The Finnish company CheckFirst and the DFRLab are releasing an online dashboard aggregating near-real-time data from Russia’s Pravda network. Our investigation found that the network published more than 3.7 million articles that repurposed content from Russian news outlets and amplified information from questionable Telegram channels.

By reverse engineering the web API of Pravda’s sites, CheckFirst created a dataset that is updated hourly. This dataset is available on their GitHub repository. The Pravda Dashboard offers researchers and the open-source community detailed insights into how specific countries are targeted by the Russian operation. Our investigation also shows how the network reuses content across multiple regions, repurposing content in an effort to reach multiple audiences in an automated fashion. This article includes case studies based on the data in CheckFirst’s repository, revealing country-specific patterns in the Pravda operation. The DFRLab also created an interactive map and visuals that can be accessed on the author’s GitHub repository.

By analyzing the dates of the earliest identified articles published by the network, the DFRLab determined that the operation’s latest iteration, which uses country-specific domains, initially focused on Poland, Germany, and France in the summer of 2023. In the chart below, each domain is represented by a dot, positioned according to the date of the earliest retrieved article. This data confirms our previous findings and indicates that Pravda operators significantly increased activity and coordinated the release of new domains in April 2024, leading up to the European Union (EU) parliament elections, and from October 2024 to January 2025.

A scatter chart showing the earliest articles retrieved from each Pravda domain over time. (Source: @gyron_bydton via @CheckFirst)

Our dataset reveals that the top five sources mentioned in Pravda articles are the Russian news organizations TASS (136,000), RIA Novosti (99,000), Lenta (89,000), Komsomolskaya Pravda (59,000), and the government-owned RT (54,000). Other cited news outlets included the Russian TV channels Ren.tv and Tsargrad. Many of these outlets have been restricted or sanctioned in the United States, Canada, and the EU.

Globally, the Pravda network has published more than 3.7 million articles, with a primary focus on France (394,400 articles), Germany (376,700), Ukraine (270,300), Moldova (244,700), and Serbia (228,900), among other countries. It is important to note that the dataset concerning Ukraine only includes articles posted on ukraine.news-pravda.com and excludes denominations that are city-specific, separatist, or from a prior iteration of the operation. The primary English news portal, news-pravda.com, published 257,800 articles, making it the third largest portal in volume, despite not being country-specific.

In countries such as Ukraine and Moldova, the most quoted sources are exclusively pro-Russian Telegram channels, likely due to the countries’ banning of pro-Russian media since the start of the full-scale invasion of Ukraine in 2022.

The DFRLab created an interactive map to better assess the country-specific footprint and tailoring of Pravda content in each region in the dataset. By clicking on or searching for a specific country or region, users can access fact sheets and metrics highlighting how the country is targeted based on the number of articles, the most frequently cited sources, and observed surges in posting activity. The case studies below utilize this map to explain how the network targets France, Germany, Moldova, and Serbia.

An interactive map representing the extent of the Pravda network. (Source: @gyron_bydton via CheckFirst)

The sources cited in Pravda articles often include Russian and pro-Russian media outlets and Telegram channels. Our investigation found that channels in the InfoDefense/SurfNoise disinformation network, which the DFRLab reported on in 2023, were among the key actors participating in content dissemination. The InfoDefense/SurfNoise network encompasses over fifty channels that disseminate pro-Kremlin and anti-Ukrainian narratives and disinformation. Our research identified that for twenty-eight countries and regions in the dataset, InfoDefense was one of the top ten cited sources, making it one of the most prominent disseminators of Russian-sponsored disinformation within the Pravda network.

Overall, the InfoDefense network cast a broad global footprint as it targeted regions such as the Balkans (Serbia), the Baltics (Estonia, Latvia, Lithuania), Eastern Europe (Bulgaria, Czechia, Hungary, Poland, Romania, Slovenia), Scandinavia (Norway, Sweden), Southern Europe (Greece, Italy, Portugal), East Asia (Japan, Taiwan), the Caucasus (Armenia), and individual countries like Germany, Austria, the Netherlands and Turkey. The collected data regarding the InfoDefense channels and their prevalence in the Pravda domains can be found on GitHub.

