Maria Giovanna Sessa, Senior Researcher, and Francesco Poldi, External Consultant at EU DisinfoLab
Executive Summary
- In contrast with the tendency of conspiracy believers to despise global elites, we found outlets with hundreds of thousands of subscribers who wish to become part of wealthy world-controlling groups, by joining the Illuminati.
- The investigation identifies online English-speaking groups that through diverse platforms (including Facebook and Telegram) offer users the possibility to become members of the Illuminati secret society upon payment of a membership fee.
- Recurrent tactics used by these actors consist of the resharing of quotes, stolen images, and selling of merchandise like books or talismans.
- The study unveils an under-investigated phenomenon, which combines potential online scams highlighting platform negligence and failure to counteract them – and dangerous conspiracy beliefs about the deep state that reinforce longstanding prejudices.
Introduction
In her conspiracy chart, misinformation researcher Abbie Richards places at the highest level of detachment from reality beliefs that “the world is ruled by a supreme shadow elite”, which thus are the most dangerous. The ‘Illuminati’ conspiracy falls under this category and is at the centre of our investigation.
Historically, the Order of the Illuminati referred to a secret society that operated from 1776 to 1785, founded in Bavaria by Adam Weishaupt, a German philosopher and law professor who was strongly inspired by Enlightenment ideals. Therefore, the ‘lluminatenorden’ sought to promote secular, intellectual, and philanthropic values among elites to influence decision-making. The Illuminati then became one of the oldest conspiracy theories when in 1797, physicist John Robison published “Proofs of a Conspiracy”, a polemic book that accused the Illuminati of infiltrating the Freemasonry. In the same year, Augustin Barruel’s “Memoirs Illustrating the History of Jacobinism” came out, which promoted the theory that secret societies – including the Illuminati – were behind the French Revolution.
The American Jewish Committee exposed the anti-Semitic aspect of the conspiracy spreading between the two world wars, according to which the Illuminati were a subversive group at the service of Jewish elites who were behind either global capitalism or Soviet communism. The false belief is also anchored in the New World Order conspiracy that a small group of powerful individuals with a globalist agenda is secretly scheming to achieve world control.
Not only is this investigation interesting because it combines multiple long-existing conspiracies and prejudices (against elites, Jews, and Freemasons), but also due to its unexpected angle. In fact, usually conspiracy believers refer to the Illuminati in derogatory terms, whereas instead our research found cases in which people are trying to join this alleged powerful sect and are willing to pay to do so.
In the first part, we identify a network of websites and Facebook groups and pages, which share the same tracker IDs (e.g. Facebook Pixel ID, among others) and are therefore connected. In the second part, we identify nine Telegram channels and groups with hundreds and sometimes thousands of subscribers and members, which try to lure users into joining the Illuminati by offering them payments.
Since the methods described hereafter did not lead us to determine who is behind these outlets and whether the websites and Facebook pages are connected to the Telegram channels and groups, we must conclude that there are multiple disinformers recycling identical content and graphics to push the same conspiracy and scam.
These malign actors exploit people’s credulity and ignorance, claiming to offer access to a secret society, despite the fact that the Illuminati does not exist, and secret societies have been outlawed everywhere for centuries. False promises of wealth and power are corroborated by images of expensive items, e.g. luxury watches, cars, or houses. Another convincing technique is the sharing of stolen photos of prominent figures – from former U.S. President Obama to the Grand Master of the Order of Malta – as well as photos of Freemasons in their ceremonial apparel, thereby perpetuating prejudices, and stigma against Freemasonry, who are believed to conduct occult activities.
Part 1: A network of websites and Facebook pages
If one is looking for information on the Illuminati online, they might start from a simple desk research on a browser, which is what we did. Surprisingly, besides informative pages on the origins of the group and content aspiring to take down this shadowy evil, we were able to find outlets that claim to be official representatives of the Illuminati and invite users to join. In detail, a Google search for “join the Illuminati” gives back almost 17 million results, including ads for websites that appear on top of the first results page. Our investigation begins with this lead, as we notice at first glance that these (and other) websites have similar logos and themes.
