How a disinformation network exploited satire to become a popular source of false news on Facebook

A couple of days before Christmas, a fabricated story about a Donald Trump rally went viral on Facebook.

Published by AJUAnews.com, the article claimed a Trump rally in Chicago had drawn massive crowds — evidence that Democrats in the liberal Midwestern city were turning on their party to support the president in 2020.

"The event saw upwards of 150,000 people arrive to witness our leader’s word and to show their absolute support for his reelection," the story reads. "But to look at the usual media sources, one would think that this celebration of leadership didn’t happen."

That’s because it didn’t — the article is false. Trump visited Chicago for the first time as president in October, not December. Aside from protesters, there’s no evidence that Democrats turned out in droves. Plus, the lead photo shows the 1985 Live Aid concert, not a Trump rally.

But the story attracted plenty of readers. It’s the most popular story AJUAnews has published since the website was registered in early December. It has racked up nearly 200,000 likes, shares and comments on Facebook, according to BuzzSumo, an audience metrics tool.

Topping it off, AJUAnews didn’t even create the hoax.

Over the past few months, made-up news stories originally published as political satire have been copied and reposted as genuine news, then shared to large audiences on Facebook. The articles published by AJUAnews.com and similar websites include death hoaxes about celebrities and made-up stories about Democratic congresswomen wanting to slash entitlement programs.

Facebook identified the posts as potential misinformation and shared the stories with fact-checking partners like PolitiFact. (Read more about our partnership with Facebook.) Once we fact-check a false post, its future reach is decreased and users who try to share it receive a warning.

As we fact-checked post after post with false headlines — "Carol Burnette dead at 89 — a huge Trump supporter lost," "‘He’s Low Risk,’ Said Obama Before Freeing ISIS Leader Al Baghdadi," "Cory Booker’s son charged with assault after attack on Santa" — we uncovered a network of more than 100 hoax websites. 

That network appears to be run by a Pakistani man who makes money by buying and selling websites. He copies ridiculous stories from a notorious American satirist and posts them onto his sites without any disclaimers that it is wrong.

Facebook took down several pages and accounts associated with the network after PolitiFact flagged them. But the websites still duped thousands of Americans at the start of another presidential election — and they reveal how easy it can be for scammers to leverage social media to cash in on disinformation.

For online misinformers, stealing alleged satire and turning it into false news is a common tactic. To understand how it works, let’s take a closer look at the Trump rally story.

DailyWorldUpdate.us originally published the article in early December. The website is part of America’s Last Line of Defense, a network of sites that publish made-up stories aimed at tricking conservatives into sharing them.

The original satirical story got only a fraction of the engagement that AJUAnews’ version did: around 14,000 likes, shares and comments, according to BuzzSumo.

Maine resident Christopher Blair runs the network. Blair has claimed his work is satirical, even though many social media users aren’t in on the joke. He points to disclaimers on his websites that warn users that the content is made-up despite the salacious headlines.

But when those stories are copied and published on other websites like AJUAnews, those disclaimers are often stripped away, making it look like they are genuine news articles.

PolitiFact analyzed each of the more than 30 stories AJUAnews has published since it was created in early December. Almost all of them were directly copied from America’s Last Line of Defense.

In an email to PolitiFact, Blair said he is aware of AJUAnews and other sites that use his content to generate clicks. His approach to fighting the copy-cat sites is to work with his fans and report the imitators to fact-checkers.

RELATED: If you're fooled by fake news, this man probably wrote it

For misinformers looking to make a buck online, it’s a fairly common practice to republish satirical or conspiratorial content — especially among spammers abroad.

After the 2016 election, a slate of false news websites started to steal Blair’s content in an attempt to drive engagement on social platforms like Facebook. BuzzFeed News reported that, instead of attempting to make money from ads placed on the articles, the scammers tried to install malware on readers’ computers. The sites operated from countries like Macedonia, Kosovo and the Republic of Georgia.

AJUAnews is the latest example of this trend.

Several links on the site try to get readers to download anti-virus software they don’t need. According to domain records, the website was registered in early December and is using a Google AdSense plugin for WordPress.

Those are two telltale signs of a disinformation operation set up to monetize falsehoods. False news sites are often very young, lasting just long enough to generate revenue without alerting search engines and social media platforms to the fact that they’re fake. AdSense is a quick and easy way for those sites to make money, as Google automatically matches advertisers to relevant websites and takes care of the billing process.

"It’s absurdly lucrative, almost like printing money," said David Carroll, an associate professor of media design at the New School's Parsons School of Design. "Facebook targeting makes it so easy to buy access to audiences that engage with junk content and then arbitrage the traffic off of Facebook."

Since the owner of AJUAnews opted into certain domain privacy settings that shield their personal information, we could not immediately see who or what was behind the website. But after some digging, we found a network of similar spam websites that all appear to be related.

AJUAnews isn’t the only new hoax website to profit from other people’s false stories over the past several weeks.

PolitiFact found dozens of similar websites that have also republished made-up content from Blair and other sources over the past few months. Using a combination of public domain records, AdSense tracking codes and advanced Google searches, we determined that at least 104 of them appear to be run by the same person or entity.

Most of the websites we identified share some common features. They bear names for made-up news outlets, such as "Dos Palos News" or "Ohio Press Pro." They have similar, basic WordPress templates. While some of the sites cater to niche topics like quilting or mental health, many of them republish content from America’s Last Line of Defense, other satire sources or conspiratorial websites.

