Late in October, in the crowded and chaotic ecosystem of online news, a strange and troubling thing happened. A website that looked almost exactly like Euromaidan Press, a Ukrainian English-language outlet that has covered the war since Russia’s full-scale invasion, suddenly appeared with a hyphen inserted into its name. The copycat site scraped the publication’s genuine articles and planted a fabricated report claiming that a Ukrainian drone had killed civilians in Kramatorsk. The fake story cited unnamed “Ukrainian OSINT channels” and was wrapped in the outlet’s familiar design, making it nearly impossible for an average reader to tell that it had not been created by real journalists. The truth, documented by witnesses, officials, and survivors, was the exact opposite: on 8 October, Russian forces struck two public buses in Kramatorsk with an aerial bomb, killing 33 civilians and wounding about 18. The fake was not an isolated act of internet vandalism. Disinformation researchers at Gnida Project linked the impersonation to Storm-1516, a well-known Russian influence operation. NewsGuard, which contacted the outlet while preparing its own debunk, attributed the fake to the same network. This is part of a years-long campaign to clone trusted news brands across Europe and publish false reports under their names, not to cause a single moment of confusion but to weaponize the credibility of real journalism, erode trust in Ukrainian media, and weaken the resolve of Western audiences whose support Ukraine depends on as the war grinds on.
The falsehood was spread with a sophistication that speaks to experience. The fake article began circulating on 24 October, one day after it was posted on the fraudulent site. Alongside it appeared a forged video, apparently produced with AI, that carried a version of Euromaidan Press’s logo. The video claimed to show “newly obtained footage” of the remains of a Ukrainian-made Liutyi drone, and said that “independent OSINT channels” had concluded that the wreckage had been “quickly removed from the scene” to hide evidence. No such channels were named; no links were provided; no evidence was presented. The video and article were pushed across X by accounts including @vick55top, @indiaTales7, @TheWorld_Update, @Wonder_star21, @Theunk5555, @SilentBriefHQ1, and @Suriyakmaps. One of those accounts later deleted the post, perhaps to cover its tracks. The most revealing detail was the amplification pattern: these accounts had small follower counts and modest typical engagement, yet their videos generated hundreds of thousands of views, between 400,000 and 500,000 each. That discrepancy is a classic sign of inauthentic amplification, a mix of bots and coordinated pushing. On 25 October, Gnida Project publicly identified the case as another Storm-1516 operation. Its recent examples included fake advertisements for Russian Geran drones, claims about a Shamonda virus leaking from a “Ukrainian biolab,” smears against US Democratic candidates, and a fabricated story on a copycat toronto-sun.ca site alleging that President Zelenskyy had purchased a nuclear bunker in Nova Scotia. The common thread is a willingness to clone anything and poison it with lies.
The real Kramatorsk attack could not be more different from the fiction. It was one of the most thoroughly documented atrocities of the month. Eyewitnesses saw a Russian aerial bomb hit two public buses; rescue workers pulled bodies from twisted wreckage; hospitals treated the wounded. The death count reached 33, with about 18 injured. Such attacks are a daily reality in Ukrainian cities near the front, but this one was especially deadly because it struck civilians in the middle of ordinary life. There was no Ukrainian drone involved, no wreckage removed by shady operatives, no anonymous investigation. The manufactured story simply took a Russian mass killing of civilians and assigned guilt to the victims. To make the lie convincing, the perpetrators did not create only a single fake page. They scraped Euromaidan Press’s entire website, mirroring real articles, and inserted the fabricated report in the middle of them, so that anyone who clicked around saw authentic journalism surrounding the lie. According to who.is data, the look-alike domain was registered on 15 October, eight days before the fake article appeared. This was not a spontaneous prank; it was a planned operation. Storm-1516, first identified in late 2023 and later named by Microsoft, grew out of Russia’s Prigozhin-era troll operations and has become what researchers describe as Russia’s main disinformation machine. It operates alongside older and overlapping networks. Since 2022, Doppelganger has cloned whole Western outlets and government websites, and it is still active, reportedly flooding France with more than 200 fake sites before its 2026 elections. Polish fact-checkers call this tactic “the attack of the clones.” Another operation, Matryoshka, fills social media with cheap fake videos credited to real outlets. NewsGuard has documented about 906 fabricated reports impersonating 163 outlets from 21 countries since 2023. The most impersonated include Euronews, the BBC, Deutsche Welle, France 24, the Kyiv Independent, and most recently the New Voice of Ukraine. Almost all the fakes bend one way: to erode Western support for Ukraine, smear its leaders, or flip Russian crimes onto Ukrainians. One false story claimed 20,000 Ukrainian soldiers who had evacuated to France had joined criminal gangs; another claimed first lady Olena Zelenska had fled abroad. A separate Storm-1516 fabrication about Ukrainian officials buying yachts with misused US aid was repeated in 2023 by JD Vance, then a US senator.
