“Mid-Year Overview of Doppelgänger Information Operations in Europe and the US”

Identifier: TRR240701.

Summary

This report delves into Doppelgänger information operations conducted by Russian actors, focusing on their activities from early June to late-July 2024. Our investigation was motivated by the unexpected snap general election in France, prompting a closer look at Doppelgänger activities during this period.

While recent activities have been described since^,, our first dive into the information operations topic offers a complementary threat-intelligence analysts’ perspective on the matter, brings additional knowledge on associated infrastructure, tactics and motivation in Europe and the United States.

Background

Doppelgänger designates a set of information manipulation operations conducted by Russian actors that leverage social networks and digital media to support Russia’s interests . The most notable characteristic of these operations is the impersonation of popular news websites to spread disinformation. The term “Doppelgänger” is also indiscriminately used in public research to designate the actors, operators and institutions that contribute to these operations.

Since the first public report in 2022, Doppelgänger has been vastly and publicly described by government organisations^, and private companies^,,.

As a result, and while Doppelgänger operations continue, government organisations, private companies and the civil society can now identify and inform about these operations more rapidly.

Given HarfangLab is based in Europe (France), we were particularly attentive to possible Doppelgänger campaigns during France’s unexpected June 2024 snap general election.

(Dis)information chain

Doppelgänger spreads and amplifies fabricated, fake or even legitimate information across social networks. To do so, social networks accounts post links that initiate an obfuscated chain of redirections leading to final content websites (see Fig. 1).

The overall content distribution approach that we could observe between early June and late-July 2024 has remained consistent, despite continuous rotation of associated infrastructure assets by the operators.

X/Twitter posts

Social media appears to be the primary dissemination means for disinformation. We surveiled activity on X/Twitter and were able to identify about 800 acounts which posted links to 1st level redirectors (see Fig. 1). These accounts do not appear to belong to real individuals, may be described as “bots”, and often present themselves as Cryptocurrency / Web3 influencers. Based on our observations, the dissemination process exhibits the following characteristics:

• Bot posts (see Fig. 2) are unique, possibly AI-generated. Comments never seem to repeat themselves across all bot activity, and use several languages (notably English, French, German, Polish and Ukrainian).
• Different bots post different links to 1st level redirectors.
• All post have abnormally high numbers of engagements compared to each account’s follower base, making it almost certain that the bot network also artificially inflates interaction metrics.
• It’s unclear whether these posts are ever able to burst out of the echoing chamber that is the bot network and reach the timeline of real user accounts.

Looking at past activities from the bot accounts, it seems like they were used in the context of cryptocurrency scams (i.e, pump and dump schemes, airdrops, etc.). This leads us to believe that Doppelgänger operators are either renting a fleet of Twitter bots from a third party, or that some of their members are also moonlighting as cybercriminals.

While writing this report, we discovered a specific case where monitored accounts that we believe are affiliated with Doppelgänger did not post links to 1st level redirectors, but an AI-generated music video impersonating the band Little Big that satirises the Paris Olympics and discourages attendance (see Fig. 3, and Appendix for the link).

While our research focused on X/Twitter, previous reports shared by Meta showed that Doppelgänger abused other platforms to spread their content.

Redirection chain

In a likely attempt to hinder research and conceal infrastructure, the information flow from social network posts to final content goes through an intricate redirection chain (see Fig. 1). The redirections are imperceptible for the targeted audience: clicking a link transparently leads to the final content website anyway – but those are making the Doppelgänger infrastructure difficult to identify in real-time and at scale.

1st level redirectors

1st level redirectors are a conceptual redirection block comprised of URLs (possibly from pooled domain names) that point to custom redirecting Web pages (on possibly pooled Web servers). Below is an example of such Web page content, as pointed to by hxxps://g5hp0[.]top/i9ro8l on July 17, 2024:

<!DOCTYPE html>
<html>
<head>
<title>Citizenship Doesn't Matter If You Support Biden</title>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="twitter:card" content="summary_large_image">
<meta property="og:title" content="Citizenship Doesn't Matter If You Support Biden"/>
<meta property="twitter:title" content="Citizenship Doesn't Matter If You Support Biden"/>
<meta property="og:description" content="Republicans are trying to rush a bill through Congress to allow only U.S. citizens to vote in presidential elections."/>
<meta property="twitter:description" content="Republicans are trying to rush a bill through Congress to allow only U.S. citizens to vote in presidential elections."/>
<meta property="og:image" content="https://telegra.ph/file/d1629e477f84abbc37dbc.jpg">
<meta property="twitter:image" content="https://telegra.ph/file/d1629e477f84abbc37dbc.jpg">
<meta http-equiv='refresh' content='0; url=hxxp://vickypitner[.]com/wash9261378'>
</head>
<body>
<script type="text/javascript">var _0xc80e=["","split",[TRUNCATED],91,"xAkdhqbIQ",45,7,10))</script>
<div> принц-регент – А кто занимается похоронами? Не вы? каганец натуралистичность предъявитель эталонирование перестилание узаконивание социолингвистика</div>
<br>
[TRUNCATED]
</body>
</html>

Those Web pages contain metadata that control link preview generation on X/Twitter, including preview pictures that are always hosted on the public telegra.ph platform.

The Web pages are set to instantly redirect to the next stage of the redirection chain (2nd level redirectors, in that case hxxp://vickypitner[.]com/wash9261378), using an HTTP meta tag.

The Web pages also contain:

• A meaningless and randomly generated Cyrillic placeholder text;
• Javascript code obfuscated using the Hunter framework, which in effect only sets the page text’s color to white (document.body.style.color = "white";), likely to ensure the placeholder text is not visible to the target audience (as the page default background color is also white) in case the redirection fails or takes too much time.

Searching from mid-May to late-July 2024, we could identify thousands of 1st level redirector URLs, leveraging hundreds of domain names (in Appendix). The 1st level redirector URLs we could retrieve match the following two patterns:

• http(s)://<5 to 6 random characters>.<domain name.tld>/<6 other random characters or text slug>
• http(s)://<short domain name.tld>/<6 random characters>

The identified 1st level redirectors domain names usually (but not always) are registered on recent TLDs, such as .click, .top or .shop.

The most frequent IP resolutions that we observed for 1st level redirectors domains between early June and late-July 2024 are presented below.

IP address	Details
168.100.9[.]238	ASN 399629, BLNWX
77.105.135[.]48	ASN 216309, EVILEMPIRE-AS / TNSECURITY LTD
185.172.128[.]161	ASN 216309, EVILEMPIRE-AS / TNSECURITY LTD

We noted that the Web servers (on the aforementioned IPs) run an OpenSSH service on port 22, and an OpenResty + PHP 7 Web service on ports 80 and 443, exposing a default self-signed certificate with C=XX, L=Default City, O=Default Company Ltd set as an issuer.

2nd level redirectors

2nd level redirectors are comprised of URLs that point to custom redirecting Web pages (on possibly pooled Web servers). 1st level redirectors redirect to 2nd level redirectors. Here is an example of a 2nd level redirector Web page content, as pointed by hxxp://vickypitner[.]com/wash9261378 on July 17, 2024 (content truncated):

<html lang="en">
<head>
<meta charset="UTF-8" />
<meta http-equiv="X-UA-Compatible" content="IE=edge" />
<meta name="robots" content="noindex, nofollow">
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
<title>with their hippopotamus.</title>
[TRUNCATED]
</head>
<body>
<div class="header">
<h1>Website Header</h1>
<a href="page2.html">Page 2</a>
<a href="page3.html">Page 3</a>
</div>
<div class="content">
<p>However, watermelons have begun to rent octopus over the past few months, [TRUNCATED] for prunes associated with their goldfishes.</p>
</div>
<div class="footer">
<p>Website Footer</p>
<a href="contact.html">Contact</a>
<a href="about.html">About Us</a>
</div>
</body>
<script src="data:text/javascript;base64,[TRUNCATED]"></script>
</html>

The Web page contains a meaningless English placeholder text, links to empty pages, as well as a base64-encoded and lightly obfuscated Javascript (decoded and truncated extract below):

var name = '_cKyZkv5N2nbDRwVb';
if (!window._cKyZkv5N2nbDRwVb) {
    window._cKyZkv5N2nbDRwVb = {
        unique: false,
        ttl: 86400,
        R_PATH: 'hxxps://gatoogeef[.]info/US-17-07_washingtonpost',
    };
}
[TRUNCATED]
var _KKb9F5gtQHKz9S1m = '?return=js.client';
    _KKb9F5gtQHKz9S1m += '&' + decodeURIComponent(window.location.search.replace('?', ''));
[TRUNCATED]
var a = document.createElement('script');
    a.type = 'application/javascript';
    a.src = window._cKyZkv5N2nbDRwVb.R_PATH + _KKb9F5gtQHKz9S1m;
var s = document.getElementsByTagName('script')[0];
s.parentNode.insertBefore(a, s)

The Javascript code aims at loading a script from the next and final stage of the redirection chain (Tracker, in that case hxxps://gatoogeef[.]info/US-17-07_washingtonpost?[TRUNCATED]), by crafting a specific URL and creating a new Javascript element in the page to include it.

Searching from mid-May to late-July 2024, we could identify hundreds of 2nd level redirector URLs, leveraging tens of domain names (in Appendix). The 2nd level redirector URLs we could retrieve match the following pattern: http://<domain name.tld>/<3 to 4 first letters of the final content website name><7 random digits>

The most frequent IP resolutions that we observed for 2nd level redirectors domains between late May and late-July 2024 are presented below.

IP address	Details
206.188.197[.]116	ASN 399629, BLNWX
64.190.113[.]45	ASN 399629, BLNWX
195.85.115[.]36	ASN 399629, BLNWX
195.2.73[.]149	ASN 48282, VDSINA-AS

We noted that Web servers (on the aforementioned IPs) run an Express application server returning a default 404 page on TCP ports 80 and 3000, with the one on port 80 containing the Cannot GET / message in its HTTP response.

Tracker

The Tracker is the cornerstone of the redirection chain. It is comprised of a domain name, as well as a server hosting an instance of the Keitaro platform – which is described as a tool for content publishers and advertisers, aimed at flexibly handling and analysing Web traffic.

A Tracker server seemingly lasts way longer than 1st and 2nd level redirectors – the latter being rotated quite frequently, while a single Tracker server can be used for months. It delivers several Javascript files, organised by campaigns, which ultimately redirect the current page to final content websites. Tracker servers are protected behind Cloudflare’s reverse-proxy, as a light infrastructure concealement technique.

The Tracker server provides a minimized and lighlty obfuscated Javascript, which is loaded by 2nd level redirectors (see previous title). Here is an example of a Tracker Javascript:

var _zGW3JkDTHFyPQXRM = function (n) {
  [TRUNCATED]
  e.client = new u({
    [TRUNCATED]
    content: {
      "body": "",
      "headers": ["Location: hxxps://www.washingtonpost[.]pm/world/2024/07/03/citizenship-doesn-t-matter-if-you-support-biden/"],
      "status": 302,
      [TRUNCATED]
    },
    debug: false
  });
}, function (t, e, n) {
  [TRUNCATED]
  e.default = function (t) {
    if (undefined !== t.content) {
      [TRUNCATED]
      if (301 === t.content.status || 302 === t.content.status) {
        n = String.prototype.replace;
        String.prototype.replace = function (t, e) {
          return "object" == typeof t && t.source.includes("http-equiv=["']?refresh["']?") ? this : n.call(this, t, e);
        };
        var e = t.content.headers[0].replace(/Location:s+/i, "");
        document.open();
        document.write("<html><head>");
        document.write("<meta name="referrer" content="never" />");
        document.write("<meta http-equiv="refresh" content="0;url=" + e + "" />");
        document.write("</head></html>");
        return void document.close();
      }
    }
    [TRUNCATED]
  };
}]);

In that case, the Tracker Javascript as loaded from hxxps://gatoogeef[.]info/US-17-07_washingtonpost?[TRUNCATED] immediately redirects to hxxps://www.washingtonpost[.]pm/world/2024/07/03/citizenship-doesn-t-matter-if-you-support-biden/, by creating an HTTP meta tag in current Web page.

Searching from mid-May to late-July 2024, we noticed only 2 distinct Tracker servers were active. In particular, we could discover a Tracker server that has been setup shorty after a public article first revealed the previous Tracker IP address (after Cloudflare reverse-proxy).

