Disinformation of Charlie Hebdo: Analyzing a Fake BBC News Site

You may have noticed that a few media outlets have been reporting that a fake BBC website was setup to spread disinformation regarding the recent Charlie Hebdo attacks in Paris, France.On January 12, 2015 our advanced threat protection flagged the bbc-news[.]co[.]uk domain as a suspicious site. While we can’t say definitively what the motives are of the operators are, it is apparent that they are untrustworthy and potentially nefarious. The predictive classification that we used to identify and flag the site is showing the attack is very similar to former incidents that malicious actors have used in the past like the Boston Marathon malware incidents.

This post will highlight the OpenDNS Security Labs analysis of the campaign and its indicators.
Key Insights

Fake BBC themed website launch using bbc-news[.]co[.]uk domain
Social media enlisted to spread disinformation to draw visitors
A 16.5x spike in normal DNS queries to the website
Website had external links to State-sponsored (Iranian) media outlet
Prominent American economist and columnist enlisted to lend credibility to disinformation
[link to labs.opendns.com]

Check out the referral list....