Ukrainian Facebook lists several dozen pages that profit from the deaths of Ukrainian defenders, publish false information and various prophecies. This way, they reach out to insanely large multimillion number of users. OPORA found this to be a coordinated network. And the profiteers are most likely Russians.
In this article, we will explore how a complex network of information resources is organized, which ultimately sends tens of thousands of people to the clutches of Russian financial fraudsters and to the purchase of dubious medicines. Also, we will tell you how the leading Ukrainian online media attract traffic with the help of such resources.
Daily Outreach That the Mainstream Media Would Envy
The network consists of at least thirty Facebook pages that pretend to be patriotic public accounts with news updates, and have their own news websites. Their names often feature patriotic slogans (“Ukraine will win”, “My Homeland Ukraine”, “Glory to Ukraine”, “We are Ukrainians, We are strong”, etc.), and they spread the unreservedly false information.
Another common feature all these networked pages share is that the their administrators are all located in Armenia.
The total engagement with the pages of the network for 30 days, in the sum-total of likes, reposts, and comments, is almost ten million. They include more than 5 million likes, half a million comments, 1.15 million shares. Of particular interest is the number of sad emoticons – 2.62 million. This is a lot, and it shows that the content is parasitic on the grief and the sympathy of readers.
Such an audience and coverage of the Facebook page is a dream objective of virtually every Ukrainian SMM expert. To assess the scale of the impact of this network (almost ten million interactions), we could compare it with the coverage of the page in Ukraine with the largest number of subscribers (3.5 million) — Повернись живим (lit. - Come back alive) (they only have 179,000).
Such engagement with the audience on Facebook is quite difficult to achieve, even when using Meta advertising tools. But the posts of these pages get into the top views of Ukraine every day.
They gain tens of thousands of reactions and shares, while not using paid promotion of their posts and pages. In total, over 30 days, the pages published more than 12,000 posts, or an average of 300 publications daily.
The “secret of success” of these pages comes from the content they share. Each post is designed to evoke emotions in the user: the joy for another "cotton explosion" in Russia, admiration for the exploits of the military and volunteers, sadness from learning about the death of Ukrainian defenders. Again, the news doesn't have to be true. On the contrary, the more striking the lies, the more reactions of Facebook users.
One of the most common technologies for attracting the attention of the platform users is the publication of fakes about the death of Russian and Ukrainian singers, actors, and other celebrities. In the last month alone, these pages reported the death of Nikita Dzhigurda, Alla Pugacheva, Vladimir Goryansky, Nikita Mikhalkov, Vladimir Vinokur, Ada Rogovtseva, and Philip Kirkorov. In fact, all of them are still alive.
Pages shared false reports about the death of People's Artist of Ukraine, Volodymyr Horyansky, who is actually alive and continues to tour the Ukrainian cities
Another popular theme of these publics is a variety of prophecies, predictions, oracle scenarios, stories of molfars, fortune-telling on cards, and other extrasensory nonsense. Which is not surprising to see. After all, one of the reasons why people are attracted to prophecy and prediction is that they offer a sense of confidence in the future.
Most of the prophecies published on these pages concern the end of the war and the death of Putin. Find below the examples of headlines that the network of pages uses to attract users:
- “The witch got into Putin's head. Reading the thoughts of the bloody dictator. Plans for attack and retreat."
- “How should Russia turn their back on the DEVIL? Cycles of Saturn in the map of Ukraine define the outcome of the war”
- “The prediction of the Carpathian Magi and molfars – what awaits Ukraine in 2022-24… Will Ukraine survive?”
Quite often, the posts of this network refer to the death of Ukrainian defenders. These publications gain the largest number of reactions (including sad emoticons), reposts, and comments.
The most popular post in the last 30 days, with information about the death of a Ukrainian soldier, on the page called "Interesting Stories," collected more than 130,000 reactions, thousands of comments and reposts. Moreover, this network created separate pages and websites that specialize exclusively in publishing the obituaries. Sometimes, the illustration does not even match the person in question.
