Open-Source Information Reveals Pro-Kremlin Web Campaign
Graph showing shared use of Google Analytics, server software, and social media by websites in the network. [Full size 1 2] Image by Lawrence Alexander.
In April of this year, Radio Free Europe/Radio Liberty and the Guardian reported on the website вштабе.рф, a large photo gallery of pro-Russian memes and “demotivator” graphics. Most of these crude caricatures ridicule US, Western, and Ukrainian leaders, whilst portraying Vladimir Putin as strong and heroic.
The site gives no credit or attribution for its design, and offers no indication as to who might be behind it. Intrigued by this anonymity, I used Maltego open-source intelligence software to gather any publicly-available information that might provide clues.
The Secrets of Google Analytics
My use of Maltego revealed that the site was running Google Analytics, a commonly used online analytics tool that allows a website owner to gather statistics on visitors, such as their country, browser, and operating system. For convenience, multiple sites can be managed under a single Google analytics account. This account has a unique identifying “UA” number, contained in the Analytics script embedded in the website's code. Google provides a detailed guide to the system's structure.
Google Analytics account number for вштабе.рф, found at the bottom of the page's HTML code.
Journalists and security experts have already raised the potential of this code to link anonymous websites to particular users.
The method was reported by Wired in 2011, and cited by FBI cyber crime expert Michael Bazzell in his book Open Source Intelligence Techniques. Several free services have sprung up that allow easy reverse searching of Google Analytics ID numbers, one of the most popular being sameID.net.
I wanted to see whether the person or organisation behind вштабе.рф was running any other sites from the same Analytics account. Viewing thewebsite's source code gave me the all-important Google Analytics ID number. When I performed a broader search on it, the results were surprising—it was linked to no less than seven other websites (archived copy).
These included whoswho.com.ua (archive), apparently aimed at collating compromising information on Ukrainian officials, whilst purporting to be a Ukrainian project; Zanogo.com (archive), another repository of memes, many anti-Western; and yapatriot.ru (archive), which appears to be an attempt to discredit Russian opposition figures. Another of the websites using the same Analytics account was syriainform.com (archive), a site seemingly promoting an anti-US and pro-Assad slant on events in Syria.
Most striking of all was the presence of Material Evidence—a website for the touring photo exhibition that has featured in several media investigations into its alleged pro-Kremlin connections. In 2014, Gawker reported on the New York show, commenting on its large, well-funded advertising campaign. They noted that its website was registered in St. Petersburg, which is confirmed by historic WHOIS records.
Down the Rabbit Hole
Whilst investigating the network of sites tied to account UA-53176102, I discovered that one, news-region.ru, had also been linked to a second Analytics account: UA-53159797 (archive).
This number, in turn, was associated with a further cluster of nineteen pro-Kremlin websites. Subsequent examinations of these webpages revealed three more Analytics accounts, with additional sites connected to them. Below is a network diagram of the relationships I have established to date.
Relationships between the websites and their Google Analytics account numbers. [Full size] Image by Lawrence Alexander.
At the time of writing, the Analytics codes remain unchanged and visible on most of these sites. My findings can easily be verified by viewing their source code, either in the browser or by saving the page and viewing it in a text editor.
Besides Google Analytics, the websites had some other common traits: shared use of Yandex Metrika, Yandex Verification, and a Nginx server—all Russian-made tools—characterized the sites in the network.
It became clear that I was most likely looking at a large, well-organised online information campaign. But whilst the Google Analytics code demonstrated shared involvement in and management of the websites, it couldn't tell me who was behind them.
A Personal Connection?
Spurred on by curiosity, I did a little more digging through publicly available information. Domain registration records in several places [1 2 3] revealed a second common factor: the e-mail address terder.n@gmail.com. [Archive: 1 2 3 4]. I found it to be associated not only with the majority of sites I had already identified, but also with a new group of websites, apparently still under construction. Their titles suggested themes similar to the existing network: either overt pro-Russian polemic, or more subtle disinformation under the guise of legitimate Ukrainian journalism. They included antiliberalism.com, dnepropetrovsknews.com and maidanreload.com.
