A network of racially charged websites used narratives of white victimhood in South Africa to turn a profit. The website domains are owned by a South African company called CoZaNic, operated by a man named Deon Venter.

Two of Venter’s most popular websites  – SAUK Nuus and SA-News  – both publish racist content. 

SA-News, which posts primarily in English, has an entire section dedicated to an alleged genocide against white South Africans, while SAUK Nuus, which primarily posts in Afrikaans, focuses on farm murders. Venter also owns the domain southafricangenocide.com.

By using racial rhetoric and posting racist content, Venter was able to drive traffic to his multitude of websites. In doing so, he was able to either profit directly from advertisements or affiliate marketing, and indirectly by selling domains to the highest bidder.

South Africa’s racial reality

The concept of white victimhood and black aggression is often used as a political ploy in South Africa, with politicians from both sides of the political spectrum inciting fear and anger to win votes. 

White minority groups such as AfriForum, and local alt-right groups such as the Suidlanders, use laws on the expropriation of white-owned land and the controversial notion that white farmers are being systematically murdered as evidence of prejudice against white South Africans.

In September 2018, President Cyril Ramaphosa came under fire after he alleged that there were no killings of white farmers and no land grabs taking place in the country. Presidential spokesperson Khusela Diko at the time clarified the president’s statement, saying Ramaphosa was responding to US President Donald Trump’s tweet from August that year, when Trump made claims about the “large scale killing of farmers.” 

According to Diko, “[N]o one in SA is targeting white people or farmers.” Ramaphosa went on to condemn farm murders in later parliamentary appearances.

Diko also clarified that crime takes place in all communities. 

The official Twitter account of the South African government responded to U.S. President Donald Trump’s tweet regarding land expropriation and farm murders, a largely false and highly spun narrative propagated to boost feelings of white grievance. (Source: @realDonaldTrump/archive, left; @GovernmentZA/archive, right)

It is important to note that farms are isolated and far away from any emergency services, making them easy targets for criminals. While attacks and murders do take place on farms, these crimes also occur across the country, and, because farm murders are not classified as a distinct crime, calculating statistics on them is very difficult. 

Even politicians in the middle of parliamentary debates have cited different figures for farm murder rates.

The interweaving of land reform and farm murders to create a narrative of white genocide can be traced back to a white, Afrikaner survivalist group known as the Suidlanders, or Southlanders. 

The group’s spokesperson, Simon Roche (who attended the Unite the Right Rally in Charlottesville in 2017) has taken responsibility for spreading the message of “white genocide” outside South Africa, particularly encouraging the amplification of the narrative in North America and Europe. 

Roche and the Suidlanders believe white South Africans are already being persecuted, and are willing to fight if  –  or when, according to Roche  – a full-blown race war starts.

While Venter does not claim to belong to the Suidlanders or any far-right group, he amplifies the narrative of genocide against white South Africans. 

Venter’s websites used derogatory language to refer to black South Africans and claimed the Black Lives Matter movement was “evil, genocidal, abhorrent and racist.” 

He appeared to regularly copy content from other websites and edit it to suit a specific narrative, including websites that have previously been revealed to support right-wing propaganda.

The DFRLab has chosen not to include links and examples of Venter’s racist and antisemitic disinformation and propaganda.

Following the money

One method Venter used to monetise traffic to the website was programmatic advertising provided by Google’s AdSense service. AdSense provides ads tailored towards each visitor, resulting in a higher click rate than standard, static ads. It also allows websites using the same AdSense ID to be tracked as coming from the same account.

A look at the source code for SA-News indicated the website was using a Google AdSense ID that was shared with 124 other websites, including SAUK Nuus. SAUK Nuus, in turn, used two different AdSense IDs: one that it shared with SA-News, and another Adsense ID unique to it.

According to reverse analytics tools, the second AdSense ID was shared with 120 other sites, many containing the same two IDs found in the SAUK Nuus website’s source code.

Overall, the DFRLab found three different Google AdSense IDs associated with 143 different domains, all registered to the same company: CoZaNic, owned by a man named Deon Venter.

WHOIS lookups for websites using the three Google AdSense IDs associated with the websites under investigation showed they were all registered by Deon Venter of CoZaNic. (Source: DFRLab via DNSlytics)

Venter’s identity as the owner of CoZaNic was confirmed in a 2015 ruling by the World Intellectual Property Organisation (WIPO), which ordered Venter to transfer five domain names to a Swedish company after it found he registered and used these domains in bad faith.

The DFRLab also identified 23 Google Analytics IDs associated with Venter’s domains that were used to monitor traffic to the website. 

Some of these Analytics IDs were embedded into the source code of domains that did not contain Google AdSense IDs. This raised an important point: not all of Venter’s websites were monetised using Google AdSense. 

CoZaNic also used additional means  – affiliate and referral marketing  – to monetise its 143 domains. For example, an advertisement for mortgages on SA-News indicated the advertiser was registered with a South African affiliate marketing company called Offer Forge.

Hovering over an advertisement on SA-News showed the website was using an affiliate marketing company called Offer Forge to make a profit. (Source: sa-news.com/archive)

A closer look at Venter’s websites showed they were created using the same template, and slightly edited to reflect the different content of each website. Many of the websites contained the same advertisements, which click through to affiliate marketing sites.

Many of Venter’s websites were created using the same structure. (Source: volksnuus.com/archive, top left; nuus.net/archive, top right; sa-news.com/archive, bottom left; news-headlines.net/archive, bottom right)

When reached for comment, Venter denied doing it for the money and accused the DFRLab of supporting, among other things, a “globalist” agenda.

