Cloned news sites

How it works

Take a real newspaper’s website. Copy the logo, the fonts, the menu, the cookie banner. Register a domain that looks like the real one (the outlet’s name with a different ending, or one letter swapped) and publish an article the real paper never wrote. Then push the link through fake accounts, paid ads and messaging groups. Readers see a familiar masthead, a familiar layout and a story that confirms something they half-suspected. The real outlet’s reputation does the convincing; the real outlet does not find out until a reader asks.

This is not hypothetical. Since at least May 2022, an operation that researchers at EU DisinfoLab named “Doppelganger” has cloned major European outlets (German tabloids and weeklies, British, French and Italian papers, Ukrainian news sites) on dozens of lookalike domains. The fake articles pushed a consistent set of lines: Ukraine is corrupt and lost, sanctions are ruining your country, your government is sending your money abroad. Meta took down the first batch in September 2022 (over 60 spoofed domains and the accounts promoting them) and later tied the network to two Russian firms, Structura and the Social Design Agency. In July 2023 the EU sanctioned both for the campaign; in September 2024 the US Department of Justice seized 32 more domains. The operation kept registering new ones.

The craft is in the small details. The fake article is often the only working page on the clone; the menu links lead to the real site or nowhere. The domain ending is one you have never seen on a news site: .ltd, .pm, .online. The story has no byline, or borrows a real journalist’s name. And the link reaches you not from the outlet’s own channels but from a stranger, an ad, or a forward in a group.

Example

@mira_in_brussels, 4h Even the Harbour Gazette admits it now: “Government secretly agrees to send troops by spring”. harbourgazette.ltd/politics/troops-spring The mainstream media is finally cracking.

@zoltan_reads_news, 3h The Gazette is harbourgazette.com. I searched their site for that headline: nothing. On the .ltd copy every other link is dead and the “author” has no other articles. That’s a clone.

@liberty_dispatch_eu, 2h Breaking from the Daily Meridian: opposition leader’s family firm got a secret EU grant. dailymeridian.pm Screenshot it before they delete it.

@zoltan_reads_news, 1h “Before they delete it” is the tell. The real Meridian has no such article, and .pm is the domain of Saint Pierre and Miquelon. Nobody deleted anything, because nobody published it.

Notice that the look, the logo and the urgency all feel real. The only fake thing is the address bar, and the address bar is the one thing nobody reads.

Why it works on you

• You recognise brands, not URLs. Years of seeing an outlet’s logo built a trust that the clone inherits for free. Nobody memorises domain names; everybody remembers a masthead.
• It confirms a suspicion. The fake story is always one you were primed for: “the media is finally admitting it”. See confirmation bias.
• Screenshots travel without the address. Once someone crops the fake article into an image, the one clue that remained, the domain, is gone. See fake screenshots.

What to do

When a link like this reaches you: read the domain, letter by letter, before you read the article. Then go to the real outlet via a search engine (never via the link) and search for the headline there. If it is not on the real site, you are done. Our guide to checking domains and dates has the full routine.

When you catch yourself: a mainstream outlet “finally admitting” exactly what you always believed is the single most common bait on cloned sites. Treat the feeling of vindication as a prompt to check, not a reason to share.

In a comment section: post the real outlet’s search result for the headline (empty) next to the fake URL. Say “cloned site”, not “you fell for propaganda”. The clones are built by professionals precisely to fool careful people. Report the ad or the post; platforms do take these networks down, but mostly after someone flags them.

Don’t confuse it with

• A real outlet’s regional edition or mirror can legitimately use a different domain. The real site links to it; a clone is never linked from the original.
• A real article that is simply wrong is a correction issue, not a cloning issue. The test is whether the outlet actually published it.