- Identifying a network of websites
Since ads on Google change with almost every search, we decided to proceed differently and start our analysis by looking at illuminatiofficial.org, claiming to be the “official website of the Illuminati. Given the plurality of Illuminati-related websites encountered, we wondered whether other outlets were connected to it. We decided to use web trackers instead as a way to identify a network of websites undoubtedly connected to the one mentioned.
What is a web tracker?
A tracker is a piece of code that gets executed by the browser each time a user visits the page that contains it. Web trackers gather data on how users interact with the websites, the number of visits and times spent on the page, the scrolling speed and other relevant information that allow web administrators to know more about their public and thus target specific audiences. More information of what trackers are and how they work is available here.
Web administrators often manage different websites that relate to the same topic. To easily aggregate information from different sources into a single virtual bucket or to provide more personalised ads, they may use the same web tracker IDs for the various websites they manage. As this process detects all websites related to a certain web tracker – including websites that are unavailable at the time of our writing (April 2022) or unrelated to the topic we are investigating – we had to filter by context and remove irrelevant information. The web tracker IDs we have been able to identify are graphically represented below, identified by colour (i.e., web tracker IDs are in green, while domains are in red).
As a result, the graph in Figure 2 reveals a vast network of connected outlets, many of which contain the word ‘illuminati’. Currently and previously hosted tracker IDs are listed below:
- FB-1071017149597530, a Facebook Pixel ID for tracking users in and out of Meta for future ads and re-market;
- UA-44625461, belonging to Google Universal Analytics (Google UA), i.e. trackers that support web measurements;
- ST-9298841, StatCounter trackers are similar to Google UA ones, as they track user interaction with the website hosting the tracker;
- HJ-552104, this is a HotJar tracker (no different from the former two);
- GTM-UA-44625461-1, which is a Google Tag Manager ID, namely similar to Google UA trackers but on the web administrator’s side;
- GP-Illuminatiam, a Google Plus tag referencing to the defunct Google Plus social network;
- Other trackers we identified can be categorised in one of the families reported above.
For example, the screenshots below show the homepages of illuminatiofficial.org and illuminati.am, sharing the same Facebook Pixel ID. This is a data-gathering tool that tracks users via cookies as they interact with a website both on and off Facebook and Instagram, retrievable via the Facebook Pixel Helper extension.
The two websites have the same logo and video from the “ILLUMINATIAM ✪” YouTube channel as additional evidence of their connection.
2. Domain-specific social network searches
To identify the domains worthy of further investigation, we skimmed through those that are still available at the time of our writing The chosen criterion is to determine if a domain has a valid DNS record, assuming a NS (i.e. nameserver) is assigned. Therefore, we excluded the domains that could not be visited anymore, thus meaning that our dataset of websites drawn through web trackers got reduced to one third.
To further narrow down the list in order to have more valuable intelligence, we had to remove the information that did not belong to the time-frame context of interest. For example, the website locsaint.com stopped using these two tracker IDs (i.e. FB-1071017149597530 and GP-Illuminatiam) from December 2017 to February 2018 and currently presents information on a hip hop singer, thus being entirely unrelated to our target.
After this data cleaning operation, we were left with a set of 24 valid domain names, which we sorted by relevance to define a priority queue, based on the interconnection strength of the network graph reported above (Figure 2). The next step was to determine other leads by performing advanced search engine queries, often called “dorks”. However, we found virtually no relevant or new information, besides some occasional confirmation of links between the websites (e.g. illuminations1.com redirects to an already known website, specifically to the webpage illuminati.am/illuminations).
Based on the data we acquired, there are four domains of primary relevance:
- illuminatiofficial.org, allegedly the “official website of the Illuminati”;
- illuminati.am, more generically defined “an official website of the Illuminati”;
- illuminati.mp, aka the “Illuminati Members Portal”;
- dodis.co, i.e., the “Department of Distribution of the Illuminati”, selling merchandise.