Photos of ex-Deputy Volodymyr Parasyuk, who now defends the country as part of the Armed Forces, are often used to illustrate materials about the death of other people
Where Does the Emotional Content of the Network of Facebook Pages Lead?
In the publications themselves, a group of Armenian pages uses the so-called clickbait approach. This technology is about not disclosing all of the information in the message and usually exaggerating, which motivates the user to follow the link to the website. This method tries to increase the number of clicks, which ensures revenue from advertising.
In total, we identified 30 websites that the pages of the network linked to. All resources use free news templates such as Wordpress or Vercel.app, not too much concerned with external design. There is certainly no contact details. In addition to the domains that we are accustomed to, such as com.ua and info, these websites also use the domains of Russia (.ru), Armenia (.am) and even the Soviet Union (.su).
As you can see from the infographic, almost every page has its own website, links to which are most often published in posts.
However, the real purpose of all these websites becomes obvious after you disable all systems of protection and ad blocking. Hundreds of advertisements appear before our eyes. As a rule, for monetization of websites in Ukraine, they use the service of contextual advertising, Google Adsense. However, among this array of websites, there is only one that works with this system. Others attract the services of other advertising platforms— adskeeper and mgid.
Both companies operate in the contextual online advertising sales market and, judging by the open vacancies, they have offices in Kyiv.
Although the advertising agencies mgid and adskeeper present themselves as two separate companies, the content and style of ads on all websites are the same. Also, when you click on the ads of adskeeper, the browser redirects the user to the link clck.mgid.com.
In general, the advertising of these agencies can be divided into three categories: the sale of a variety of medicines, food additives and household supplies, advertising of phishing websites, and the promotion of Ukrainian online media.
Contextual advertising from MGID and Adskeeper. Advertising is quite similar in content, and links to the same resources
Fraudulent Schemes and the Russian Footprint
The ads directly on the websites often offer a variety of methods for making a fast buck, financial compensation or assistance. All of them eventually direct the user to the Great Finance website. On the website itself, the user is offered to download a list of the most highly profitable shares. However, to download it, you need to fill out a questionnaire: name, phone number, email. We filled out the questionnaire and got access to the offered report.
Few days later, we received a call with an offer to use an innovative investment platform, where artificial intelligence will make investments automatically, and we will only have to withdraw and spend the profits received.
After a series of questions about the place of work, income, dreams and a mobile phone (they were very interested in the phone model we use), the Russian-speaking manager offered to install the AnyDesk application so that she could instruct on the use of the investment platform.
AnyDesk is an application that allows you to remotely access and control another device from anywhere in the world. Allowing unauthorized persons to do this is very risky because they can take over your personal information, infect your device with malware, and also drag you into financial fraud schemes.
The manager asked us when we would complete the installation of AnyDesk, and sent detailed instructions, the address of their alleged office in Kyiv, and a link to the investment platform.
The platform itself is called Bawag-Invest (which has a very similar name to one of the largest Austrian banks BAWAG P.S.K.). The company website looks quite modern but basic from a technical point of view. Our attention was caught only by a large number of Russisms and the AI generated photos of "top managers" (blurred background, head turn).
There are three other websites running on the same server. They are all very similar, and offer similar investment services. The difference is only in the names and localization of websites (English, Ukrainian, and Russian).
After registering on their platform, we contacted the operator again. Of course, we did not install any software and asked for a verbal briefing by phone. But we were denied: according to the manager, the only possible way was to use AnyDesk. When we raised our reservations about their communication in Russian and the possible risks of fraud on their part, the manager reassured that we could come to visit their office in Kyiv, and that all actions are absolutely safe.
To verify her words, we decided to use the most famous Ukrainian password and asked her to say the word "palyanytsia". At this point, the manager broke down and handed the call to her colleague. Her partner ignored our greeting "Glory to Ukraine" twice, and after the third attempt he broke into a stream of Ukrainophobic threats.
After this conversation, we have no doubt that the ultimate goal of all advertisements is financial fraud through remote access to devices, and it is most likely organized by the Russians.