The French-speaking Telegram channel @Vbachir is by far the most cited channel across the entire network, with a total of 53,600 articles quoting it as a source. The channel, which emerged in 2022, allegedly belongs to online influencer “Volodymyr Bachir,”  according to its profile picture. Telegram and TGstat point at multiple French-speaking channels being involved in the amplification of its content. In its description, the channel states that it belongs to an alleged Spetsnaz soldier involved in Russia’s war in Ukraine. The description also referenced the Telegram account of a certain “Rusev Givi.” At the time of writing, the DFRLab was unable to confirm the identity of these individuals.

TGStat data also shows that @Vbachir mentioned multiple French-speaking channels, including International Reporters, the successor to the French-speaking disinformation platform “Donbass Insider,” which is supported by French journalist Christelle Neant. The channel also cited Erwan Castel, a former French legionnaire and soldier who fought alongside the Russian forces and previously shared Kremlin-aligned false narratives incriminating Ukraine in the 2024 Russian bombing of Ukraine’s Okhmatdyt children’s hospital. Further, @Vbachir mentioned “Node of Time” multiple times, which the DFRLab identified as being part of the InfoDefense/SurfNoise operation.

TGStat data revealed that @Vbachir is most often cited by three accounts, which, similarly to Rustev Givi’s @Rustev95 Telegram account, are also suffixed with the number 95. In Rustev Givi’s case, the suffix coincides with the birth year displayed on Telegram. These channels include @LeChat95, @Ryadavoy95, and @VPoutine_95.

Despite @Vbachir serving as the primary source for most of the Pravda network’s articles, the Telegram account @pravdafrcom does not appear on TGStat as an amplifier reposting content from @Vbachir, as illustrated in the above screenshot. However, on the TGStat page for @pravdafrcom, @Vbachir appears as the most quoted channel with 3,971 mentions. The second-most cited channel by @pravdafrcom is RT in French, with 1,380 mentions at the time of writing.

Additionally, multiple pro-Russian Telegram channels either affiliated with Russian state media or pro-Kremlin influencers were amplified by the network. For instance, the pro-Russian channel Politnavigator is linked to an online anti-Ukraine disinformation news outlet with alleged links to the FSB. Further investigation shows that the email address used to register the YouTube channel of Politnavigator belongs to Sergey Stepanov, a Russian journalist based in Sebastopol who is frequently interviewed on pro-Russian media and identifies on LinkedIn as the editor of Politnavigator. According to the Ukrainian Security Services, Stepanov is suspected of coordinating an “FSB spy network.” At the time of writing, nearly 42,000 posts in the Pravda network cited Politnavigator as their primary source.

The DFRLab analyzed the network’s posting activity across highly targeted regions, including France, Germany, Moldova, and Serbia. In all cases, spikes in publications appeared to correlate with major news events, such as discussions about the war in Ukraine, election cycles, or the arrests of high-profile Russian individuals.

By splitting our dataset into trimesters, we isolated the dates where an outlying amount of posting was observed on country-specific domains compared to the observed activity for that period. Using this method, we identified up to five of the most significant surges in activity since the network’s inception. Although the narratives shared during these surges do not always align with the news developments that they correlate to, this highlights the network’s ability to increase publications and saturate the news cycle.

In France, a surge was observed on February 27, 2024, correlated with discussions surrounding the potential deployment of French troops to Ukraine. Another surge in the first week of June 2024 coincided with the 2024 EU Parliament elections and Ukrainian President Volodymyr Zelenskyy’s address to the French parliament. Another notable surge occurred on August 25, 2024, following the arrest and detention of Telegram CEO Pavel Durov by French authorities.