It took less than a minute of searching to link the e-mail address to a real identity. A group on Russian social networking site VKontakte [archive] lists it as belonging to one Nikita Podgorny.
Podgorny's public Facebook profile shows he is a member of a group called Worldsochi—the exact same name as one of the websites linked by the two Google Analytics codes I examined.
Nikita Podgorny's membership of Worldsochi Facebook group.
Podgorny has a Pinterest account with only one pin [archive]—an infographic of Russia's space accomplishments taken from a site called infosurfing.ru. Whilst infosurfing.ru doesn't have an embedded Google Analytics code, it shares some similarities in image construction with several sites in the pro-Kremlin network.
The online FotoForensics tool shows that images from infosurfing.ru [1 2 3], putininfo.com [1 2] and вштабе.рф [1 2] contain metadata sourced from the exact same version of software: Adobe XMP Core: 5.5-c014 79.151481, 2013/03/13-12:09:15. By itself this is not a unique identifier, but it might be suggestive of a connection, especially in the context of additional information about Podgorny's online persona.
Most notably, Podgorny is listed in the leaked employee list of St. Petersburg's Internet Research Agency, the pro-Kremlin troll farm featured in numerous news reports and investigations, including RuNet Echo's own reports.
Podgorny's date of birth, given on his public VK profile, is an exact match for that shown in the leaked document.
Podgorny's date of birth, as shown on his VK profile, compared with listing in the leaked Internet Reseach Agency document.
Podgorny is also VK friends with Igor Osadchy, who is named as a fellow employee in the same list. Osadchy has denied working for the Internet Reseach Agency, calling the leaks an “unsuccessful provocation.”
Nikita Podgorny's VK association with Igor Osadchy.
When contacted by Global Voices, Podgorny neither confirmed nor denied involvement in the websites, and would not comment further.
In the next post on the pro-Kremlin website network, we will look in more detail at the content, the aims, and the ideology behind the websites.
This post is part of RuNet Echo, a Global Voices project to interpret the Russian language internet. All Posts · Read more »
99 comments
Интересная информация.
Thank you, very interesting & useful information
такс такс такс што тут у нас мемы мемы мемыыы ахахаха наканецта
Господи, эти придурки разоблачили мемесы. Теперь я видел всё.
If I had a penny for each and every time over the last year that I, an American citizen since birth, have been called a ‘putinbot’, a ‘Russian’, or some other such nonsense by Right Wing nitwits, then I would be richer than Donald Trump himself. Invariably what sets these morons off is simply the reality of somebody opposing more US Pentagon war making in Ukraine, which they do support. It reminds me of when people used to be called ‘nigger lovers’ all the time if they were not racist in the South. Now you are called a ‘putinbot’ instead. This commentary we are replying to feeds the nonsense of all these Right Winger morons that tell me I am supposedly paid to post online. IDIOTS!
“an American citizen since birth”
As if an American citizen could not be a pro-Kremlin idiot or a traitor to his nation.
Gee ??? I guess that rather than being called a kremlinoid or a member of Putin’s “TV tribe”, he prefers to be called a “malicious useful idiot” or a plain Benedict Arnold ??
PS The Russian army invaded and stole land and resources from Ukraine and he has the audacity to state : “US Pentagon war making in Ukraine” !!!
PPS
Savchuk’s revelations about the agency have fascinated Russia not because they are shocking but because they confirm what everyone has long suspected: The Russian Internet is awash in trolls. “This troll business becomes more popular year by year,” says Platon Mamatov, who says that he ran his own troll farm in the Ural Mountains from 2008 to 2013. During that time he employed from 20 to 40 people, mostly students and young mothers, to carry out online tasks for Kremlin contacts and local and regional authorities from Putin’s United Russia party. Mamatov says there are scores of operations like his around the country, working for government authorities at every level. Because the industry is secretive, with its funds funneled through a maze of innocuous-sounding contracts and shell businesses, it is difficult to estimate exactly how many people are at work trolling today. But Mamatov claims “there are thousands — I’m not sure about how many, but yes, really, thousands.”