The scheme of selling medicines and household appliances is similar. Clicking on the ad, the user gets to the landing website, where various celebrities, scientists or doctors describe the benefits of a particular drug or product, and hundreds of fake comments of satisfied buyers are published at the bottom of the site.
On the website, the user is always offered to buy the last stock of the goods at a bargain price or get them for free. You also need to provide your phone number.
We tried to order one drug and filled out the appropriate form. In a second, we received a call from the consultant, and after 20 minutes of questions and recommendations, she offered a set of medicines for UAH 2,800. We will not now describe in detail the psychological subtleties of the conversation, but you can rest assured that after such a conversation it is extremely difficult to refuse to buy.
The goods are sent without any advance payment by "Nova Poshta." You just needed to specify the postal unit number and accept the oral offer agreement obliging to pick up the parcel. The next day they called us back and offered us the last chance to buy the medicine at a price of UAH 1,500.
OPORA has no medical expertise to draw conclusions about the appropriateness of using drugs advertised on Internet. But none of these drugs, according to the online service tabletki.ua, is sold in Ukrainian pharmacies. However, most of the advertised drugs are available for purchase on marketplaces such as rozetka.ua or prom.ua, and are also sold and manufactured in Russia. For example, the ointment "dermatizon": the Rozetka website does not specify the manufacturer but Google instantly gives you multiple search results for Russian stores where a Russian company is mentioned as a manufacturer.
There is another detail that indicates the close connection of the network of pages with Russia. The website ukraianaok.ru (which only posts information about the death of our soldiers) has an advertisement mentioning an "IP Manushkina Y.S." (IP is the Russian analogy of the Ukrainian individual entrepreneur).
We checked and found an entrepreneur registered in the Pskov region, as well as negative feedback from Russian citizens about the quality of medicines and amulets. It shows that this network and the configured "sales funnel" works both in Ukraine and in Russia.
Unfair Traffic or Who is the Intermediary That Casts a Shadow on Large Ukrainian Media
In addition to collecting personal data and sales, the network uses another method of monetization – the so-called traffic arbitrage. Arbitrators generate traffic through clickbait, misinformation, manipulations and redirect it for a certain reward to the largest Ukrainian online media. Such traffic is much cheaper than traditional Facebook or Google ads because its generation does not require significant costs.
In the ads of the websites you can find links to a number of major Ukrainian publications: UNIAN, TSN, Obozrevatel, Sport.yua, and New Voice (New Time), Focus, etc.
However, the listed media are not directly involved in the placement of these ads. The intermediary is another company — Ideal Media, which provides content promotion and audience exchange services. The company's website has a contact address in Northern California in the United States, where the same-name company was actually registered on April, 26, 2022. Until 2019, the service was called lentainform.com and was an analogue of the Russian media aggregator lentainform.org.
In addition, MGID EUROPE LIMITED was registered in the UK from 2010 to 2013. In 2013, it changed its name to IDEAL MEDIA EUROPE LTD. The company ceased operations in 2015 but these changes indicate the connection between the advertising agency MGID and the news aggregator Ideal Media.
We asked Ideal Media to comment on the cooperation with the MGID advertising platform. So far, OPORA has not received any response.
Given the simplicity of creating such websites, it is quite a challenge to track and counter their impact on the consciousness and wallets of Ukrainians.
However, at the end of January, 2023, the National Center for Operational and Technical Management of Telecommunications Networks at the State Service for Special Communications issued an order regulating the creation of a centralized system of automatic blocking of Internet resources in Ukraine. Its main goal is to combat phishing and automatically block phishing sites.
Despite the fact that from March, 2, all providers had to connect to the system, these websites continue to work. OPORA is preparing an appeal to the Ministry of Digital Affairs and Cyberpolice of Ukraine, with a request to conduct an audit on possible fraud.
OPORA also submitted a request to Meta administration asking to block the detected network of pages, which systematically distributes false content in the Ukrainian information field. In our opinion, this is exactly the “Coordinated Inauthentic Behavior” that the platform's rules prohibit.