Similar patterns were observed in the German-language network. Surges were noted on March 1, 2024, when Germany issued a NATO scramble alert from Latvia’s Lielvarde airfield, and on June 7, 2024, during the EU Parliament elections. Another surge occurred on December 2, 2024, as German Chancellor Olaf Scholz announced military aid to Kyiv and an upcoming visit to the country. The last recorded spike was observed on February 14, 2025, during the Munich Security Conference.

In Moldova, surges were observed on November 3, 2024, during the country’s second round of presidential elections, and on May 29, 2024, when former US Secretary of State Anthony Blinken visited Czechia and Moldova. The Serbian subset of the Pravda network also experienced surges related to both domestic and international news. A significant surge occurred on May 24, 2024, when the United Nations voted on the creation of a Remembrance Day for the Srebrenica massacres in Bosnia and Herzegovina. Other surges were noted on September 4, 2024, during Deputy Prime Minister Aleksandar Vulin’s visit with Russian President Vladimir Putin, and on October 1, 2024, when President Aleksandar Vučić announced that Serbia was not planning to go to war over Kosovo. The last recorded surge was observed on March 13, 2025, as Serbian citizens gathered to hold large anti-government protests.

The dataset revealed a structured network of domains linked by shared language characteristics through their alternate meta tags. The alternate meta tag is an HTML element that signals to search engines and browsers that a given page has alternative versions, which may include translations or region-specific adaptations. Analysis of these alternate links showed that the operation was not merely focused on high-volume publishing but also on strategically repackaging content to target specific linguistic audiences. By visualizing the connections, several distinct clusters emerge.

A robust Francophone network is evident, centred on the French-language domain. This cluster not only includes francais[.]news-pravda[.]com but extends to other French-speaking countries, indicating that content originally produced in Russian is being continually translated and repackaged for French-speaking audiences across both France and French-speaking regions in Africa, like Senegal and Burkina Faso. 

Another prominent cluster formed around the German language, with deutsch[.]news-pravda[.]com at its core. This group ties in additional European domains, where content is adapted for German-speaking communities, suggesting a concerted effort to influence audiences in Central Europe.

Similarly, a distinct Balkan network links domains such as serbia[.]news-pravda[.]com and montenegro[.]news-pravda[.]com. This cluster is tailored to the southeast European region, reflecting a deliberate strategy to tailor narratives to local languages and cultural contexts in the Balkans.

An international or anglophone network is also present, incorporating domains like usa[.]news-pravda[.]com, uk[.]news-pravda[.]com, and possibly canada[.]news-pravda[.]com. This suggests that the disinformation operation seeks to penetrate global media channels and influence English-speaking audiences worldwide. 

Additionally, the database points to an Eastern European cluster, with domains such as ukraine[.]news-pravda[.]com, ua[.]news-pravda[.]com, and moldova[.]news-pravda[.]com playing key roles. This indicates targeted messaging toward audiences in Eastern Europe, further underscoring the operation’s sophisticated use of multilingual strategies.

Overall, the strength of these connections, reflected in the high degree of shared multilingual content, demonstrates a deliberate and refined approach to disseminating narratives across different regions. The mapping of these networks highlights not only the volume of the operation but also its adaptability and precision in tailoring content to specific linguistic and cultural audiences. 

The dataset also revealed a strikingly continuous publication pattern, with articles being published around the clock. Daily counts exhibited significant fluctuations, ranging from modest numbers on quieter days to sharp peaks exceeding a thousand articles on other days, signaling an ongoing, automated process that does not adhere to typical human work schedules. This relentless rhythm suggests that the content production is driven by a heavily automated system, likely relying on artificial intelligence for rapid translation, adaptation, and distribution of material across multiple domains and languages.

Valentin Châtelet and Amaury Lesplingart, “Russia’s Pravda network in numbers: Introducing the Pravda Dashboard,” Digital Forensic Research Lab (DFRLab) and CheckFirst, April 18, 2025, https://dfrlab.org/2025/04/16/russias-pravda-network-in-numbers-introducing-the-pravda-dashboard/.