A fake news website that has caused panic in South Africa in recent weeks after being promoted by Google News is using an infamous proxy service to shield its owner’s identity.
The service — Iceland-based Withheld for Privacy — has come under the microscope for helping to protect people behind tens of thousands of sketchy websites.
The Rise Up WV website has published numerous articles since late May 2025 that spread across social media after being served to South Africans through Google’s news article aggregation service.
Among these stories was one that falsely claimed the Adjudication of Administrative Road Traffic Offences Act (Aarto) would come into effect on 5 June 2025.
The legislation includes sweeping changes to South Africa’s road law enforcement, including introducing a driving licence penalty points system.
Despite the article being debunked by the Road Traffic Infringement Agency (RTIA), the story was picked up by reputable news websites.
One publication amended its article to indicate the implementation date for Aarto was delayed until October 2025, quoting a Western Cape government official.
However, the RTIA and Road Freight Association said that there was no confirmed implementation date. The RTIA also later confirmed that the October date was an old target that was no longer relevant.
While the articles re-reporting the 5 June 2025 implementation date for Aarto did not cite sources, the timing and lack of credible sources suggested that it originated from Rise Up WV.
In addition to the fake Aarto story, Rise Up WV has published fake stories about load-shedding, petrol price cuts, NSFAS changes, social grants, and extreme weather forecasts.
In some cases, these reports contain an inkling of truth from credible sources, like predictions from the South African Weather Service for snowfall a few weeks ago, to add some believability.
One positive development is that it appears as though Google News has recently stopped surfacing articles from Rise Up WV, which should limit its future influence.
Nonetheless, Google’s support has emphasised that its news aggregation service does not create or verify content itself but pulls it from a wide range of publishers based on several signals.
“While Google does aim to show high-quality journalism, it doesn’t fact-check articles directly,” a support agent explained.
Original website owner long gone
The riseupwv.org domain was originally registered to Rise Up West Virginia, which is still mentioned in an About Us section underneath the articles.
The Charleston-based organisation is a “grassroots, people-powered” political advocacy organisation founded to “give voice to working-class communities” and mobile citizens around progressive policies.
However, a disclaimer in the About section states the website was no longer officially affiliated with the organisation, its founders, volunteers, or any related nonprofit or political organisation.
Nonetheless, it is odd for a reputable news organisation to take over a website linked with such a specific US state political advocacy movement while reporting on South African news.
According to another About Us section on Rise Up WV, the “Delhi Marketing Agency” now claims to own the site. However, we could not find any online record of this company.
Another red flag was that the website has only been publishing stories for a few weeks, with the first appearing on 1 May 2025.
The second article was posted on 28 May 2025 and seems to have been an accidental republication of a generic WordPress welcome post, with “Priya Sachedva” credited as the author.
Only one other writer’s byline appears on the website — John Mullar. There is no further information about Mullar or Sachedva anywhere else on the website.
Although these were likely fake profiles, there were many social media accounts for people with the same names, so firm confirmation that they were not real writers would be a challenge.
Infamous proxy service used to hide owner’s identity
Investigating the website’s registration details in the hopes of learning more about the people behind also did not yield any results.
The website registrant’s contact details included a street address and phone number used as the default for users of Withheld for Privacy, an entity that has become infamous in cybersecurity circles.
The privacy-focused domain proxy service was established by one of the world’s biggest domain registrars, Namecheap, and is currently in the crosshairs of Iceland’s Internet regulators.
Although Iceland’s tax department confirms the street address 2 Kalkofnsvegur as the company’s registered address, there is no outward sign that it actually operates from the six-story building.
In addition to an H&M store, the building’s most well-known tenant is the Icelandic Phallological Museum, which displays 320 mammal penises.
The New York Times has reported that several dodgy websites have used Withheld for Privacy to carry out crimes, including:
- A website that spent $1.3 million on fraudulent Meta Platforms ads targeting supporters of US President Donald Trump to steal their credit card details.
- Prestige Assets Management, which the Texas State Securities Board issued with a cease and desist for a scheme impersonating another company to deceive potential investors.
- An address linked to cyberhacking group DarkSide, which carried out a crippling attack on a US oil pipeline.
MyBroadband previously also found Withheld for Privacy’s registered address and phone numbers were used by the registrants of two scam websites falsely claiming to sell Starlink equipment and accessories.
Meta Platforms has also sued Withheld for Privacy for registering domain names that deceive people by pretending to be affiliated with Facebook apps.