Ukrainian outlets copied false anti-vaxxer coronavirus story and promoted their posts on connected Facebook pages

Several Ukrainian fringe media outlets republished an article amplifying the false claims of an Italian anti-vaxxer regarding the efficacy of quarantines and the feasibility of a potential vaccine in slowing the COVID-19 outbreak. In a likely effort to evade detection, the outlets substituted letters borrowed from different alphabets in the headline to foil automated web crawlers.

The DFRLab previously covered the narrative spread of the anti-vaxxer’s claims on April 14, 2020. This report details an inauthentic amplification scheme concerning a related article by Ukrainian fringe media outlets.

The alphabet-blending approach has become quite popular on fringe media and junk news sites in Ukraine as a means to avoid Google’s attempts to scrub coronavirus misinformation from its platforms, including Google Search. While this method helps these outlets avoid detection by search engines, it ironically makes detection of coordinated behavior easier for researchers when websites copy/paste each other’s publications featuring the same orthographic substitutions.

The Italian doctor story

The first media that translated the story into Ukrainian was bn24.biz.ua, or Bomb News. Bomb News published it under the title, “You’ve been deceived. There are 3 people that died from coronavirus directly in Italy. The rest from…”

This clickbait headline, however, bore unusual typographic markers: it was written in Ukrainian, but featured English letters in the words “coronavirus” and “Italy,” replacing both “i”s for “l”s Moreover, the Ukrainian letter “є” was substituted for the Russian letter “э” in the word “died.” These changes were a likely attempt to avoid search engine indexing, as an automated web crawler would not be able to detect the letter substitutions in the words, as a human reader can do with relative ease.

In this case, the DFRLab found that several media outlets published the misleading article under the same headline, with typographical substitutions intact: Dreamcountry.info, polit.media, puer.org.ua, vazno.net.ua, fayno.org, and presentnews.biz.ua.

How the story spread on Facebook

Following republication, Facebook pages related to the outlets amplified the story on social media. According to a CrowdTangle search, the original story received 6,135 shares on Facebook, with the most engagement coming from Facebook groups and the page of bn24. The bn24 website had three Facebook pages actively publishing its content exclusively. In this case, however, only the page called Inform Bomb posted the story, receiving 1,220 total reactions.

The other two top shares appeared in the Facebook groups Enemies of the People and Voice of People –Control of Power. They were posted by accounts that are all friends with members that shared the last name “Havrilyak.” A search on both groups for the term “Havrilyak” showed that these accounts shared exclusively bn24 material in the groups. Moreover, the English spelling of this last name — as opposed to the Ukrainian one — revealed another group of “family” members with similar posting behavior. All of the accounts involved, with the exception of one, identified their current city as Chervonohrad, in western Ukraine.

Bn24 is not a lone website: an analysis of the site’s Google Analytics code via DNSLytics shows that 18 websites have been using the same code, which may suggest coordination among the website operators. Several of the websites also used the identical Google AdSense IDs, which suggests that advertising was managed from the same account.

Vazhno.net.ua

Vazhno.net.ua’s version of the article received 13,879 engagements, including 5,762 shares. The website used the same headline and included the word “source” below the text but did not hyperlink it, which may suggest that the text was copied.

Like Bomb News, vazhno.net.ua uses Facebook pages — Newscor (206,405 followers) and Publisher (166,761 followers) — to publish most of its content, even though both pages each state they are linked to another websites, isn.net.ua and ukrtime.info, respectively.

Fayno.net

Using a similar model, fayno.net used two Facebook page to amplify its content: Моя семья (“My family” and Дети — это счастье (“Kids are happiness”). The “My family” Facebook page has the handle @7yamy, and a Google search returned the website 7yamy.com, which the page shared. Fayno.net also featured a Facebook widget for a third page, Наша Україна, (“Our Ukraine”), which also published the article. All three pages have four administrators in Ukraine and one administrator in Poland.

A subset of Facebook accounts also disseminated news from these websites in two groups: Khmelnitskyi moms and Prayer — powerful way to salvation.

Dreamcountry.info

One of the sites, dreamcountry.info, posed as a public nonprofit. All of its material, however, appeared in a regional Facebook group for supporters of Ukrainian President Vladomyr Zelensky. The group is not connected to the official Zelensky team. The group was created by the page Ukrainian News, which has its own website uanews.international. The group states both dreamcountry.info and uanews.international as news sources in its About section.

The dreamcountry.info website shares the Google Analytics code with several sites that propose to earn bitcoins, such as videonews.world, vsenews.info, hotnews.guru. Notably, two out of three websites have been shared on the abovementioned group in support of Zelensky with political news, which might suggest the recent content deletion on those websites. However, the most notable website with the same Google code is seotok.pro, the platform of traffic exchange. This platform claims that it could increase views of any webpage.

Roman Osadchuk is a Research Assistant, Eurasia, with the Digital Forensic Research Lab.

Follow along on Twitter for more in-depth analysis from our #DigitalSherlocks.