Open-Source Information Reveals Pro-Kremlin Web Campaign

Graph showing shared use of Google Analytics, server software and social media

Graph showing shared use of Google Analytics, server software, and social media by websites in the network. [Full size 1 2] Image by Lawrence Alexander.

In April of this year, Radio Free Europe/Radio Liberty and the Guardian reported on the website вштабе.рф, a large photo gallery of pro-Russian memes and “demotivator” graphics. Most of these crude caricatures ridicule US, Western, and Ukrainian leaders, whilst portraying Vladimir Putin as strong and heroic.

The site gives no credit or attribution for its design, and offers no indication as to who might be behind it. Intrigued by this anonymity, I used Maltego open-source intelligence software to gather any publicly-available information that might provide clues.

The Secrets of Google Analytics
My use of Maltego revealed that the site was running Google Analytics, a commonly used online analytics tool that allows a website owner to gather statistics on visitors, such as their country, browser, and operating system. For convenience, multiple sites can be managed under a single Google analytics account. This account has a unique identifying “UA” number, contained in the Analytics script embedded in the website's code. Google provides a detailed guide to the system's structure.

Google Analytics Code

Google Analytics account number for вштабе.рф, found at the bottom of the page's HTML code.

Journalists and security experts have already raised the potential of this code to link anonymous websites to particular users.

The method was reported by Wired in 2011, and cited by FBI cyber crime expert Michael Bazzell in his book Open Source Intelligence Techniques. Several free services have sprung up that allow easy reverse searching of Google Analytics ID numbers, one of the most popular being sameID.net.

I wanted to see whether the person or organisation behind вштабе.рф was running any other sites from the same Analytics account. Viewing thewebsite's source code gave me the all-important Google Analytics ID number. When I performed a broader search on it, the results were surprising—it was linked to no less than seven other websites (archived copy).

These included whoswho.com.ua (archive), apparently aimed at collating compromising information on Ukrainian officials, whilst purporting to be a Ukrainian project; Zanogo.com (archive), another repository of memes, many anti-Western; and yapatriot.ru (archive), which appears to be an attempt to discredit Russian opposition figures. Another of the websites using the same Analytics account was syriainform.com (archive), a site seemingly promoting an anti-US and pro-Assad slant on events in Syria.

Most striking of all was the presence of Material Evidence—a website for the touring photo exhibition that has featured in several media investigations into its alleged pro-Kremlin connections. In 2014, Gawker reported on the New York show, commenting on its large, well-funded advertising campaign. They noted that its website was registered in St. Petersburg, which is confirmed by historic WHOIS records.

Down the Rabbit Hole
Whilst investigating the network of sites tied to account UA-53176102, I discovered that one, news-region.ru, had also been linked to a second Analytics account: UA-53159797 (archive).

This number, in turn, was associated with a further cluster of nineteen pro-Kremlin websites. Subsequent examinations of these webpages revealed three more Analytics accounts, with additional sites connected to them. Below is a network diagram of the relationships I have established to date.

Relationships between websites and Google Analytics account numbers.

Relationships between the websites and their Google Analytics account numbers. [Full size] Image by Lawrence Alexander.

One of the websites in this larger network, emaidan.com.ua (archive) appears at first glance to be a legitimate information resource for the Ukrainian protest movement. But closer inspection shows it is laced with rising anti-Ukrainian sentiment, as if written by a disillusioned former Maidan supporter. putininfo.com (archive) is a glowing tribute to the Russian president, complete with “My Putin” social media accounts.

At the time of writing, the Analytics codes remain unchanged and visible on most of these sites. My findings can easily be verified by viewing their source code, either in the browser or by saving the page and viewing it in a text editor.

Besides Google Analytics, the websites had some other common traits: shared use of Yandex Metrika, Yandex Verification, and a Nginx server—all Russian-made tools—characterized the sites in the network.

It became clear that I was most likely looking at a large, well-organised online information campaign. But whilst the Google Analytics code demonstrated shared involvement in and management of the websites, it couldn't tell me who was behind them.

A Personal Connection?
Spurred on by curiosity, I did a little more digging through publicly available information. Domain registration records in several places [1 2 3] revealed a second common factor: the e-mail address terder.n@gmail.com. [Archive: 1 2 3 4]. I found it to be associated not only with the majority of sites I had already identified, but also with a new group of websites, apparently still under construction. Their titles suggested themes similar to the existing network: either overt pro-Russian polemic, or more subtle disinformation under the guise of legitimate Ukrainian journalism. They included antiliberalism.comdnepropetrovsknews.com and maidanreload.com.

