A Russian disinformation campaign cloned Euromaidan Press to blame Ukraine for Russia’s own strike on Kramatorsk (we took the fake down)

Euromaidan Press has been impersonated as part of a Russian disinformation campaign. A copycat website was created, with a hyphen added to our name, which published a fabricated article alleging a Ukrainian drone had killed civilians in Kramatorsk that cites anonymous "Ukrainian OSINT channels" amid copies of our real news reports. In reality, that 8 October strike was a Russian aerial bombing of two public buses that killed 33 civilians.
The fabrication is part of a years-long Russian disinformation campaign to impersonate and clone trusted news brands, predominantly in Europe, and publish false reports under their names. The disinformation research project Gnida tied our case to Storm-1516, one of several overlapping Russian operations, alongside the older Doppelganger, and NewsGuard, which reached out to us while preparing its own debunk, attributes the fake to the same operation. The fabricated Kramatorsk report comes amid an ongoing effort to erode Western support for Ukraine, as Russia's war goes on, and to sow distrust among Western political elites.
The claim and the actual 8 October attack
The fake started circulating on 24 October, one day after the forged publication appeared on our website. It started making rounds on X together with a forged video with a version of our logo claiming that "newly obtained footage" featured the remains of a Liutyi drone that "independent OSINT channels" claimed were "quickly removed from the scene." No specific OSINT channels were named; no sources were linked.
The forged video, apparently produced with AI, and the link were spread by X accounts such as @vick55top, @indiaTales7, @TheWorld_Update, @Wonder_star21, @Theunk5555, @SilentBriefHQ1, and @Suriyakmaps, where it was subsequently removed. The videos on those accounts averaged 400,000 to 500,000 views, far more than the accounts' modest follower counts and their usual engagement would produce, a likely sign of inauthentic amplification.
On 25 October, the Russian disinformation monitor Gnida Project flagged this as a case of the Storm-1516 disinformation campaign. Other recent cases flagged by Gnida included advertisements of Russian Geran drones, claims of the Shamonda virus being leaked from a "Ukrainian biolab," smears against US Democratic candidates, and a fake on a similar copycat "toronto-sun.ca" website alleging that President Zelenskyy purchased a nuclear bunker in Nova Scotia.
The latest Storm-1516 disinformation campaign is targeting Ukraine. The campaign promotes a false narrative that a deadly strike in the Ukrainian city Kramatorsk was performed by a Ukrainian drone based on a fake "Ukrainian OSINT investigation" pic.twitter.com/Klpm9UVCf2
— gnida project (@gnidaproject) October 25, 2026
As for the actual content of the fake, the real event is one of the most thoroughly documented atrocities of the month. On 8 October 2026, Russian forces struck two public buses in Kramatorsk with an aerial bomb, killing 33 people and wounding about 18. Such attacks are, sadly, a daily occurrence in cities on the frontline. There was no Ukrainian drone and no removed wreckage. The fabrication simply reassigns a Russian mass killing of civilians to its victim, which is the entire point.
The fake site was not a single page. It scraped our entire website, mirroring our genuine articles, and injected the fabricated one among them, so the lie traveled under the credibility of real reporting. The look-alike domain was registered on 15 October, eight days before the fake appeared, according to who.is data.
Storm-1516
Gnida Project identified the fake as part of Storm-1516, a Russian influence operation that clones trusted news brands to spread fabricated stories, and NewsGuard, which contacted us about the impersonation, attributes it to the same operation. NewsGuard has documented the tactic generating some 900 false reports over three years; the same operation has targeted France and Germany and has recently impersonated other outlets, including in Ukraine, such as this fake report on a copycat website pretending to be the New Voice of Ukraine.
Storm-1516 is one of several overlapping Russian operations that impersonate real media. Since 2022, the Doppelganger network has cloned whole Western outlets and government sites, and it is still active, flooding France with more than 200 fake sites before its 2026 elections. Polish fact-checkers literally call the tactic “attack of the clones.” A second operation, Matryoshka, floods social media with cheap fake videos credited to real outlets. Storm-1516, first identified in late 2023 and later named by Microsoft, grew out of Russia's Prigozhin-era troll operations, is the most elaborate of the three, and has overtaken RT and Sputnik as Russia's main disinformation machine. Its attacks combine cloned websites and fake videos.
NewsGuard counts some 906 fabricated reports impersonating 163 outlets from 21 countries since 2023, Euronews, the BBC, Deutsche Welle, and France 24 most of all, as well as the Kyiv Independent. The fakes nearly all bend one way, to erode Western support for Ukraine. Some smear Ukraine's leaders, a fabricated story that 20,000 Ukrainian soldiers evacuated to France had deserted into criminal gangs, invented claims that first lady Olena Zelenska fled abroad. Others, like the one aimed at us, flip Russian actions onto Ukraine. A separate Storm-1516 fabrication, a false claim that Ukrainian officials bought yachts with misappropriated US aid, was repeated in 2023 by JD Vance, then a US senator.
We filed a copyright and abuse complaint with the host, Namecheap, and a phishing report with Cloudflare, and pressed the registrar. The complaints worked: the clone has been taken down.
How to take down a cloned news site
Impersonation is cheap to set up, and any outlet can be next, so here is the procedure our technical team used, which other newsrooms can follow to take a clone down quickly.
- Cut the scraping pipeline. Run a DNS lookup (ping, nslookup, or dnschecker.org) on the cloned domain to expose the hosting IP behind any basic masking, then add a custom block rule in your Cloudflare WAF (Security, WAF, Custom Rules) targeting that IP, which cuts off the scraping scripts in real time. Watch the WAF logs over the next 48 hours in case the attackers rotate to new scraping proxies.
- Unmask the infrastructure and send formal notices. Run an IP WHOIS lookup (ipinfo.io) to identify the host, for example Namecheap or DigitalOcean, and the registrar, then submit DMCA takedown and phishing notices to the host's legal portal or abuse address. Include side-by-side URL comparisons of the original and cloned pages, clear documentation of the brand spoofing and the injected disinformation, and a good-faith legal statement with full contact details.
- Block access and de-index from search. Report the clone to Google Safe Browsing under social engineering and impersonation, which, once verified in 24 to 48 hours, makes Chrome, Firefox, and Safari show a full-page red warning to anyone who tries to open it. Then file a Google Search Console DMCA removal request to pull the cloned URLs out of search results.
- Escalate to the registrar. Submit a registrar abuse complaint demanding a full suspension of the domain, a ClientHold status, on the grounds of bad-faith typosquatting and identity theft, and push your open abuse ticket IDs through your Cloudflare account to skip the standard queue.
Be sure to read the automated replies from the host and Cloudflare and answer them promptly. Those acknowledgments often ask for specific additional information, and a fast, complete reply keeps the ticket moving instead of stalling in a queue.
How to spot Russian Storm-1516 attacks
Many users on X called out the signs: a look-alike domain (our only website is euromaidanpress.com, with no hyphen), a claim sourced to unnamed "OSINT channels," and a story that reassigns a Russian attack to Ukraine.
We never publish an image or video without crediting its source, and we never cite anonymous OSINT experts: our reporting traces to a first source. Trust only reports that name the first source of a claim and label the origin of their images and video. If you cannot trace the source, you cannot trust the report.



















































