Storm-1516 operators are preparing for German election with new fake media network of almost 100 websites

Our team, together with Correctiv and NewsGuard, was able to discover a network of at least 95 websites (94 of which weren’t previously used in campaigns or reported), which we were able to attribute to Storm-1516 operators. One of the websites, presseneu[.]de - was used in recent disinformation campaign. We believe, the total number is most likely a 100.

The network bears a lot of similarities with MAGAstan network, which was created to target U.S. presidential election. Similar to the previous network, websites are filled by mostly the same materials, individually rewritten by AI for each website. Domain naming approach is also similar to the previous network.

However, unlike the American network, websites are not using CloudFlare and are hosted across three hosting providers: Hostinger, NameCheap and SIM-Networks. We also noticed that all AI generated publications on these websites appear as being published at the same time: 9:00 AM in UTC time zone. It also seems that network is not yet fully operational: some websites are updated more often than others; some of the previously operational websites are going bust. At the time of writing, none of the websites (excluding presseneu[.]de) contained “Impressum” section, which is mandated by German law.

For a more detailed analysis, we suggest to review the publications by Correctiv (in German) and by NewsGuard (in English).

Domain list

Hostinger

aktuellenews-berlin[.]de
an-berlin[.]de
b-blatt[.]de
berlin-apropos[.]de
berlinertagespost[.]de
brlnr-stimme[.]de
cito-novit[.]de
deinequellen[.]de
deutsch-w[.]de
einmaleinsneu[.]de
f-aktuell[.]de
fr-press[.]de
heute-inberlin[.]de
klartext-news[.]de
konusnews[.]de
kurzchronik[.]de
news-checker[.]de
newsletters-berlin[.]de
nnberlin[.]de
nrtv[.]online
oku-nachrichten[.]de
presseneu[.]de
resonieren[.]de
scheinwerfen[.]de
tageblatt-berlin[.]de
top-news-munchen[.]de
visionar-info[.]de
wdr-hall[.]de
weitwinkelmedien[.]de
xn--wochenberblick-berlin-eic[.]de

NameCheap

aktuellde[.]de
alles-klar-hamburg[.]de
ausdemueberall[.]de
das-denkt-hamburg[.]de
deutschenachrichtenstelle[.]de
diewahreseite[.]de
doch-infomedia[.]de
dznachrichten[.]de
einfachandersinfo[.]de
gegengewicht-media[.]de
gegenleitmedien[.]de
guckmalgenauhin[.]de
h-np[.]de
hamb-post[.]de
hamburg-ex[.]de
hamburger-anzeiger[.]de
hamburger-sichtweisen[.]de
in-absicht[.]de
info-mediaplattform[.]de
info-stichpunkt[.]de
infomediafuerdich[.]de
infomediaregierungskritisch[.]de
informant-info[.]de
internetpoebler-info[.]de
kernpunkt-infomedia[.]de
la-cher[.]de
media-transparent[.]de
n-a-h[.]de
nachrichtendestages[.]de
nachrichtenunabhaengig[.]de
newsfuereuch[.]de
prinzipienfest[.]de
ruf-der-freiheit[.]de
stimmedeutsch[.]de
thesis-info[.]de
zeitenwende-news[.]de

SIM-Networks

aktuell-nachricht[.]de
aktuelles-aus-nurnberg[.]de
alles-wichtig-news[.]de
allethemen24[.]de
dasneueste-online[.]de
de-nachrichtenseite[.]de
expert-infomedien[.]de
herrpostillon[.]de
in-und-ausland[.]de
ins-gesicht[.]de
kernrecht[.]de
laut-medien[.]de
mehrstimmen[.]de
munchener-nachrichten[.]de
newsmacher[.]de
newswichtig[.]de
novanachrichten[.]de
nudis-verbis[.]de
onlinedaheim-24[.]de
onlineunterwegs[.]de
polemisch-infomedia[.]de
rundumdieuhr-24[.]de
sag-das[.]de
seite-eins-nachrichten[.]de
tagesnews-24[.]de
tagundnacht24[.]de
ungeziert-info[.]de
unmittelbar-medien[.]de
vollverstand[.]de
w-a-munchen[.]de