Threat Level: green Handler on Duty: Jan Kopriva

SANS ISC: Question about faux news websites SANS ISC InfoSec Forums

Participate: Learn more about our honeypot network
https://isc.sans.edu/honeypot.html

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Question about faux news websites
Greetings,

Both here at work, and outside work, I am constantly lecturing people for linking to news stories on websites that are not reliable sources of information. It seems that hardly anyone anymore vets the news that they pass along. We have Snopes, but even Snopes gets it wrong from time to time (and increasingly so, in my experience).

The studying of disinformation has been one of my hobbies lately, and I am increasingly amazed the more I study just how many websites out there are, intentionally or not, involved in the passing on of disinformation.

Disinformation has a variety of uses, and is used by a variety of actors - some more dangerous than others. Sometimes these are news sites that are nothing more than clickbait. Other sites are used by nation-states to advance geopolitical strategies (as in the case perhaps of Russia using sites like RT or sputniknews). Some of the websites that come to mind:

globalresearch.ca
zerohedge
beforeitsnews
whatdoesitmean
prisonplanet
infowars
RT
sputniknews

I would find it very useful to compile a list of websites that are primary (or well-known) sources of disinformation. I am wondering what steps to take to get started in compiling such a list. Is there anything already compiled somewhere, where someone has already done some work in identifying “bad” information sources? What general guidelines would you put forth in helping to determine whether a particular site is a good source of information, or bad? (Or somewhere in-between...) We all know about whois, and other simple tools like that. But after running the basic tools, what next? Often, a simple whois is not enough.

It’s not easy to spot well-crafted disinformation. The best disinformation is around 95% (or more) true, and 5% (or less) false. That way, it is more believable, and the false information is taken in along with the good, which is why the bad guys use it.

I ran across this series of posts that I found interesting, I hope you find them interesting as well:

http://aktivnyye.com/t/20160207-fringenet1.html
http://aktivnyye.com/t/20160212-fringenet2.html
http://aktivnyye.com/t/20160215-fringenet3.html

Also, a good blog that tracks Russian disinformation is here:

https://toinformistoinfluence.com/

These are all Russia-focused, but there are other bad actors out there using disinformation to advance their agendas, or just to make money off people clicking and forwarding their stories. I think it would be great to have a more or less definitive list of the worst ones.

Best regards,

Marko
Marko

7 Posts
Here is an additionnal list of news that are well known to propagate false information:
The Beaverton CA, the Onion US, Le Gorafi FR, Der Postillon DE

I wonder why they should not be included in your list ...
Anonymous

I think the Gorafi is spreading faux news on purpose, Gorafi readers are well aware that it is just an hoax following humorous purpose.

Concerning the list, it is sad to say but most of the mainstream media has been caught spreading fake news too.
Blackgal

2 Posts
Concerning the gorafi
[url]https://en.wikipedia.org/wiki/Le_Gorafi[/url]
Blackgal

2 Posts
Quoting Blackgal:Concerning the gorafi
[url]https://en.wikipedia.org/wiki/Le_Gorafi[/url]


Okay thanks
Anonymous

Sign Up for Free or Log In to start participating in the conversation!
https://isc.sans.edu/forums/diary/1557/
isc.sans.edu
crawl=CC-MAIN-2021-31
24805
application/http; msgtype=response
sha1:HQVTMKAIM6UMHSK55LINIFBWYZR23WPY
<urn:uuid:ad7afb53-bfee-4def-a682-cb20abb8b0e3>
2021-07-28T07:03:36Z
45.60.31.34
text/html
sha1:UOHZRRPHB3TRHXK7P7ZTWCJG4Z7GPDT5
<urn:uuid:2fadf4ac-8811-46a1-a58e-f1ba4c11892c>
https://isc.sans.edu/forums/diary/1557/
response
<urn:uuid:7b060aa7-f3dc-45ef-bc60-884fb1684350>
isPartOf: CC-MAIN-2021-31
publisher: Common Crawl
description: Wide crawl of the web for July/August 2021
operator: Common Crawl Admin (info@commoncrawl.org)
hostname: ip-10-67-67-235.ec2.internal
software: Apache Nutch 1.18 (modified, https://github.com/commoncrawl/nutch/)
robots: checked via crawler-commons 1.2-SNAPSHOT (https://github.com/crawler-commons/crawler-commons)
format: WARC File Format 1.1
conformsTo: https://iipc.github.io/warc-specifications/specifications/warc-format/warc-1.1/