When Bellingcat published its investigation into the digital connections between Viory and Ruptly, it presented multiple technical indicators suggesting an operational relationship between the Abu Dhabi-registered video agency and the Russian state media-linked outlet. The investigation identified shared SSL certificates, overlapping IP infrastructure and common backend monitoring systems while noting that both organisations denied any affiliation.
To independently assess these findings, we conducted our own open-source intelligence analysis using SecurityTrails infrastructure data, SimilarWeb traffic intelligence and Ahrefs backlink analysis. While these datasets cannot establish ownership or corporate control, they provide additional evidence of technical alignment, ecosystem dependence and content distribution patterns that reinforce many of the conclusions reached in the original investigation.
Our infrastructure analysis using SecurityTrails identified a striking overlap between the technical environments supporting both Viory and Ruptly.
Multiple subdomains belonging to the two organisations are hosted within Yandex.Cloud LLC, including development environments, frontend applications, search APIs, media asset management systems, streaming players and transcription services. The analysis includes domains such as frontend.dev.viory.video, search-api.dev.viory.video, player.viory.video and stenogram.viory.video, alongside corresponding Ruptly assets including frontend.dev.ruptly.tv, player.ruptly.tv, search-api.ruptly.video and stenogram.ruptly.video.
The mirrored architecture extends beyond public websites into backend operational services that would normally be maintained by development and DevOps teams. Similar naming conventions across critical infrastructure components suggest either a shared codebase, common engineering resources or a closely coordinated deployment strategy.
Although cloud infrastructure can be shared by unrelated organisations, the co-location of multiple functionally identical services across both ecosystems represents a significant technical association. Rather than isolated overlaps, the findings indicate parallel video distribution stacks built on the same hosting environment.
Traffic intelligence collected through SimilarWeb provides another layer of evidence. The country split shows a multi‑regional Asia‑centric audience, with the heaviest share in Indonesia, followed by Russia and Turkey.
Viory.video’s April 2026 SimilarWeb profile shows an anomalous referral traffic from a Russian login domain (passport.yandex.ru) and a sudden spike, with primary audience clusters in Indonesia, Russia, Turkey, India, and the US.
Top referrer: passport.yandex.ru accounts for 96.71% of all referrals, with a reported change “> 5,000%” for April 2026. Other referrers are marginal.
Top traffic countries in April 2026:
According to April 2026 data, 96.71 percent of all referral traffic to Viory.video originated from passport.yandex.ru, Yandex’s authentication platform. The increase exceeded 5,000 percent compared with previous reporting periods, making it by far the site’s dominant referral source. Other referring websites accounted for only a small fraction of inbound traffic.
Such concentration is unusual for a commercial news agency or video distribution platform, where referral traffic would typically be distributed across multiple external publishers.
The data may indicate that Viory is integrated into the broader Yandex ecosystem through authentication flows, embedded services or platform partnerships. Alternative explanations, including technical implementation choices or traffic acquisition campaigns, cannot be excluded. However, the overwhelming reliance on a Russian technology platform for user referrals is notable given Viory’s positioning as an independent international video agency.
Geographic traffic patterns also reveal a changing audience profile. Indonesia remains the largest source of visitors, but Russian traffic increased by more than 56 percent while Turkish traffic grew by over 63 percent during the same reporting period. This shift coincides with the emergence of Yandex-driven referrals and suggests a growing orientation towards markets closely connected with the Russian digital ecosystem.
When viewed alongside the shared hosting infrastructure identified through SecurityTrails, the traffic data presents a coherent picture of a platform whose technical delivery and audience acquisition appear closely tied to Yandex services.
Heavy dependence on a Russian identity/log‑in infrastructure introduces exposure to Russian platform policies, or potential data access. A sudden >5,000% spike from a single Russian‑linked referrer combined with a sharp rise in Russian and Turkish traffic could fit scenarios such as: onboarding by a Russian‑aligned media or tech partner, use in information campaigns, or heavy testing in those markets.
One notable example involves freelance correspondent Franco Fafasuli, whose public portfolio presents identical video material under both the Viory and Ruptly brands. At the same time, his professional LinkedIn profile highlights collaborations with major international news organisations while omitting references to either agency.
The correspondent, Franco Fafasuli, on his portfolio page [francofafasuli.myportfolio.com/video-1] posts video prepared for both, Ruptly and Viory. On his Linkedin page [linkedin.com/in/francofafasuli/] he does not mention any work for Ruptly and Viory. This discrepancy illustrates how content associated with Russian-linked ecosystems can circulate without transparent attribution in professional contexts.