Moreover, we identified two related Facebook pages (Figure 7):
- Illuminatiam, whose ‘about’ section mentions the website illuminati.am, the verified Twitter account Illuminatiam, and the Illuminatiam YouTube channel;
- Department of Distribution, whose ‘about’ section mentions the dodis.co merchandising website.
A blue verified badge on Twitter might be achieved through one of the following three methods: providing links to an official website, ID verification, or an official email address. It gives an account a degree of trustworthiness, which in this case is not justified.
As well as three Twitter accounts (Figure 8):
- Illuminatiam, a verified account that mentions the illuminati.am website;
- IlluminatiMP, mentioning the illuminati.mp website;
- DODistribution, linking a website called DepartmentOfDistribution.com.
As a result of this, we managed to identity a network of unequivocally connected websites and social media accounts that share basically identical content.
Part 2. Telegram channels
Simultaneously to the network analysis of websites and social media pages presented earlier, we looked at a total of nine Illuminati-focused Telegram channels (listed in Table 1). A necessary disclaimer is that the first and the second part of the analysis progressed in parallel, therefore the order according to which these next sections are outlined is merely a matter of presentation rather than consequentiality.
1. Selecting messages of interest
To skim through the huge amount of messages and select the most useful ones we kept in mind that our goal was to acquire relevant information for the purpose of attribution. Therefore, we decided to extract all the messages that contain at least one of the following keywords:
- WhatsApp;
- “Contact us”;
- Wa.me;
- Email;
- Gmail.com.
On a side note, none of the chats contained references to the four domains mentioned previously (i.e., illuminatiofficial.org; illuminati.am; illuminati.mp, and dodis.co).
The criterion allowed us to select only 110 messages among over 14,796, reducing the sample to less than 1% of the initial size. These messages were then processed, and relevant information extracted.
After analysing this dataset, we did not find any information that matches previously acquired leads, meaning that emails, phone numbers, or other relevant information extracted do not appear at the same time on Telegram and Facebook.
2. Scam risks
Users occasionally shared that they were asked for a fee (ranging between $115 and $600), which would allegedly cover registration and the “Freemasonry regalia uniform and your freemason ring”. Some complained that they got scammed and were ignored after paying the required fee.
In general, chat members are asked to contact a recruiter or ‘Grand Master’ via Telegram or WhatsApp and so we did, using a VOIP number, in a final attempt to grasp additional information on the scam without exposing our identity. However, the person we reached out to demanded personally identifiable information, including three photos, so this was not a feasible option due to privacy and security concerns.
Therefore, at the current stage, we have not been able to identify a connection between the domains and social media pages highlighted in the first part, and the Telegram chats described so far in the second part of the investigation. Hence, the next section will focus on the recurrent disinformative strategies used by these outlets.
3. Analysing disinformative tactics on Telegram
The most common disinformative tactics in which the selected Telegram outlets push stolen content and false narratives are presented here.
- Reposting the same content
Different chats, allegedly administered by different actors, recurrently share the exact same content, whether these are photos (Figure 11) or copy-pasted text messages (Figure 12) promising immediate wealth, fame, and power, and inviting subscribers to contact recruiters. This is a common trait of the chats we analysed, which raises concerns about whether they were the creators of the content shared – especially the photos.
For example, several photos posted in the “Join the Illuminati Brotherhood” chat on 9 December 2021 at 4:11pm and seen by 2k subscribers, were re-shared in the “ILLUMINATI FRATERNITY 666” chat the next day, 10 December 2021, and seen by less than 700 users. Although this does not say much regarding the possible coordination between the two channels, it certainly shows a tendency to imitate content.
- Imagery of wealth (and the occasional devil)
Piles of money and luxury cars are a recurrent aesthetic across these pages, claiming there are “benefits for newly initiated members”.
