongside Northriver-asia's fabricated UK charity number and exposed-range phone contacts, gives registrars and law enforcement concrete indicators that likely accelerate takedown or seizure action against at least one domain within 90 days, consistent with the FBI's seizure of 13 similar front sites last month. Northriver-asia's weaker infrastructure overlap and cruder fabrication make it the more exposed standalone target even if the three-site core resists attribution. The same amateurish tradecraft reads at least as consistent with a low-effort commercial scam or SEO lead-generation scheme as with a state intelligence front. Confidence is moderate: the finding traces to a single technical investigation, amplified but not independently corroborated by FDD's parallel publication. Absent a seizure, security-clearance holders and think tank staff remain exposed to recruitment outreach with no official warning to cite.

2 sources

Suspicious Firms Still Seek Professionals With Military and Government Experience - Foundation for Defense of Democracies
Guest Post: Consulting in the Name - Memetic Warfare (Substack)