Two layers of fog – anonymous Norwegian websites linking to Russian-affiliated domains

The Russian disinformation and propaganda ecosystem consists of an unknown number of ‘news’ websites in multiple languages. While some are officially Russian, such as RT and Sputnik News, the majority hide their Kremlin affiliation. We call those ‘proxy sites’. Our database includes 80 official and 2606 proxy sites. In this report, we refer to them collectively as ‘Russian-affiliated domains’. This exploratory study examines whether there are anonymous Norwegian websites that share links to the 2686 Russian-affiliated domains in our database. We consider websites to be anonymous if they do not provide truthful or verifiable information about the website’s owner or authors. This may be an indicator of covert influence activity targeting a Norwegian audience and thus enable us to identify Russian-affiliated proxy sites in Norwegian. First, we have used Majestic’s Search Engine Optimization (SEO) tool to identify domains that contain hyperlinks to the Russian-affiliated domains in our database. We have then qualitatively examined 693 identified Norwegian domains in line with common digital literacy practice to see if these domains provide credible and sufficient information to their readers about the site and its authors. We identified 37 Norwegian domains that link to Russian-affiliated domains while operating anonymously. However, the majority of them do not seem to share Russian links today, but they appear in our dataset because previous websites on the same domain have done so in the past. Of the 37 anonymous Norwegian domains, we have highlighted four for further analysis described in this report. These are selected not primarily because they share Russian links, but because they display various inauthentic and manipulative properties, such as authors with fake names and stolen or AI-generated portraits and plagiarized content that is auto-copied and auto-translated. Two of the four domains mimic authentic news outlets and are connected to a global network of 443 similar inauthentic and anonymous websites, of which 14 are in Norwegian. We have not found indications to suggest that these are linked to Russia, nor do we imply that they are. While evaluating content is a subjective exercise, hyperlink detection allows us to objectively map how content from Russian-affiliated domains proliferate on the web. It provides verifiable data that can be filtered for relevance but requires further qualitative analysis. This is because outgoing hyperlinks from a domain do not provide context, for example whether as to the website supports or is making fun of Russian propaganda. One obvious limitation with this method is that we are unable to reveal domains that share content from Russian-affiliated sources if they do not link to the actual source. Another limitation is that we are only investigating hyperlinks to known Russian-affiliated domains.