Online disinformation does not spread only through viral posts on social networks. Influence operations can exploit networks of websites, automated republishing, reciprocal links and search engine results. Understanding these mechanisms also matters for anyone working with SEO, digital reputation and AI-based search systems.
From political strategy to digital distribution
In 2019 Geir Hågen Karlsen published a study in Palgrave Communications (now Humanities and Social Sciences Communications) on political influence activities attributed to Russia in Europe. The analysis, based on around forty public reports from Western intelligence services, describes a repertoire of tools that includes exploiting political and social divisions, cyber activities and information operations. However, the study does not show that every initiative achieved its intended effect. [1]
A second study, published in 2024 in East European Politics, asks which countries are targeted by Russian state-sponsored disinformation campaigns, and why. For this study we rely on the available abstract: we do not attribute to it any figures or coefficients that we could not verify in the full text. [2]
The two studies provide useful theoretical context. To observe web techniques concretely, however, we need investigations with verifiable indicators.
Portal Kombat: what VIGINUM identified
The French agency VIGINUM described Portal Kombat, a network of news portals observed in the context of influence activities favourable to Russian narratives. The technical report documents domains with common characteristics, the republishing of content and related infrastructure elements, including an IP address associated with part of the network during the period analysed. [3]
Particularly relevant for SEO is one observation reported by VIGINUM: some websites in the network appeared in results for long-tail searches, even when they did not show up for generic queries. This does not mean that search algorithms endorse that content; it shows that publishing many pages on specific topics can increase the chances of matching particular queries. [3]
Some of these websites use domains of the form pravda- followed by a country code, which is why the network is also known as the Pravda network. In April 2024 VIGINUM documented its expansion with new domain names aimed at European, African and Asian countries. [4]
The European External Action Service, in its third report on foreign information manipulation and interference (FIMI) threats, also lists Portal Kombat among networks of channels with hidden connections, and proposes a model for linking digital channels to the infrastructure behind them. [6]
A backlink is not proof of membership
When analysing a network, technical signals must be kept separate from editorial relationships. Two websites may share an IP because they use the same host; they may link to each other because one is criticising the other; they may publish similar headlines because they both draw on a news agency. In none of these cases can we automatically conclude that they work for the same entity.
Cloudflare itself explains that many domains protected by its proxy share the network's IP addresses. A reverse IP lookup is therefore not enough to establish common control. [5]
It is the same methodological mistake we see when analysing the backlinks of a business website: a list of suspicious domains does not, on its own, tell you who controls them or what effect they have. We have written about this in our articles on spam backlinks and PBNs in eCommerce and toxic backlinks and disavow.
NarrativeScope: an open-source tool to make evidence visible
As an experimental project we have built NarrativeScope, a local Python script that searches for news through GDELT, can read publicly accessible pages and produces a navigable graph showing explicit links, textual similarities and current DNS records. Every edge shows the type of evidence; the exportable data allows manual verification.
The first version is a prototype: it does not contain a certified, up-to-date list of propaganda websites, it does not make automatic political attributions and it does not produce an exhaustive map of European blogs. Its value is methodological: making the step from data collection to hypotheses open to scrutiny.
The code is public under the MIT licence: github.com/bithub-it/narrative-scope. The README (in Italian) covers installation, options and known limits, including the fact that text similarity only works within a single language and that DNS records show the current situation, not its history. The tool is meant to run locally: it is not designed to be exposed as a service that fetches URLs supplied by others.
Applications to SEO, GEO and reputation
A graph of sources helps identify how citations, republished content and recurring themes circulate. It can be useful for studying the ecosystem in which a brand or a news story is mentioned. But on its own it does not measure Google rankings, citations in AI assistants or real impact on public opinion: each of those questions needs separate tests. We have also written about how content gets picked up by AI-generated answers in FAQs for local SEO and AI answers.
The main conclusion is a rule of method: the more connections you observe, the more important it is to explain what they actually prove. Maps can make relationships visible; interpreting them requires sources, dates and context.
At BitHub we apply the same approach when we analyse a website's SEO, its link profile or its security: verifiable data first, hypotheses second, and always kept apart.
Frequently asked questions about site networks, SEO and propaganda
Do two websites on the same IP address belong to the same owner?
Not necessarily. Many websites share an IP because they use the same shared hosting or the same proxy and CDN service: Cloudflare, for example, documents that many domains protected by its network share the same addresses. A common IP is a clue to cross-check against other evidence, such as dates, republished content and configurations, not proof of common control.
What is the Portal Kombat network, also known as the Pravda network?
It is the name given by the French agency VIGINUM to a network of news portals that relay content favourable to Russian narratives. The 2024 reports document websites that produce no original content but republish texts from other sources on a massive scale, shared infrastructure elements and, in April 2024, an expansion with new domains aimed at European, African and Asian countries.
Why do long-tail searches matter for these networks?
VIGINUM observed that some websites in the network did not appear for generic searches but did appear for very specific ones. Publishing a large number of pages on niche topics increases the chances of matching queries with little competition. It does not mean that the search engine endorses that content.
Does NarrativeScope automatically identify propaganda websites?
No. It is a prototype that gathers news through GDELT, reads public pages and builds a graph in which every connection shows the type of evidence: explicit links, textual similarities, current DNS records. It contains no certified list of websites and makes no political attributions: its purpose is to make the step from data to hypotheses verifiable.
Let's analyse your website's links, sources and visibility
Sources
- G. H. Karlsen, Divide and rule: ten lessons about Russian political influence activities in Europe, Palgrave Communications, 2019. nature.com
- B. Stewart, S. Jackson, J. Ishiyama, M. C. Marshall, Explaining Russian state-sponsored disinformation campaigns: who is targeted and why?, East European Politics, 2024. DOI. Abstract only.
- VIGINUM, Portal Kombat: a structured and coordinated pro-Russian propaganda network, technical report, February 2024. PDF
- VIGINUM, Portal Kombat, update on the network's expansion with new domain names, April 2024. PDF
- Cloudflare, Cloudflare IP addresses. developers.cloudflare.com
- EEAS, 3rd EEAS Report on Foreign Information Manipulation and Interference Threats, March 2025. PDF