Tracker domain	Details	IP Address (after Cloudflare)
gatoogeef[.]info	Setup on 2024-07-15. Registered at Namecheap on 2024-04-28, last update on 2024-05-03 associated with justinpacke[@]proton[.]me email.	45.87.41[.]37, ASN 62068 (SpectraIP B.V.)
cheekss[.]click	Setup on late July 2023. Registered at Namecheap.	65.108.158[.]243, ASN 24940 (Hetzner Online GmbH)

All Tracker Javascript loading URLs we could retrieve start with the following pattern : https://<domain name.tld>/<two letters country code of targeted country>-<number of the day when link is released>-<number of the month when link is released>_<beginning of the name of final content website, possibly followed by _- and a number> (ex: US-17-07_washingtonpost).

Final content

The ultimate step of the redirection chain leads the targeted audience to final content URLs, hosted on various websites. The final content is presented in various language (English, French – see Fig. 4, German, Polish – see Fig. 5, Hebrew, Ukrainian, etc.), depending on the targeted audience.

Gathering hundreds of final content URLs during investigation timeframe, we noted that while URLs mostly directed to Doppelgänger-fabricated websites (spreading fake news, sometimes impersonating popular news websites), they could also lead to distinct types of content websites (including legitimate ones). In general, we could identify tens of websites (see Appendix), fitting 4 distinct categories:

• Fabricated news websites: those websites, most probably created by Doppelgänger or its affiliates, are the most frequent final content destination, and notably amplify or are sources of fake news. Some examples are rrn[.]media (multi-language), franceeteu[.]today (French), derbayerischelowe[.]info (German), truthgate[.]us (English) and polskikompas[.]com (Polish).
• Websites impersonating legitimate ones: those websites are very similar to the previous, but additionally mimick and impersonate existing legitimate news websites or magazines. Some examples are www.leparisien[.]wf (French), www.spiegel[.]ltd (German), www.forward[.]pw (Hebrew), www.polityka[.]link (Polish), www.unian[.]pm (Ukrainian) or www.fox-news[.]in (English).
• Strongly opinionated websites: those websites appear to be legitimate and may have been existing for a long time, but only publish inflamatory and/or divisive content. They sometimes are directly supporting Russian narratives. Some examples are stratpol[.]com (French) or www.liberationnews[.]org (English).
• Other: those websites do not fit into any other category, and are legitimate news websites, content publishing platforms or institutional websites. The associated final content URLs are given as sources to support narratives on social networks. A most notable example is hxxps://www.ifop[.]com/publication/le-climat-legislatif-a-deux-semaines-du-vote-du-30-juin/, which is leading to poll results published by a legitimate French opinion polling leader (and indicating the far-right collects most voter intents for the June general snap elections).

We noted that all Doppelgänger-fabricated final content websites are protected by Cloudflare reverse-proxy service or similar (and possibly custom) frontend protection mechanisms. Despite these safeguards, we could identify the likely backend hosting servers (behind Cloudflare) for some of the fabricated content websites that are still online at the time of writing this article:

Fabricated websites	IP Address (after Cloudflare)
www.spiegel[.]ltd	111.90.146[.]198, ASN 45839 (Shinjiru Technology Sdn Bhd)
www.forward[.]pw, www.hamodia[.]in	101.99.90[.]184, ASN 45839 (Shinjiru Technology Sdn Bhd)
www.psychologies[.]top	101.99.90[.]165, ASN 45839 (Shinjiru Technology Sdn Bhd)

Pivoting from these discovered servers, we could identify 6 domain names that were registered in July, that impersonate existing legitimate websites, and that with believe with medium to high confidence might be leveraged by Doppelgänger in the future:

Suspicious domain	Impersonated website
closermag[.]eu	closermag[.]fr (French)
conspiracywatch[.]in	conspiracywatch[.]info (French, English)
mensjournal[.]day	mensjournal[.]com (English)
mynaszlaku[.]in	mynaszlaku[.]pl (Polish)
dzieckowpodrozy[.]in	dzieckowpodrozy[.]pl (Polish)
bibelbund[.]cfd	bibelbund[.]de (German)

Final content analysis and targets

Information manipulation operations are designed to manipulate public opinion to achieve strategic objectives. The most common goals of these campaigns include political influence, social manipulation, eroding public trust in the media, and general destabilization. The timing and content of the Doppelgänger activities indeed make their intentions apparent, actively targeting the public opinion, particularly in the lead-up to elections.

Political analysis

We analyzed over 200 of Doppelgänger’s latest publications from May to July. To conduct this analysis, we employed a large language model (LLM) designed for extensive text analysis and reasoning – the “LLaMA-3-Sonar-Large-32k-online”, to read and score the articles for their political leanings using a political compass.

The LLM was tasked with reading the articles and scoring them based on their political leanings. This analysis began with providing an agenda assessment, identifying the primary goal of the content and determining whether it aimed to influence political opinions or promote a specific ideology. The model then evaluated and categorized the political-economic stance of each article, ranging from “far left” to “far right”. Far-left positions typically advocate for a socialist or communist society, rejecting capitalism and often promoting radical transformation of the existing socio-economic order, while far-right positions emphasize nativism and authoritarianism.

Additionally, the LLM was directed to assess the “social score” of each article, ranging from Libertarian to Authoritarian. This social axis evaluates the article’s stance on personal freedoms, government control over social issues, and individual rights, with Libertarians advocating for maximum personal freedom and minimal government intervention, while Authoritarians support greater government control.

Finally, the LLM was also tasked with identifying the country of focus within each article.

Bearing in mind the limitations of LLMs (such as potential biases and other constraints) and acknowledging the slight room for interpretation in analyzing the articles, the results are as follows:

Agenda

Ukraine emerges as the most discussed country, with topics ranging from its handling of conscription, corruption, military capabilities, and readiness for EU membership, often portraying Ukraine’s governance and policies negatively. France is critiqued for its preparedness for the 2024 Paris Olympics, political unrest, and immigration policies. Germany’s handling of Ukrainian refugees, energy plans, COVID-19 measures, and defense spending are scrutinized. The United States is criticized for its foreign policy and military readiness under Biden, with support for a more assertive approach and transparent election processes. Poland’s economic policies under Donald Tusk are criticized as misguided and leading the country to bankruptcy. Israel’s political maneuvering and humanitarian aid are discussed, with a focus on Netanyahu’s policies. And last but not least, Russia’s media regulations and censorship are condemned, advocating for freedom of speech.

The articles generally take a stance critical of mainstream Western policies, often supporting more nationalist or conservative viewpoints. There’s a tendency to question the actions of the US, NATO, and the EU while sometimes presenting Russia in a more favorable light. The content frequently highlights internal problems within Western countries and criticizes their involvement in foreign conflicts, particularly in Ukraine. Many articles focus on corruption, governance issues, and economic challenges in various countries.

Targets

Our analysis reveals a hierarchy in Doppelgänger’s geographic focus. France emerges as the primary ‘target’ and subject of disccussion, followed closely by Germany, the United States and Ukraine. Judging from the recent articles we analyzed, these four countries dominate the narrative landscape, reflecting the current geopolitical dynamics and aligning with temporal trends.

To a lesser extent, Doppelgänger also targets Israel, Poland and Taiwan, indicating a broader, albeit less intense, interest in these regions. Hungary and Switzerland are also mentioned, in relation to Ukraine.

As far as the contents of the articles are concerned, several recurring themes and patterns emerge. The most frequently discussed topics include the Ukraine-Russia conflict, European Union politics, NATO and military affairs, immigration issues, US politics and foreign policy, and various national political situations, particularly in France and Germany.

Converting the political compass data into a heatmap reveals a clear pattern to Doppelgänger articles. The most prominent concentration is observed in the right-wing authoritarian quadrant, indicating a significant bias towards conservative economic policies coupled with socially restrictive viewpoints. Interestingly, there’s a secondary, although less intense, concentration in the left-libertarian section of the compass.

This dual-focus strategy suggests a nuanced approach to disinformation, aiming to appeal to (or manipulate) diverse political demographics. The presence in opposing quadrants could be an attempt to sow discord across the political spectrum and generally worsen existing divisions.

The scattered spread across other areas of the compass indicates that the group doesn’t exclusively target the aforementioned stances, but rather adapts its content to cover a range of perspectives, as deemed appropriate, to maximize their reach and impact.

This pattern in the distribution of Doppelgänger articles lends itself to an interpretation through the lens of the horseshoe theory.

From the horse’s mouth

The horseshoe theory posits that the far-left and far-right, rather than being at opposite ends of a linear political spectrum, share similarities and can be closer to each other than to the political center.

In the context of information warfare, the horseshoe approach supports Doppelgänger’s objective of destabilizing target countries by creating artificial discourse. This is achieved by promoting seemingly opposing viewpoints that, in reality, advance the same foreign interests.

It’s important to note, however, that while the horseshoe theory provides an interesting framework for interpreting the group’s strategies, it remains controversial and not widely accepted.

Overall, the different mappings show Doppelgänger has a bias towards conservative economic policies coupled with socially restrictive viewpoints, aligning with the group’s known tactics of exploiting nationalist and traditionalist sentiments. However, rather than adhering strictly to one ideological stance, Doppelgänger also attemps to appeal to left-libertarian viewpoints, although to a lesser extent.

Black Hat SEO for fabricated websites

In the process of researching traces of Doppelgänger activities, we noticed that references to final websites had been added in comments (see Fig. 9), users profiles, forum threads (see Fig. 10) and pages (see Fig. 11) of publicly accessible and completely unrelated websites, prior to or during Doppelgänger websites use as part of information operations.

We believe such references have been introduced in various webpages as a search engines results optimization (SEO) attempt.

Cross-referencing email addresses, IP addresses and usernames of accounts posting such content, we discovered what appears to be an entire spam network of accounts which is dedicated to posting fake comments – we assume for the purposes of increasing the linked website’s PageRank rating.

The most frequent IP addresses that posted such comments between May and July are presented below. They are still producing comments at the time of this writing.

IP address	Details
5.35.32[.]114	ASN 216071, SERVERS TECH FZCO (VDSINA)
212.118.39[.]106	ASN 216071, SERVERS TECH FZCO (VDSINA)
146.70.111[.]132	ASN 9009, M247 Ltd Belgrade

Doppelgänger content appears to represent only a minor fraction of the content pushed by this network: most comment samples we could uncover instead advertise a variety of Russian-language material (i.e., a phone repair shop in Moscow, cryptocurrency mixers, Telegram channels associated with sex work, online casinos, etc. – see Fig. 12 and 13).

Just like with X/Twitter accounts, it is likely that this infrastructure is not managed directly by Doppelgänger but is purchased as a service from a gray-market vendor; or that Doppelgänger actors also conduct other dubious SEO campaigns.

No matter what their exact relationship is, we believe that these findings demonstrate at least a degree of porosity between information manipulation operations and the cybercrime ecosystem.

Doppelgänger amplifies CopyCop

While collecting Doppelgänger final content URLs, we noticed that Doppelgänger sometimes amplified fake news that were originally published outside of the Doppelgänger’s scope.

For instance, in early July, Doppelgänger released several 1st level redirectors URLs (such as http://jrbwcf.bukuygemoy436[.]shop/swc9ws) targeting a French audience, and which led to fake news on a Doppelgänger-fabricated website (hxxps://rrn[.]media/fr/les-electeurs-francais-soudoyes/). The fake news claimed that the party of the French President was trying to bribe electors during the French general snap election (see Fig. 14).

The same fake news was previously emitted a day before on another fabricated website (see Fig. 15), franceencolere[.]fr, which is not a final content website for Doppelgänger-published links.

While franceencolere[.]fr is protected by Cloudflare, franceencolere[.]fr seems to be hosted on an IP address 95.165.66[.]27 behind Cloudflare (ASN 25513, PJSC Moscow city telephone network). The same IP address also hosts CopyCop-associated websites (such as miamichron[.]com and clearstory[.]news) and is long-known as a CopyCop asset.

We additionally noticed that a TLS certificate for fku.falconeye[.]tech was generated on the same date (2024-05-15) than the last (and still valid) TLS certificate for the publicly described CopyCop Matomo tracker (trk.falconeye[.]tech). While also protected by Cloudflare, fku.falconeye[.]tech seems to be hosted on an IP address 46.138.250[.]248 behind Cloudflare (ASN 25513, PJSC Moscow city telephone network), and most notably hosts a file named trk.php as well as what could be an article publication form (see Fig. 16) named ia.html. As a result we believe with low confidence that this server might be associated with CopyCop.

