While the Armed Forces are fighting back the enemy on the ground and in the sky, Ukrainian diplomats are blocking the ability of the russian federation to circumvent the sanctions, and millions of Ukrainian volunteers are providing the military and civilians with necessities, an equally important struggle continues on the information front. Now this component of the war has become particularly noticeable: in addition to conducting active hostilities, the russian federation is also trying to disseminate its fake reports on Ukraine at the international level (such as the meeting convened by russia about US biolabs located on Ukraine's territory). According to The Washington Post, Ukraine is now winning the information war but it should be understood that our information space will have to be cleared from russian websites and social media pages that have disseminated pro-russian messages for a long time now. Despite the fact that it has now become somewhat easier to implement (not least thanks to the help of Meta, YouTube and others that prohibit russians from broadcasting ads and shut down powerful propaganda resources like Russia Today), there is still a lot of work to do on the information front.

Even before the full-scale russian invasion, Civil Network OPORA was working on exposing anti-Ukrainian Facebook pages, investigating the activities of pro-Russian politicians in social media, and identifying the objectives of the network of pages that promoted russian propaganda in Ukraine. In this piece, analysts share their experience of searching for such media, as illustrated by russian media sites and pages, which OPORA started collecting in February, 2022. Over the month since then, some pages and sites have already been blocked, and some have remained available only through VPNs. However, a number of websites and pages are still active and require immediate blocking in Ukraine.

Websites

The starting point of the search was a list of 72 russian websites focusing on Ukrainian topics that use the Texty outlet to monitor the pro-russian messages. Subsequently, using Alexa and SimilarWeb resources (they help find similar websites in terms of audience and content), analysts compiled their own list of webpages. Many of these websites no longer operate in Ukraine but some can still be opened, even without the VPN services. It works in favor of the enemy and is detrimental to Ukrainian society.

Thus, analysts collected 225 websites that disseminate russian propaganda in the Ukrainian information space (find the full list here).

According to SimilarWeb, the estimated total Ukrainian audience of these resources is at least 66 million visits each month. 132 of these websites have a significant audience in Ukraine (from 923 to almost 6.5 million visits each month). On average, before the beginning of the full-scale war, each of the websites was visited by 500,000 users from Ukraine in a month.

The other 93 websites are visited by less than 50,000 users each month, and therefore analytical services do not provide any detailed information about the share of visits originating from Ukraine. At the same time, most of these web pages report local news on Crimea or the so-called Donetsk and Luhansk people's republics, and therefore they are most likely visited only by local residents of these territories.

OPORA divided all identified websites into three categories:

  • Russian Media This list includes russian "professional" resources, such as TASS or Komsomolskaya Pravda that have long been familiar to everyone. OPORA identified 45 of them.
  • Pro-Russian “tabloid” media. This includes sites that disseminate outright propaganda or fake information without referring to reliable sources and using emotionally colored headlines and texts — for example, Russkaya Pravda (lit. - Russian Truth). 120 such websites have been identified.
  • Local media. These are websites that spread local news from Crimea or isolated districts of Donetsk and Luhansk regions — for example, Taurica. Quite often, propaganda messages are posted next to local news. 60 such websites have been identified.

Next, analysts gathered baseline data on these websites. The host.io service revealed key information about the domains: IP addresses, Google Analytics data, and the website's country of origin. Through SimilarWeb, it was possible to identify the key audience of websites and the share of the Ukrainian audience that visits them.

The geography of the websites (obtained with the help of the host.io service ) turned out to be an interesting observation. Thus, 112 of them are expectedly administered directly from russia, 40 — from the United States, 14 — from Germany, 10 — from Ukraine. Several websites also "work" from the UK, France, Estonia, and Finland. However, in fact, it is obvious that all these pages are administered either from the russian federation or from the territories under its control. It is illustrative that 27 pages of the Moskovskyi Komsomolets outlet are purportedly operating from Belize but in fact, they are simply hiding their real IP addresses.

When it comes to IP addresses and Google Analytics data, it is these metrics that allow you to link different websites to the same network. For example, OPORA found several small networks:

An additional step for analysis can be the deeper data collection: the date of creation, the organization behind the use of the website, and its registration. You can do this using WHOIS or other domain verification resources (GoDaddy etc.). This information not only further confirms the links between the websites but also allows you to see the links not visible at the stage of preliminary data collection, or those that will be a good illustration for a particular reasoning.

Thus, for example, it is illustrative that when the websites of ordinary media began to work mainly in the 1990's/2000's, a real "surge" in the launch of pro-russian "tabloid" media took place in 2014/15 — during this period 44 such pages were launched. In parallel, there was a somewhat smaller surge in the creation of local media, apparently related to the annexation of Crimea and the occupation of the isolated districts of Donesk and Luhansk regions by the russian federation.

The advantages such data may bring is that it can confirm assumptions from the previous stage. For example, first, analysts found out that websites 8692.ru and 3652.ru share an IP address and come from russia. WHOIS can confirm the link between these websites, as they were created on the same day (March 20, 2014); they are located on the same server (ns1.selectel.org); and they use the same host services (REGTIME-RU).

The last step to use for analyzing websites is to describe their content and search for similar elements among different web pages. The content of most identified websites is typical of the russian media: round-the-clock news about the "special operation" in Ukraine and the promotion of the common propaganda cliches (neo-Nazism in Ukraine, abuse of prisoners by the Ukrainian military, etc.). At the same time, whereas the "professional" media try to be low key in their expressions, at least partially, the tabloid media are full of overt and emotionally charged propaganda (take a look at expressions about the Nazis and the "US biological laboratories" in Ukraine).