To convince people to join, fabricated finance-related claims are made about a global control of banks, and, for this reason, members of the group can allegedly print money limitlessly, which explains their fortune. This and other messages contain occasional references to Satanism, shown in the repeated use of the Antichrist number “666” and salutations as “Hail Lucifer”, although we ran across the reassurance that there is “no blood sacrifice involved” for joining.
- Stolen images of Freemasons
The Illuminati conspiracy is often connected to the Freemasonry, as they crossed paths in the past, and the latter organisation asks its members for discretion, which feeds into prejudice, suspicion, and a misleading idea of secrecy. From these considerations, we had reasons to believe that the images of Freemasons present on the chats were stolen from elsewhere and shared to make subscribers believe they belonged to alleged members of the Illuminati. A reverse image search confirmed our hypothesis: as shown below, the photos that appeared on 25 January 2022 on the “New World Order” channel were taken from the Facebook page of a masonic lodge in October and November 2021.
Masonic symbols are repeatedly shown, such as the square and compasses. Moreover, images of masonic temples or masonic-inspired locations are also presented, like is the case of a lodge in the Wisconsin (Figure 16) or a themed wedding venue in Michigan (Figure 17).
- Stolen images of prominent figures
The conspiracy Telegram chats also shared images of prominent figures, with insistence on who a reverse image search revealed to be now deceased Giacomo dalla Torre del Tempio di Sanguinetto, the 80th Grand Master of the Sovereign Military Order of Malta, photographed below with Pope Francis.
Another recurrent character is former U.S. President Barack Obama, who is portrayed below as he awards the 2013 Presidential Medal of Freedom to Cordy Tindell Vivian, together with masonic symbols and piles of cash.
- The Illuminati testament
The investigated Telegram spaces make reference to a book titled “Illuminatiam: The First Testament Of The Illuminati”. A reference to it is also made in the first part of the study: the bio of the Illuminatiam Twitter account (Figure 7) says “Read the Illuminati Testament: illu.link/illu7”. The link redirects visitors to the illuminati.am website, where one can click on the “order now” button and find it on Amazon, authored by Illuminatiam.
In the Amazon link, an HTTP parameter caught our attention, namely the affiliation ID “tag=illuminatiam-20”. This means that for every purchase made by customers using the link, the associate gets a commission. Further inquiries failed to assess the number of other URLs containing the tracking ID cited above. In particular, we had to stop our investigation here because of the impossibility of Google web searches to contain search terms with punctuations.
Conclusion
The investigation sheds light on an unexpected side of the Illuminati conspiracy theory and its believers: those who want to be part of the global elite rather than expose it. In the first part, we identified a network of websites and Facebook pages that have the same tracker IDs. In the second part, we explored a total of nine Telegram chats that often share the same content. Overall, we were not able to demonstrate who is behind these outlets, whether the first (websites and Facebook) and the second (Telegram) outlets are connected, or if the Telegram channels are managed by the same actors. Despite these limits, our analysis aims to emphasise the exploitative approach to disinformation that malign actors maintain, by recycling the same graphics, images, and texts to promote a scam.
Pretending to be members of a non-existent society, disinformers exploit people’s vulnerabilities and aspirations to enter a rich and influential elite. This is carried on through a combination of solemn-sounding messages, empty promises of a lavish lifestyle, and (on Telegram) the systematic use of stolen images of Freemasons, religious chiefs, and politicians, exposed by reverse image searches. This exacerbates convictions in a dangerous conspiracy theory that, once the deception is unveiled, risk to reinforce anti-establishment and discriminatory sentiments.
This deceptive approach is further enabled by platforms, as in the case of the Google ads in the very beginning of our study, the verified account on Twitter, as well as the merchandise sold on Amazon. In view of that, besides recurrent visuals and messages, references to the “Illuminati testament” resurfaces in both the first and second part of our analysis. The question whether there is some level of coordination between these outlets or different malign actors are exploiting the same deception remains open.