Conclusion

Our analysis of Doppelgänger’s recent information operations reveals a persistent, convoluted and relatively large effort by Russian actors to make room for a foreign narrative in Europe and the United States. This is most likely done to help manipulate public opinion. These operations primarily involve impersonation of legitimate news websites and dissemination of disinformation through a network of bot accounts on social media platforms, notably X/Twitter. The actor’s dynamic and obfuscated infrastructure alongside the intricate redirection chain makes real-time detection and mitigation challenging.

Our findings indicate that Doppelgänger operations are adaptive, likely leveraging rented or shared cybercrime infrastructure. The political analysis of Doppelgänger’s content shows a clear bias towards conservative and nationalist viewpoints, with a significant focus on destabilizing Western democracies by exploiting existing societal and political divisions.

As far as future developments are concerned, we discovered days before this publication an AI-generated music video shared by Doppelgänger operators, which indicates that they’re still in the process of ramping up their efforts and attempting to reach virality through the production of meme-compatible material.

The amplification of content from other disinformation campaigns (i.e., CopyCop) further highlights the interconnected nature of these operations. Despite the challenges in measuring the real-world impact of such campaigns, the continuous and persistent nature of Doppelgänger activities certainly succeed in supporting a foreign narrative and disseminating fabricated news, as well as underscores the need for robust countermeasures and international cooperation to safeguard democratic processes.

Appendix

Known infrastructure and content links

Associated data are also available on our GitHub repository.

IP Addresses

168.100.9[.]238|1st level redirectors server
77.105.135[.]48|1st level redirectors server
185.172.128[.]161|1st level redirectors server
206.188.197[.]116|2nd level redirectors server
64.190.113[.]45|2nd level redirectors server
195.85.115[.]36|2nd level redirectors server
195.2.73[.]149|2nd level redirectors server
45.87.41[.]37|Keitaro Tracker server (after CLoudflare)
65.108.158[.]243|Keitaro Tracker server (after CLoudflare)
111.90.146[.]198|Doppelgänger-fabricated website hosting (after Cloudflare)
101.99.90[.]184|Doppelgänger-fabricated website hosting (after Cloudflare)
101.99.90[.]165|Doppelgänger-fabricated website hosting (after Cloudflare)
95.165.66[.]27|CopyCop-fabricated website hosting (after Cloudflare)