It took less than a minute of searching to link the e-mail address to a real identity. A group on Russian social networking site VKontakte [archive] lists it as belonging to one Nikita Podgorny.

Podgorny's public Facebook profile shows he is a member of a group called Worldsochi—the exact same name as one of the websites linked by the two Google Analytics codes I examined.

Nikita Podgorny's membership of Worldsochi Facebook group.

Nikita Podgorny's membership of Worldsochi Facebook group.

Podgorny has a Pinterest account with only one pin [archive]—an infographic of Russia's space accomplishments taken from a site called infosurfing.ru. Whilst infosurfing.ru doesn't have an embedded Google Analytics code, it shares some similarities in image construction with several sites in the pro-Kremlin network.

The online FotoForensics tool shows that images from infosurfing.ru [1 2 3], putininfo.com [1 2] and вштабе.рф [1 2] contain metadata sourced from the exact same version of software: Adobe XMP Core: 5.5-c014 79.151481, 2013/03/13-12:09:15. By itself this is not a unique identifier, but it might be suggestive of a connection, especially in the context of additional information about Podgorny's online persona.

Most notably, Podgorny is listed in the leaked employee list of St. Petersburg's Internet Research Agency, the pro-Kremlin troll farm featured in numerous news reports and investigations, including RuNet Echo's own reports.

Podgorny's date of birth, given on his public VK profile, is an exact match for that shown in the leaked document.

Podgorny's date of birth, as shown on his VK profile, compared with listing in the leaked Internet Reseach Agency document.

Podgorny's date of birth, as shown on his VK profile, compared with listing in the leaked Internet Reseach Agency document.

Podgorny is also VK friends with Igor Osadchy, who is named as a fellow employee in the same list. Osadchy has denied working for the Internet Reseach Agency, calling the leaks an “unsuccessful provocation.”

Podgorny-Osadchy VK connection

Nikita Podgorny's VK association with Igor Osadchy.

When contacted by Global Voices, Podgorny neither confirmed nor denied involvement in the websites, and would not comment further.

In the next post on the pro-Kremlin website network, we will look in more detail at the content, the aims, and the ideology behind the websites.

RuNet Echo author Aric Toler contributed translation and interpretation for this post.

99 comments

  • Vladimir Andrienko

    Интересная информация.

  • Марина Казанцева

    Thank you, very interesting & useful information

  • wendoman

    такс такс такс што тут у нас мемы мемы мемыыы ахахаха наканецта
    Господи, эти придурки разоблачили мемесы. Теперь я видел всё.

  • If I had a penny for each and every time over the last year that I, an American citizen since birth, have been called a ‘putinbot’, a ‘Russian’, or some other such nonsense by Right Wing nitwits, then I would be richer than Donald Trump himself. Invariably what sets these morons off is simply the reality of somebody opposing more US Pentagon war making in Ukraine, which they do support. It reminds me of when people used to be called ‘nigger lovers’ all the time if they were not racist in the South. Now you are called a ‘putinbot’ instead. This commentary we are replying to feeds the nonsense of all these Right Winger morons that tell me I am supposedly paid to post online. IDIOTS!

    • guest

      “an American citizen since birth”
      As if an American citizen could not be a pro-Kremlin idiot or a traitor to his nation.

      • LES1

        Gee ??? I guess that rather than being called a kremlinoid or a member of Putin’s “TV tribe”, he prefers to be called a “malicious useful idiot” or a plain Benedict Arnold ??

        PS The Russian army invaded and stole land and resources from Ukraine and he has the audacity to state : “US Pentagon war making in Ukraine” !!!

        PPS

        Savchuk’s revelations about the agency have fascinated Russia not because they are shocking but because they confirm what everyone has long suspected: The Russian Internet is awash in trolls. “This troll business becomes more popular year by year,” says Platon Mamatov, who says that he ran his own troll farm in the Ural Mountains from 2008 to 2013. During that time he employed from 20 to 40 people, mostly students and young mothers, to carry out online tasks for Kremlin contacts and local and regional authorities from Putin’s United Russia party. Mamatov says there are scores of operations like his around the country, working for government authorities at every level. Because the industry is secretive, with its funds funneled through a maze of innocuous-sounding contracts and shell businesses, it is difficult to estimate exactly how many people are at work trolling today. But Mamatov claims “there are thousands — I’m not sure about how many, but yes, really, thousands.”

