You click on a link and the outline of a familiar news site appears on your screen.

The article that loads makes some incredible claims, but something is not quite right. The website address, or URL, is very similar to that of the site you thought you were on. But it is not exactly the same. 

Welcome to the world of website spoofing – a technique used by internet criminals and tricksters to fool people into visiting fraudulent websites by mimicking legitimate and recognised ones.

Spoof sites will often look extremely similar to the website they are imitating and will also have a very similar web address, for instance, www.timesofmalta.eu rather than www.timesofmalta.com.  

Spoofing is a form of phishing - a social engineering online attack in which a person or entity dupes a victim into handing over their data, including passwords or credit card information, by posing as a trusted person, company or website.

Locally, phishing attacks have risen exponentially over the past year, with online fraudsters posing as several local companies and even the COVID-19 vaccine service to try and steal user data. 

Common theme to local spoofs

A concerted disinformation campaign targeting Malta in the past days has relied heavily on spoofing, with fake pages seeking to mimic websites run by Newsbook, Net News, TVM and even Times of Malta.

The content of the false stories being disseminated locally varies, but it all seems to be connected by a common theme: discrediting critics of Yorgen Fenech and casting doubt on the case being made against him.

Fenech stands accused of complicity in the murder of journalist Daphne Caruana Galizia.

One of the principal stories circulated claimed that state witness Melvin Theuma, whose testimony has been central to the case against Fenech, lied under oath and was advised by the police to continue lying lest his presidential pardon be revoked.

A spoof website mimicking Lovin Malta published this false story.

The fake news report closes off by saying that the case against Fenech is based on false information and that “there is no question of a fair trial and should result in inadmissibility”.

False claims through legitimate news sites are also being made about Jason Azzopardi, namely that he actively consumes hard drugs, goes cruising and was at one point in a relationship with Manuel Delia.

Azzopardi appears parte civile on behalf of the Caruana Galizia family during the criminal proceedings against Fenech, and in his role as an MP has been critical of Fenech and his alleged wrongdoings.

Delia has also been the target of a smear campaign, with fake emails pretending to be from him claiming he was suffering from a mental illness and taking medication.

Fenech’s lawyers told Times of Malta that their client categorically denied having anything to do with the disinformation campaign.

Is website spoofing legal?

While spoofing is not a criminal offence locally, it could be used as a “precursor” to criminal activities, including fraud, impersonation, blackmail and defamation, among others.

“Website spoofing can lead to a number of illegal activities including violations to intellectual property rights, including but not limited to trademark and copyright infringement,” explained Antonio Ghio,  president of the Malta IT Law Association and lecturer in ICT law and cybercrime at the University of Malta.

Newsbook has also been targeted by the disinformation campaign. Note the incorrect URL.

“These would not be matters for the police but for the civil courts,” he said.

“Things are compounded as these are shrouded in layers of anonymity and proxies, which renders any enforcement and protection more difficult. Furthermore, such sites would be typically hosted outside of Malta which also renders immediate redress more problematic.”

So what can websites do about spoofs?

Journalist Matthew Caruana Galizia told Times of Malta that in terms of enforcement, there was not much that could be done as in many jurisdictions spoofing a website is not necessarily a criminal offence.

“What the police can do is limited. In this case the spoofed websites were hosted in the United States, so the police would have to send a request to that jurisdiction, which is not the most efficient way to deal with the problem,” he said.

Such attempts were rarely taken seriously by foreign authorities and requests for information were often ignored, he added.

He said the most efficient means for the targeted websites to deal with the problem was by issuing a Digital Millennium Copyright Act (DMCA) takedown notice if their intellectual property, copyrighted material or trademarked brands were being hosted illicitly on a spoofed site.

“Issuing a DMCA is a common practice and thousands of these requests are filed every day. A lot of the time the process is even automated,” he continued.

“If a brand you own is being copied without permission and the hosted material is violating your copyright, big website hosting companies tend to take these notices seriously.”

Delia said his lawyer sent a request to the US host company, Namecheap Inc, for the spoofed content posing as his blog to be removed. While the company did not respond to the request, the next day, all the spoofed websites in question were no longer accessible.

The challenge of making laws against fake news

The explosion of fake news on social media needs to be regulated with a measured and steady hand, Ghio said.

“The regulation of false information and fake news, especially in an online world, is a very delicate matter. Regulation is very difficult to design and is dangerous,” he said.

“While it would be simple to introduce legal provisions criminalising fake news, it would all be a matter of who is enforcing those laws. Imagine if we had such laws under an authoritarian or anti-democratic government where even real news would be taken down through the force of law because the ‘authorities’ would consider them so. Pure Orwellian territory.

A false story on a spoof website imitating TVM.

“Such regulation cuts both ways. Freedom of information law is a complex balancing act between our fundamental right to share and impart information and other rights such as privacy and intellectual property rights.”

Ghio said that protecting a brand and domain through trademark registration would improve one’s legal position when filing complaints, however further education is required to combat the issue.

“Education is the most important tool to fight fake news. Do not believe everything you read online and make sure that you always get your news from the proper sources and not from what appears on your Facebook feed.”