Local media also often spread outright propaganda, placing it next to local news such as road repairs or store openings. Cumulatively, all these pages are designed to spread russian propaganda targeting it at different audiences: when "professional" media are consumed by all categories of citizens, "yellow" press is very popular among low-educated audiences that could be easily manipulated through emotions. Local news readers may be interested in the intriguing headline about “Nazi atrocities” that users will see when reading about sewer pipe repairs in their neighborhood.

However, it is important to understand that all these websites cannot spread russian propaganda effectively on their own — after all, before becoming a "regular visitor" for most of them, you need to learn about it somewhere. To do this, the curators use social media, including Facebook pages. The next section will discuss how russian propaganda spreads on this social network and how it can be efficiently found and removed.

Facebook Pages

Since February 22, 245 Facebook pages have been sharing posts from russian propaganda websites. Data on the content of such web pages on the social media was collected by analysts using the Crowdtangle tool. The total number of subscribers to these pages is more than 15 million users. Mostly, such pages do not share political ads. In general, they can be divided into three categories:

  • Facebook pages of propaganda websites;
  • pages of russian embassies, consulates, and other diplomatic institutions;
  • pages targeting foreign audience.

The 67 identified pages are foreign public pages from different countries — both eastern and western — such as Solidarity with Donbass & Antifascists in Ukraine (USA, over 2,000 followers), Sprawa Kresowa Sprawa Kresowa – Sprawa Narodowa (Poland, almost 5,000 followers) and Stimmen der Gerechtigkeit (almost 6,000 followers). Another 43 are pages of embassies, consulates, and representative offices of Rossotrudnichestvo “Russian House” in various countries of the world. In other words, half of the pages that share the content of these websites broadcast propaganda to foreign users or the russian diaspora in the world. These pages are russian fighters on the information front among the international community.

The foreign pages publishing posts with links to these pro-russian sites presented most of interest. In the month after the beginning of the full-scale russian-Ukrainian war, users engaged with the content of these pages almost 4 million times — they liked, commented, and reposted their publications. On average, posts on these pages gained more than 57,000 engagements.

It is worth taking a closer look at the 5 pages that have received the most user engagements since February 24, 2022. The most popular page that shared the content of pro-russian websites is the Portuguese opposition media “Blog Da Dilma” (425,000 followers). Most of the content concerns local politics – Brazil will hold regular elections in the fall, so administrators are more interested in criticizing the incumbent President, Jair Bolsonaro, than the war in Ukraine. However, from time to time, they also publish posts about Ukraine. The page has no definitive position on Ukraine: in some publications, they criticize russia for the military aggression, in others, they post pro-russian narratives, such as they repost from the russian pro-government media, Sputnik.

Second follows the page of the Vietnamese pro-russian blogger Giá trị cuộc sống (61,000 followers). Since February, 24, 2022, users have engaged with his posts more than 300,000 times. Since the early days of the full-scale war, he has published posts criticizing NATO and Western countries, glorifying the Soviet army, and supporting vladimir putin as an indispensable leader of russia.

The next page is the Bosnian Kompletno Rusko Naoružanje (over 70,000 followers). It was created in 2014 and, according to the description, it aims to inform about the armed forces of the rf. One of the page administrators is a user from Ukraine. From the beginning of the war, the page has been publishing russian propaganda posts, such as about the russian government “liberating Mariupol from the Nazis from Azov”.

The fourth page is Vietnamese, too. Tin chiến sự Ucraina means "War News from Ukraine." The page was created in 2014 and has over 30,000 subscribers. Its content is similar to the materials of its Bosnian "colleague" — it is singing a supporting part to russian propagandists. For example, they publish posts that Ukrainian troops are shelling their own cities and about the "friendly attitude" of the russian military to Ukrainian civilians.

The next page  القدرات العسكرية السورية ٢ (translated from Arabic as “Syrian War Opportunities”) is administered from Syria. The media has been actively supporting russia and broadcasting russian disinformation since the beginning of the full-scale russian-Ukrainian war.

The Empire Must Die

66 million visits to pro-russian websites, 15 million followers of pro-russian Facebook pages — these figures are alarming, especially since consumers of manipulative and outright propaganda information are often users from Ukraine or other countries. Russian propaganda has already led to large-scale hostilities and the death of thousands of civilians and military personnel. That is why it needs to be destroyed, at least in the Ukrainian information space and, if possible, in the international space.

In this piece, OPORA has shown how to combat propaganda on a practical level by detecting websites and Facebook pages. However, the most important thing here is the final step: what do we do now with all of this list of online resources?

First of all, you can complain about Facebook pages through the internal tool of Meta itself. However, if you do it on your own, there may be no effect. It is necessary to attract as many people as possible who also want to reduce the presence of russian propaganda in the information space. We advise you to share your findings with the Ministry of Internal Affairs of Ukraine through the bot https://t.me/stopdrugsbot (it is used for coordinated counteraction to pro-russian propaganda and disinformation through mass complaints about dangerous content on social media), which transmits information to the Ukrainian Internet army.

Fight and you will overcome! Remember that the destruction of russian propaganda is another stitch that will eventually lead to the death of the russian empire.