Backlink analysis using Ahrefs data, combined with manual review of referring domains, demonstrates that Viory functions as a source of syndicated video content across multiple Asian media outlets. Viory content is cited by various media, mainly in Asia, and mostly with Russia-friendly coverage.
The backlink network also reveals repeated citations by Singapore-based Wake Up Singapore, which has credited Viory as the source for videos covering Vladimir Putin, Russia-China relations, strategic weapons systems and narratives emphasising Western decline. In many cases, the outlet reproduces Viory’s framing and titles with minimal editorial modification, effectively treating the agency as an authoritative video wire service.
Examples:
“Putin shares ‘great respect’ for China, ‘limitless potential’ as partners ahead of Beijing visit” [wakeup.sg/putin-praises-china-partnership/] links to www.viory.video/en/videos/a3001_19052026/interested-in-bringing-our-nations-closer-putin-shares-great-respect-for-china-limitless-potential-as-partners-ahead-of-beijing-visit
“Western nations ‘losing leading positions and giving way to new growth centres… the Global South countries!’ – Putin” [wakeup.sg/putin-global-south-rising/] links to www.viory.video/en/videos/a3017_28042026/western-nations-losing-leading-positions-and-giving-way-to-new-growth-centres-the-global-south-countries-putin
“Putin reveals cutting-edge Sarmat ICBM has ‘four times the power’ of any Western counterpart” [wakeup.sg/putin-unveils-sarmat-capabilities/] links to www.viory.video/en/videos/a3053_12052026/sarmat-icbm-has-range-of-over-35-000-km-could-be-equipped-with-nuclear-warhead-putin
“Great moment to consult with our Russian friends! – Araghchi slams US ‘excessive demands and flawed approach’ to talks ahead of Putin meeting” [wakeup.sg/araghchi-slams-us/] links to www.viory.video/en/videos/a3014_27042026/great-moment-to-consult-with-our-russian-friends-araghchi-slams-us-excessive-demands-and-flawed-approach-to-talks-ahead-of-putin-meeting
“Putin says Zelensky’s ‘legitimacy’ for signing any peace deal is ‘a question for lawyers'” [wakeup.sg/putin-challenges-zelensky-authority/] links to www.viory.video/en/videos/a3096_04062026/this-is-not-our-whim-putin-says-zelensky-s-legitimacy-for-signing-any-peace-deal-is-a-question-for-lawyers-
“Europe must make do with the money we have! – Merz calls for tighter spending… one day after EU hands Ukraine 90 billion euros” [wakeup.sg/europe-must-make/] links to www.viory.video/en/videos/a3033_24042026/europe-must-make-do-with-the-money-we-have-merz-calls-for-tighter-spending-one-day-after-eu-hands-ukraine-90-billion-euros
A similar pattern appears in Indonesia, where Tribun Video, part of the larger Tribunnews network, regularly republishes Viory content while explicitly crediting Viory.video as the original source. Stories concerning Russian security services, diplomatic conflicts, war in Ukraine and Russian military capabilities are translated and adapted for Indonesian audiences, extending the reach of Kremlin-frienly narratives originating from Viory into one of Southeast Asia’s largest media markets.
“Rusia Bongkar Agen Mata-mata Ukraina, Tersangka Didakwa Pengkhianatan Kirim Data Militer ke Kiev” [video.tribunnews.com/news/933393/rusia-bongkar-agen-mata-mata-ukraina-tersangka-didakwa-pengkhianatan-kirim-data-militer-ke-kiev] links to “FSB detains Kursk resident accused of gathering intelligence for Ukraine” [www.viory.video/en/videos/a3015_05052026/web-of-spies-fsb-detains-kursk-resident-accused-of-gathering-intelligence-for-ukraine]
“Utusan Rusia di PBB Kecam Ukraina dan Uni Eropa, Sebut Pertunjukan Murahan di Sidang Darurat Ukraina” [video.tribunnews.com/news/929720/utusan-rusia-di-pbb-kecam-ukraina-dan-uni-eropa-sebut-pertunjukan-murahan-di-sidang-darurat-ukraina] links to “Cheap second-rate performance to hide the panic in their own ranks!’ – Russian rep slams EU, Kiev at latest UNSC on Ukraine conflict” [www.viory.video/en/videos/a3083_20042026/blame-game-washington-beijing-moscow-and-kiev-trade-accusations-over-russia-ukraine-iran-conflicts-at-unsc]
“Bocoran Surat Rahasia Zelensky yang Dikirim ke Trump, Ukraina Disebut Minta Perlindungan kepada AS” [video.tribunnews.com/news/939003/bocoran-surat-rahasia-zelensky-yang-dikirim-ke-trump-ukraina-disebut-minta-perlindungan-kepada-as] links to “Begging for protection? Zelensky says ‘special letter’ sent to Trump and Congress after Ukraine’s brutal drone attack on LPR college” [www.viory.video/en/videos/a3105_27052026/begging-for-protection-zelensky-says-special-letter-sent-to-trump-and-congress-after-ukraine-s-brutal-drone-attack-on-lpr-college]
“Detik-detik Rusia Uji Coba Rudal Balistik Antarbenua Sarmat, Jangkauan Lebih dari 35.000 Km” [video.tribunnews.com/news/935344/detik-detik-rusia-uji-coba-rudal-balistik-antarbenua-sarmat-jangkauan-lebih-dari-35000-km] links to “Russia releases explosive footage of cutting-edge ICBM test launch with range of over 35,000km” [www.viory.video/en/videos/x4005_12052026/sarmat-unleashed-russia-releases-explosive-footage-of-cutting-edge-icbm-test-launch-with-range-of-over-35-000km]
Across these examples, Viory is generally presented simply as a neutral video source, with little indication of the organisational questions surrounding the platform. This attribution model allows editorial framing to travel across jurisdictions while preserving the appearance of an independent international news agency.