Domains and hostnames

gatoogeef[.]info|Keitaro Tracker server
cheekss[.]click|Keitaro Tracker server
adudu4d-ayam[.]store|1st level redirector top domain
grabemas[.]store|1st level redirector top domain
101zz[.]store|1st level redirector top domain
100myrtle[.]com|1st level redirector top domain
15mb2vy4z[.]top|1st level redirector top domain
16mbzrw2g2[.]top|1st level redirector top domain
1typ[.]top|1st level redirector top domain
27488877[.]com|1st level redirector top domain
2k3o[.]top|1st level redirector top domain
5pjj5[.]top|1st level redirector top domain
69set4[.]fun|1st level redirector top domain
82604433[.]com|1st level redirector top domain
abouhaus[.]shop|1st level redirector top domain
aceofdigital[.]xyz|1st level redirector top domain
acrobatuk[.]shop|1st level redirector top domain
adobepl[.]shop|1st level redirector top domain
adumtree[.]co[.]uk|1st level redirector top domain
africanherbaloil[.]xyz|1st level redirector top domain
aicaitwss[.]online|1st level redirector top domain
aiedge[.]green|1st level redirector top domain
aipro[.]community|1st level redirector top domain
akagami75[.]shop|1st level redirector top domain
akagami95[.]shop|1st level redirector top domain
akhilsmm[.]shop|1st level redirector top domain
alanwake7[.]website|1st level redirector top domain
alieninsider[.]online|1st level redirector top domain
ambatukam45[.]shop|1st level redirector top domain
andonelebron[.]click|1st level redirector top domain
anehociak5[.]click|1st level redirector top domain
anesongbosio207[.]click|1st level redirector top domain
anesongbosio226[.]click|1st level redirector top domain
antsleveler[.]com|1st level redirector top domain
anybodyfornow[.]live|1st level redirector top domain
arabiandates[.]shop|1st level redirector top domain
aratox[.]shop|1st level redirector top domain
asas[.]blog|1st level redirector top domain
asvam[.]top|1st level redirector top domain
auas[.]krd|1st level redirector top domain
b0l9[.]top|1st level redirector top domain
babasang[.]shop|1st level redirector top domain
bandcamp-music[.]download|1st level redirector top domain
baslercom[.]ch|1st level redirector top domain
bestlebanesegrill[.]com|1st level redirector top domain
bestmyservice[.]com|1st level redirector top domain
bharatcoders[.]buzz|1st level redirector top domain
bilidragoon[.]com|1st level redirector top domain
body-balance[.]blog|1st level redirector top domain
bookofbuzz[.]vip|1st level redirector top domain
bostondrywallservices[.]com|1st level redirector top domain
brazilianhomesolutions[.]com|1st level redirector top domain
brodewicz[.]tech|1st level redirector top domain
brogecoin[.]vip|1st level redirector top domain
bukuygemoy402[.]shop|1st level redirector top domain
bukuygemoy436[.]shop|1st level redirector top domain
bukuyjelly105[.]shop|1st level redirector top domain
burraqmart[.]online|1st level redirector top domain
cannon147[.]click|1st level redirector top domain
cannon152[.]click|1st level redirector top domain
carhartthoodie[.]com|1st level redirector top domain
celebfashiontoday[.]com|1st level redirector top domain
centralhot[.]com|1st level redirector top domain
chauonima[.]click|1st level redirector top domain
circadiyin[.]one|1st level redirector top domain
clicklist[.]net|1st level redirector top domain
codewithwaqar[.]com|1st level redirector top domain
coipery[.]shop|1st level redirector top domain
commerceconciergeco[.]com|1st level redirector top domain
cookiejar[.]love|1st level redirector top domain
crazydigital[.]academy|1st level redirector top domain
curlyshana[.]uk|1st level redirector top domain
cytershop[.]com|1st level redirector top domain
decohomeartdesigns[.]com|1st level redirector top domain
depolumi4[.]click|1st level redirector top domain
depolumi5[.]click|1st level redirector top domain
depopulsa9[.]click|1st level redirector top domain
depopulsaa4[.]click|1st level redirector top domain
desmoinesbathpros[.]com|1st level redirector top domain
diamndmgcwn[.]online|1st level redirector top domain
digitallydone[.]store|1st level redirector top domain
disenoweblogrono[.]xyz|1st level redirector top domain
djovn[.]shop|1st level redirector top domain
dotcomfoods[.]co[.]uk|1st level redirector top domain
dpboss[.]shop|1st level redirector top domain
driveble[.]ch|1st level redirector top domain
dropshipping[.]buzz|1st level redirector top domain
dtlys[.]one|1st level redirector top domain
dusloungebar[.]com|1st level redirector top domain
dxbescortgirls[.]shop|1st level redirector top domain
eaglesgaming[.]club|1st level redirector top domain
egt9l7gpf[.]top|1st level redirector top domain
epsilonfinancial[.]org|1st level redirector top domain
erosstarescorts[.]com|1st level redirector top domain
estafetaod[.]top|1st level redirector top domain
estafetaofw[.]top|1st level redirector top domain
estafetaoi[.]top|1st level redirector top domain
eunsh[.]shop|1st level redirector top domain
expertgame77[.]pro|1st level redirector top domain
feliznavidad[.]click|1st level redirector top domain
felmut[.]shop|1st level redirector top domain
fjieka[.]shop|1st level redirector top domain
fjioqjioa[.]shop|1st level redirector top domain
fkriee[.]shop|1st level redirector top domain
flamebargrill[.]com|1st level redirector top domain
flowmeta[.]cfd|1st level redirector top domain
fredearlsvo[.]com|1st level redirector top domain
freedommediacorp[.]com|1st level redirector top domain
g5hp0[.]top|1st level redirector top domain
gamewin10[.]click|1st level redirector top domain
gamewin130[.]click|1st level redirector top domain
gass83[.]click|1st level redirector top domain
gasskuy123[.]click|1st level redirector top domain
gatcha46[.]click|1st level redirector top domain
gbo4d4[.]store|1st level redirector top domain
gituyahmainnya104[.]click|1st level redirector top domain
gjiqoaia[.]shop|1st level redirector top domain
globalchamberoc[.]org|1st level redirector top domain
gold365s[.]win|1st level redirector top domain
grizzly[.]dog|1st level redirector top domain
handbaglife[.]online|1st level redirector top domain
hatcapbag[.]com|1st level redirector top domain
healthygoodlife[.]live|1st level redirector top domain
hints[.]media|1st level redirector top domain
homesnowcone[.]com|1st level redirector top domain
hophop5[.]click|1st level redirector top domain
howler56[.]click|1st level redirector top domain
incomeapk[.]xyz|1st level redirector top domain
indo39oke[.]lol|1st level redirector top domain
infinityeight[.]ch|1st level redirector top domain
investinsavvy[.]com|1st level redirector top domain
ipdj[.]top|1st level redirector top domain
iplscore2024[.]live|1st level redirector top domain
iwantthiscar[.]info|1st level redirector top domain
j9ha2b7pv[.]top|1st level redirector top domain
jacketmania[.]shop|1st level redirector top domain
jacketmania[.]shop-|1st level redirector top domain
jagoanterbang-9[.]click|1st level redirector top domain
javierkeough[.]org|1st level redirector top domain
jenna-design[.]com|1st level redirector top domain
jieshenplay[.]top|1st level redirector top domain
joyboy61[.]shop|1st level redirector top domain
junacogeneraltradinguae[.]com|1st level redirector top domain
justice4us[.]biz|1st level redirector top domain
katakku4d[.]online|1st level redirector top domain
kejartarget27[.]click|1st level redirector top domain
kejartarget57[.]click|1st level redirector top domain
kin888net[.]lol|1st level redirector top domain
kindreadking[.]online|1st level redirector top domain
knowledgeguru83[.]com|1st level redirector top domain
knowsomething[.]click|1st level redirector top domain
kohen[.]website|1st level redirector top domain
kosa[.]social|1st level redirector top domain
lakersmenang[.]click|1st level redirector top domain
language-force[.]ru|1st level redirector top domain
laraibrabbani[.]net|1st level redirector top domain
larissacrane[.]shop|1st level redirector top domain
lawlessdenimco[.]shop|1st level redirector top domain
leagendmind[.]xyz|1st level redirector top domain
lewisgriggs[.]com|1st level redirector top domain
lightweb-inc[.]com|1st level redirector top domain
littlemonstersphotos[.]com|1st level redirector top domain
livegamepro[.]org|1st level redirector top domain
lkuer[.]top|1st level redirector top domain
loklok35[.]shop|1st level redirector top domain
marcobrivio[.]com|1st level redirector top domain
mathswithmushi[.]com|1st level redirector top domain
maxpay173[.]click|1st level redirector top domain
mefusst[.]tech|1st level redirector top domain
megabet89[.]shop|1st level redirector top domain
merindaw[.]shop|1st level redirector top domain
minesxp[.]online|1st level redirector top domain
miniature[.]homes|1st level redirector top domain
mirage5acxr37[.]click|1st level redirector top domain
mlbsports[.]club|1st level redirector top domain
mmeqdar[.]homes|1st level redirector top domain
mmk14[.]top|1st level redirector top domain
modentwrk[.]net|1st level redirector top domain
mollygemoy16[.]click|1st level redirector top domain
mollys[.]garden|1st level redirector top domain
moneyfever[.]buzz|1st level redirector top domain
moviezwap[.]today|1st level redirector top domain
musuli[.]shop|1st level redirector top domain
myblogreviews[.]online|1st level redirector top domain
mytechtrends[.]online|1st level redirector top domain
nasiputihxnasimerah[.]click|1st level redirector top domain
news-hive[.]online|1st level redirector top domain
news24mp[.]com|1st level redirector top domain
newtrendsboutique[.]com|1st level redirector top domain
ngd2xqivb[.]top|1st level redirector top domain
nicegame113[.]click|1st level redirector top domain
ninoarbasetti[.]com|1st level redirector top domain
nteh7[.]top|1st level redirector top domain
num386113[.]top|1st level redirector top domain
o6ngt[.]top|1st level redirector top domain
oaini[.]store|1st level redirector top domain
odbsa[.]com|1st level redirector top domain
odpkg[.]shop|1st level redirector top domain
ordinarypunks[.]com|1st level redirector top domain
packpranks[.]online|1st level redirector top domain
paodavida[.]church|1st level redirector top domain
pecahbet[.]site|1st level redirector top domain
pefecetemoney[.]xyz|1st level redirector top domain
penembakjitu81[.]click|1st level redirector top domain
pergipulangpagi[.]click|1st level redirector top domain
personalinjurycar[.]com|1st level redirector top domain
pg3f[.]top|1st level redirector top domain
placeholderdomain[.]link|1st level redirector top domain
plotspot[.]shop|1st level redirector top domain
positivebodyfit[.]com|1st level redirector top domain
premiumslimminggummies[.]shop|1st level redirector top domain
princepannu[.]com|1st level redirector top domain
professionalattitude[.]click|1st level redirector top domain
progambler[.]buzz|1st level redirector top domain
prokeysuk[.]shop|1st level redirector top domain
pronailscomplex[.]online|1st level redirector top domain
protraveler[.]world|1st level redirector top domain
purepurchase[.]shop|1st level redirector top domain
puzzledplay60[.]shop|1st level redirector top domain
pvbartending[.]com|1st level redirector top domain
q1s3873jl[.]top|1st level redirector top domain
q6hd[.]top|1st level redirector top domain
qisoaip[.]shop|1st level redirector top domain
