Jan 12, 2018
South Africa: Fake News, Financial Impact
How a fake, clickbait story spooked the rand
On January 9, a South African website ran the shock headline that the country’s long-serving President Jacob Zuma resigned. The story caused the South African rand to spike, and then tumble, as hair-trigger investors reacted to the news.
The story was a fake, but the website which launched it mimicked a genuine African news site, AllAfrica.com, which is on Twitter as @AllAfrica.
The story was quickly debunked, and the rand stabilized. However, the fake story continued to spread on social media and clickbait websites, including, apparently, in the United States.
Using open sources, we tracked the spread of the false narrative across a network of similar sites. The story was a case study in how fake news operates, and how stories that target clickbait can have a real, albeit unintended, impact.
The source: clickbait, not currency
The story was launched on a website called AllAfricaNews.co.za, and pitched as a breaking news story.
The story was lengthy, detailed, and false. It claimed that Zuma made the announcement on national television and provided copious fictional details of the event:
In an emotion-filled, nationally televised speech this morning, the culmination of months of pressure amidst immediate protest and concerns from his own party officials to remove him from office, Zuma said the newly elected leader of ANC, Cyril Ramaphosa would be sworn in to succeed him at noon on Friday, 12 January, 2018. “The leadership of South Africa will be in good hands,” Zuma said, his voice wavering.
The story was rapidly exposed as a fake , reported as such by genuine sites include SApeople.com. Given the wealth of spurious detail, including Zuma’s tone of voice, the story cannot conceivably have stemmed from a misunderstanding or error. It can only be a deliberate piece of deception, which can properly be called “fake news”.
The story caused a temporary fluctuation in the value of the South African rand, which rose sharply, if briefly, when the fake story emerged.
This currency fluctuation is unlikely to have been deliberate, or an attempt at market-rigging. AllAfricaNews.co.za is a clickbait site which appears to have been set up to drive users to native advertising, thus generating revenue for the creator. Each story is followed by a batch of links to sensational or titillating content.
Each link begins with the URL mgid.com. This is a native advertising site which offers users the chance to “generate revenue with non-disruptive branded content geared specifically for your audience.”
The copyright notice at the foot of the AllAfricaNews.co.za page gives a copyright date of 2012 and a different name, NewsPhD.com.
Searching for NewsPhD.com leads to an apparently dormant news aggregator site, which copied content from genuine news outlets. As of January 10, 2018, its top story was the death of cult leader Charles Manson, which occurred on November 19, 2017. Another of its top stories was a report that Australian politician Pauline Hanson had worn a burqa in the country’s senate, which happened in August 2017.
Again, this appears to be a clickbait site, using genuine stories copied from reputable outlets, rather than fake ones. Similar ads are appended to each story; in each case, the URL begins with api.content-ad.net, suggesting an advertising and monetizing function.
Both sites, therefore, look like attempts at revenue generation — one by reproducing genuine news and the other by posting fake news.
The domain name AllAfricaNews.co.za appeared to trade off the brand of a genuine African news website, AllAfrica.com. According to a WhoIs search, which shows when and by whom websites were registered, AllAfricaNews.co.za was registered in March 2017, and updated in September:
The site was registered to an individual called Tumelo Belebesi, in Carletonville in the province of Gauteng, South Africa. @DFRLab emailed the contact address which was given but received no answer.
That name is attached to a little-used Facebook page which also gave a location in Carletonville (as of January 10, its most recent post dated back to July 2017). This user’s biography states that they are self-employed and a graduate of the Africa Healthcare Nursing College. That, in turn, cross-references with a LinkedIn profile under the same name, and giving the same professional experience, but no further information. Neither account mentions the fake-news site; there is insufficient evidence to show whether this user is the fake-news site registrant.
NewsPhD.com was privately registered, so no contact details were available.
A genuine Fake News Network
Perhaps because of the swift debunking, the story did not spread massively online. The original version of the story received some 2,800 likes, but did not appear on a Facebook search for the headline.
A number of other websites reproduced the story verbatim. The best-performing duplicate post was on a site called texas-express.com, which was shared 160 times on Facebook. Another site, exclusive103.com, registered 92 shares.
These appear to be geographically diverse. Exclusive103.com dedicated tabs for news from Nigeria and Biafra, and was attributed to a Facebook user who gives his location as south-eastern Nigeria; texas-express.com focuses on U.S. news, mostly out of date as of January 10. Another site with a Nigerian domain name, oraclenews.ng, also re-posted the story, but only achieved 117 views and eight shares by January 10.
A further site, fox-news24.com, also shared the article. This, again, is U.S.-focused, and its URL suggested a link to the Fox News cable network. This is false: the genuine Fox network is at foxnews.com.
Some of these sites appeared to have been fooled by the story. OracleNews in Nigeria, for example, appears to be a genuine, locally-focused news site. Exclusive103.com is also news-focused, and its URLs lead to other parts of the same site, not pay-per-click ads.
Others, however, seemed to belong to a clickbait network. Texas-express.com shares the same stories and has the same design as NewsPhD.com; the stories to which it linked use the same api.content-ad.net URL shortener.
The visual style is identical with that of AllAfricaNews.co.za, whose homepage is also full of outdated stories, including the Pauline Hanson one.
Texas-express.com also showed the NewsPhD copyright sign.
Fox-news24.com reported some of the same subjects, also outdated, including Charles Manson’s death.
Its copyright gave a different name: “USA on TV”, also dated 2012. Otherwise, however, it is stylistically identical with the NewsPhD cluster, and yet again, the recommended stories beneath each article lead to pay-per-click URLs. This appeared to be another member of the same network.
According to WhoIs data, fox-news24.com, texas-express.com, and NewsPhD.com were all privately registered, leaving no indication of who was behind them. Texas-express.com was registered on September 1, 2017; NewsPhD.com on July 19, 2017; and fox-news24.com on February 13, 2017.
Conclusion
The fake story of Zuma’s resignation was launched, and mainly spread, by a small cluster of clickbait sites whose sole purpose seems to have been to attract and monetize unwary clicks.
The brief impact it had on the currency markets was almost certainly unintended: that, and the amplification by two news sites in Nigeria, appears to be an example of the collateral damage which fake news can cause.
Of the four linked sites, three were registered anonymously, and appeared to target American news, and thus, presumably, American users. The outlier was AllAfricaNews.co.za, registered in South Africa with a given name and location; we have been unable to verify the person involved.
While the name should be taken with caution, this raises the question of the relationship between the American- and South African-focused sites. They are linked by style and content, and it seems reasonable to assume that the connection is not coincidence. The purpose certainly seems to be to make money from news, including fake news. The sites could have been run from the US, from South Africa, or from a third country altogether.
Whatever the location, this appears to be a concrete example of a cluster of fake-news sites working to attract clicks — and impacting money markets in the process.
Ben Nimmo is Senior Fellow for Information Defense at the Atlantic Council’s Digital Forensic Research Lab (@DFRLab).
Donara Barojan is a Digital Forensic Research Associate at @DFRLab.
Follow along for more in-depth analysis from our #DigitalSherlocks.