http://www.nytimes.com/2015/06/07/magazine/the-agency.html?_r=2
PPPS
Late last year, I came across a Russian manual called Information-Psychological War Operations: A Short Encyclopedia and Reference Guide (The 2011 edition, credited to Veprintsev et al, and published in Moscow by Hotline-Telecom, can be purchased online at the sale price of 348 roubles). The book is designed for “students, political technologists, state security services and civil servants” – a kind of user’s manual for junior information warriors. The deployment of information weapons, it suggests, “acts like an invisible radiation” upon its targets: “The population doesn’t even feel it is being acted upon. So the state doesn’t switch on its self-defence mechanisms.” If regular war is about actual guns and missiles, the encyclopedia continues, “information war is supple, you can never predict the angle or instruments of an attack”.
http://www.theguardian.com/news/2015/apr/09/kremlin-hall-of-mirrors-military-information-psychology?CMP=share_btn_tw
PPPPS
Call it Terrorism: The Unacknowledged Tactic of the Russian-Led Insurgency in Ukraine’s East
By John E. Herbst
June 26, 2014
John E. Herbst is a former U.S. ambassador to Ukraine and the director of the Dinu Patriciu Eurasia Center at the Atlantic Council.
http://www.atlanticcouncil.org/blogs/new-atlanticist/call-it-terrorism-the-unacknowledged-tactic-of-the-russian-led-insurgency-in-ukraine-s-east
And as if I, as an American, am some how obligated to to be the same dumb shit sort of Right Winger as you and people like Palin and Trump are…..
You, who are such a marx-ssid, should go to Northern Corea and not stink in the US.
Why? It stinks the worst right here in the US with all the garbage created by capitalism here. Concrete all over the damn place, and cars going around in circles with millions of utterly vapid people farting out their hamburgers inside their own vehicles. We, the USA, is the leader in garbage production, including your own stupid vapid comment, Idiot.
That’s why you have been told: Go to North Korea. No cars, no hamburgers. No, really, why are you still living in the US if you hate this country?
I don’t hate the country. I just despise people like you who live in it…. You Right Wing idiots disgrace the US!
Identifying themselves as “american citizens” is actually a common theme for russian nazi-trolls. The idea is to have more appeal to the US or perhaps other western readers by placing themselves in the “our/us/we” category. And then they try to impress you with some uhmm… “critical thinking” by stating that NATO is evil, the US is only some racist entity and the Western world is run by war-mongers and extreme rightwingers. It’s a typical pattern, probably based on a trolling guidebook or sth.
You are a real genius!
‘Identifying themselves as “american citizens” is actually a common theme for russian nazi-trolls.’
And I guess that if you actually are an American being falsely accused of being Russian by morons like yourself, then we should respond that we live in Moscow //// You are a true moron, Dude. And you say your name is just what???? ‘Nikita Dumkoff”?
It seems the article and some comments have really stirred you up. Try to relax!
Is that what you do, Nicky? You ‘relax’ and then fart out your shit onto the screen?
It’s obvious you are a Russian professional troll. Your initial post had nothing to do with the subject of the article, was meant to divert attention from it and manufacture a faux controversy. It’s a well-known and – researched diversionary tactics. I am not trying to argue with you, as there is no subject – my post is meant for the naive responders to your provocations that help you muddy up the discussion of a well-researched article.
Whatever, Teach, you dumbass moron and…..
‘…my post is meant for the naive responders to your provocations that help you muddy up the discussion of a well-researched article.’
…pompous ass.
The fact that you pass to personal insults shows that you lost the discussion. What can you say, really? A typical leftist attitude: if you have nothing to say, just yell out loudly. Marx-ssidic shit.
I believe you’re the guy from the troll factory that will be turning off the light. You have been writing solemnly on pro-Ukrainian articles and articles that target Russian disinformation campaigns. Go get a job selling Ladas or something.
DumbAss. I’ll keep on expressing my opinions from right here in the USA all I want, You Right Winger Morons simply don’t speak for everybody, and you never will either, Now go stick it up Trump’s you know where….
Take your meds, guy.
Do you always like to jerk off with ad hominem crap, Moron?