ql9uk[.]top|1st level redirector top domain
re-china[.]com|1st level redirector top domain
redbanknow[.]info|1st level redirector top domain
renzkaliloalio34[.]click|1st level redirector top domain
rh899main[.]biz|1st level redirector top domain
rolunicotributario[.]life|1st level redirector top domain
rrirxh618[.]top|1st level redirector top domain
rsvd[.]top|1st level redirector top domain
rtp-mana777[.]com|1st level redirector top domain
rtpgora68[.]online|1st level redirector top domain
rushroll[.]shop|1st level redirector top domain
safe-pharma[.]com|1st level redirector top domain
santaslotjp[.]net|1st level redirector top domain
sayasukajepe12[.]click|1st level redirector top domain
seaux9[.]com|1st level redirector top domain
selalubegitu[.]click|1st level redirector top domain
semanismadu48[.]click|1st level redirector top domain
semanismadu56[.]click|1st level redirector top domain
sepengujungan[.]click|1st level redirector top domain
servergacor20[.]click|1st level redirector top domain
shakeologybigbag[.]store|1st level redirector top domain
shanhuo[.]site|1st level redirector top domain
shark4k[.]shop|1st level redirector top domain
shfue[.]shop|1st level redirector top domain
showthatsauce[.]co[.]uk|1st level redirector top domain
shrabanicreative[.]xyz|1st level redirector top domain
signatureartworld[.]com|1st level redirector top domain
sihpalingdewa07[.]click|1st level redirector top domain
sillonesluberto[.]com|1st level redirector top domain
sin88[.]yoga|1st level redirector top domain
skqoa[.]shop|1st level redirector top domain
slestimatego[.]quest|1st level redirector top domain
sociogrowth[.]com|1st level redirector top domain
sorcellerie-magie-noire[.]com|1st level redirector top domain
starprince-light14[.]click|1st level redirector top domain
stockingmypantry[.]top|1st level redirector top domain
streamflex[.]shop|1st level redirector top domain
streetsoccer-school[.]com|1st level redirector top domain
stuartparry[.]uk|1st level redirector top domain
study-company[.]biz|1st level redirector top domain
superfollowers[.]uk|1st level redirector top domain
swiftluxemarket[.]com|1st level redirector top domain
takperlupenganti[.]click|1st level redirector top domain
tech-value[.]online|1st level redirector top domain
techsaferz[.]com|1st level redirector top domain
tengnangkia114[.]click|1st level redirector top domain
texansmart[.]com|1st level redirector top domain
tgfhairsalon[.]shop|1st level redirector top domain
thea1techservice[.]com|1st level redirector top domain
thebaitlounge[.]com|1st level redirector top domain
thedigitalmarketing[.]live|1st level redirector top domain
thesachinvaishya[.]xyz|1st level redirector top domain
thienthienpucethao[.]click|1st level redirector top domain
todayjob[.]store|1st level redirector top domain
tolate[.]click|1st level redirector top domain
topcaijing[.]shop|1st level redirector top domain
travelusaexperts[.]link|1st level redirector top domain
treasurebesar[.]click|1st level redirector top domain
trhab[.]top|1st level redirector top domain
tuakaohia2[.]click|1st level redirector top domain
tukulhebat7[.]click|1st level redirector top domain
tutinlen[.]store|1st level redirector top domain
tvmountsallhd[.]online|1st level redirector top domain
tx99goo2o[.]top|1st level redirector top domain
u-adobe[.]shop|1st level redirector top domain
unchaayi[.]com|1st level redirector top domain
unidadedivina[.]org|1st level redirector top domain
unixcom[.]tech|1st level redirector top domain
us-en-livpure[.]com|1st level redirector top domain
vcsoftware[.]shop|1st level redirector top domain
viopenfs[.]click|1st level redirector top domain
visitanytime[.]online|1st level redirector top domain
visitingkw[.]com|1st level redirector top domain
vitalitytotaloffers[.]website|1st level redirector top domain
vmbjf[.]shop|1st level redirector top domain
vrundadigitalmarketing[.]online|1st level redirector top domain
vumato[.]store|1st level redirector top domain
wheretrip[.]today|1st level redirector top domain
wonders28[.]click|1st level redirector top domain
woodworkingz247[.]store|1st level redirector top domain
wszystko[.]space|1st level redirector top domain
xjan[.]top|1st level redirector top domain
yamadeko187[.]click|1st level redirector top domain
yourhappytour[.]online|1st level redirector top domain
yourterif[.]com|1st level redirector top domain
ys012[.]top|1st level redirector top domain
zd0xnb5mp[.]top|1st level redirector top domain
ztnty[.]click|1st level redirector top domain
zzih73zmi[.]top|1st level redirector top domain
06hue1c29p[.]top|2nd level redirector top domain
1sunwin[.]top|2nd level redirector top domain
2ir841s4y[.]top|2nd level redirector top domain
3jxc4mewe[.]top|2nd level redirector top domain
accgamegraphic[.]com|2nd level redirector top domain
adelalbassam[.]com|2nd level redirector top domain
alisverisinkalbi[.]best|2nd level redirector top domain
clinicafamiliahispana[.]com|2nd level redirector top domain
coficity[.]com|2nd level redirector top domain
compensate[.]cyou|2nd level redirector top domain
contexcapital[.]com|2nd level redirector top domain
cpdm8u0ya5ndgw2vek[.]site|2nd level redirector top domain
dakotaindeck[.]website|2nd level redirector top domain
daktronicss[.]com|2nd level redirector top domain
davejs[.]top|2nd level redirector top domain
davetn[.]top|2nd level redirector top domain
difmlaw[.]com|2nd level redirector top domain
dinheiroagora[.]icu|2nd level redirector top domain
estafetamnr[.]top|2nd level redirector top domain
estafetaovt[.]top|2nd level redirector top domain
estrellaj[.]com|2nd level redirector top domain
fbusercenter[.]top|2nd level redirector top domain
forceunlockx[.]top|2nd level redirector top domain
foxworkz[.]com|2nd level redirector top domain
freetogetstarted[.]com|2nd level redirector top domain
herbalhealingforchildren[.]com|2nd level redirector top domain
hgeventservices[.]com|2nd level redirector top domain
imlxjqla1[.]top|2nd level redirector top domain
liberaricoffee[.]com|2nd level redirector top domain
lspcf7rq1[.]top|2nd level redirector top domain
maekss[.]com|2nd level redirector top domain
mavigelinim[.]com|2nd level redirector top domain
minelab-tech[.]com|2nd level redirector top domain
moneylioonzp[.]top|2nd level redirector top domain
motorsignhsrp[.]com|2nd level redirector top domain
olibroom[.]com|2nd level redirector top domain
paradigmjewels[.]com|2nd level redirector top domain
scottish-images[.]com|2nd level redirector top domain
sdstudyabroad[.]com|2nd level redirector top domain
services-channelplus[.]com|2nd level redirector top domain
superlays[.]store|2nd level redirector top domain
tjxe7zkxe[.]top|2nd level redirector top domain
vickypitner[.]com|2nd level redirector top domain
vpaaywdw[.]cfd|2nd level redirector top domain
xiangpet[.]site|2nd level redirector top domain
yearbookarchive[.]com|2nd level redirector top domain
zhuangatlantic[.]site|2nd level redirector top domain
teamcanadafoundation[.]com|2nd level redirector top domain
rrn[.]media|Final content website (Fabricated news website)
tribunalukraine[.]info|Final content website (Fabricated news website)
allons-y[.]social|Final content website (Fabricated news website)
artichoc[.]io|Final content website (Fabricated news website)
candidat[.]news|Final content website (Fabricated news website)
franceeteu[.]today|Final content website (Fabricated news website)
lavirgule[.]news|Final content website (Fabricated news website)
lesfrontieres[.]media|Final content website (Fabricated news website)
lexomnium[.]com|Final content website (Fabricated news website)
notrepays[.]today|Final content website (Fabricated news website)
la-sante[.]info|Final content website (Fabricated news website)
laterrasse[.]online|Final content website (Fabricated news website)
le-continent[.]com|Final content website (Fabricated news website)
lebelligerant[.]com|Final content website (Fabricated news website)
lesifflet[.]net|Final content website (Fabricated news website)
arbeitspause[.]org|Final content website (Fabricated news website)
besuchszweck[.]org|Final content website (Fabricated news website)
blackout-news[.]de|Final content website (Fabricated news website)
derbayerischelowe[.]info|Final content website (Fabricated news website)
grenzezank[.]com|Final content website (Fabricated news website)
meisterurian[.]io|Final content website (Fabricated news website)
miastagebuch[.]com|Final content website (Fabricated news website)
wanderfalke[.]net|Final content website (Fabricated news website)
brennendefrage[.]com|Final content website (Fabricated news website)
deintelligenz[.]com|Final content website (Fabricated news website)
derglaube[.]com|Final content website (Fabricated news website)
derleitstern[.]com|Final content website (Fabricated news website)
derrattenfanger[.]net|Final content website (Fabricated news website)
hauynescherben[.]net|Final content website (Fabricated news website)
kaputteampel[.]com|Final content website (Fabricated news website)
omnam[.]life|Final content website (Fabricated news website)
polskikompas[.]com|Final content website (Fabricated news website)
acrosstheline[.]press|Final content website (Fabricated news website)
holylandherald[.]com|Final content website (Fabricated news website)
mypride[.]press|Final content website (Fabricated news website)
shadowwatch[.]us|Final content website (Fabricated news website)
truthgate[.]us|Final content website (Fabricated news website)
ukrlm[.]info|Final content website (Fabricated news website)
warfareinsider[.]us|Final content website (Fabricated news website)
electionwatch[.]live|Final content website (Fabricated news website)
interventionist[.]us|Final content website (Fabricated news website)
liesofwallstreet[.]com|Final content website (Fabricated news website)
spicyconspiracy[.]info|Final content website (Fabricated news website)
uschina[.]press|Final content website (Fabricated news website)
www.psychologies[.]top|Final content website (Website impersonating legitimate one)
www.leparisien[.]wf|Final content website (Website impersonating legitimate one)
www.lepoint[.]wf|Final content website (Website impersonating legitimate one)
www.spiegel[.]ltd|Final content website (Website impersonating legitimate one)
www.welt[.]pm|Final content website (Website impersonating legitimate one)
www.forward[.]pw|Final content website (Website impersonating legitimate one)
www.hamodia[.]in|Final content website (Website impersonating legitimate one)
news.walla[.]re|Final content website (Website impersonating legitimate one)
www.polityka[.]link|Final content website (Website impersonating legitimate one)
www.polskieradio[.]cfd|Final content website (Website impersonating legitimate one)
www.polskieradio[.]icu|Final content website (Website impersonating legitimate one)
www.rbk[.]media|Final content website (Website impersonating legitimate one)
www.obozrevatel[.]ltd|Final content website (Website impersonating legitimate one)
www.unian[.]pm|Final content website (Website impersonating legitimate one)
www.fox-news[.]in|Final content website (Website impersonating legitimate one)
www.washingtonpost[.]pm|Final content website (Website impersonating legitimate one)

