Investigation prompts European hosting companies to block accounts linked to Russian disinformation

Two European web hosting companies have reportedly blocked some accounts linked to the Russian “Doppelgänger” propaganda campaign after researchers discovered that their operators were using the infrastructure of legitimate companies in Europe to spread misinformation.

Hosting giants Hetzner of Germany and Hostinger of Lithuania confirmed to German nonprofit journalist group Correctiv, which was involved in the doppelgänger investigation, that they had terminated the accounts used by the network’s operators.

Hostinger, whose servers in Singapore were used to run several propaganda websites imitating legitimate media, said it had taken down duplicate-linked versions of the Israeli website The Liberal as well as several German-language websites.

“We have already drawn up an action plan to limit such abuse in the future,” the company spokesman told Correctiv.

Hetzner, whose Finnish subsidiary hosted four lookalike websites, said it had blocked the affected server. When Correctiv published its report, two of the four websites were still functioning.

Last week, researchers from digital rights nonprofits Qurium and EU DisinfoLab uncovered infrastructure used by Doppelgänger located or registered in at least ten European countries.

This means that European companies – whether knowingly or not – are making their services available for a disinformation campaign affecting their own countries, the researchers said.

Doppelgänger has been active in Europe since at least May 2022. The malware is known for spreading fake articles on websites that are designed to resemble real media outlets such as the German “Spiegel” or the British “The Guardian”.

The network’s goal is to advance the Kremlin’s interests and sow discord among its enemies, including the United States and Western Europe.

Some of the companies identified told Correctiv that they had not known about Doppelgänger and that there had been no complaints about it to the authorities.

Hetzner and Hostinger were the first to react to the report. Thanks to their actions, some posts on Facebook and X that were previously attributed to doppelgängers have been leading to an error message for several days. Some of the propaganda and fake pages are no longer accessible at all.

According to Antibot4Navalny, an anonymous volunteer group that tracks Russian disinformation on X, around 35% of the original doppelgänger pages and more than a fifth of all the campaign’s pages, including cloned media pages, were affected by the recent outages.

On July 14 and 16, the campaign distributed only four links each, fewer than ever before in the period under review, according to Correctiv.

The network operators are trying to adapt to the blocking, the researchers found, and moved some of their services from Hetzner to a new address at a Russian hosting provider. “Old links no longer work. New links, on the other hand, lead to content that has not yet been affected by the blocking,” says a report by Correctiv.

Even well-known media outlets whose websites have been imitated by doppelgängers are trying to shut down the fake websites.

The “Süddeutsche Zeitung” had already received back two of the campaign’s Internet addresses in a dispute settlement procedure. As a publisher spokesperson explained to Correctiv, however, an investigation initiated by a criminal complaint had been discontinued.

The “Frankfurter Allgemeine Zeitung” also considered taking legal action against the network, but rejected this due to a lack of prospects of success, the report says.

The German authorities are also aware of the abuse of European infrastructure by doppelgängers, but do not seem to be taking any action, according to Correctiv.

This “raises the question of how serious the European authorities are about combating disinformation,” says Correctiv.

Learn more.