BANNER: A screen capture showing the thirteen domains of MD24 with identical Google Analytics tags and Google Tag Manager IDs. (Source: DNSLytics) 

The newly created Moldova24 (MD24) online broadcaster, presented as an independent Moldovan outlet, is directly tied to Russian state-aligned media infrastructure. Hosted in Russia and connected to Kremlin-funded entities like RT and TV Novosti, MD24 operates a network of at least sixteen mirror domains and coordinated social media accounts to evade oversight and promote pro-Kremlin narratives. 

Moldova’s information space has become a key battleground for both domestic and foreign actors as the country’s fragile democracy and critical elections make it fertile ground for targeted attacks. Among the most vocal voices challenging the pro-European government of President Maia Sandu is the Kremlin-aligned network of fugitive oligarch Ilan Shor, which has consistently accused the administration of authoritarianism and censorship and argued against the shutdown of several TV channels associated with Shor. Moldovan authorities said the banned channels were spreading disinformation and pro-war propaganda, posing a threat to national security. 

In an effort to bypass these restrictions, the Shor group has repeatedly attempted to shift its media operations. According to a March 2023 investigation by anticoruptie.md, Shor was closely linked to a sprawling media network that continued to operate despite official bans, primarily through proxy ownership and rebranding tactics. Several TV channels previously sanctioned by Moldovan authorities have resurfaced under new names or affiliated entities. Meanwhile, some of the sanctioned channels, such as TV6, have moved their broadcasting online, effectively operating outside the reach of national regulations.  

In July 2024, just three months ahead of Moldova’s presidential election and European Union (EU) referendum, a new online broadcaster, Moldova24 (MD24), was registered and began broadcasting around the clock from Moscow. The founders of MD24 have not been publicly identified, and Shor has not claimed ownership. However, the channel’s editorial direction suggests it operates as an unofficial extension of his media network, using anonymity to mask its role in coordinated influence efforts. 

This investigation maps out the ecosystem supporting MD24, traces its digital infrastructure, and explores how pro-Kremlin actors aligned with Shor are leveraging Russian safe havens and online platforms to influence Moldova’s fragile information space. 

The creation of MD24 marked a strategic shift in the information tactics of the Shor network, reflecting a broader trend in Moldova’s hybrid media landscape. Unlike the previously banned TV channels, which operated through national cable networks, MD24 exists entirely online, allowing it to circumvent domestic broadcasting regulations and content moderation frameworks. The site hosts a steady stream of politically charged content, livestreams, talk shows, and pre-recorded segments, promoting messaging that largely echoes pro-Kremlin talking points and discredits Moldova’s pro-European leadership. The narratives promoted by MD24 seek to undermine trust in Moldova’s democratic institutions, weaken public support for NATO cooperation, and derail the country’s path to European integration. 

MD24 built a significant online presence. As indicated on its website, MD24 operated across various social media platforms, including TikTok, Telegram, Instagram, and YouTube, all working in coordination to disseminate and amplify pro-Kremlin narratives. 

The channel exploits domestic crises and seeks to manipulate public opinion. For example, the channel was highly active during the energy crisis that affected Moldova, particularly impacting the Transnistrian region, in early 2025. Between January 1 and February 24, MD24’s TikTok page posted 929 videos, garnering over 17 million views, a volume of posts that suggests an effort to saturate social media with politically charged content and maximize audience reach. Most of these TikTok videos focused on Moldova’s energy crisis, a recurring theme in Russian disinformation campaigns. The content overwhelmingly featured commentary from pro-Russian figures, reinforcing narratives that blamed the West, the Moldovan government, or Ukraine for Moldova’s economic difficulties. Emotional manipulation was a central tactic, with videos using dramatic music, sensationalist headlines, and selectively edited footage to stoke public dissatisfaction and erode trust in Moldova’s leadership. 

As of the publication of this investigation, MD24’s TikTok account, which had amassed more than 53,000 followers, was no longer accessible, indicating it may have been suspended or deleted. On April 25, 2025, a new MD24 TikTok channel emerged, and within its first ten days of use, it posted 176 videos. However, it has struggled to regain its following, with only forty-nine followers at the time of writing. The broadcaster’s YouTube channel is also unavailable. The only other accounts that remained active at the time of writing were on Instagram, featuring 1,814 video posts and 1,700 followers, and Telegram, which hosted over 3,000 videos and had more than 10,000 subscribers. 

Technical analysis indicated that MD24’s infrastructure is deeply embedded within Russia’s digital ecosystem, with both hosting and domain registration tied to Russian service providers. The IP address 91.218.228.51, currently associated with MD24, is hosted by the Ihc.ru network, a Russian internet service provider frequently used by Kremlin-aligned media outlets and proxy websites. 

Throughout the course of our investigation, we identified a multi-domain strategy employed by the operators behind MD24. Rather than relying on a single domain, the platform functions across a network of at least sixteen mirror websites. The proliferation of domains suggests a clear intent to evade restrictions and potential shutdowns. If one domain is blocked by authorities or service providers, others can be activated to maintain uninterrupted access and content distribution. 

Further reinforcing the centralized nature of the operation, the mirror sites use the same Google Analytics tag (G-1F9WVPBDS6) and Google Tag Manager ID (GTM-MNPJQVSF). This overlap strongly indicates that these domains are not operated independently but are instead managed from a unified backend, likely by the same team or entity that coordinates the content and infrastructure. 