Suspicious IP addresses

46.138.250[.]248|Possible CopyCop-associated server (after Cloudflare)

Suspicious domains

closermag[.]eu|Possible Doppelgänger-fabricated website
conspiracywatch[.]in|Possible Doppelgänger-fabricated website
mensjournal[.]day|Possible Doppelgänger-fabricated website
mynaszlaku[.]in|Possible Doppelgänger-fabricated website
dzieckowpodrozy[.]in|Possible Doppelgänger-fabricated website
bibelbund[.]cfd|Possible Doppelgänger-fabricated website

Final content URLs

Please note that some of URLs below are not hosted on Doppelgänger-fabricated websites, but on legitimate existing websites (including strongly opinionated news websites and content publication platforms). Refer to previous “Domains and hostnames” sections to identify Doppelgänger-fabricated websites.

hxxps://acrosstheline[.]press/escaping-from-war/biden-prioritizes-ukraine-over-u-s-border-security
hxxps://acrosstheline[.]press/u-s-mexico-border/tragic-death-of-12-year-old-in-houston-open-borders-policy-to-blame
hxxps://allons-y[.]social/bardella-menaces-de-recuperer-les-milliards-pilles-par-l-ue/
hxxps://allons-y[.]social/crime-de-guerre-en-crimee-la-responsabilite-des-etats-unis-engagee/
hxxps://allons-y[.]social/emmanuel-macron-attise-la-guerre-civile/
hxxps://allons-y[.]social/viktor-orban-arrive-en-ukraine-pour-rencontrer-zelensky/
hxxps://arbeitspause[.]org/kriegstreiber-pistorius-will-noch-mehr-geld/
hxxps://arbeitspause[.]org/so-nah-am-frieden/
hxxps://arbeitspause[.]org/ukraine-verubt-terror/
hxxps://artichoc[.]io/emmanuel-macron-et-rachida-dati-appeles-a-ne-pas-fermer-entierement-le-centre-pompidou-pour-cinq-ans/
hxxps://artichoc[.]io/la-sculpture-olympique-de-l-artiste-alison-saar-inauguree-a-paris/
hxxps://artichoc[.]io/le-festival-d-avignon-appelle-son-public-a-voter-aux-prochaines-elections/
hxxps://artichoc[.]io/les-elections-legislatives-sont-devenues-l-un-des-evenements-politiques-les-plus-mediatises/
hxxps://artichoc[.]io/metallica-annonce-son-concert-avec-une-affiche-en-langue-russe/
hxxps://besuchszweck[.]org/antisemitische-stimmung-bluht-in-deutschland
hxxps://blackout-news[.]de/aktuelles/einzelhandel-in-der-krise-drastische-umsatzeinbrueche-bremsen-wirtschaftswachstum/
hxxps://brennendefrage[.]com/europa/politische-turbulenzen-in-europa
hxxps://brennendefrage[.]com/rest-der-welt/verantwortung-der-usa-fur-den-raketenangriff-in-sewastopol
hxxps://candidat[.]news/elections-legislatives-2024-pour-qui-les-francais-vont-ils-voter/
hxxps://candidat[.]news/fete-de-satan-le-soleil-et-les-montagnes-suisses-n-ont-pas-attire-tout-le-monde/
hxxps://candidat[.]news/jo-24-20-militaires-pour-assurer-la-securite/
hxxps://candidat[.]news/jo-la-securite-avant-tout/
hxxps://candidat[.]news/rn-l-unite-nationale-pour-sortir-de-la-crise/
hxxps://deintelligenz[.]com/staat/3794
hxxps://deintelligenz[.]com/staat/amerikanisches-unternehmen-verzogert-den-bau-eines-chipwerks-in-deutschland
hxxps://denae[.]org/article/703
hxxps://derbayerischelowe[.]info/groszugigkeit-mit-nebenwirkungen-deutschlands-dilemma-bei-der-ukraine-hilfe
hxxps://derbayerischelowe[.]info/rekrutierungsdrama-in-der-ukraine-ein-land-zwischen-pflicht-und-widerstand
hxxps://derbayerischelowe[.]info/ukrainische-diplomatie-am-scheideweg-erfolge-im-westen-widerstande-im-suden
hxxps://derglaube[.]com/geschichte-des-glaubens/zahl-antimuslimischer-ubergriffe-verdoppelt-sich
hxxps://derleitstern[.]com/prognosen-und-vorhersagen/neue-umstrukturierungen-im-militarapparat-der-ukraine
hxxps://derrattenfanger[.]net/ampel-will-deutschland-islamisieren
hxxps://derrattenfanger[.]net/deutschland-verliert-an-wettbewerbsfahigkeit
hxxps://derrattenfanger[.]net/es-gibt-nur-einen-richtigen-weg-raus-aus-der-eu
hxxps://derrattenfanger[.]net/eu-kapitalmarktunion-soll-fremde-schulden-mit-deutschem-geld-bezahlen
hxxps://derrattenfanger[.]net/russland-ist-immer-noch-da
hxxps://derrattenfanger[.]net/was-halten-deutsche-von-selenskyj
hxxps://derstatus[.]at/politik/wende-im-mainstream-jetzt-spricht-man-von-exit-strategie-fur-ukraine-krieg-2680.html
hxxps://desk-russie[.]eu/2024/06/13/un-meme-combat-democratique-en-ukraine-et-en-france.html
hxxps://deutschlandkurier[.]de/2024/06/christina-baum-afd-von-pressefreiheit-kann-in-deutschland-keine-rede-sein/
hxxps://deutschlandkurier[.]de/2024/06/rainer-rothfuss-afd-wir-sind-der-erklaerte-feind-der-globalisten/
hxxps://electionwatch[.]live/g7-loan-approval
hxxps://electionwatch[.]live/increase-in-missile-deliveries
hxxps://franceeteu[.]today/chez-nous/jo2024-qui-en-a-vraiment-besoin
hxxps://franceeteu[.]today/chez-nous/les-athletes-devront-recuperer-physiquement-et-mentalement-apres-les-jo-2024
hxxps://franceeteu[.]today/nous-et-eux/les-dirigeants-occidentaux-se-reunissent-pour-discuter-de-lukraine-prolonger-la-guerre-et-se-congratuler
hxxps://franceeteu[.]today/nous-et-eux/les-pays-membres-de-lotan-augmenteront-leurs-depenses-militaires-de-18
hxxps://franceeteu[.]today/nous-et-eux/les-ukrainiens-profitent-des-avantages-de-lue-pourquoi
hxxps://franceeteu[.]today/nous-et-eux/washington-ne-sarrete-pas-il-est-desormais-possible-de-frapper-la-russie
hxxps://gewerkschaften-gegen-aufruestung[.]de/
hxxps://grenzezank[.]com/wem-soll-geholfen-werden/
hxxps://h16free[.]com/2024/06/14/77581-la-justice-sociale-nexiste-pas
hxxps://harriman.columbia[.]edu/event/western-sanctions-on-russia-and-the-rise-of-the-non-western-offshore-world/
hxxps://hauynescherben[.]net/marktanalyse/baukrise-bedroht-deutsche-wirtschaft
hxxps://hauynescherben[.]net/marktanalyse/deutschland-bricht-rekorde-bei-zahl-der-insolvenzen
hxxps://hauynescherben[.]net/marktanalyse/europa-nimmt-energiedialog-mit-moskau-wieder-auf
hxxps://hauynescherben[.]net/news/schweizer-friedenskonferenz-ohne-frieden
hxxps://histoireetsociete[.]com/2024/06/04/guerre-en-ukraine-et-elections-europeennes-vers-une-guerre-mondiale-ineluctable/
hxxps://holylandherald[.]com/american-military-on-edge/
hxxps://interventionist[.]us/media-propaganda/a-new-tragedy-the-consequences-of-a-broken-immigration-system
hxxps://interventionist[.]us/media-propaganda/biden-and-trump-s-fate-by-charles-ortel
hxxps://justthenews[.]com/accountability/political-ethics/hld-hunter-biden-was-proposed-board-member-120-million-burisma
hxxps://kaputteampel[.]com/personlichkeiten-und-politik/manuela-schwesig-bei-einem-besuch-in-der-ukraine
hxxps://la-sante[.]info/5-virus-transmis-par-les-moustiques-qui-pourraient-perturber-les-jeux-olympiques/
hxxps://la-sante[.]info/epidemie-de-cholera-dans-l-armee-ukrainienne-plusieurs-cas-mortels-deja-signales/
hxxps://la-sante[.]info/epidemie-de-dengue-risques-a-l-approche-des-jeux-olympiques/
hxxps://laterrasse[.]online/les-francais-sont-preoccupes-par-le-nombre-d-immigres-dans-le-pays
hxxps://laterrasse[.]online/marine-le-pen-ne-doute-pas-de-sa-victoire-aux-prochaines-elections
hxxps://lavirgule[.]news/elections-legislatives-un-choix-francais-decisif/
hxxps://lavirgule[.]news/l-ukraine-noie-l-ue/
hxxps://lavirgule[.]news/les-elections-francaises-jettent-une-ombre-sur-les-jo-2024/
hxxps://le-continent[.]com/geopolitique-et-relations-internationales/accord-de-securite-europeen-washington-joue-sa-partition-ukrainienne
hxxps://lebelligerant[.]com/affaires-internes/delocalisations-cachees-la-dispersion-des-migrants-dans-la-france-rurale
hxxps://lebelligerant[.]com/affaires-internes/macron-promet-d-agir-jusqu-en-mai-2027-et-d-etre-protecteur-de-la-republique
hxxps://lebelligerant[.]com/conflits-brulants/les-etats-unis-et-israel-discutent-de-l-envoi-de-systemes-patriot-a-l-ukraine
hxxps://lebelligerant[.]com/conflits-brulants/les-hommes-ukrainiens-se-cachent-en-masse-pour-echapper-a-la-conscription
hxxps://lebelligerant[.]com/conflits-brulants/macron-et-nouvelle-caledonie-un-cas-d-arrogance-coloniale
hxxps://lebelligerant[.]com/diplomatie/les-pays-de-l-ue-entament-des-negociations-d-adhesion-avec-la-moldavie-et-l-ukraine
hxxps://lebelligerant[.]com/revelations/recrutement-des-agents-de-securite-pour-les-jo-finalise-ou-6000-ukrainiens-a-paris
hxxps://lesfrontieres[.]media/hauts-de-seine-une-fille-de-12-ans-violee-parce-que-juive-par-3-adolescents
hxxps://lesfrontieres[.]media/legislatives-quelles-mesures-sur-limmigration-une-assemblee-de-droite-pourrait-adopter
hxxps://lesifflet[.]net/jeunesse-actu/l-allemagne-accueille-des-musiciens-et-des-footballeurs-ukrainiens
hxxps://lesifflet[.]net/sports-et-esports/comment-les-etats-unis-transforment-les-jeunes-europeens-en-terroristes
hxxps://lexomnium[.]com/attal-promet-de-legiferer-contre-les-hausses-d-impots/
hxxps://lexomnium[.]com/l-ukraine-face-a-un-avenir-incertain/
hxxps://lexomnium[.]com/le-pen-previent-macron-que-bardella-n-autorisera-pas-l-envoi-de-troupes-en-ukraine/
hxxps://lexomnium[.]com/nouveaux-affrontements-en-nouvelle-caledonie-les-espoirs-de-macron-decus/
hxxps://lexomnium[.]com/panique-de-macron-le-pen-avertit-d-un-coup-d-etat-administratif/
hxxps://lexomnium[.]com/sommet-en-suisse-les-propositions-de-paix-russes-rejetees-zelensky-poursuivra-la-guerre/
hxxps://liesofwallstreet[.]com/statistics/truly-international
hxxps://mehr-diplomatie-wagen[.]de/
hxxps://meisterurian[.]io/der-neue-generalsekretar-der-nato/
hxxps://meisterurian[.]io/deutschlands-schlechtester-kanzler/
hxxps://meisterurian[.]io/wer-will-den-krieg-wirklich-beenden/
hxxps://miastagebuch[.]com/fusball-oder-front-ukrainische-nationalspieler-vor-der-wahl-ihres-lebens
hxxps://miastagebuch[.]com/ukraine-im-abseits-friedenskonferenz-offenbart-internationale-distanzierung
hxxps://mypride[.]press/disney-is-controlling-the-minds-of-americans
hxxps://mypride[.]press/fbi-is-covering-trans-shooters
hxxps://mypride[.]press/ukrainian-lgbtqia-propaganda-for-the-usa
hxxps://news.walla[.]re/item/2113714.html
hxxps://news.walla[.]re/item/4236441.html
hxxps://news.walla[.]re/item/9844192.html
hxxps://notrepays[.]today/sommet-de-burgenstock-quelle-paix-sans-la-russie
hxxps://omnam[.]life/b-wlm/qry-h-l-mryq-ym
hxxps://omnam[.]life/bysr-l/rh-b-pwhdt-mhzb-llh
hxxps://original.antiwar[.]com/paul/2024/06/17/we-spent-a-billion-dollars-fighting-the-houthis-and-lost/
hxxps://overton-magazin[.]de/hintergrund/politik/unser-gemeinsames-interesse-muss-es-sein-den-gegenwaertigen-krieg-baldmoeglichst-zu-beenden/
hxxps://overton-magazin[.]de/hintergrund/wirtschaft/tor-tor-tod/
hxxps://overton-magazin[.]de/top-story/das-geschacher-um-das-gemeinsame-communique-der-schweizer-friedenskonferenz/
hxxps://polskikompas[.]com/2024/06/01/zelenski-uwaza-negocjacje-z-rosja-za-nierealne/
hxxps://rrn[.]media/de/eu-gipfel-mit-selenskyj-und-ohne-die-ukraine/
hxxps://rrn[.]media/de/euro-2024-zuge-obdachlose-und-terroristen/
hxxps://rrn[.]media/de/korruptes-nordatlantisches-bundnis/
hxxps://rrn[.]media/de/video-friedlicher-gipfel-nicht-fur-den-frieden/
hxxps://rrn[.]media/de/video-russland-und-asien-vereinen-sich/
hxxps://rrn[.]media/de/zurucktreten-oder-nicht-zurucktreten/
hxxps://rrn[.]media/fr/bardella-nenverra-pas-de-troupes-francaises-en-ukraine/
hxxps://rrn[.]media/fr/grand-casse-de-lukraine/
hxxps://rrn[.]media/fr/le-deuxieme-tour-en-france-la-deuxieme-chance-de-lue/
hxxps://rrn[.]media/fr/les-electeurs-francais-soudoyes/
hxxps://rrn[.]media/fr/macron-exploite-les-gauchistes-au-second-tour/
hxxps://rrn[.]media/fr/video-le-sommet-le-plus-absurde/
