Disappearing site clones: new methods of Russian disinformation campaign

Russians create duplicate news sites and Facebook posts with ads that mimic real, authoritative media and then delete them, usually within a day.

Despite their short lifespans, the authors of the disinformation operation manage to effectively spread anti-Ukrainian and pro-Russian narratives. 

Researchers at the Atlantic Council’s Digital Forensics Laboratory have identified more than 500 such posts on Facebook.

This is a new iteration of the site-clones operation. Facebook-owned Meta and the EU DisinfoLab discovered the previous version in September 2022. Later, the French government agency VIGINUM, actively fighting disinformation, successfully established its connection to Russia.

“Two years after Russia’s invasion of Ukraine, this well-documented operation continues to target audiences in Europe. Based on the research, the article asserts that despite platforms’ increased resilience to the campaign and its association with Russian companies, the operation remains widespread and massive.

The researchers identified 568 such Facebook posts: 443 in French, 75 in German, 38 in Ukrainian, and 12 in English. The researchers observed that the authors of this operation created dozens of pages with the same names linked to each other, allowing for their quick removal and replacement with new ones.

Read also: Pro-Russian websites network in Europe that serves Russia’s information warfare

One of the two authors of the study, Roman Osadchuk, suggested in an interview with Voice of America that this was their way of trying to circumvent Facebook’s blocking: as soon as the social network blocks one post with suspicious content and a link to a fake site, a new one appears.

The posts and fake pages they linked to contained satirical images or memes that ridiculed Ukraine, the European Union, the United States, and sometimes Israel. The narratives the researchers saw promoted the “pointlessness” of Ukraine’s fight against Russian troops and claimed that the support of allies was unstable, creating a general sense of hopelessness for Ukrainians and a lack of meaning in supporting Ukraine among partners.

Additionally, analysts discovered an advertising campaign that utilized this method to disparage the Ukrainian counteroffensive, targeting the European audience. The researchers also saw an intensification of this operation during the announcement of new aid packages in France and Germany.

In addition to the posts targeting Ukraine, the Digital Forensics Laboratory found 248 posts in French that portrayed Ukraine as a threat to French farmers.

The most common method is not to create clones of websites but to create photos or videos with the logo of media outlets or individuals.

VoxCheck, an organization that did not participate in the Atlantic Council’s study, told Voice of America that they also encounter similar fakes, but mostly in the form of posts with anti-Ukrainian narratives that allegedly refer to well-known media outlets, bloggers, or celebrities.

People have previously created such fakes about Ukraine using the logos of other international media outlets like Euronews, Politico, and Reuters.

Fakes about celebrity statements are created in a similar way: based on real screenshots of social media accounts, photo manipulations are made to make it look like a blogger has posted an anti-Ukrainian comment or picture that ridicules Ukrainians and their allies, the authors said.

Russian or pro-Russian Telegram channels, a platform popular among Ukrainians, often serve as the primary source of these fakes, from which they spread to other social networks.

The authors of the investigation advise users to be careful and pay attention to the pages from which they see content.

If the name of the page looks strange, was recently created, and runs ads instead of appearing in the feed as a post from friends, the site should be further checked for authenticity and not shared on social media.

If a user visits a website through a post on Facebook, experts advise looking at the domain extension, i.e.,.com, not.ru, and comparing it to the real domain of a well-known media outlet.

Also check the quality and grammatical correctness of the text. Russian fake news factories, as a rule, do not have editorial supervision like media organizations, and their texts may contain numerous errors or unnatural grammatical structure.