WMCLeaks: Weaponising white monopoly capital

No discussion on disinformation would be complete without mention of the most controversial of them all: WMCLeaks.

The WMCleaks website rose to prominence early in 2017, during the height of the Gupta family’s attempts to clear their name following the damning GuptaLeaks. The site, published anonymously, was used to launch smear campaigns against journalists, politicians and organisations critical of the Gupta family.

Although it was never conclusively established that the Guptas were responsible for the website, the evidence suggests that they were the main beneficiaries of the site’s vitriol.

The site became prominent shortly after the existence of the GuptaLeaks was revealed, and heralded a particularly sinister chapter in the online discourse. WMCLeaks represented what appeared to be the culmination of the family’s efforts to influence their public image. Even the name “White Monopoly Capital Leaks” hinted at the site being a counter to the trove of emails and documents that exposed the inner workings of a part of the Gupta empire.

The similarities stop there though. Whereas the information in the GuptaLeaks has resulted in scores of investigative reports, the firing of ministers, the suspension of high-profile executives and arguably even the recall of a president, the WMCLeaks campaign has been less effective.

WMCLeaks made its last post on December 31, 2017. Since then, the website has been shut down completely, and the scores of accounts responsible for amplifying its falsehoods have fallen silent.

The WMCLeaks website was shutdown.

In the website’s own words: “Truth always wins, but in sweet time.”



The website claimed to be focused on “exposing” white monopoly capital’s secrets. This invariably entailed fabricating stories about journalists, publications and organisations critical of the Gupta family.

Former Public Protector Thuli Madonsela was depicted as a grotesque caricature acting at the behest of billionaire businessman Johann Rupert, following her office’s State of Capture report. The report implicated the Gupta family in allegations of state capture investigated by her office.

The anonymous exposés targeted editors and journalists for reporting on the GuptaLeaks. Photoshopped images of editors Sam Sole, Adriaan Basson, Ferial Haffajee and other journalists were circulated when their publications started reporting on the information contained in the leaks.

A handful of Twitter users made an effort to identify scores of sockpuppet accounts pretending to be those of South Africans, which eventually became known as the “Guptabots”. They were rewarded with a WMCLeaks expose labelling them as “Twitter Master Analysts”.

The website focused on manufacturing stories that played up the Gupta family’s role as victims of white monopoly capital, and downplayed criticism on their role in state capture. Despite claiming to obtain its information from “verified sources”, the site has never produced a single shred of evidence.

First Cracks

However, WMCLeaks attempted to provide evidence once. Early in June 2017, the site ran an exposé on former Business Day editor Peter Bruce.  Bruce had previously reported critically on the Guptas.

The exposé took the form of an investigation conducted by a nameless WMCLeaks “investigative photojournalist”, depicting what the site claimed was proof that Bruce was involved in an affair.

The “evidence” was uploaded in PDF format, and contained a series of photographs and comments made by the mysterious journalist during their investigation.

But by analysing the information contained in the metadata of the document, Scorpio discovered that the document was not even created in South Africa. The PDF file’s timestamp indicated that the document was created on a computer using the GMT+0530 timezone.

India is the only country in the world that uses this timezone.

Further analysis of the document also showed that the creator of the document used the name “Saurabh”. Social media searches found that Saurabh Aggarwal, a former manager of the Gupta-owned Sahara Computers, had recently relocated to India after working for the Guptas for several years. He was employed by Sahara Computers, The New Age and TV news station ANN7.

His immigration documentation, found in the GuptaLeaks, showed that Aggarwal had given the Guptas’ address as his place of residence.

At the time, Aggarwal declined to comment on Scorpio’s findings. Yet, the website removed the links to the PDF following the questions.

This investigation provided the first tangible, albeit circumstantial, links between the WMCLeaks site and the Guptas, and also provided proof that the site was being administered outside South Africa.


The Big Reveal

The big reveal came in July 2017. News24, working in conjunction with open source investigators at Bellingcat, identified the person behind the network of sites that formed the WMCLeaks cluster.

Their investigation identified links between WMCLeaks and several other websites: wmcscams.com, wmc-scams.com, whitemonopolyafrica.com, whitemonopoly.com, fakeguptaleaks.com, publicopinion.co.za, southafricabuzz.co.za and whitemonopolycapital.com

Notice a trend?

Most of these sites were anonymously registered, but publicopinion.co.za and southafricabuzz.co.za were registered to “Adebola Adeniyi”. Adeniyi provided different addresses and phone numbers despite registering both sites on the same day. Adeniyi was a prominent Guptabot.

All the websites, except for wmcleaks.com and whitemonopoly.com, received the bulk of their traffic from India. This pattern persisted, even during the weeks that the Guptabots were actively sharing the articles from these sites.


Linking back

The investigation traced the sites using their Google AdSense and Google Analytics IDs, the unique identifiers Google uses to determine traffic to each website and where advertising revenue should be allocated. By tracing these Google IDs, 15 websites were identified that made use of overlapping identifiers. This included five of the websites linked to the WMCLeaks stable.

These digital fingerprints belonged to Kapil Garg, the chief executive of CNET Infosystems, who was the registered owner of 10 of the 15 websites. Four of the remaining sites were hidden behind a privacy proxy, and the fifth was registered to an unrelated individual.

Among the websites registered to Garg are atulgupta.info, atul-gupta.net and ajaygupta.info.

After repeated requests, neither Garg nor CNET Infosystems responded to questions concerning the existence of their Google AdSense and Google Analytics IDs on these sites. In the days following the submission of these questions though, several of the websites removed the IDs from their sites.



Despite evidence linking WMCLeaks to individuals outside South Africa, with links to the Guptas as far back as early June 2017, it remained a popular reference for the “anti-WMC” and “rapid economic transformation” brigade until late in December 2017.


This reached a climax during the ANC elective conference in December 2017

An in-depth investigation on the Twitter activity around the time of the elective conference by the blogger Superlinear identified a definite push from WMCLeaks and its Twitter accounts in favour of Nkosazana Dlamini-Zuma.

Conversely, the WMCLeaks website was severely critical of then-deputy president Cyril Ramaphosa, labelling him a womaniser and an agent of white monopoly capital. The Dodgy SA Ministers Facebook account posted a story labelled “#RamaphosaLeaks: The Black Billionaire with WMC Mind” in the run-up to the elections.  WMCscams’ page went with “Leaked Personal Emails Expose Cyril Ramaphosa’s Womanizer Conduct” about allegations at the time that Ramaphosa was having an extra-marital affair.


WMCLeaks came to a definite and abrupt end towards the end of 2017.

After Dlamini-Zuma lost to Ramaphosa at the ANC elective conference, the WMCLeaks website, Twitter accounts and Facebook pages went dormant. News24 reported that most of the accounts stopped tweeting on December 29, 2017, and the website itself was last updated on December 22, 2017.

By July 2018, a little more than a year after it started, the WMCLeaks website had been shut down completely.