While recent attention has focused on the emergence of Viory and its possible links to Ruptly, the Russian video agency itself continues to play an active role in disseminating audiovisual content across the Kremlin’s domestic and international media ecosystem.
Analysis of current citations and content distribution patterns indicates that Ruptly remains an important provider of live streams, interviews and video packages for Russian state institutions and pro-Kremlin media outlets targeting audiences both inside and outside Russia.
Ruptly remains integrated into the communications infrastructure of Russian state figures. Telegram channels operated by senior Russian officials and institutions, including Foreign Ministry spokesperson Maria Zakharova and the Ministry of Foreign Affairs, regularly distribute Ruptly live streams and video links covering press briefings, official events and diplomatic statements.
The domain ruptly.video receives regular citations from Russian officials’ Telegram channels: Maria Zakharova [telegram.me/s/MariaVladimirovnaZakharova] and Russian Foreign Ministry [telegram.me/s/Mid_Russia].
Official communications from the Foreign Ministry explicitly state that “the signal is distributed by the Ruptly video agency,” demonstrating that Ruptly continues to serve as a technical and editorial provider for the Russian state’s external messaging. Despite international sanctions imposed on RT and related entities, Ruptly’s infrastructure remains embedded within official government communications.
Ruptly content is also republished by Russian-language media outlets focused on audiences in Latvia, Lithuania and Estonia. Baltnews, a portal associated with the Rossiya Segodnya media group, repeatedly cites Ruptly live streams as the primary source for its reporting.
The article ‘Miroshnik: Article 359 of the Russian Criminal Code applies to mercenaries from the Baltic states’ [baltnews.com/Russia_West/20260130/1026572630/Miroshnik-dlya-naemnikov-iz-Pribaltiki-est-statya-359-UK-RF.html] refers to Ruptly stream – stream.ruptly.video/202601300800-LIVE21654/channel2. It covers the Kremlin’s statements about Baltic volunteers fighting for Ukraine.
The article ‘Truth Prevails: Why Russian Citizens Are Returning Home’ [baltnews.com/Russkie-Pribaltiki/20241030/1026374690/Pravda-pobezhdaet-Pochemu-grazhdane-RF-vozvraschayutsya-na-Rodinu.html] quotes a Ruptly stream stream.ruptly.video/202410300700-LIVE18863/channel1. It promotes narratives portraying Russians returning from abroad as evidence of growing patriotism and confidence in the Russian state.
The hardline nationalist outlet under international sanctions cited a Ruptly interview with a wounded participant in Russia’s so-called “special military operation,” using the footage to construct an emotional narrative around sacrifice and heroism on the battlefield in Russia’s war in Ukraine. Sanctioned website tsargrad.tv cited this Ruptly video in the article ‘I promised my mum I’d come back alive’: A wounded soldier in the special military operation achieved the impossible right on the battlefield’ [tsargrad.tv/news/obeshhal-mame-vernutsja-zhivym-ranenyj-boec-svo-sdelal-nevozmozhnoe-prjamo-na-pole-boja_1569841]. It says: ‘In an interview with Ruptly, he described how he lost his leg on the front line — all by himself.’