        http://www.nytimes.com/2015/06/07/magazine/the-agency.html?_r=2

        PPPS

        Late last year, I came across a Russian manual called Information-Psychological War Operations: A Short Encyclopedia and Reference Guide (The 2011 edition, credited to Veprintsev et al, and published in Moscow by Hotline-Telecom, can be purchased online at the sale price of 348 roubles). The book is designed for “students, political technologists, state security services and civil servants” – a kind of user’s manual for junior information warriors. The deployment of information weapons, it suggests, “acts like an invisible radiation” upon its targets: “The population doesn’t even feel it is being acted upon. So the state doesn’t switch on its self-defence mechanisms.” If regular war is about actual guns and missiles, the encyclopedia continues, “information war is supple, you can never predict the angle or instruments of an attack”.

        http://www.theguardian.com/news/2015/apr/09/kremlin-hall-of-mirrors-military-information-psychology?CMP=share_btn_tw

        PPPPS

        Call it Terrorism: The Unacknowledged Tactic of the Russian-Led Insurgency in Ukraine’s East

        By John E. Herbst

        June 26, 2014

        John E. Herbst is a former U.S. ambassador to Ukraine and the director of the Dinu Patriciu Eurasia Center at the Atlantic Council.

        http://www.atlanticcouncil.org/blogs/new-atlanticist/call-it-terrorism-the-unacknowledged-tactic-of-the-russian-led-insurgency-in-ukraine-s-east

      • And as if I, as an American, am some how obligated to to be the same dumb shit sort of Right Winger as you and people like Palin and Trump are…..

        • Right

          You, who are such a marx-ssid, should go to Northern Corea and not stink in the US.

          • Why? It stinks the worst right here in the US with all the garbage created by capitalism here. Concrete all over the damn place, and cars going around in circles with millions of utterly vapid people farting out their hamburgers inside their own vehicles. We, the USA, is the leader in garbage production, including your own stupid vapid comment, Idiot.

             
          • guest

            That’s why you have been told: Go to North Korea. No cars, no hamburgers. No, really, why are you still living in the US if you hate this country?

             
          • I don’t hate the country. I just despise people like you who live in it…. You Right Wing idiots disgrace the US!

             
    • Nikita Voronin

      Identifying themselves as “american citizens” is actually a common theme for russian nazi-trolls. The idea is to have more appeal to the US or perhaps other western readers by placing themselves in the “our/us/we” category. And then they try to impress you with some uhmm… “critical thinking” by stating that NATO is evil, the US is only some racist entity and the Western world is run by war-mongers and extreme rightwingers. It’s a typical pattern, probably based on a trolling guidebook or sth.

      • You are a real genius!

        ‘Identifying themselves as “american citizens” is actually a common theme for russian nazi-trolls.’

        And I guess that if you actually are an American being falsely accused of being Russian by morons like yourself, then we should respond that we live in Moscow //// You are a true moron, Dude. And you say your name is just what???? ‘Nikita Dumkoff”?

        • Nikita Voronin

          It seems the article and some comments have really stirred you up. Try to relax!

        • citicrab

          It’s obvious you are a Russian professional troll. Your initial post had nothing to do with the subject of the article, was meant to divert attention from it and manufacture a faux controversy. It’s a well-known and – researched diversionary tactics. I am not trying to argue with you, as there is no subject – my post is meant for the naive responders to your provocations that help you muddy up the discussion of a well-researched article.

          • Whatever, Teach, you dumbass moron and…..

            ‘…my post is meant for the naive responders to your provocations that help you muddy up the discussion of a well-researched article.’

            …pompous ass.

             
          • Right

            The fact that you pass to personal insults shows that you lost the discussion. What can you say, really? A typical leftist attitude: if you have nothing to say, just yell out loudly. Marx-ssidic shit.

             
        • Massif1

          I believe you’re the guy from the troll factory that will be turning off the light. You have been writing solemnly on pro-Ukrainian articles and articles that target Russian disinformation campaigns. Go get a job selling Ladas or something.

        • Istvan

          Are you really saying this article is not legit purely because you are a US Citizen and a Putin supporter without being on Putin’s payroll?

          • doroteo arango

            yawn… Anybody who says anything against US foreign policy these days now gets told stupidly that they are automatically “putin supporters’. Not only do we now have a new cold war but we have a new Joe McCarthy Era too!

             
          • Istvan

            Pot, kettle. You call everyone right wing, Trump and Palin supporters for no reason.