An additional domain of interest, jtf-ilan.com (Just the Facts: Ilan Shor), shares the same IP address as MD24. The website appears to have been designed specifically to curate and promote Shor’s image internationally. Registered on November 11, 2023, with an initial expiration date of October 10, 2024, the domain was last updated in April 2025, when the expiration was extended to October 10, 2025. Although the site was inaccessible at the time of this writing, the DFRLab analyzed its content using archived snapshots from the Wayback Machine. 

According to the last snapshot, from October 4, 2024, the website frames Shor as a victim of political repression in Moldova, claiming the government launched a “comprehensive retaliatory campaign” to prevent him from running in future elections. This is an example of the “persecuted opposition” narrative, a disinformation tactic frequently used by Kremlin-aligned actors to undermine democratic institutions by portraying sanctioned individuals as victims of injustice. 

To lend credibility, the site includes quotes from international figures and institutions, often selectively framed to imply widespread support for Shor. Among those cited is Ryszard Henryk Czarnecki, a former Member of the European Parliament from Poland’s Law and Justice Party. Czarnecki has a controversial track record, having been involved in corruption allegations and removed from his position as vice president of the European Parliament for “serious misconduct” after insulting fellow MEP Róża Thun. The DFRLab previously reported on how politically biased figures, such as Czarnecki, were used to legitimize disputed elections in Georgia by posing as observers. 

MD24 is part of a broader digital infrastructure network associated with the Russian state media ecosystem. The IP address hosting the MD24 website, 91.218.228.51, is also home to a cluster of domains connected to RT and its affiliated projects, including putinspeaks-rt.com, rtdoc.tv, rtred.online, and msimonyan.ru. 

The DFRLab also noted the presence of navalny.lol on the same server, a spoofed website used to mock the late Russian opposition leader Alexei Navalny. It purported to offer “investigations on demand” and mirrored tactics used by Russia to discredit opposition figures through parody, misinformation, and character assassination.  

Additional domains sharing the same IP include Gateway to Russia (gw2ru.com), a rebranded version of Russia Beyond, which was announced on December 23, 2024. Operated by TV Novosti, the same state-controlled entity behind RT, and funded by Russia’s Ministry of Digital Development, Communications, and Mass Media, Gateway to Russia promotes soft power narratives that seek to shape Russia’s image abroad. The site runs multilingual subdomains targeting Spanish (es.gw2ru.com), French (fr.gw2ru.com), Croatian (hr.gw2ru.com), Italian (it.gw2ru.com), Japanese (jp.gw2ru.com), and Macedonian (mk.gw2ru.com) audiences, indicating a coordinated, international propaganda campaign.  

MD24 also operates under the subdomain md24.b37m.ru, part of the b37m.ru domain that is also registered by TV Novosti, Russia Beyond, and Gateway to Russia.  

The login page for md24.b37m.ru, branded with MD24’s logo, features fields for email and password, indicating a login portal. This subdomain usage goes beyond coincidental infrastructure overlap. It points to a deeper operational link between MD24 and the Kremlin’s global propaganda apparatus. 

As part of the dataset analyzed by the DFRLab linked to MD24’s IP address, 91.218.228.51, we identified several other platforms designed to target foreign audiences with pro-Russian propaganda and influence local political discourse. One such platform is the “Kanzlerdaddy” (Chancellor Daddy) network, a Russian propaganda operation aimed at a German audience. 

The network operates across multiple platforms, including a dedicated website (kanzlerdaddy.ru), two Telegram channels (one in Russian and one in German), as well as TikTok and VKontakte accounts. Its content strategy relies on a blend of satire, disinformation, and selectively framed reporting on German social and political issues. By exploiting emotional and polarizing topics, often through humor, memes, and edited media, Kanzlerdaddy seeks to undermine trust in German institutions, mock Western leaders, and advance narratives aligned with the Kremlin’s interests. 

The website ahilesva.info is another example of a platform designed to target foreign audiences with pro-Russian propaganda. Operating under the brand “¡Ahí les Va!”, which translates to “Here You Go,” the website is part of the Russian state-controlled media ecosystem, managed by TV Novosti. Tailored specifically for Spanish-speaking audiences across Latin America, Ahí les Va employs satire, emotionally charged narratives, and anti-Western framing to promote Kremlin-aligned viewpoints. Like Kanzlerdaddy, the platform maintains a strong presence on Telegram, TikTok, and other social media channels, using local language and culturally resonant messaging to embed disinformation within familiar formats. Together, these platforms demonstrate a coordinated effort to expand Russia’s influence through targeted, multilingual content operations. 

Despite Moldova’s ongoing efforts to protect its information space, Russian influence operations have grown more adaptive and resilient. The investigation into MD24 reveals the strategy employed by Kremlin-aligned actors to circumvent national restrictions and maintain a steady flow of disinformation. By operating from Russian servers and leveraging a coordinated network of mirror domains, MD24 exemplifies how pro-Russian propaganda can persist, rebrand, and evade takedowns, undermining regulatory controls and eroding public trust. 

The outlet’s deep integration into infrastructure shared with state-funded entities, like RT and TV Novosti, confirms that this is not an isolated media operation, but part of a broader, state-aligned influence campaign. MD24 effectively functions as a Kremlin-protected digital enclave, targeting Moldovan audiences with narratives designed to destabilize the country’s democratic institutions and derail its pro-European trajectory. 

The integration of Russian digital infrastructure into Moldova’s media platforms represents a critical strategic vulnerability for Moldova, especially in the context of upcoming parliamentary elections. 

Victoria Olari, “The Russian web behind the Moldova24 TV channel,” Digital Forensic Research Lab (DFRLab), June 3, 2025, https://dfrlab.org/2025/06/02/unveiling-the-russian-infrastructure-supporting-the-moldova24-tv-channel/.