STORY UPDATED: check for updates below.

Forget Macedonia, the real capital of fake news might just be Accra in Ghana

On April 17, 2018 former First Lady Barbara Bush passed away but a full day earlier an article prematurely announcing her death from a website pretending to be CNN managed to rack up a combined 2.3 million likes, shares and comments on Facebook. Barely a week later a similar site pretending to be the New York Times got a quarter million likes, shares and comments on a false story claiming her husband George H.W. Bush had now also died at the age of 93.

Fake News: Former First Lady Barbara Bush Did NOT Die At 92 (UPDATE: She Did Now) | Lead Stories

STORY UPDATED: check for updates below. UPDATE: Barbara Bush did now pass away on April 17, 2018 as reported by the NY Times: As the wife of the 41st president and the mother of the 43rd, George W. Bush, Mrs.

(Facebook engagement count of Barbara Bush death hoax, courtesy of get.trendolizer.com)

To give some perspective on those 2.3 million engagements: BuzzFeed News published a list of the top 50 fake news articles of 2017 at the end of last year. The stories in positions one and two on that list received 1.2 and 1.1 million Facebook engagements respectively. The Barbara Bush death hoax got those amounts combined and most of it happened in a single day. Yikes!

An investigation by Lead Stories in collaboration with Jeremy Massler of Manic News has now revealed the origin of these sites and the many, many other ones that made up a vast network of fake news websites that had been operating since at least the beginning of 2016. The hub of the network seems to be centered in Ghana, Africa. Move over Veles, Macedonia, the new capital of fake news might just be Accra.

The Network

Let's start from the beginning: the site breaking-cnn.com that published the Barbara Bush death hoax was being used to promote the (now defunct) Facebook page https://www.facebook.com/World-News-1061040047315656 back in September of 2017 according to records kept by Lead Stories.

That same page was also promoted at various points in time by these websites (all defunct now):

• breaking-bbc.co.uk
• radiogtv.com
• tv-bbc.com
• usanews-tv.com

From these sites Lead Stories was able to drill down into the network by comparing advertising tags, Google Analytics ID's, IP adresses, historic WHOIS records and various other bits & pieces of data. In the end we found over 80 connected sites, you can see the full list here along with some of the properties we used to link them to each other and a list of their most popular articles on Facebook (and the number of engagements there).

The site breaking-cnn.com had ID's from the MGID advertising network on it (212510 and 223718) which were also found on these two sites, neatly linking the Bush death hoaxes together:

• theguidian.com
• nytimes-news.com

Both these sites were recently used for spreading death hoaxes and on both we found a code from the MGID advertising network linking it to the site dream1k.com (archived here), which offers to donate $1000 to someone that needs it according to its about page:

Welcome to Dream1k.com. Dream 1k is a philanthropic project embarked on by Travel Blogger, Akesse Sanza of Jetsanza.com.

Dream 1k is here to unlock potentials by providing funding for persons who think $1,000 can help them run a business, handle educational needs, pay off medical bills, run a community project, or any special activity that seeks to develop persons or the society.

Dream1K is hosted on the IP address 198.71.233.195 which is also used by jetsanza.com and several other sites in the fake news network (most notably glonews360.com). But more about that in a moment.

Fake news themes & tactics

When looking at the sites in the network and the types of fake stories posted on them several patterns started to emerge. Many of the sites would hide their true nature by only publishing real news copied from legitimate sources on their front pages while hiding the hoaxes on pages deeper down. Generally the domain names of the sites were chosen to resemble the names of legitimate news outlets but with things like 'news', 'breaking', 'tv' or 'channel' added to it: bbc-tv.com, nytimes-news.com, tv-cnn.com, breaking-cnn.com, cnn-channel.com, elpais-tv.com. Other times the names were simple misspellings or letter/number substitutions of real news website domain names: theguidian.com, 1ndependent.co.uk, m1rror.com.

Stories from the network were sometimes aimed at audiences in different specific regions or countries but these would often appear side by side on the same site with articles meant for completely different audiences. We found news about politicians, celebrities and local issues from the Caribbean, various African countries, the Philippines, various European countries, the U.S., Australia, Latin America... Some sites would even mix articles in English, French or Spanish. Very often the same articles would be repeated over and over again but with names and places changed or even translated in a different language.

One popular theme was visa-free travel to the United States or Europe soon becoming possible from a country or region. We debunked several such stories in the past mentioning Guyana, Jamaica, Trinidad and Tobago, The Phillipines, Nigeria, Uganda, Ghana And Malawi, Ghana, Ethiopia And Kenya, the entire Caribbean...