hxxps://rrn[.]media/fr/video-lue-contre-la-democratie/
hxxps://rrn[.]media/fr/video-pas-de-gagnants-dans-les-legislatives-en-france/
hxxps://rrn[.]media/fr/week-end-touristique-de-zelensky/
hxxps://rrn[.]media/nato-shifts-focus-away-from-ukraine/
hxxps://rrn[.]media/netanyahu-s-political-chess/
hxxps://rrn[.]media/the-democratic-facade-of-zelensky-s-ukraine/
hxxps://rrn[.]media/time-to-dissolve-nato/
hxxps://rrn[.]media/video-u-s-orders-spark-two-terror-attacks-in-one-day/
hxxps://shadowwatch[.]us/ukrainians-lose-faith-in-zelensky-s-leadership/
hxxps://spicyconspiracy[.]info/conspiracy/aliens-and-nuclear-war
hxxps://spicyconspiracy[.]info/conspiracy/cuban-missile-crisis-2-0
hxxps://spicyconspiracy[.]info/conspiracy/ukraine-is-in-debt
hxxps://spicyconspiracy[.]info/forecasts-and-predictions/biden-is-buying-electors
hxxps://stratpol[.]com/aider-lukraine-au-detriment-des-interets-de-son-peuple-est-un-suicide-politique/
hxxps://stratpol[.]com/le-president-zelensky-a-etabli-une-dictature-lukraine-ne-repond-pas-aux-criteres-dadhesion-a-lue-ni-politiquement-ni-economiquement/
hxxps://stratpol[.]com/le-regime-macronien-en-crise-ne-peut-plus-masquer-lineluctable-defaite-ukrainienne/
hxxps://theconversation[.]com/legislatives-anticipees-quel-avenir-pour-la-fonction-publique-231643
hxxps://townhall[.]com/columnists/dennisprager/2024/06/11/why-americans-mistrust-election-results-more-than-the-citizens-of-any-other-democracy-n2640280
hxxps://tribunalukraine[.]info/article/1237
hxxps://tribunalukraine[.]info/article/1245?lang=fr
hxxps://tribunalukraine[.]info/article/1246?lang=fr
hxxps://tribunalukraine[.]info/article/1247?lang=fr
hxxps://tribunalukraine[.]info/article/1248?lang=fr
hxxps://tribunalukraine[.]info/article/1251
hxxps://tribunalukraine[.]info/article/1262?lang=fr
hxxps://tribunalukraine[.]info/article/1263?lang=fr
hxxps://truthgate[.]us/under-fire/
hxxps://ukrlm[.]info/corruption/kyiv-officials-smuggle-relatives-abroad-using-orphans
hxxps://ukrlm[.]info/revelations/zelensky-frustrated-by-west-s-concerns-about-corruption
hxxps://uschina[.]press/taiwan-dispute/taiwan-war-will-determine-the-fate-of-the-world
hxxps://uschina[.]press/taiwan-dispute/taiwanese-separatists-will-face-the-death-penalty
hxxps://wanderfalke[.]net/das-schlimmste-kommt-spater
hxxps://wanderfalke[.]net/deutschland-gibt-mehr-aus
hxxps://warfareinsider[.]us/zelensky-declines-orban-s-ceasefire-plan/
hxxps://www.achgut[.]com/artikel/ideologie_subvention_und_betrug
hxxps://www.agoravox[.]fr/tribune-libre/article/le-sommet-du-desastre-et-pourtant-255330
hxxps://www.agoravox[.]fr/tribune-libre/article/les-peuples-d-europe-proches-du-255191
hxxps://www.bvoltaire[.]fr/sante-politique-la-cocaine-conquiert-la-region-parisienne-en-toute-impunite/
hxxps://www.bvoltaire[.]fr/tribune-le-chaos-et-la-violence-cest-la-gauche-toujours-la-gauche/
hxxps://www.causeur[.]fr/le-front-populaire-sans-le-peuple-285289
hxxps://www.fakt[.]pl/pieniadze/ceny-pradu-w-gore-od-1-lipca-wiemy-jak-zmienia-sie-nasze-rachunki/295je61
hxxps://www.forward[.]pw/news/543608/Netanyahu-Blackmails-Biden-Israel%27s-Last-Chance.html
hxxps://www.forward[.]pw/news/543608/Ouroboros-in-Israeli-Government-Coalition-Falls-Apart-and-Can-Drown-the-Country.html
hxxps://www.forward[.]pw/news/543608/Thanks-to-US-Democrats-AntiSemitism-in-Europe-Reared-Its-Head.html
hxxps://www.forward[.]pw/news/543608/US-Democrats-and-Israeli-Left-Liberals-Want-to-Permanently-Set-the-US-and-Israel-at-Variance.html
hxxps://www.forward[.]pw/news/543608/US-Surrendered-Israel-to-Hezbollah.html
hxxps://www.fox-news[.]in/world/Decades-for-America-to-Recover-After-Biden.html
hxxps://www.fox-news[.]in/world/Redneck-Foreign-Policy-JD-Vance-Is-a-Democrat-Nightmare.html
hxxps://www.fox-news[.]in/world/Trump-Faces-a-Guilty-Verdict-Biden-Isn%27t-Likely-to-Be-Helped-by-This.html
hxxps://www.fox-news[.]in/world/US-Elites-Bette-on-the-Best-Candidate-since-Theodore-Roosevelt.html
hxxps://www.fox-news[.]in/world/US-Is-Stuck-in-Europe-It's-Time-to-Get-Out.html
hxxps://www.hamodia[.]in/2024/06/18/Biden-Set-Planes-on-Wrong-Course.html
hxxps://www.hamodia[.]in/2024/06/18/Cui-Prodest-Trump's-Death-Would-Benefit-Democrats-and-Ukraine.html
hxxps://www.hamodia[.]in/2024/06/18/If-Not-Blinken-Then-Baerbock--US-Tries-to-Pressure-Israel-Through-Its-Satellites.html
hxxps://www.hamodia[.]in/2024/06/18/Israelis-Became-Ukraines-Hostages.html
hxxps://www.hamodia[.]in/2024/06/18/Ukraine-Believed-Biden-But-We-Shouldn%27t-Do-That.html
hxxps://www.hamodia[.]in/2024/06/18/Wait-is-Short-Vice-Presidential-Candidate-James-David-Vance-Offers-Hope-for-Israel.html
hxxps://www.ifop[.]com/publication/le-climat-legislatif-a-deux-semaines-du-vote-du-30-juin/
hxxps://www.leparisien[.]wf/politique/D%C3%A9truire-l'Ukraine-la-Russie-et-l'Europe--la-guerre-totale-am%C3%A9ricaine-03-07-2024-OBOKEOSPR5EIMELFXPWCZGYEXI.php
hxxps://www.leparisien[.]wf/politique/Jeux-olympiques-%C3%A0-Paris--une-f%C3%AAte-g%C3%A2ch%C3%A9e-03-07-2024-OBOKEOSPR5EIMELFXPWCZGYEXI.php
hxxps://www.leparisien[.]wf/politique/La-Macronie-a-peur-d'un-gauchissement-03-07-2024-OBOKEOSPR5EIMELFXPWCZGYEXI.php
hxxps://www.leparisien[.]wf/politique/Les--canards-boiteux--se-r%C3%A9voltent-contre-le-plan-am%C3%A9ricain-13-06-2024-OBOKEOSPR5EIMELFXPWCZGYEXI.php
hxxps://www.leparisien[.]wf/politique/Les-Ukrainiens-veulent-la-paix-Macron-veut-la-guerre-16-07-2024-OBOKEOSPR5EIMELFXPWCZGYEXI.php
hxxps://www.leparisien[.]wf/politique/Macron-a-lanc%C3%A9-une-grenade-sur-ses-supporters-19-06-2024-OBOKEOSPR5EIMELFXPWCZGYEXI.php
hxxps://www.leparisien[.]wf/politique/Panique-dans-le-camp-mondialiste--le-RN-veut-rendre-%C3%A0-la-France-son-ind%C3%A9pendance-24-06-2024-OBOKEOSPR5EIMELFXPWCZGYEXI.php
hxxps://www.leparisien[.]wf/politique/Jupiter-et-une-bande-d'escrocs-23-07-2024-OBOKEOSPR5EIMELFXPWCZGYEXI.php
hxxps://www.lepoint[.]wf/politique/A-la-veille-des-Jeux-olympiques-la-Macronie-est-frapp%C3%A9e-par-la-schizophr%C3%A9nie-03-07-2024-2528358_20.php
hxxps://www.lepoint[.]wf/politique/Il-est-temps-pour-la-France-de-se-pr%C3%A9parer-%C3%A0-quitter-l'OTAN-19-06-2024-2528358_20.php
hxxps://www.lepoint[.]wf/politique/La--ligne-de-d%C3%A9fense--de-Zelensky-a-disparu-en-Ukraine-17-05-2024-2528358_20.php
hxxps://www.lepoint[.]wf/politique/La-droite-pr%C3%AAte-%C3%A0-mener-un-combat-d%C3%A9cisif-pour-l%27Europe-27-05-2024-2528358_20.php
hxxps://www.lepoint[.]wf/politique/La-France-se-r%C3%A9veille-et-choisit-la-droite-et-la-paix-27-05-2024-2528358_20.php
hxxps://www.lepoint[.]wf/politique/La-victoire-%C3%A0-la-Pyrrhus-de-la-Macronie-03-07-2024-2528358_20.php
hxxps://www.lepoint[.]wf/politique/Le-bluff-et-l%27effondrement-de-la-Macronie-13-06-2024-2528358_20.php
hxxps://www.lepoint[.]wf/politique/Les-Insaisissables-03-07-2024-2528358_20.php
hxxps://www.lesechos[.]fr/elections/legislatives/legislatives-2024-jordan-bardella-promet-une-abrogation-de-la-reforme-des-retraites-a-partir-de-lautomne-2102105
hxxps://www.liberationnews[.]org/dozens-quitting-u-s-military-over-gaza-in-protest/
hxxps://www.merkur[.]de/politik/umsetzungshuerden-habeck-robert-deutschland-wasserstoff-plaene-2030-experten-warnung-93098721.html
hxxps://www.nachdenkseiten[.]de/?p=116956
hxxps://www.obozrevatel[.]ltd/ukr/politics-news/amerike-ne-do-ukrainy.php
hxxps://www.obozrevatel[.]ltd/ukr/politics-news/drugie.php
hxxps://www.obozrevatel[.]ltd/ukr/politics-news/o-vojne-luchshe-vsego-rasskazyvajut-kladbischa.php
hxxps://www.obozrevatel[.]ltd/ukr/politics-news/shatkoe-polozhenie.php
hxxps://www.obozrevatel[.]ltd/ukr/politics-news/zakon-dlja-vseh.php
hxxps://www.obozrevatel[.]ltd/ukr/politics-news/zdravyj-smysl-pod-zapretom.php
hxxps://www.observateurcontinental[.]fr/?module=articles&action=view&id=6030
hxxps://www.observateurcontinental[.]fr/?module=articles&action=view&id=6037
hxxps://www.polityka[.]link/tygodnikpolityka/kraj/2225160,1,Sprawca-zamachu-na-Trumpa-siedzi-w-Kijowie.read.html
hxxps://www.polityka[.]link/tygodnikpolityka/kraj/2225160,1,Straszliwa-zemsta-Tuska-w-Polsce-rozpoczęły-się-prawdziwe-represje.read.html
hxxps://www.polskieradio[.]cfd/5/1222/Artykul/7328273,Przestańmy-marnować-nasze-pieniądze-Ukraińcy-nie-chcą-już-walczyć.html
hxxps://www.polskieradio[.]cfd/5/1222/Artykul/7328273,Ukraińska-nikotyna-nadal-zabija-Europę.html
hxxps://www.polskieradio[.]cfd/5/1222/Artykul/7328273,Wszystko-jest-%C5%BAle-dzia%C5%82ania-rz%C4%85du-Tuska-prowadz%C4%85-kraj-do-bankructwa.html
hxxps://www.polskieradio[.]cfd/5/1222/Artykul/7328273,Czas-wziąć-przykład-z-Niemców.html
hxxps://www.polskieradio[.]icu/5/1222/Artykul/7328273,Ukrai%C5%84cy-to-nie-tylko-problem-ale-i-korzy%C5%9Bci-Polska-nie-powinna-wydala%C4%87-pracownik%C3%B3w.html
hxxps://www.rbk[.]media/rus/news/i-snova-o-pravah-1704319701.php
hxxps://www.spiegel[.]ltd/ausland/Das-Scheitern-in-der-Schweiz-wird-eine-T%C3%BCr-zum-Frieden-%C3%B6ffnen--a-f6e19b84-f463-4072-9dc9-4f01d107bbe4.html
hxxps://www.spiegel[.]ltd/ausland/Die-Ampel-will-sich-nicht-um-die-Alten-k%C3%BCmmern-a-81f83d7b-9a62-4916-8af9-e4af795b3ad5.html
hxxps://www.spiegel[.]ltd/ausland/Die-CDU-hat-beschlossen-die-ukrainische-Fl%C3%BCchtlingskarte-zu-spielen-a-fd5ae6c0-bd2a-440b-9fcc-cd8b733a7a69.html
hxxps://www.spiegel[.]ltd/ausland/Die-Schulen-vergessen-Deutsch-a-e637e017-ec74-43f3-87fd-50edb6b9d52f.html
hxxps://www.telepolis[.]de/features/Trump-Bei-Wiederwahl-Ende-der-Ukraine-Hilfe-9767021.html
hxxps://www.telepolis[.]de/features/Ukraine-Wir-werden-diesen-Krieg-endgueltig-verlieren-9772466.html
hxxps://www.telepolis[.]de/features/Wie-steht-es-um-die-Kriegstuechtigkeit-der-Ukraine-9770058.html?seite=all
hxxps://www.theblaze[.]com/columns/opinion/is-joe-biden-fulfilling-the-promise-of-trumps-second-term
hxxps://www.theeuropean[.]de/politik/politische-krisen-und-die-frage-warum-diplomatie-meist-zu-spaet-kommt
hxxps://www.tichyseinblick[.]de/meinungen/wie-die-bundesregierung-die-verteidigungsausgaben-schoenrechnet/
hxxps://www.tribunalukraine[.]info/article/1226
hxxps://www.tribunalukraine[.]info/article/1227?lang=fr
hxxps://www.tribunalukraine[.]info/article/1228?lang=fr
hxxps://www.tribunalukraine[.]info/article/1229
hxxps://www.tribunalukraine[.]info/article/1230
hxxps://www.tribunalukraine[.]info/article/1232?lang=fr
hxxps://www.tribunalukraine[.]info/article/1234
hxxps://www.tribunalukraine[.]info/article/1235?lang=fr
hxxps://www.unian[.]pm/politics/natsionalnaja-traditsija-korruptsija-sverhu-donizu.php
hxxps://www.unian[.]pm/politics/ostalis-prava.php
hxxps://www.unian[.]pm/politics/poka-ne-opredelilis.php
hxxps://www.unian[.]pm/politics/polmesjatsa-do-katastrofy.php
hxxps://www.unian[.]pm/politics/tsena-ozhidanij.php
hxxps://www.unian[.]pm/politics/ukrainu-gotovjat-k-novoj-tragedii.php
hxxps://www.unsere-zeit[.]de/spiel-mit-dem-nuklearkrieg-4792986/
hxxps://www.unsere-zeit[.]de/weg-zum-frieden-4792997/
hxxps://www.washingtonpost[.]pm/world/2024/06/06/swiss-f-ck-up/
hxxps://www.washingtonpost[.]pm/world/2024/07/03/citizenship-doesn-t-matter-if-you-support-biden/
hxxps://www.washingtonpost[.]pm/world/2024/07/03/sleepy-joe-doesn-t-go-democrats-can-t-win-honestly/
hxxps://www.welt[.]pm/politik/deutschland/article240128277/Die-Ampel-verlangt-Opferbereitschaft.html
hxxps://www.welt[.]pm/politik/deutschland/article240128277/Fu%C3%9Fballfans-werden-ein-weiteres-Tor-gegen-die-Ampel-erzielen.html