These pieces follow a purely propaganda editorial line. In these cases, Ruptly functions not merely as a video supplier but as the original video source underpinning narratives that align closely with Kremlin propaganda objectives. The footage provides visual authority to messages designed to influence Russian-speaking audiences in the Baltic region.
Backlink analysis further shows that Ruptly content continues to circulate through a wider ecosystem of pro-Kremlin websites operating across Europe. According to Ahrefs backlink data, domains such as newsnet.fr, cz24.news and belgiumnews.net reference or republish Ruptly-sourced videos, incorporating them into articles that support Russian foreign policy positions or amplify anti-Western narratives.
This distribution model allows Ruptly to function as a transnational video wire service for fringe and openly pro-Kremlin media outlets that often operate outside the regulatory restrictions imposed on RT’s official broadcasting channels. Through syndication and citation, Ruptly footage continues to reach audiences across Europe under the branding of local or alternative media platforms.
The evidence suggests that Ruptly remains a critical node within the Kremlin’s media infrastructure despite Western sanctions. Its live streams continue to supply Russian ministries, its footage is republished by propaganda platforms targeting the Baltic states, and its reporting is syndicated across a network of pro-Kremlin websites throughout Europe.
Rather than operating as a neutral international video agency, Ruptly’s current output continues to be deployed in explicitly political contexts, supporting narratives that legitimise Russian government policies, discredit Ukraine and the West, and reinforce strategic messaging aimed at foreign audiences. Its continued use by official institutions and affiliated media demonstrates that the agency remains an active component of Russia’s broader information operations architecture.
Viory.video and Ruptly.video share a closely aligned technology stack and operational footprint centred on Russian provider Yandex, indicating a high degree of technical integration between the two video agencies.
Viory.video is built on a modern React/Next.js stack served via Nginx. The front end uses Radix UI and Tailwind CSS, while Sentry is deployed for error tracking. Ruptly.video similarly runs on Nginx with JavaScript front ends and uses Modernizr and loadable‑components, indicating a dynamic, client‑heavy application with progressive enhancement and code‑splitting.
Viory’s web hosting, data centre, and email services are all attributed to Yandex, with server locations in the Russian Federation and Armenia, and Yandex.Metrika embedded as the primary analytics suite. Ruptly.video also relies on Yandex Mail and Yandex.Metrika, and is delivered via Nginx with Let’s Encrypt/GlobalSign certificates, with additional presence on Amazon Web Services.
The heavy dependence of Viory.video and Ruptly.video on Yandex‑provided hosting, mail, and analytics services—combined with shared tooling and overlapping tech stacks—means that user and client data for both platforms are processed within Russian‑controlled infrastructure, increasing exposure to Russian jurisdiction, data‑collection practices, and potential state leverage over the operation of these video agencies.
The combined evidence points to Viory operating not merely as a content producer but as a distribution hub within a wider media ecosystem.
Video packages produced under the Viory brand are syndicated, translated and republished by regional partners while retaining their original framing and editorial emphasis. As the material moves through local publishers, its provenance becomes increasingly obscured, enabling narratives to reach audiences under the branding of trusted domestic outlets rather than through Russian state media directly.
This model resembles the traditional operation of an international newswire service, except that questions surrounding ownership, infrastructure and editorial influence remain contested.
Our analysis does not establish legal ownership or direct organisational control between Viory and Ruptly. Infrastructure overlaps and traffic intelligence cannot, on their own, prove corporate identity.
However, when considered alongside Bellingcat’s findings, the independent evidence reveals a consistent pattern. Shared Yandex.Cloud infrastructure, mirrored backend architecture, extraordinary dependence on Yandex authentication referrals and a regional content amplification network documented through backlink analysis all point towards a high degree of technical and operational alignment.
Taken together, these indicators strengthen the hypothesis that Viory forms part of a broader ecosystem linked to Russian media infrastructure, even as the organisations involved continue to deny any formal relationship. For investigators, and policymakers assessing information influence operations, the case illustrates how infrastructure analysis, traffic intelligence and content mapping can complement traditional investigative reporting to expose networks that are increasingly sophisticated, transnational and digitally integrated.
A new investigation by Bellingcat has uncovered multiple digital connections between Viory, a self-described "Global…
Volodymyr Zhemchuhov was born 80 kilometres from the Russian border, speaks Russian as his mother…
The Czech-led initiative that has supplied Ukraine with more than four million large-calibre artillery shells…
The UK has announced a new package of sanctions targeting cryptocurrency exchanges and illicit financial…
Latvia's foreign ministry has dismissed Moscow's threat to take the Baltic states to the International…
Paris prosecutors have launched an independent investigation into an alleged foreign influence operation that targeted…