Copycat websites

One of the methods Venter appeared to use to direct traffic to his websites was via copycat websites and Facebook pages. By creating pages and websites with similar names to legitimate websites, Venter could count on the occasional accidental click to send traffic his website’s way.

A key example of this being exploited via Facebook was through a page called “Wereldwyd,” which imitated a page called “Wêreldwyd”. (The “Wereldwyd” Facebook page was removed during the course of the DFRLab’s investigation). 

Wêreldwyd (“worldwide” in English), a website created by AfriForum, publishes news and information to help South Africans living abroad stay connected with the homeland. Its corresponding Facebook page has over 34,000 followers, and primarily posts information from the Wêreldwyd website or content from other AfriForum media websites.

The only difference between “Wêreldwyd” and “Wereldwyd” on Facebook was a single special character. Considering special characters are difficult to find and use when searching Facebook, users might simply forgo the special character and accidentally click on “Wereldwyd” in their search for the actual “Wêreldwyd” page.

The Facebook page associated with the official Wêreldwyd website on the left, next to the imitation Facebook page operated by Deon Venter on the right. (Source: Wêreldwyd/ archive, left: Wereldwyd/ archive, right)

It would appear Venter’s goal was for people to accidentally click on his Facebook page. The page’s About section encourages users to believe Venter’s page is the Facebook page for the legitimate Wêreldwyd website by using the special character.

The ‘About’ section for Venter’s Wereldwyd Facebook page uses the special character in its description of the page, encouraging users to believe the copycat page is the legitimate page for the Wêreldwyd website. (Source: Wereldwyd/ archive)

The page further aims to confuse by linking to a website called wereldwyd.com. The only difference between the website Venter links to and the legitimate website was the domain, as the legitimate Wêreldwyd website uses a co.za address. 

To further increase traffic to his site, Venter’s “Wereldwyd” Facebook page primarily contained links to articles published by his other websites, namely SAUK Nuus and SA-News.

But the “Wereldwyd” Facebook page and website was only one example of this tactic. 

Of the 124 websites Venter has associated with his three Google AdSense IDs, several of them bore very similar domain names to well-known legitimate outlets. 

For example, 5-fm.co.za and 5fm.mobi appeared to be copycats of 5fm.co.za, a radio station owned by South Africa’s public broadcaster. 

Similarly, users looking for information about Cape Town International Airport might accidentally click on capetowninternationalairport.com or cape-town-airport.com, both owned  – and monetised  – by Venter.

Perhaps the most misleading site was Nuus.net, which called itself SAUK Nuus. (SAUK is the Afrikaans translation of SABC, the South African Broadcasting Corporation). Under the “Contact Us” section, the site does clarify the relationship (or lack thereof) between the SABC and SAUK Nuus, claiming the page was started as a form of protest against the broadcaster’s refusal to publicise information about white genocide.

Under the Contact Us page of SAUK Nuus, there is an explainer detailing that the site is not an Afrikaans version of the official state broadcaster (the SABC), and that it was created as a form of protest against the SABC and its ‘genocide against Afrikaans’. (Source: SAUK Nuus/ archive)

Although the public broadcaster no longer goes by its Afrikaans acronym, anyone searching for “SAUK” on Google will see Venter’s website before they encounter the current website for the SABC.

Redirecting traffic

Clicking through to wereldwyd.com redirected users to a page to the same SAUK Nuus website that displayed search results for the word “wêreldwyd.” Although users would know they had been directed to the wrong site, Venter would have successfully increased traffic to his website.

When Facebook users click the link displayed on Venter’s Wereldwyd Facebook page, they are redirected to a page on the SAUK Nuus website displaying all references to the word ‘wêreldwyd’. (Source: SAUK Nuus/ archive)

The redirecting of websites seems to be a common feature of Venter’s websites. For example, EuroWars.org is a website linked to a Twitter account @EuroWarsOrg. The account tweets exclusively about conservative British politics.

But visiting EuroWars.org instead redirects the visitor to another of Venter’s websites, news-headlines.net. The site is styled thematically similar to other “news” websites operated by Venter and contains the same affiliate marketing advertisements seen on his other websites.

A screengrab of the news-headlines.net website after being redirected through EuroWars.org. (Source: news-headlines.net/archive)

Similarly, the @CozaNic Twitter account links to a website called cozanic.com. However, when clicking on the site, users are redirected to another of Venter’s websites, who-is.co.za, where he advertises domains for sale starting at R50 (about $3.01) per month. Whois.co.za is the official domain for South Africa’s domain name registrar.

Venter went through all this trouble in order to drive up the traffic to his websites: the more traffic a specific domain name receives, the more valuable it is to prospective buyers.

This is evident from tweets by the @CozaNic Twitter account announcing auctions of Venter’s sites, with pricing based on the number of search hits on the website. The Twitter account also hints at the legal dispute with Match.com referred to earlier.

The Twitter account associated with Venter’s company, @CozaNic, posted information about website auctions. (Source: @CozaNic/archive) The domain name CoZaNic.com is available at a negotiable price, advertised on another of Venter’s websites. (Source: yell.co.za/archive)

Ultimately, Venter created a way to increase traffic to his multitude of websites by capitalising off racially charged content. In doing so, he was able to amplify the narrative of white victimhood while simultaneously turning a profit. DM

Tessa Knight is a Research Assistant, Southern Africa, with the Digital Forensic Research Lab (@DFRLab) and is based in South Africa.

The DFRLab team in Cape Town works in partnership with Code for Africa. This article was first published on Medium.