News farm impersonates 60+ major outlets: BBC, CNN, CNBC, Guardian...

BleepingComputer has discovered a content farm operating some 60+ domains named after popular media outlets, including the BBC, CNBC, CNN, Forbes, Huffington Post, Reuters, The Guardian, and Washington Post, among others.

These "news" websites, which we were able to trace to their proprietor in India, repost articles from credible media and research organizations without attribution.

Beyond that though, their intentions seem multifaceted—from building SEO for their online gambling ventures to deceptively selling "press release" and "product review" ad slots at hefty prices to unsuspecting users looking to market their products online.

Content farm operates 60+ 'news' websites

BleepingComputer has identified a network of more than five dozen "news" websites that impersonate leading media outlets like the BBC, Bloomberg, CNBC, CNN, Crunchbase, Forbes, Huffington Post, The Guardian, The Metro (UK), The Mirror, The Telegraph, Reuters, Washington Times, and Washington Post.

We have released the complete list of these domains in this article below.

Sites impersonate mainstream media outlets like the Washington Post, Guardian, and CNN
(BleepingComputer)

These websites repost existing news articles taken from other sources verbatim under an "admin" author account without proper attribution, effectively plagiarising them from credible media outlets and research organizations.

As an example, notice the following article published on www.guardiannewstoday.com, which is not associated with the widely circulated newspaper, The Guardian.

BleepingComputer identified that the article, along with its headline and body, was copied word-to-word from a legitimate source, jurist.org, which is a legal news and commentary website.

'Guardian' lookalike website reposting articles from original source, jurist.org
(BleepingComputer)

Spams forums for SEO and to sell press releases for $1000

The party behind this operation frequently spams forums and comment sections of various kinds of websites with backlinks to these domains, in an attempt to boost SEO for these online properties and in turn lend credibility to them.

Of the several examples we found, below are posts made on a gaming forum, and the popular Immigration Boards forum, where community members share experiences about their UK immigration journey.

Operator spams forums to boost SEO for these lookalike news sites
(BleepingComputer)

Several forums and news sites spammed by the 'news' syndicate (BleepingComputer)

BleepingComputer also observed that in some of these comments, the operator of this network appeared to be selling advertorial slots for press releases and product reviews, starting at $50 per post or a "bulk deal" priced at $1000.

Advertorial placement spaces for these websites are being sold for a thousand dollars
(BleepingComputer)

The lure could be tempting to unsuspecting readers interested in promoting their products, who could be confusing these lookalike websites with legitimate media outlets that they mimic.

Maintains Google News and social media presence

Facebook page for the operation's 'BritishNewsToday' website (BleepingComputer)

We were further surprised to learn that in addition to running over five dozen online properties, the operator maintains Facebook pages for some of these and might have additionally enrolled them as a Google News publisher, much like real media organizations do.

Below is a search result for a Sky Sports (UK) article, a copy of which also appears on CanadianNewsToday.com, a part of this domain syndicate and visible on Google News.

Counterfeit news sites reposting Sky News stories that also appear on Google News
(BleepingComputer)

The complete list revealed

Below is a list of the 60+ live domains presently associated with this network. BleepingComputer will continue to monitor this campaign and update the list as more domains are discovered.

Any content or 'news' published on these websites should not be trusted to be coming from authoritative news sources and should be independently fact-checked.

Moreover, there is no guarantee that any products or services being marketed via promotional advertorials on these websites are legitimate, and could be part of a scam.

www.australiannewstoday.com
www.bbcnewstoday.com
www.bloombergnewstoday.com
www.bostonnewstoday.com
www.britishnewstoday.com
www.canadiannewstoday.com
www.chinaworldnewstoday.com
www.chroniclenewstoday.com
www.cnbcnewstoday.com
www.cnnworldtoday.com
www.crunchbasenewstoday.com
www.dailyexpressnewstoday.com
www.dailyheraldnewstoday.com
www.dailymirrornewstoday.com
www.dailystarnewstoday.com
www.dailytelegraphnewstoday.com
www.dutchnewstoday.com
www.dwnewstoday.com
www.europeannewstoday.com
www.forbesnewstoday.com
www.frenchnewstoday.com
www.germaynewstoday.com
www.guardiannewstoday.com
www.headlinesworldnews.com
www.huffingtonposttoday.com
www.irishnewstoday.com
www.italiannewstoday.com
www.livemintnewstoday.com
www.maltanewstime.com
www.mirrornewstoday.com
www.nationalposttoday.com
www.neatherlandnewstoday.com
www.neweuropetoday.com
www.norwaynewstoday.com
www.oxfordnewstoday.com
www.portugalnewstoday.com
www.postgazettenewstoday.com
www.republicofchinatoday.com
www.reuterstoday.com
www.russiannewstoday.com
www.scotlandnewstoday.com
www.spanenewstoday.com
www.switzerlandnewstoday.com
www.thedailymailnewstoday.com
www.thedailytelegraphnewstoday.com
www.theexpressnewstoday.com
www.theheraldnewstoday.com
www.theindependentnewstoday.com
www.theirishtimesnewstoday.com
www.theirishtimestoday.com
www.themetronewstoday.com
www.themirrornewstoday.com
www.thequintnewstoday.com
www.thestarnewstoday.com
www.thesunnewstoday.com
www.thetelegraphnewstoday.com
www.timesofnetherland.com
www.timesofspanish.com
www.topeuropenews.com
www.topworldnewstoday.com
www.turkeynewstoday.com
www.walesnewstoday.com
www.washingtonposttoday.com
www.washingtontimesnewstoday.com

Operation traced to India

Many of these domains, according to public WHOIS records, have been operational since at least 2022, with new ones gradually added over time, well into 2024.

BleepingComputer observed that most of these websites use WordPress as their choice of CMS, and share a common registrar and host, One.com.

Based on the contact information listed on some of these websites, we were able to trace them to their operator. Our preliminary analysis suggests that the operation is based in and running out of India.

In addition to abusing well-known media trademarks for SEO marketing, the ultimate goal of these online ventures is apparently to promote online gambling, sports betting, casino games, and crypto enterprises—which are among the key focus areas of the entity behind this operation.

The operators of this syndicate may be associated with jackpotbetonline.com, a sports betting and gambling company that, according to its LinkedIn page is based in Gurugram, India, and has been active since at least 2014. The company's social media account on X (formerly Twitter) was suspended.

Given the multifaceted use cases of such a large-scale domain network, it is challenging to ascertain if its activities have remained and will remain limited to SEO building and deceptively selling advertorial spaces, or could this network evolve in the future to disseminate fake news and disinformation, which it can very well do.

This discovery is reminiscent of a 2023 NewsGuard report that unveiled an unrelated network of domains pushing AI-generated articles that were also attributed to an "admin" account.

Even if the proprietors of this business can get away with trademark violations by claiming that the names of their websites are sufficiently different from established Western media outlets and that they operate in a different geographical location, the content that these websites are blatantly reposting is still copyrighted, and subject to legal disputes.