             
          • Istvan

            Bullshit. There is plenty of legitimate debate (even among the democratic rank and file) on specifics of US policy, including but not limited to the Iran deal, Gitmo, the China policy. If you fall for or knowingly advance Putin’s propaganda and purpose you are a Putin tool however.

             
    • Massif1

      If you love Russia so much Delta can fly you to Moscow.

    • Joe Morton

      Turnabout is fair play. Here’s hoping all the NATO and Kiev trolls get their crap hacked by CyberBerkut and all the US/UK gov payoffs via Atlantic Council to this moron Eliot Higgins come out. As if there isn’t an army of moronic Kiev and NATO trolls who obsessively monitor the #Mh17 hash tag on Twitter 24/7 with names like RoarBro, ASpinoftheWheel and MJoyce (the tuba playing bastard who never sleeps and is probably some Pentagon psyops bot experiment).

      Any US, Polish or eurotrash Swedish and Italian Nazi mercs who fought for the criminals in Kiev deserve to be outed too.

      • Joe Morton

        Global Voices is just another Soros operation anyway, like the CIA slush fund ‘Open Society Institute’.

        Dear Kiev trolls clogging this thread I’m an American and I for one, resent your failed state pathetic country dominated by idiots and Bandera worshipping Nazis sponging off my tax money. You had your Maidan and your stupid war on Donbass kids and babushkas but want ME to pay for it, well go scrub a toilet in Poland if they’ll let you in once Daddy Warbucks Soros and the SBU Nazi thugs don’t have a trolling job for you anymore.

        • Dirk Smith

          You Putinist parrots need some new material. Geez, robotic morons……

          • odikhmantievich

            They could certainly do with some of your originality – simply calling everyone you disagree with a putinbot rather than responding to their argument.

            Btw, the Open Society Institute’s filings are publicly available. Check them out yourself if you want: 990s.foundationcenter.org/990pf_pdf_archive/137/137029285/137029285_201312_990PF.pdf

             
    • Ionutz Yountz

      i dont call u a putin bot i call you vacauous safely tucked away in the west where you can cry wahhhhhmbulance! at your obvious leisure. Funny how those so far away from real bad intentioned ammo flying around have the most nonsalient info. bagamaispula

      • Idiot, much of my family lives on the US- Mexican border INSIDE Tamaulipas. You are so full of it, and you don’t even have the slightest clue!

        • Ionutz Yountz

          so im clueless lol sitting right now less than 200 miles from bullets champ but then a western hemi guy gonna tell me all about eastern europe – vacuous

          • I’m in the US, but my immediate family is dual citizenship. You are one dull ass dummy, YouisNuts.

            It’s not hard to understand if you are not a complete idiot. SOME of my extended family lives in a war zone that is in some ways much worse than what is going on in Donbas.

            You are an idiot.

            ‘Sitting right now less than 200 miles from the ongoing Russian aggression champ but then a western hemi guy gonna tell me all about eastern europe – vacuous’

            You hardly make any sense at all with your scribbles…. I know that you think that you are fluent in English, but yor really aren’t.

             
          • Ionutz Yountz

            whatever you say champ

             
          • Ionutz Yountz

            you only have Enrique’s fecklessness and corruption, El Chive’s worthless ass, his minions the Metros and the Ciciones or whatevr name they’re using this week to blame for that

             
          • Keep trying. Eventually you might actually say something semi coherent….

             
    • Rookamillion

      Oh I see…. You’re not a Putinbot….. You’re just an asshole! XD

  • wendoman

    ROFL This is a strong evidence for Hague Tribunal

  • […] Global Voices Online: In April of this year, Radio Free Europe/Radio Liberty and the Guardian reported on the […]

  • […] Global Voices Online: In April of this year, Radio Free Europe/Radio Liberty and the Guardian reported on the […]

  • […] Global Voices Online: In April of this year, Radio Free Europe/Radio Liberty and the Guardian reported on the […]

  • […] Global Voices Online: In April of this year, Radio Free Europe/Radio Liberty and the Guardian reported on the […]

  • […] Global Voices Online: In April of this year, Radio Free Europe/Radio Liberty and the Guardian reported on the website […]

Join the conversation

Authors, please log in »

Guidelines

  • All comments are reviewed by a moderator. Do not submit your comment more than once or it may be identified as spam.
  • Please treat others with respect. Comments containing hate speech, obscenity, and personal attacks will not be approved.