Another favorite trope was celebrities being arrested at an airport with 2kg (or sometimes 20kg) of cocaine. Here's a recent example of a story like that. Or the story about a restaurant serving human meat that kept happening in different cities all over the world. Or a story about a local kid getting 30 million dollars and a lifetime scholarship from Apple. Or stories about celebrities donating whopping sums of money to hurricane victims.

The thing the network is most famous for is a long string of death hoaxes culminating in the premature Barbara Bush death announcement that netted those 2.3 million engagements on Facebook. Usually a few days after mainstream news sources would report some celebrity or politician was ill or had been hospitalized the network would put out a death hoax claiming the person had passed away. Sceptical readers would find plenty of mainstream news reports about the victim being very ill or in hospital and would just assume the hoax site got the scoop on the death announcement. Famous victims of this practice include David Cassidy, Ken Dodd, Charles Manson, Malcom Hebden, Morgan Tsvangirai and recently George H.W. Bush. Note that in some cases the person actually did die a few days later.

The network monetized its sites using various ad networks like Google Adsense, ContendAd and MGID at different times.

Connecting the dots: Agnes, Glorian and Akesse

Back in February 2018 while researching the WHOIS information behind the domain names of two sites connected to the network (fox-news24.com and usa-television.com) the name "Agnes Arthur" popped up, a woman supposedly living in Accra, Ghana. We were unable to locate any social media profiles matching the description (there seem to be a lot of Agnes Arthur's in Ghana though).

A Google search revealed this article (archived here) on fact checking site memebuster.net that claimed a Facebook user by that name had been posting a pro-Duterte fake news story from network site usa-radio.com to a Filipino Facebook group.

Alex Kaplan, a writer at MediaMatters, recently noted that a Facebook account belonging to "Glorian Maame Nyarkoh" (archived) had been spamming the Barbara Bush hoax in a variety of Facebook groups. Glorian's profile indicates she lives in Ghana, and she has a long history of sharing links to these hoax sites. We found a second Facebook profile using her name and profile picture that was friends with the profile of Akesse Sanza, the blogger from Ghana we mentioned earlier who runs jetsanza.com.

A glance through Nyarkoh's posting history shows she has a long history of posting hoaxes from the network onto Facebook: for example she shared a texas-express.com article in September, 2017 about an alleged gang rape carried out by rescue workers during Hurrican Harvey. On November 16, 2016, Nyarkoh shared a cbn-tv.com article claiming South Korean President Park Geun-hye had resigned (an event that never occurred).

Calling Ghana...

We tried contacting the phone number of Agnes Arthur found in the domain name registration records but got a very confused sounding woman over a terrible mobile connection who wasn't able to provide us any information.

In the morning of April 24, 2018 we also sent email and Facebook messages to Nyarkoh and Sanza asking if they knew about some of the sites, Agnes Arthur and each other.

Both replied. Nyarkoh said she didn't know Sanza but she did know Agnes and that it was her friend. When confronted with a second Facebook profile we found with her name and her picture that was friends with Sanza's profile she said it was hacked and she didn't know Facebook friends in person.

Sanza on the other hand said he did know Nyarkoh but denied working together. He said Agnes Arthur ran the hosting on his websites but he didn't have any contact information for her except her email address (which matched the one we found in the WHOIS records). He claimed he couldn't find any of her social media profiles because it seemed like she deleted them and stated he met her through a Facebook advertisement. He also mentioned he should probably be getting his own hosting soon, explaining that he owned the jetsanza.com domain but that Arthur hosted it.

We also contacted the Agnes Arthur email address (mentioning two of the websites in the network and saying Sanza gave us her info) and got back a short reply:

Yes he forwarded me your email. I do own three of them and just deleted them after receiving your forwarded message.

If it's truly large, then they may belong to some of my clients. I do host sites for people as well.

The network goes dark

Shortly after our initial contact with Sanza, Nyarkoh and Arthur several of the websites in the network went offline, including some of the ones that had been most active recently: breaking-cnn.com, nytimes-news.com, theguidian.com, texas-express.com, glonews360.com and stluciantimes.com.

Simultaneously the public Facebook page for Akesse Sanza with over 200.000 fans was suddenly restricted to just visitors from Ghana:

So, who is really behind the network?

The person behind the Agnes Arthur email claimed to have owned and deleted three of the sites. That leaves about 80 other sites that we know of. All run by her 'clients'? And if she only owned three, why did all of them go dark all of a sudden along with Sanza's public page? And why do they all follow the same pattern when it comes to content, naming style and advertising networks?

Our investigation continues: we found some very interesting news articles and social media posts that merit further investigation and we are preparing a follow-up article that will do a deeper dive into how this network operated and how it got its stories to trend. To be continued...

Addendum: the list of sites in the network