Euromaidan Press did not take the attack quietly. The outlet filed copyright and abuse complaints with the web host, Namecheap, and a phishing report with Cloudflare, and pushed the registrar as well. The complaints worked, and the clone was taken down. But impersonation is cheap and easy to set up, which means any outlet can be next. The technical team’s procedure is worth sharing. First, cut off the scraping pipeline. A simple DNS lookup, using ping, nslookup, or a service like dnschecker.org, can reveal the hosting IP behind a cloned domain, even if the attackers tried to mask it. Once the IP is known, add a custom rule in Cloudflare’s WAF, under Security, WAF, Custom Rules, targeting that IP. This stops the automated scripts that copy the site’s content in real time. Watch the WAF logs over the next 48 hours, because the attackers may rotate to different scraping proxies. Second, expose the infrastructure and send formal legal notices. An IP WHOIS lookup, for example through ipinfo.io, will identify the hosting provider and the registrar. Then submit DMCA takedown and phishing notices to the host’s legal portal or abuse address. Include side-by-side URL comparisons of the original and cloned pages, clear documentation of brand spoofing and the injected disinformation, and a good-faith legal statement with full contact details. These details matter; a vague complaint will not get the same attention. Third, block access and de-index the clone from search engines. Report the fake site to Google Safe Browsing under the category of social engineering or impersonation. Once verified, usually within 24 to 48 hours, browsers such as Chrome, Firefox, and Safari will show a full-page red warning to anyone trying to open the site. Then file a Google Search Console DMCA removal request to pull the cloned URLs out of search results, so that people searching for the story do not find the lie. Finally, escalate to the registrar. Submit a registrar abuse complaint demanding full suspension of the domain, a status called ClientHold, on the grounds of bad-faith typosquatting and identity theft. Pushing open abuse ticket IDs through your Cloudflare account can help you skip the standard queue and get a faster response.
The fight does not end with takedowns. One of the most practical lessons from this experience is to read every automated reply from hosts and platforms. They often ask for specific additional information, and a fast, complete answer keeps the ticket moving rather than letting it stall in a queue. But ordinary readers also have a role. Many people on X immediately spotted warning signs: a domain with a hyphen, since Euromaidan Press’s only legitimate address is euromaidanpress.com; a claim built on unnamed “OSINT channels”; and a story that conveniently reassigns a Russian attack to Ukraine. The outlet’s editorial standards offer a simple template for judging any viral report. Euromaidan Press never publishes an image or video without crediting its source, and it never cites anonymous OSINT experts. Its reporting traces every claim to a first source, whether that is a government agency, a humanitarian organization, a witness, or an official statement. Readers should apply the same standard to everything they see. Does the report name who filmed the video? Does it link to the original document? Does the quoted expert exist outside the post? Can you find the first source? If not, the report should not be trusted. The internet is now full of convincing deepfakes, mirror sites, and manufactured virality. The basic discipline of verification is more important than ever. Ask whether the domain is exact, whether the language is unusually vague, whether the images are suspiciously low-quality or too dramatic, and whether the story fits a political agenda too perfectly. These small acts of skepticism do not cost much, but in an information war they are a form of resistance.
Behind the technical details and the names of operations like Storm-1516 lies a human tragedy. The 33 people killed in Kramatorsk were not symbols. They were people waiting for buses, on their way to work or to see family, and their lives were torn apart by a Russian aerial bomb. To take that horror and twist it into a lie that blames Ukraine for its own citizens’ deaths is an especially cruel form of propaganda. Russia’s disinformation machine is not trying to win a debate. It is trying to make it impossible for anyone to believe the truth. If every outlet is suspected of being a clone, if every video is suspected of being a deepfake, if every massacre is met with a chorus of “who actually did it?”, then the public loses the ability to respond to atrocity. That is the point. Storm-1516 and its sister operations do not need to convince everyone that Ukraine is guilty. They only need to create enough confusion to slow military aid, weaken political will, and make Western audiences feel tired and helpless. There is good news in this story, however. The clone was taken down. The fake was exposed. Fact-checkers, researchers, and regular users worked together to name the operation and blunt its impact. Euromaidan Press is still publishing, still documenting the war, still telling the truth. But this is a continuous battle, not a single victory. The same playbook will return, perhaps under a new name, aimed at another outlet, with another fabricated story designed to divide and confuse. The best defense is a combination of strong technical procedures, rigorous editorial standards, and a public that refuses to be manipulated. Every time someone checks a domain, questions an anonymous source, or decides not to share an unverified video, the operation loses a little more of its power. For the dead and wounded of Kramatorsk, and for all the civilians whose suffering has been turned into ammunition, the truth is not a luxury. It is a moral obligation.