The investigation is based on our previous research on Doppelganger’s infrastructure and focuses on the open question regarding the use of hidden front-end-proxies to display different content depending on the user, so called Cloaking service. The discovery of the cloaking service used by Doppelganger led us to a wider network of actors involved in a variety of scams and cyber criminal activities such as the traffic distribution system VexTrio .

In April 2024, Qurium received an email from “Alissa Muncy” claiming that an article from the Peruvian investigatory newspaper Ojo Publico – about the money laundry of Joaquín Ramírez – was an infringement of copyright. Mrs. Muncy pointed us to the website infouse.exposure[.]co as the original source of the investigation. Our past experience of battling fake DMCA requests made us curious to find out who Mrs Muncy really was and who she was working for.

– Exposing The Evil Empire of Doppelganger Disinformation Executive summary In September 2022 Qurium in collaboration with EU DisinfoLab exposed for the first time a Russia-based influence operation network that… Read more: How Russia uses EU companies for propaganda

There was once a time when unsolicited advertisements would arrive in our physical mailboxes. The Internet made those printed ads obsolete and they were soon replaced by e-mails. E-mail spam was the most commonly-used mechanism to lure victims into all sorts of scams. It was the time of Viagra, lottery prizes and dating scams.

Meduza is one of the largest and most influential Russian regime critical news site that delivers daily news from all across Russia in Russian and English languages. Meduza operates in exile… Read more: Russian exiled media Meduza.io facing repeated DDoS attacks

The Scam Machinery – Did you see the Le Monde article revealing how Le-Pen earned a fortune on crypto trading? I checked out the trading platform she was using and… Read more: A journey into the Crypt of cloned media

A deep fake video of Maria Ressa promoting the crypto-currency scam “Bitcoin Method” was released on Facebook on 6 February 2024. The AI edited video was based on Ressa’s appearance… Read more: Deep fake of Maria Ressa connected to Russian cyberscam network

The Nation Media Group is the largest independent media house in East and Central Africa with operations in print, broadcast and digital media serving audiences in Kenya, Uganda, Tanzania and… Read more: Adsterra used to promote malicious content using hacked Facebook pages

On 20 November 2023 a group of Twitter accounts shared a message with almost 200 media outlets and fact-checking organizations that included a video from a billboard in Time Square,… Read more: Russian disinformation against Zelenskyy exposed on Times Square billboard

Our investigation started when the Philippine media outlet MindaNews, the news arm of the Mindanao Institute of Journalism, made Qurium aware that they had found a clone of their website… Read more: Hundreds of sites cloned to promote a Chinese gambling network

– A Digital Marketing Scam using SparkTraffic to create fake Google Analytics data To reach a wide and relevant audience is key for the success of any media outlet. Social… Read more: Looking Inside A Website Traffic Con

Media clones serving Russian propaganda This work is the result of a collaboration with EU DisinfoLab an independent non-profit organization focused on tackling sophisticated disinformation campaigns targeting the EU. EU… Read more: Under the hood of a Doppelgänger