According to BuzzSumo, the network we identified regularly gets hundreds of thousands of likes, shares and comments on Facebook. AJUAnews is the most popular, and stories are often shared in large pro-Donald Trump or Fox News fan groups on Facebook.

For example, a Dec. 25 story falsely claiming that House Speaker Nancy Pelosi "wants to empty Social Security to pay the national debt" got more than 125,000 engagements on Facebook, including in groups like "THE TRUMPERS!!!" and "Women United For Trump." 

For comparison, the story would have landed in the top 10 most engaging Breitbart stories of the past month — and Breitbart is one of the most popular publishers on Facebook.

Several posts linking to the Pelosi story were deleted after PolitiFact flagged AJUAnews to Facebook. In an email, a company spokesperson said it has been investigating the spam network and will continue to take action as needed.

"These pages and accounts violated our policies including against spam and fake accounts by posting clickbait content to drive people to off-platform sites," said a spokesperson for the company.

When readers click headlines on many of the sites in the network, they are redirected to spam links for software or games. The stories have similar ads: polls on whether readers support Trump and comment boxes with different emoji reactions. And many of the URLs end in ".pro" or ".xyz," another indicator that they’re not reputable news sources.

We found more commonalities in the source code.

Most of the websites use either AdSense tracking codes or WordPress plugins. Using public domain tools, we were able to connect many of the sites to the same 13 tracking codes.

"Fraud and anti-fraud is a cat-and-mouse game, so I would expect fraudsters to go through the trouble of using more IDs to evade detection," Carroll said.

RELATED: The latest PolitiFact Facebook fact-checks

Like AJUAnews, most of the sites were registered within the past six months. While the majority of the sites have also opted into privacy settings that hide their owners’ whereabouts, 10 of them turned up locations in Pakistan.

Nearly all of the sites we identified also share the same hosting provider: an American company called NameCheap. Since its services are fast to set up and relatively inexpensive, the company is a popular option for online scammers. 

Put together, those findings suggest the network is run by the same person or entity. We set out to figure out who or what it is.

The person who appears to be behind the false news network is a Pakistani man, Kashif Shahzad Khokhar, who regularly uses his search engine optimization and marketing expertise to sell illicit web services online. 

To find Khokhar, we first searched the web for the network’s most prolific author: someone who goes by the usernames "dashikashi11" and "dashikashi1100." The author’s email was listed on a couple of stories.

That took us to Black Hat World, a popular marketing forum where practitioners share advice on everything from growing an Instagram following to "black hat" marketing tactics like exploiting search engine rankings (a practice known as "spamdexing").

The email associated with "dashikashi11" and "dashikashi1100" is also associated with a user on Black Hat World who goes by the username "theqavish."

Theqavish appears to be an experienced SEO spammer. His profile lists his occupation as "SEO/SEM/Money Making." 

"I am selling my website on flippa (a website where people can buy and sell websites) hollywoodkingdom dot com," theqavish wrote in one of his earliest posts, dated Oct. 22, 2010. "I am very curious and nervous that how much i will get from this website."

Theqavish’s profile on BlackHatWorld.com, where digital marketers trade illicit SEO strategies to game search engines and turn a profit. (Screenshot)

Black hat marketing is big business. BuzzFeed News reported in December about how hackers will get paid to break into compromised websites and insert links from clients. Those clients tend to congregate on forums like Black Hat World, where users regularly buy and sell SEO services.

Over the past decade, theqavish has discussed creating shell websites for the purpose of gaming Google search results and generating traffic. 

In a February 2014 post, theqavish estimated that he made around $1,000 per month from AdSense. But it took a lot of investment — in a May 2019 post responding to another user’s frustration with such services, theqavish quantified how much he had invested in his online business.

"Its been 8 years and after using 100s of services and spending almost $100k on seo, it has been revealed that there are more than 10 factors which affect site ranking," he wrote.

Theqavish also deals in buying and selling Facebook pages and the profiles that like them. In a post from September 2012, he inquired about buying a "funny pictures fanpage" with "10k-200k fans." He requested to meet sellers in person and gave his location as "Rawalpindi/Islamabad" — two major cities in Pakistan.

PolitiFact asked Facebook for more details about the pages it took down, as well as what it had learned about who’s behind the network of spam news sites. The company did not provide any comments on the record.

Theqavish has a matching profile on Apple Matters, a website on which users discuss Apple products. The personal website listed on that profile is KashifShahzad.com.

The URL now appears to be a shopping website and, using a tool called Complete DNS, we found evidence that Shahzad could have stopped using the site in either 2012 or 2015. But the name is consistent with other theqavish profiles we found online, including those on LinkedIn, Flickr and a freelancing website. Several of those profiles list Rawalpindi, Pakistan, as the user’s location — the same city he mentioned in a Black Hat World post in 2012.

The Skype profile included on theqavish’s Black Hat World profile lists Shahzad’s full name as Kashif Shahzad Khokhar. According to the profile, he currently lives in Sharjah, United Arab Emirates. We couldn’t find much about Khokhar online. But he appears to be behind the network of false news and spam sites we identified.

Using public domain records, we linked Khokhar’s name and email addresses to nearly 200 other websites — ones in which he did not opt into privacy settings that hide his identity. Most of the sites are expired and were created in 2016 and 2017 using NameCheap hosting. Some appear to have been false news sites, bearing names like "ALNewsNetwork.press" and "ABCNews1.us."

We reached out to Khokhar several times via Skype and email. We haven’t heard back.

See a questionable website, photo or video on your social media feeds? Send it to [email protected] and we’ll fact-check it for you.