Analysis Maps Doppelgänger/RRN Disinformation Infrastructure
Summary
DomainTools analyzes the Doppelgänger/RRN influence network, finding coordinated media-impersonation domains, scripted provisioning, TLD migration, CDN/cloud hosting and segmented WordPress operations designed to sustain campaigns amid enforcement.
Key points
- The analysis describes core RRN hubs, country-specific narrative fronts, and clusters of domains impersonating Western media brands.
- Domain registrations reportedly clustered in mid-2022 and September 2024; operators preserved second-level names while changing TLDs following enforcement actions.
- Across the assessed 48-domain dataset, researchers observed 34 unique IP addresses, with Cloudflare fronting and backend infrastructure on Google Cloud and, to a lesser extent, AWS.
- Recovered WordPress artifacts included coordinated account provisioning and role-specific accounts, including SEO-focused roles.
- The report identifies recurring domain-generation patterns, registrar diversification, and privacy shielding as features of the ecosystem’s infrastructure strategy.
- Germany is assessed as the highest-priority target; France, the United States, the United Kingdom, and Italy received regionally tailored infrastructure and narratives.
- The analysis says it found no evidence of malware command-and-control or phishing infrastructure, and recommends Certificate Transparency monitoring for potential new impersonation domains.
Article Details
- Attack Vectors
- Operators used media-brand impersonation domains, including typo variants, semantic suffixes, geographic modifiers, and alternative TLDs.
- Domains were provisioned in campaign waves and migrated to replacement TLDs while retaining second-level names after enforcement actions.
- The infrastructure used Cloudflare CDN fronting and backend hosting across Google Cloud and AWS, with distributed WordPress publishing nodes.
- Role-segmented WordPress accounts supported coordinated publishing and SEO-focused content distribution.
- Redirect and tracking infrastructure, SEO optimization, and social media amplification were described as distribution layers.
- Defensive Notes
- Monitor Certificate Transparency logs for new domains matching the described brand-token, semantic-suffix, and geographic-modifier patterns.
- Track second-level domain reuse across TLD substitutions, particularly following seizures or other enforcement actions.
- Correlate nameserver pairs, DNS provider, TTL, and SOA patterns across related domains; the article identifies these as potential linkage signals.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | 20minuts[.]com | Listed in the assessed domain corpus associated with the reported media-impersonation ecosystem. |
| DOMAIN | 50statesoflie[.]cc | Reported narrative-front domain in the Doppelgänger ecosystem and part of a TLD-migration pattern. |
| DOMAIN | 50statesoflie[.]com | Reported narrative-front domain that reappeared under .cc and .so variants. |
| DOMAIN | 50statesoflie[.]so | Reported replacement variant of the 50statesoflie narrative-front domain. |
| DOMAIN | acrosstheline[.]cc | Reported narrative-front domain and replacement for acrosstheline[.]press. |
| DOMAIN | acrosstheline[.]press | Reported narrative-front domain that later transitioned to a .cc counterpart. |
| DOMAIN | ansa[.]ltd | Listed as an ANSA-impersonation domain in the reported media-clone corpus. |
| DOMAIN | artichoc[.]cc | Listed as a narrative-front domain in the reported ecosystem. |
| DOMAIN | avisindependent[.]eu | Listed as a narrative-front domain in the reported ecosystem. |
| DOMAIN | bild[.]beauty | Listed as a Bild-impersonation domain in the reported media-clone corpus. |
| DOMAIN | bild[.]expert | Listed as a Bild-impersonation domain in the reported media-clone corpus. |
| DOMAIN | bildd[.]lol | Reported typo-variant domain in the Bild-impersonation corpus. |
| DOMAIN | blld[.]live | Reported typo-variant domain in the Bild-impersonation corpus. |
| DOMAIN | build[.]vip | Reported phonetic-substitution variant in the Bild-impersonation corpus. |