Fabricated Paris Olympics music video URL

hxxps://x[.]com/i/status/1815752292055822627

X/Twitter accounts

This list contains mostly “primary source” usernames (accounts that initially posted Doppelgänger 1st level redirectors links), but also contain usernames that are related to the primary sources (1st degree relation: reposted primary source links or following/followed by primary source accounts and matching external caracteristics of other bots in the network).

0xharveylad
AaronJames63529
AaronSmith98307
AArtavious80519
abominable486
AdelaidaYu94857
AdelynRean84620
AdrianSton21731
AdrienneHa82186
AdrionTou72012
adulteress1980
AGerren45837
agular_agul
ahangmen70
AhmedLaqui81929
AishahSofeySe
AkeemCrist19487
AkeiaDinit7721
AlandoKale63531
AlanMyers410571
AlbertineM58094
AleenaSony33802
AlejandroT29613
AlejandroT69868
Aleta760
AlexanderC86105
AllisonAtk87511
AllisonSmi24214
allnick
AllysaGeor10757
AmandaLe866301
AmandaMorg1105
AmberroseN44334
amputee1999
AmyCampbel14512
AmyleeJame46361
AmyPerkins89407
AmyWilson833826
AnastacioJ80599
AndrewCast20146
AndrewD68079835
AndrewKirb89649
AndrewOlso26872
AndrewRoch43050
AndrewRoll29279
AndrewT96311492
AndrewVarg71211
AnesaJael62201
AngelaMrs63742
angela_wil3281
AnikaFelic89191
AnivalVeda47636
AnnaliisaR94430
AnsonTejua50696
anthesis_end
AnthonyAnd1822
AnthonyAnd79317
AnthonyBen93775
AnthonyM68181
AnthonyRom30072
AnthonyWei84870
Antoinette56690
AnyaHnyda65722
AranMieko83072
ArianaGra349
Armbrister56062
ArroyoMarg99763
articulate_691
AshleaWiss17955
AshleyBoon92744
AshleyFowl22508
AshleyWatt9356
AssuntaKan26666
AsusenaLat46773
attalosIIphil
AubreRanis68237
AudeliaJes27752
Auhneshnikole43
AurelGallucc
AutumnNels92401
azalea17520
BairdMatth10879
BallardMic52393
BandonDeid56215
barnes_nat70915
BartlettMd12992
BBeasley96693
beachhead1987
bean_andre19923
beatty1991
BeckyAusti47600
BeckyTaylo53337
BekhiSeren
BenjaminWa20266
BethanyDvm62915
BethSexton98585
BHill19122
bikol_200
BillyZ77908
BitkoinAleksan1
BobbyMaddo6319
book733submitta
BOrtega22699
BoscoLilia59808
boyle_samu18869
BradleyGre77484
BradleyGuz44361
BradlyBrio22556
BradMack546206
BrandiWill70364
BrandonMcc90355
BrandonWel6144
BrandyP97889
Braniff459subju
BreckieH63
BreckieHill111
BrendaBuck54860
BrendaKell73705
BrenenDovi30274
BrianBryan7374
BrianGould97893
BrianMoon25896
BrianYoung68899
BriggsBret48724
brittani95296
BrittanySm60334
bryant_jes71710
BThompson91953
BussLupe70263
BWaylon81740
CailynPorf50907
CainJessic10931
calculated_1993
CalemTimmo56963
CalhounDr2376
calicle1999
CallieChuc23210
CalyJaycee18615
CamachoErn94310
CannonAndr35594
CannonNich68729
cape34inheritor
CardiBOnlyfan
CarlosPadi49920
CarolynFri73810
CarrellLyl31383
CassandraC51655
CathyMarti38680
cCierra678
CeliaWynon65447
ceukaryote28
ChadLyons23017
ChannelleK29581
ChanteeJav13642
CharleenDe8219
Chatherine64548
CheriseLat25116
CherylWils33812
chief7Chelia
chopfallen_boy7
ChristenaK98632
ChristianP32968
ChristinaT59003
ChristineA76598
ChrisWells18099
church8884
churchman_love
CieraNicka75693
CindyJenki6110
cisneros_j71464
ClarkBarba84873
CodySwanso34355
colonic_YT_
ColtenKelc77186
ConnerLisa88597
connoisseur129
cooper_pat48335
CordiaNjie98793
cornfield_BTC
CorynneA73247
cose_rosema
creighton_1975
creversible308
CrystalA9811
CrystalHar27125
CSavahna95445
curry_tiff86148
cynthia_ra55954
DakotaDura56698
DameshaL40774
DamonSulta30154
DanahJarel68338
DanaMartin77885
DanaReid279769
DanielE92553229
DanielFren43236
DanielWill65551
DarinAlin358290
DarinL73784
DariusSing15125
DarleneGuz2006
DarrenFuen44399
DavidCl82987335
DavidClark64644
DavidDo58780247
DavidIb77126627
DavidLevin943
DavidMc37860799
DavidRay930605
DavidSi25635031
DavonEndy94558
dBonn651
DdsColon70368
DebbieCox156901
DeborahRee84073
DebraHashe21356
decker_jav924
DeleonShar83009
demivolt1940
DeniseAtki43363
dennis_mar29792
DennisZach64095
DerrickBro54878
DesmoneJuv19870
destefano_1994
DevinSimps85838
devisable_MC
DiamondHer59732
DianeRicha54865
discuss21nepoti
disoperation_sA
DixMeredit
DonieshaLa63273
DonnaOrtiz76077
DonyaMonte94646
dorothea44216
DouglasJoh35345
DouraDied
DrakeZacha28819
DrCharlesM68203
DrRachelPi9815
DTyrisha70369
duncan_ang69209
DustiHattl
dvm_heathe94228
DvmKathlee342
DyanneGarr48936
DylanMille77762
EarleenNoe80743
EbonyVideo11
ecliffhang0
edgardoedge_ETH
EdwardHunt38954
EEastmond18906
EitanSylve26476
ElaineHutc47605
EleciaD74439
ElectaLayn463
ElexisJabr35217
Elizabe65233540
Elizabe68650189
ElizabethA58612
ElvinaErri60184
EmiliaClarke36
EmilieStru70424
EmilyCrawf61240
envisage_love
envysairdrops
ErekJerell37620
ErikRogers14246
ErikSmith139921
ErinOrozco53853
escorn749
EstherKlob3514
EstterMuniz34
ETemika39808
et_schoo
EugeneHend76426
execratory_69
FaliciaTon89989
FarrenTary88644
feet1971
FloyYantz21591
ford59Jinny
FoxElizabe8301
FranchotMa93551
frenetic_2000
FreyPamela90224
funniest9999
furry79Hippocra
GabirelKel24246
GabrielleL28209
GambleDyla11694
GarrenLyni61267
GaryWillia45710
gauntlett_liker
GDevaris67612
gHanoi329
giantess_Ms
gina_ryan42326
GlendaDiaz5386
GloriaBrow59480
gourmet_0072
gravedigger_ETH
GreggMd12074
GrygielShi14200
gunwale_323
HaleyB382
haley_zimm13022
HallDds3993
HamidYumik24083
HannahBark49911
HannahHowa21425
hansen_bru36354
HarryEvans74555
harvey_jas1645
HeatherBai30539
HeatherPat8959
henry_bruc63443
HiepShraga59066
HMcintosh13411
HodgesKevi79792
holly_mcin34307
HollyMille37923
HollyWilli75508
HomemadeL735
horodko_123
horrible589
howell_hea52026
HoytJanica75392
hudson_ale50374
HueBettina81105
IanHarr07314635
IanHill1384887
IggyAzaleaV2024
IgnasioIss64309
implore1985
infelicitous8Ki
ingram_mat8278
IPessy22221
JackieYoun5959
JacobColem69943
JacobP53131
JacobRios260287
jacobs_jan37664
JadeMiller87460
JakeClark137774
JamekaLich49048
JamesBenja2615
JamesGeorg19164
JamesHayne40018
JamesLittl17061
JamieGraha78891
JamieTucke14261
JaneaneKen11409
JaneBlair32443
JannelleAl40199
JannelleLy12689
JareeHasan47887
JarisNafee3865
JasmineFra35397
JasmineSai20009
JasonAlvar52028
JasonFord541921
JasonMathe26616
JasonPalme66606
JataraE30626
JayceeToni22310
JaymeeRodd9891
JazmyneKeo15068
JeanellJ33566
JeanetteGr81110
JeffreyPet10795
JeffreyRya62186
JElonzo41580
JeneaJulee87185
JenniferBr86495
JenniferFr14330
JenniferGa21371
JenniferHe69883
JenniferHu89540
JenniferMa43562
JenniferMi92430
JenniferMu56967
jennifer_p98723
JeraBoy13302
JeremyCase7417
JeremyMont69875
JerilynTab27852
JeseniaLat63272
JessicaFri13311
JessicaHal13033
JesusArroy87326
JGardner38000
JGrimes50648
JhoannaKel72165
JillEvans298191
JillKenned70832
JillynMaki81738
jimenez_st77745
JKhaleelah57015
JMyesha93939
joel_stanl78119
JohnAguila71917
JohnAustin9200
Johnell089Mesha
JohnSandov62241
Johnwillia67214
JolynnLato43219
JonathanCa87793
JonathanSa77732
jones_jose29247
JonesTina44863
JosephClar21335
JosephPach65125
JoshuaAlle54201
JoshuaF03234929
JoshuaHenr26332
JoshuaK29297
JoshuaK33818
JoshuaRyan31275
JoshuaWhit94641
JRashidah35844
Juanisha82judic
JuDusat
JudySultan85594
Julia_johnyyS
julie_powe75191
JustinPatt22465
JustyneSte82338
JWhite35849
KaitlynKrems625
KananiLano12953
KarenRiley77877
KarenSwans1335
KarenThoma51883
KateriD34053
KatherineP79348
KatherineW23809
KathleenSm49791
kaufman5082
kayde32613
kayde47060
KeenanSave50530
KellyBrook31135
KellyGarre18418
KellyLove119303
KellyMerca81106
KellyMitch73247
KellyWood349975
KelseyJohn96059
KendraMcmi66898
KennethDav26808
kenneth_ra40124
KennethWal7325
KenyettaMa35474
KevinRiley43187
KevinSmith89025
KHinton71864
KHumphrey31621
KimaTarron26681
KimberlyA68149
KimberlyMo50615
KimHenders5169
KimyaSoctt97474
KjellTaqui53048
KlaraMesen25364
KnightAlan4409
konstantin87233
KoreyRayfo62115
kotick_YTs_
kremer_Missis
KristaRobi35732
kristyl89466
KrystnJ9527
KTimothey81113
KyleGuzman99454
kyoko_megg91549
lacai_e
LacyLennonSex
laliberte_lndn1
LambertCla42301
LambertoOp6388
LaquithaNa3436
LarrySmith81320
latitude342
LauraLinds18885
LauraRi01194232
LauraSu04447407
LaureneSal86083
LaurenRich18669
LavelleLen17338
LCoventon7407
LeblancMan21827
Leib08Camille
LekeyaSann13304
LennisNash89621
LexySahar46322
Liberty911lice
LichelleJa5001
LilliaE98714
LindaDa25640159
LindseySmi38603
LisaCastro89568
LisaKim1821855
LisaMiller44058
LisaMorris30278
LolaRidell63973
LopezWilli47150
LorendaSha13685
LorrainePa87513
lotion_likeretw
LShantale46957
LunaroseWa13728
Lynzie408
lyophobic_lndn
MaddoxRebe55780
MaeMarsaw18016
MaeScharwa81101
magen69383
magic_malk51998
magnetron1Macgr
mailbag1991
ManuellaJoseph4
MarcusMars90787
MarettaQ14802
MariaRodri59262
MarieannD45842
MarliAlexa1334
MarquettaA3249
MaryDaniel92309
MaryLewis249231
MaryMit63572507
mastrocovi32794
MatthewGre88340
MatthewHer58919
MatthewKni27769
MatthewSto5853
MaxCole58677
MaxwellCry68359
MayolaMonz67142
MccormickM67122
mcentire_1992
mcfarland99958
mcguire_gr12198
MeganHunt314085
MeganSchwa80211
Melissa92980720
MelissaRee29626
MeyerVonni62726
MichaelGre85462
MichaelKin81586
MichaelPri51727
MichaelShi16460
MichaelWar93654
MicheleR78117
MichelleGo92874
Miguelange75441
MikennaTav35853
MillyTasha76454
MirandaBre65593
MirnaTobia74424
miscible869infe
MissS93037
MistyYates99557
MitchellJa24559
MKohn62918
MLawson8410
MNallie85980
money_johnyyS
monique_ri38619
MontaviusL2902
moore_javi58917
MorganHutc54052
MrDavidGon68023
MShonetta31918
MWashingto83908
MWillilam90778
NancyannTa23675
NataliePortma56
NatalineRa49167
NathanHend18636
NathanPatt6732
NeslanMadon
NevinRenea2349
newton_nic94268
Nichola9487044
NicholsonA95169
NicolaJaco43377
NikolCapri3502
NissaAkeya54889
nlacewing7
nolan_bria8187
NolaShalay51794
nolen26989
OAlyx39237
oneal_andr99285
OrtizTrace76497
OwensMr36616
OYocheved44921
OzielSatia64560
pantie1985
paragon_19750
PatrickDun462
PaulaOwens43042
PaulAyala424679
PaulGilles99813
PaulOneill50974
PaulTho0716281
PeckRenee66005
peltz1943
PeterD36670
PetersonEr89123
PhilbertSu45226
phobos_youtube9
PhucShanta71008
PierceMich19606
pJamel37
pJolleen4
plum_likeretwee
PMilissa53217
Polyhedra099914
promiscuous277
purr1985
QLachandra61083
quinte_boy
RachelAdam67549
RachelOcon2995
RachelWeav4005
randolph_m27451
raven_vaug34552
RebeccaAda20607
rebecca_mi27877
RebeccaO34619
RebeccaSan16467
RebeccaWil21610
reformed_76
ReginaldWe13732
reisch_boy
RenaMoneymake
RiaYantzi77529
RichardBla76330
RichardTho36053
RichardTor74837
riggs_greg40427
rivkarivkah_Mss
RLorinda51844
RMaryclair93963
RMccall81605
RNochum2266
RodneyHoll46453
RomeroVane47941
RonaldSmit54984
RondalSusa55034
RonnieCole58080
RonnikaSap26717
ross_cryst13099
RoxieWittn15726
rupp_33
ruthann92687
RyanForbes24037
RyanPage469190
SabrinaChr37767
SabrinaJoh79876
SadieJuice532
SakiaVania6203
SamanthaBl97552
SamanthaTh66709
SamuelBurn70061
SamuellD55225
sanchez_tr95073
SandraGamb38747
sandra_jon76201
SandraRobi96694
SandraW17317
SAntione89137
SarahAnder18454
SarahGibso33555
SarahHouse85482
SarahTanne4593
SaraM48854
SariyahMcg16015
savage_mic86268
SayakaSult94128
SCarey91266
ScottHenso26132
ScottSmith27547
SeanYoung238734
SekinaStep79983
shallot545Mt
ShannonAll72218
ShannonJoh87746
ShannonLee30580
ShantielL75886
SharisseKa56286
ShaunPlass
ShavinaRec88908
ShawniseJ44342
Shealene805Conw
SherekaJ30290
SherriLee486457
shroudlaid_enda
skricki_boy
SLakendra40247
SLonzell68686
SmithJanet13836
smith_kris97653
smith_will45596
SoniaStewa87530
spherics1940
spiderwort49
spoilt_gods
SSharolyn68038
StaceyMath37549
StacyJo93914753
StefaneeTe93861
SteinDariu64643
Stephan75047130
StephanieB64499
StephanieG39116
StephenDav26643
StephenKle57162
StephenR56531
steven_mor63330
steven_par14886
StevenWilc31359
subtle198
surety3strategy
SusieTuran54770
SuzanneKel72571
switchman813
talesman_1987
TamaraGonz19395
tamara_hin53004
TammyDavis91571
TanuGup08767224
TaylorCame25203
TaylorRand16664
TenaAnamar29362
TeresaVela92096
TerezaYavo58490
Thoa798
thomas_les82576
ThomasMoor16021
TimothyBuc90326
TimothyHen27493
TimothyWhi28503
TKandyce7379
TMckayla99785
ToasAlis
topping1992
TorreMilag72930
TPayne72526
TracyJones14896
tran_david32161
TrevorAlva54728
TrippieBri60
TroyWright37608
tShaneta6
turner_emm46784
TylerRiver4061
valerie_br66135
ValeriePen32037
ValerieZam82562
vanadium206
VartanJade60010
vChelse55
VeraK64338
VeronicaGo77329
VGibson20277
VickiLloyd34309
VictoriaWh46368
vic_vonbarg
view8pacific
walker_dan12028
WalkerTodd20454
wallace_va1897
w_arrell
WarrenGate20561
WavaG69999
weeks_kevi51151
WendyZhang65479
westley36121
white_beli29419
WhiteMadis26175
WhitneyR64941
WilkersonA90927
WilliamArn56684
WilliamBoy65270
WilliamChr79595
WilliamHug84601
WilsonAndr94342
WilsonMari17041
Won157Jaycob
woodwind49
WootonJaim33284
wriggle_YT_
WTollefs
Yulia69gazette
YvonneEver42450
ZhangJerem38552

Published on 25 July, 2024

Last update on 25 July, 2024

MITRE ATT&CK TTPs – created by AI

• Social Media Manipulation – TTP-ID: T1491
• Utilizing bot accounts to post links to disinformation on social media platforms like X/Twitter.
• Creating AI-generated content to mislead and influence public opinion.
• Engaging in comment spam to increase visibility and PageRank of fabricated websites.
• Impersonation – TTP-ID: T1588
• Impersonating legitimate news websites to spread disinformation.
• Creating websites that mimic established media outlets to lend credibility to false narratives.
• Obfuscated Redirection – TTP-ID: T1071
• Implementing a complex chain of redirections to obscure the final destination of malicious content.
• Using multiple levels of redirectors to hide the true nature of the content being shared.
• Content Manipulation – TTP-ID: T1490
• Creating and disseminating fabricated news articles to influence public perception.
• Amplifying existing disinformation from other sources to broaden the reach of false narratives.
• Infrastructure Manipulation – TTP-ID: T1583
• Rotating associated infrastructure assets frequently to evade detection.
• Utilizing shared or rented cybercrime infrastructure to support operations.

Source: Original Post