Uncovering the webmaster behind an influence network in the Sahel

GPCI, propaganda as a service

The Groupe Panafricain pour le Commerce et l’Investissement (GPCI) is an important network of Russian media influence in Africa. Identified by All Eyes on Wagner back in February 2023 for a campaign in Burkina Faso, it has remained a fairly shadowy organisation. The Africa Centre for Strategic Studies suggested that the GPCI, along grassroots organisations such as PARADE International, may be directly supported by Russian Embassies on the continent.

The GPCI historical network has been managed by Harouna Douamba who founded in 2011 a pan-African NGO called “Aimons notre Afrique” in Ivory Coast and other organisations such as Coalition Afrique Engagée (CAE) and the Fédération Nationale des Ivoiriens d’Origine Étrangères.

According to Saber Jendoubi, Douamba became well known in the Central African Republic at the beginning of 2018 where he organised anti-French campaigns, brought in Kémi Seba and became in charge of the digital campaign of President Touadéra’s party, the United Hearts Movement (Mouvement Coeurs Unis) in 2021.

The NGO Aimons Notre Afrique was most likely financed by Lobaye Invest, a company directly affiliated with the Wagner group in the Central African Republic. While Douamba worked for the Information and Communication Office (BIC) in the Central African Republic, a center of influence established by the Wagner group within the Central African Presidency.

Via its subsidiary ANACOM. ANA has mainly carried out campaigns in favor of President Touadéra in the Central African Republic and of Russia and against France and the MINUSCA. ANACOM has not yet completely disappeared and Harouna Douamba has taken the helm of the Pan-African Group for Trade and Investment (Group Panafricain pour le Commerce et l’Investissement (GPCI)) specializing in communication and digital marketing. The company located in Lomé, Togo and in Casablanca, Morocco indicates that it has around forty media entities that form the entire ANACOM network.

Our technical investigation can now reveal one of the faces behind the creation of most of the new websites deployed by the GPCI. GPCI has been behind the disinformation network which has called Amnesty International a spying front and put in danger two French journalists,  A the webmaster behind a large segment of the GPCI’s network of websites is also working for a large Burkinabe consortium claiming to provide services to organisations such as the World Bank and the US AID .

Following back the trail of digital bread crumbs and identifiers left behind by the webmaster behind the deployment of GPCI websites, this investigation sheds light into the commercial backers of the GPCI, a Burkinabe consortium of companies providing various security and consultancy services.

From GPCI hosting to Linkedin, story of a webmaster

Tailing WhoIS bread crumbs

GPCI historical network of websites listed in our previous investigation is still live and is now hosted on the following IP address 162.240.96.82:

  • miroirdafrique.info
  • lecontinental.info
  • lereveilafricain.info
  • sursautdafrique.info
  • loccident.info
  • afriqueactualite.info
  • larevelationafricaine.info
  • etoileducontinent.info
  • liptakogourma24.info

The hosting of GPCI-linked websites initially revealed the prevalence of a webmaster/registrar, using the alias “Sékou Traoré” and the email address [email protected]. These details were used to register the following websites, for most associated with the GPCI network:

LOGOWebsite/URLIPDate
Le Sahelien162.240.96.8220/09/2023
Ouest Actu162.240.96.8226/06/2023
Afrique Evenementiel162.240.96.8218/04/2022
Afrique Libre162.240.96.8218/04/2022
La Fraternité162.240.96.8226/06/2023
La Voix du Sahel162.240.96.8220/09/2023
Le Gourma162.240.96.8220/09/2023
L’Info du Sahel162.240.96.8220/09/2023
Le Meilleur d’Afrique70.40.216.9013/04/2022
Union du Sahel162.240.96.8220/09/2023
Sahel Liberty News162.240.96.8221/09/2023
Afrik Times Info70.40.216.9007/11/2022

The coordinated nature of the creation of these websites is obvious. Most are linked to the same IP address, and a good percentage of them were registered the same day – 20th September 2023.

WhoIS records for these websites link their creation to a username and an email address, respectively rrdodyz and [email protected]. 

A search across social media providers and hosting platforms revealed that “rrodyz” is linked to the following accounts:

PlatformURLNotes
Youtubehttps://www.youtube.com/@rrodyz Published videos linked to Burval SE.
Instagramhttps://www.instagram.com/rrodyz/ 

Rrodyz also appears as an author for several of the GPCI websites. Some of the articles are automatically generated by WordPress theme engines, once again confirming that user “rrodyz” is actually the webmaster behind the creation of these websites.

Example of a template article written by website admin “rrodyz”, source: [lafrique.info/fighter-p...](https://lafrique.info/fighter-plane-crash-during-world-war/)

Who’s rrodyz?

The username rrodyz was matched to the name of a Burkinabe IT specialist, Rodrigue . This username was used on Instagram, a platform on which rrodyz highlighted his real identity.

Screenshot of Rodrigue Zampou, aka “Rrodyz”, profile on Instagram. Source: Réseaux sociaux

Several websites referring to his full name place rrodyz in Burkina Faso. His location is further confirmed by the Linkedin profile opened three to four months ago.

On his Linkedin Profile, rrodyz aka Rodrigue  overtly states he has worked for BBS Holding, as Company Information Security Officer – CISO and Webmaster since 2010, well before the birth of the GPCI and of the network of websites associated with its activities.

INPACT/AEOW has contacted Rodrigue who has not responded to our request for comments.

Backing up GPCI infrastructure

Having looked at the public profile of rrodyz’s linkedin page, a look at the BBS Holding website confirms that Rodrigue aka “rrodyz” is the same webmaster who registered GPCI websites and the Burval Security Equipment (Burval SE) website. 

Burval SE is listed as one of the companies part of the BBS Holding consortium. BBS Holding is led by Burkinabe businessman Harouna Nikiéma, scoring over 20 years of experience. BBS Holding is a conglomerate of smaller companies providing a broad range of safety and security services, from manned guarding to fire safety and studies.

An article written by no one else than rrodyz aka “Rodrigue” in September 2021 and sourced from Africa Intelligence, praises Arouna Nikiéma as being one of the favourite subcontractors of the United Nations Mission to the Central African Republic (MINUSCA).

Article written by rrodyz on Burval SE’s website, praising Harouna Nikiéma as MINUSCA contractor. 

What is less publicised is the fact that GPCI has runned campaigns against international organisations like the MINUSCA or international aid organisations like Amnesty International. Despite that,  Burval SE / BBS Holding’s CISO seems to be eating at both tables: working on the deployment and the daily management of GPCI websites while the. As such a big conglomerate he is working for is handling contracts with the World Bank, or advertising their status as privileged partners of a United Nations mission operating where Russian and Wagner Group influences are at their strongest. 

Is the webmaster and CISO of BBS Holding / Burval SE acting on its own, developing and running GPCI websites on the side of his official activities? Or has BBS Holding, a company working with international agencies and companies, been the engine / support office of the GPCI from the very beginning?

INPACT/AEOW has contacted BSS Holding which has not responded to our request for comments.