| DOMAIN | dailymail[.]cfd | Listed as a Daily Mail-impersonation domain in the reported media-clone corpus. |
| DOMAIN | faz[.]agency | Listed as a FAZ-impersonation domain in the reported media-clone corpus. |
| DOMAIN | fox-news[.]top | Listed as a Fox News-variant domain in the reported media-clone corpus. |
| DOMAIN | levinaigre[.]so | Listed as a narrative-front domain in the reported ecosystem. |
| DOMAIN | rrn[.]com[.]tr | Reported RRN ecosystem domain and current iteration of Researchers & Reporters Network. |
| DOMAIN | rrn[.]media | Previously used RRN narrative hub, reported as seized after enforcement action. |
| DOMAIN | rrn[.]so | Reported successor RRN narrative hub after rrn[.]media was disrupted. |
| DOMAIN | rrussianews[.]com | Earlier core hub in the reported RRN disinformation infrastructure. |
| DOMAIN | shadowwatch[.]us | Listed as a narrative-front domain in the reported ecosystem. |
| DOMAIN | spiegel[.]agency | Listed as a Spiegel-impersonation domain in the reported media-clone corpus. |
| DOMAIN | spiegel[.]media | Listed as a Spiegel-impersonation domain in the reported media-clone corpus. |
| DOMAIN | spiegel[.]today | Listed as a Spiegel-impersonation domain in the reported media-clone corpus. |
| DOMAIN | sueddeutsche[.]cc | Listed as a Süddeutsche Zeitung-impersonation domain in the reported media-clone corpus. |
| DOMAIN | theguardian-com[.]com | Listed as a Guardian-impersonation domain in the reported media-clone corpus. |
| DOMAIN | ukrlm[.]so | Listed as a narrative-front domain in the reported ecosystem. |
| DOMAIN | welt[.]media | Listed as a Welt-impersonation domain in the reported media-clone corpus. |
MITRE ATT&CK
Threat Actors
DoppelgängerThe article describes the RRN ecosystem as a new iteration of Doppelgänger, using media-brand impersonation and coordinated disinformation infrastructure.Doppelganger Disinfo NetworkThe article explicitly identifies this as another name for Researchers & Reporters Network and associates it with the RRN disinformation infrastructure.Researchers & Reporters NetworkThe article identifies this as the current iteration associated with rrn[.]com[.]tr and states that it is also known as Doppelganger Disinfo Network.Social Design AgencyThe article characterizes the RRN/Doppelgänger ecosystem as a new iteration of Social Design Agency (SDA); it attributes coordinated influence infrastructure to the ecosystem.
Vendors
Amazon Web ServicesInfrastructure is cloud-native and attribution-resistant, fronted by CDNs (Cloudflare) with backends on hyperscalers (Google Cloud, some AWS) and distributed IP micro-clusters to reduce single points of failure.CloudflareInfrastructure is cloud-native and attribution-resistant, fronted by CDNs (Cloudflare) with backends on hyperscalers (Google Cloud, some AWS) and distributed IP micro-clusters to reduce single points of failure.Google CloudInfrastructure is cloud-native and attribution-resistant, fronted by CDNs (Cloudflare) with backends on hyperscalers (Google Cloud, some AWS) and distributed IP micro-clusters to reduce single points of failure.
Products
Countries
Franceinfrastructure resilience, registrar/TLD diversification, geographic micro-targeting (notably Germany, France, the U.S., UK, and Italy), and rapid enforcement-aware migration rather than short-term spoofing orGermanyemphasizes infrastructure resilience, registrar/TLD diversification, geographic micro-targeting (notably Germany, France, the U.S., UK, and Italy), and rapid enforcement-aware migration rather than short-term spoofingItalyregistrar/TLD diversification, geographic micro-targeting (notably Germany, France, the U.S., UK, and Italy), and rapid enforcement-aware migration rather than short-term spoofing or financially motivatedUnited Kingdomresilience, registrar/TLD diversification, geographic micro-targeting (notably Germany, France, the U.S., UK, and Italy), and rapid enforcement-aware migration rather than short-term spoofing or financially motivatedUnited Statesresilience, registrar/TLD diversification, geographic micro-targeting (notably Germany, France, the U.S., UK, and Italy), and rapid enforcement-aware migration rather than short-term spoofing or financially