The "Doppelgänger" campaign uses cybersquatting practices, through which Russian sources lease internet domains that clone legitimate media websites in order to spread false, pro-Russia narratives.
This statement was originally published on europeanjournalists.org on 30 September 2024.
The Media Freedom Rapid Response (MFRR) consortium expresses serious concern over the persistent spoofing of legitimate European media outlets, most recently as part of a Russian disinformation campaign called “Doppelgänger”.
Over the past two years, this disinformation campaign, initially discovered in 2022, continued to weigh in the political debate with so-called cybersquatting practices, through which Russian sources leased internet domains that cloned legitimate media websites, in order to spread false narratives that were massively shared on social media.
On 4 September, a total of 32 manipulative websites with domains leased from American companies were identified by the US Department of Justice. Official documents disclosed counterfeit domains of numerous European media outlets, mainly based in Germany, Italy, Ukraine, Estonia, and France. Visuals from the original news website were maliciously mimicked to mislead readers. Payment for the registration of the counterfeit domains was made via crypto-currencies from several wallets associated with Russia, with the use of encrypted email addresses on the Proton secure messaging service, making the identification of the spoofing perpetrators even more difficult.
According to internal documents from the Moscow-based Social Design Agency (SDA), which were revealed by the US State Department, the Kremlin’s strategy was to target France and Germany in particular to weaken support for Ukraine, promote euroscepticism, and support far-right parties such as Germany’s Alternative für Deutschland (AfD), especially ahead of elections. A significant portion of counterfeit domains were created ahead of the European elections, and of the upcoming 2024 US Presidential elections. In France, dailies Le Monde, Le Parisien, and Le Figaro saw their domains cybersquatted, while in Germany this concerned Der Spiegel, Neues Deutschland, Bild, T-Online, Die Welt, Frankfurter Allgemeine Zeitung, Der Tagesspiegel and Süddeutsche Zeitung.
Ukrainian media were also targeted with cybersquatting: numerous websites were created, which imitated legitimate, major Ukrainian outlets in order to propagate defeatist theses about the war with Russia, such as a lack of personnel and military material in the Ukrainian army or the need for negotiations with Moscow and to cede territory to Russia. The targeted news outlets included Ukrainska Pravda, Suspilne, 1+1, Obozrevatel, and RBC Ukraine. Most of the spoofing websites were promoted on Facebook through sponsored advertisements.
Other findings from European fact-checking organisations but also the European External Action Service’s (EEAS) monitoring, disclosed further identities of media affected by the cyber campaign, such as Polish weekly Polityka and public broadcaster Polskie Radio. The links to cloned websites were massively disseminated on social media via artificial X accounts with manipulative posts, which were widely commented on and shared. The Doppelgänger operation is not confined to X. Other social networks such as Facebook, Messenger, Instagram, and instant messaging networks like Whatsapp or Telegram have been misused to spread fake content that reaches a wider audience.
The MFRR consortium reiterates its call for tech platforms such as Meta, but not only, to take necessary steps to counter disinformation, including the removal of spoofing content. These platforms are currently doing too little on this issue, even when fake websites are signaled. Spoofing content not only affects the media’s credibility and integrity but also jeopardises the fundamental right of readers to access information free from manipulation (Article 10 of the European Convention on Human Rights).
As highlighted in the latest MFRR mid-year monitoring report, spoofing is increasingly targeting journalists and media in the European Union member states and candidate countries and requires stronger vigilance and urgent actions from the Member States. We call on the relevant authorities to ensure a swift and thorough investigation into the process through which fake websites are created, but also to allocate additional resources and seek international support from bodies such as Europol to ensure a safe environment for the media and access to reliable information for citizens.
This statement was produced as part of the Media Freedom Rapid Response (MFRR), a Europe-wide mechanism which tracks, monitors and responds to violations of press and media freedom in EU Member States and candidate countries.