Great. Do that. Appreciate that. And be glad that you can do that freely without the fear of punishment
Are you really saying this article is not legit purely because you are a US Citizen and a Putin supporter without being on Putin’s payroll?
yawn… Anybody who says anything against US foreign policy these days now gets told stupidly that they are automatically “putin supporters’. Not only do we now have a new cold war but we have a new Joe McCarthy Era too!
Pot, kettle. You call everyone right wing, Trump and Palin supporters for no reason.
Bullshit. There is plenty of legitimate debate (even among the democratic rank and file) on specifics of US policy, including but not limited to the Iran deal, Gitmo, the China policy. If you fall for or knowingly advance Putin’s propaganda and purpose you are a Putin tool however.
If you love Russia so much Delta can fly you to Moscow.
Thanks, but I do not want a Right Winger nitwit like you to be any sort of travel guide for me. It really pisses you fugs up a lot that Russia is a sometimes independent of the US voice in the world today.
you tell ’em Reynaldo apparently you have much in common with the Zetas; siempre vacua
Sure, Urnutz, I like to cut off a head at least once a week, and you are a head that just fell into the mud, Moron.
Perhaps you require a dictionary, ESL students must have them. Obviously logic isnt your strong suit either maybe a primer on logical fallacies is in order. enjoy your flea circus.
Yawn…. I believe it is you that has spent a lot of time as a student in ESL, NuttyUzzzz.
Turnabout is fair play. Here’s hoping all the NATO and Kiev trolls get their crap hacked by CyberBerkut and all the US/UK gov payoffs via Atlantic Council to this moron Eliot Higgins come out. As if there isn’t an army of moronic Kiev and NATO trolls who obsessively monitor the #Mh17 hash tag on Twitter 24/7 with names like RoarBro, ASpinoftheWheel and MJoyce (the tuba playing bastard who never sleeps and is probably some Pentagon psyops bot experiment).
Any US, Polish or eurotrash Swedish and Italian Nazi mercs who fought for the criminals in Kiev deserve to be outed too.
Global Voices is just another Soros operation anyway, like the CIA slush fund ‘Open Society Institute’.
Dear Kiev trolls clogging this thread I’m an American and I for one, resent your failed state pathetic country dominated by idiots and Bandera worshipping Nazis sponging off my tax money. You had your Maidan and your stupid war on Donbass kids and babushkas but want ME to pay for it, well go scrub a toilet in Poland if they’ll let you in once Daddy Warbucks Soros and the SBU Nazi thugs don’t have a trolling job for you anymore.
You Putinist parrots need some new material. Geez, robotic morons……
They could certainly do with some of your originality – simply calling everyone you disagree with a putinbot rather than responding to their argument.
Btw, the Open Society Institute’s filings are publicly available. Check them out yourself if you want: 990s.foundationcenter.org/990pf_pdf_archive/137/137029285/137029285_201312_990PF.pdf
i dont call u a putin bot i call you vacauous safely tucked away in the west where you can cry wahhhhhmbulance! at your obvious leisure. Funny how those so far away from real bad intentioned ammo flying around have the most nonsalient info. bagamaispula
Idiot, much of my family lives on the US- Mexican border INSIDE Tamaulipas. You are so full of it, and you don’t even have the slightest clue!
so im clueless lol sitting right now less than 200 miles from bullets champ but then a western hemi guy gonna tell me all about eastern europe – vacuous
I’m in the US, but my immediate family is dual citizenship. You are one dull ass dummy, YouisNuts.
It’s not hard to understand if you are not a complete idiot. SOME of my extended family lives in a war zone that is in some ways much worse than what is going on in Donbas.
You are an idiot.
‘Sitting right now less than 200 miles from the ongoing Russian aggression champ but then a western hemi guy gonna tell me all about eastern europe – vacuous’
You hardly make any sense at all with your scribbles…. I know that you think that you are fluent in English, but yor really aren’t.
whatever you say champ
you only have Enrique’s fecklessness and corruption, El Chive’s worthless ass, his minions the Metros and the Ciciones or whatevr name they’re using this week to blame for that
Keep trying. Eventually you might actually say something semi coherent….
Oh I see…. You’re not a Putinbot….. You’re just an asshole! XD
How original you are!
ROFL This is a strong evidence for Hague Tribunal
Another funny picture: