BANNER: People use the flashlights on their phones as they demonstrate outside the parliament during an anti-government rally, in Sofia, Bulgaria, on December 10, 2025. (Source: REUTERS/Stoyan Nenov)

A Bulgarian website publishing fabricated or misleading articles generates revenue through the Adskeeper native ads platform, with a coordinated Bulgarian Facebook network driving traffic to the site.

The Facebook network (two pages, nine groups, and six accounts) demonstrates coordinated inauthentic behavior (CIB) as some of the accounts that manage the Facebook groups and amplify the external website links exhibit strong indicators of inauthenticity.

Six Facebook accounts, seemingly authentic and inauthentic, are connected via Facebook groups where they serve as administrators. Two of the six accounts (Kolev Bo and Rostislava Gigova) consistently amplify content from dailystandart.com. Although three accounts in the network are currently dormant, beyond serving as group admins, they were previously active in 2024. Their continued presence within the network suggests the potential for future reactivation or repurposing. Some accounts display clear indicators of inauthenticity, including the use of stolen profile images, prolonged dormancy, and mismatched profile names and URL handles. This behaviour likely violates Meta’s CIB and Account Integrity policies through the use of inauthentic or deceptive accounts.

For example, one account, operating under the name “Ростислава Гигова” (“Rostislava Gigova”), uses a stolen profile image, as seen when reverse searching the account’s profile photo. The account, which posts daily within the network’s groups, has no publicly visible posts on its timeline. Another account, “Мария Димитрова” shows a notable discrepancy between the account name (“Maria Dimitrova”) and the URL handle (“george.remos.54”).

The network manages nine politically themed Facebook groups with names that reference domestic political issues as well as explicitly pro-Russian positioning. As of February 2, the nine Facebook groups within the network had 211,600 total members. The largest group, “Support for Putin against the US,” had 59,700 members, followed by a group named “I support Putin and Russia!” with 51, 800 members. Alongside accounts, the network includes two Facebook pages, which are listed among the administrators of the groups. Two pages in the network have a combined 11,000 followers. Both pages show little or no activity on their public timelines. One page, “Bulgaria and Russia – Eternal Friendship,” is active almost exclusively within groups, where it shares content from dailystandart.com.

Dailystandart articles are predominantly posted via user accounts and are disseminated through three primary methods within the network: direct links, screenshots of article headlines with links in the comments, or text posts accompanied by links in the comments.

Dailystandart was registered in 2020. Information about its registrar and ownership is hidden. It operates as a clickbait website that publishes false and misleading political articles designed to attract user attention and generate traffic.

We downloaded the XML sitemap from dailystandart.com, containing 1,070 article URLs published between December 2023 and February 2026. Several patterns in the sitemap indicate that the website is likely operating as an automated news generator. The clearest signal appears in the URL slug structure. WordPress generates slugs from post titles and automatically appends a numerical suffix (-2, -3, etc.) when a duplicate slug is created. We identified multiple instances where the same slug appears from three to thirteen times across different publication dates. Manual verification of the thirteen such cases confirmed that the pages contained identical content. The repeated creation of identical posts without deduplication controls is highly consistent with automated or bulk publishing.

Additional data supports the automated publishing assessment. In sixty-one cases, articles shared an identical last-modified timestamp; in forty-five instances, three or more articles were published within a 15-minute window; and repeatedly, clusters of articles were published at exact 10-minute intervals across several days in February and March 2025. When taken independently this does not serve as confirmation, but taken together with the slug duplication, the behavior is consistent with programmatic batch publishing rather than manual activity.

A review of articles mentioning Bulgaria (identified via the website’s internal search engine) found the materials included fabricated claims of correspondence or alleged statements between Russian President Vladimir Putin or Russian Foreign Minister Sergey Lavrov and Bulgaria’s former president Rumen Radev, who resigned in January. Radev’s image and success are frequently highlighted in these articles. Between December 2025 and February 2026, Radev was mentioned in sixteen URLs indexed in the XML sitemap alone. This does not include additional references in non-indexed or body-text content. The website also repeatedly promotes narratives portraying Bulgaria as being under constant external threat, including claims about Russia’s military capabilities reaching Bulgaria and alleged “secret” USSR restoration plans that are said to describe Bulgaria as strategically important.

For example, in Fall 2025, amid domestic protests and shortly before Bulgaria’s planned accession to the Eurozone, the website amplified fabricated headlines that claimed  Putin had warned Bulgarians of “dependence on external forces.” These articles were accompanied by AI-generated images portraying Putin in an angry or threatening manner, designed to provoke fear. The article used deliberately incomplete headlines (cut off mid-sentence), this appears to be a tactic to generate clicks.

In addition to Bulgarian political developments, dailystandart heavily promoted narratives of Russian military superiority and used fabricated content to depict Ukraine as weak or defeated.  For example, on September 24 and 25, 2025, dailystandart published a fabricated story claiming that 1,800 Ukrainian soldiers were surrounded by Russian forces and forced to surrender. There is no credible reporting of such an incident taking place.

The dailystandart website was previously flagged by Factcheck.bg for similar practices, demonstrating that it systematically publishes misleading or fabricated content. For example, in 2023, Factcheck found that a dailystandart claim about NATO mobilizing 30,000 Bulgarian troops was fabricated. Factcheck also reported that in 2023, the website portrayed Putin, Radev, and Hungarian Prime Minister Viktor Orbán as “superheroes.”

According to website traffic analysis tool Similarweb, dailystandart received 1,165 total views in January 2026, with 68.5 percent of this traffic originating from social media. Evidence suggests that much of this traffic was driven by coordinated sharing across Facebook groups, directing users to article pages monetized through native ad units served by the Adskeeper advertising platform. When scrolling through an article on dailystandart.com, new ads load automatically as the user moves down the page. This behavior of auto-loading allows the site to load an unlimited number of ads in a single session. While there are no limitations to how many ad units can be used on the same webpage, Adskeeper prohibits practices involving placing more advertising than publisher-provided content.

The operation’s monetization results are unknown, but Adskeeper pays publishers based on a cost per click (CPC) model. In January, dailystandart received 1,165 monthly visitors from Bulgaria, meaning the website should have hypothetically earned less than $2. Notably, Adskeeper maintains a requirement of 3,000 daily visitors to use its service, raising questions about dailystandart’s traffic sources and compliance. Adskeeper also notes it can reject websites for having a “low rating.”

This behavior presents two possibilities: either the traffic is inauthentic (automated clicks bypassing standard measurement tools), or the traffic is genuine but does not meet Adskeeper’s mandatory 3,000 daily visitor thresholds.

We found Adskeeper’s embedded script (https://jsc.adskeeper.com/site/716654.js ) on dailysdandart’s page header containing the unique Site ID (716654) assigned to this domain. The presence of this ID on a domain with only 36 daily visitors suggests a high likelihood that the publisher is circumventing Adskeeper’s requirements. In this scenario, it is possible that a publisher had a legitimate high-traffic website approved first to secure a master account. Once they have that approved ID, they may copy and paste the code onto a smaller, lower-quality site. This trick may have allowed the operators to bypass Adskeeper’s security filters and get paid for clicks on a site that would normally be rejected for failing to meet the minimum standards.

The operation behind dailystandart.com pushes fabricated political content in Bulgaria for profit. Unlike typical clickbait sites that chase various viral topics, this site is ideologically driven, focusing exclusively on pro-Kremlin narratives supported by AI-generated images. This content is then pushed through a coordinated network of Facebook groups to generate traffic.

The website bypasses the safety rules of its advertising platform, Adskeeper. Despite the platform’s strict requirements for high daily traffic and balanced ad placement, the website likely uses a “Master Account” Site ID to force ads onto a small, low-quality domain that would otherwise be rejected.

Overall, the operation represents a coordinated effort to monetize politically polarizing content by exploiting both social media amplification via an inauthentic network and advertising platform infrastructure.

Sopo Gelava, “Coordinated Bulgarian Facebook network amplifies fabricated for-profit political content,” Digital Forensic Research Lab (DFRLab), March 9, 2026, https://dfrlab.org/2026/03/09/coordinated-bulgarian-facebook-network-amplifies-fabricated-for-profit-political-content/.