On Sunday August 5, 2018 a fake news website using the URL yahoonews-us.com and a logo from Yahoo! News ran a death hoax about actor Michael J. Fox. Lead Stories was the first fact checking website to debunk the story:
Fake News: Beloved Actor And Back To The Future Star Michael J. Fox Has NOT Died At The Age Of 57 | Lead Stories
Did actor Michael J. Fox die at Cedars-Sinai Medical Center from complications related to Parkinson's disease? No, that's not true: the death hoax was reported by a fake news website masquerading as Yahoo! News but it is not real.
A short while later the entire domain name yahoonews-us.com was put on a blacklist by Google's Safe Browsing initiative, causing visitors to see a warning about phishing when they tried to access the site. Because Lead Stories was including an embedded image coming from the blacklisted site our debunk also briefly showed that warning page until we removed the embed.
Fake News Site Pushing Michael J. Fox Death Hoax Marked As Unsafe By Google (Along With Lead Stories Debunk!) | Lead Stories
Yesterday Lead Stories reported on a death hoax involving actor Michael J. Fox which was published by a site pretending to be Yahoo! News: Did actor Michael J. Fox die at Cedars-Sinai Medical Center from complications related to Parkinson's disease? No, that's not true: the death hoax was reported by a fake news website masquerading as Yahoo!
The security message later led AFP to include the phishing warning in an article debunking the hoax:
No, popular actor Michael J. Fox has not died
An imposter website purporting to be Yahoo! News reported that popular actor Michael J. Fox died at the age of 57. The report is a hoax that uses made-up comments from a coroner and is aimed at luring people onto the copycat website to steal their personal data.
The article implied Google was saying the site is collecting passwords and stealing bank data:
Google warns people the copycat website is engaging in phishing, which is a term for using deceptive practices online to gather personal information from unsuspecting people such as their passwords or bank details.
Lead Stories has investigated the website itself and found no trace of any attempt to collect passwords or banking details. The hoax website didn't even have contact or comment forms for personal information to be entered into. It did use cookies for statistics and advertising purposes but so does every other website, this isn't enough to qualify for "phishing" in our view.
We contacted the owner of the website through an anonymous email address we know he uses and asked him for a comment. This is what he had to say:
Yeah not sure whats going on there. Maybe just people reporting it as a knockoff site. I might do fake news but I am definitely not stealing anyone's identity or credit details. You can still access the site via mobile which does not display the 'dangerous site' message. I have deleted all the information in the story and just updated it with the below image hahaha. Will close it down later today.
At Lead Stories we don't mind the fact that fake news websites get shut down or blocked when they break the rules but it still irks us a bit when they get accused of practices they weren't engaging in. Perhaps Google should change the categories in the Safe Browsing error messages to include "Deceptive domain name" or "Brand infringement"? Or just "Social engineering"? Their own help article uses that term (and puts "phishing" as a sub-class of that) so why not put that in the error message when it is not strictly about phishing?
