STORY UPDATED: check for updates below.

Question: What do British singer David Cassidy, American serial killer Charles Manson, British comedian Ken Dodd, Zimbabwean opposition leader Morgan Tsvangirai and British actor Malcom Hebden have in common?

Answer: They were all declared dead recently by the same network of fake news websites shortly after they were admitted to hospital with various health problems. (In the case of Cassidy and Manson the fake news about their deaths unfortunately became real news a few days later when they eventually did pass away.)

This seems to be the newest trick in the book of a group of fake news websites: look for news about a well-known celebrity being taken to hospital, wait a few days and then announce that person has sadly passed away. Skeptics who do Google around a bit for confirmation before sharing the article will find a slew of news reports from well respected news outlets all saying the person was in hospital (likely with severe health problems) so the news of the death seems plausible enough to pass on without further scrutiny. Usually that's all it takes to make the death hoax go viral, allowing the site operators to cash in on the advertising revenue windfall.

Who?

But who is behind these sites?

• The David Cassidy death hoax was published by city-herald.com.
• The Ken Dodd death hoax emerged via abcnewgo.com (a site mimicking the real domain name of abcnewsgo.com by omitting the letter 's').
• The Charles Manson death hoax appeared on texas-express.com and florida-times.com.
• The Malcom Hebden death hoax showed up via miami-express.com and florida-times.com.
• The Morgan Tsvangirai death hoax was pushed via allafricanews.co.za.

Looking at them a little closer they all have several features in common:

• All sites appear to be running on the popular Wordpress publishing software.
• Their domain names tend to mimick existing news websites or pretend to be local news sources.
• Their main pages generally contain articles copied verbatim from mainstream news websites also found in Google News. For example, on city-herald.com we found stories from LA Times, Channel NewsAsia, Washington Post, NBC News, Bloomberg, Reuters, ABC News and MSN, all without attribution.
• Often the fake stories don't appear on the main page at all, sometimes they don't even show up in the RSS feed for the site. This can be done relatively easily in Wordpress for example with the Hide Post plugin.
• Except for allafricanews.co.za the domain names were all registered anonymously via the same domain name registrar ('Wild West Domains, LLC").

As this article from DFRLab points out, the AllAfricaNews.co.za site was registered under the name of one "Tumelo Belebesi" but it was unclear if this was the actual person behind the site.

Network

All of the sites are part of a larger network. Using the fingerprinting feature in our Trendolizer engine we were able to piece together several links connecting the sites together as illustrated in this graphic:

Sites in the network are monetized using the ContentAd and MGID ad networks which allowed us to identify several sites sharing identical Widget ID's and domain codes. This means the money made from those ads goes to the same people.

Some of the sites also used common IP addresses (note: some of the sites appear to live on multiple different IP addresses because of the way the sites are hosted). Two sites being on the same IP doesn't have to mean they are connected, it could just be they are using the same hosting provider. But if there are more links like shared advertising IDs or other connections it usually is a pretty good sign of common ownership and that seems to be the case here.

Another way to link sites together is by looking at the Facebook App ID or Google Analytics ID used in the HTML code of the pages. We were able to use this information to link several other sites to the network.

This graph makes it clear the five death hoaxes are only the tip of the iceberg. Looking back at our own archives we found several examples of very similar hoaxes pushed by these sites claiming President Trump approved visa free travel to the United States for citizens of various countries or regions: Guyana, Jamaica, Trinidad and Tobago, The Phillipines, Nigeria, Uganda, Ghana And Malawi, Ghana, Ethiopia And Kenya, the entire Caribbean...

The Editor/Dash network

Another interesting tidbit we found in our Trendolizer fingerprints database: most of the sites in the list on the right that share the "UA-75650730" Google Analytics ID also used to have a Facebook page widget promoting a (now defunct) page called "The-Editor-283812522002681" (still partially visible with the Wayback Machine). The widget promoting this page appeared on at least eighteen sites, some of which also appear in other places in the graph:

• ab.cnewsgo.com
• asianews-tv.com
• boroughtimes.com
• cbn-tv.com
• cnewsgo.com
• cnn-channel.com
• fox-news24.com
• livetv-news.com
• metro-uk.com
• news.cbn-tv.com
• newsdaily-tv.com
• online.read-news.com
• online.states-tv.com
• read-news.com
• states-news.com
• theguard1an.com
• usa-radio.com
• usa-television.com

As you can see they very often mimick the names of existing media outlets and many of them contain a dash. That is why I've been refering to this network internally as the "Dash" or "The Editor" network. Whoever is behind it is quite good at covering their tracks because I must admit I still have no idea of their identity. Any tips welcome via our contact page!