Doppelgänger Responds to U.S. Funding Vote

armed conflict
international affairs

Information Epidemiology Lab


April 24, 2024


April 25, 2024


This brief will outline the topics in content, but will not address the operation’s mechanics, which many other researchers have addressed at length. See the Doppelgänger lit review here: Double Take.

The Doppelgänger Operation has responded to the passage of aid to Israel and Ukraine by posting content to undermine trust in democratic alliances. Emphasizing unreliability and the resultant vulnerability to potential aggression, the content casts doubt on the U.S.’s commitment to allied nations.

Across multiple topics, content discussed the United States’ unreliability as a global partner and the destruction that befalls those who rely upon the United States. Invocations of fear are sometimes followed by a call to forge new alliances with Russia and China.

Figure 1: Accounts identified in research by InfoEpi Lab and the U.S. research group, dTeam.

The campaign could be sorted into three categories: Ukraine, Israel, and domestic issues in democratic nations. In each of these, we find either arguments not to trust the United States as an ally or arguments encouraging the U.S. public to embrace isolationist ideas and grievance.


You can see examples from each section or see examples with their text sections. If you are on a mobile device, it is better to view the galleries on their own pages.


The operation posted extensively about Ukraine, with three distinct sub-narratives:

Alleged Lack of Support: Some posts appear supportive of Ukraine but subtly and sometimes overtly suggest that its democratic allies should be doing more. The posts create a false dichotomy that might be an attempt to encourage grievance and resentment among Ukrainians toward allies.

  • One series of posts shared an article asserting that former President Trump would “stop the plundering of the U.S. budget.” The article uses the domain fox-news.[in] perhaps aiming to reach a Fox News audience without them realizing it’s not the real website.

Political Corruption: Several posts depict the current Speaker of the House as willing to be tough on Ukraine, forcing it to address corruption. One series of posts warned foreign investors about dealing with Ukraine. The focus on high-level corruption within the Ukrainian government undermines trust in Ukrainian leadership and aims to deter international investment and support.

Trivializing Ukrainians’ Experience: One set of images trivializes Ukrainians’ experience, reducing them to entertainment that fails to keep the attention of U.S. citizens. Other posts describe Ukraine as a failed investment that has “gone up in smoke.”

See complete Ukraine gallery.


Military Disappointment


Content concerning Israel emphasizes the unreliability of the U.S. and draws parallels to Ukraine, implying Ukraine’s current state is the result of depending upon the United States.

Abandonment by the U.S.: Posts assert that the U.S. has turned its back on Israel. Multiple posts specifically urge Israel to seek a new alliance with Russia and China. Other posts decried the delay in aid from the perspective of U.S. citizens.

Inadequate Support: Similar to the messaging about Ukraine, posts argue that the U.S. has failed to provide sufficient support to Israel, hinting at a need for Israel to reassess its strategic partnerships. Posts raised changing attitudes in the U.S. as a reason Israel needed to seek new alliances. One post states that criticism of any kind is unacceptable.

Political Cartoons: One set’s cover photo featured U.S. President Biden with a soccer ball stamped with the Star of David. The graphic may imply Biden is “playing games” with Israel’s security or that the U.S. is trivializing Israel’s security concerns. The comments leave it open to interpretation.

Emotional Stories: The network amplified an article from JPost on healthcare workers being traumatized in Israel. The story and concern are valid.

JPost Article

This series shared a real article that discusses the hardship endured by healthcare professionals in Israel.

See the Israel gallery.

Directed at Democracies

Content directed at people living in democracies amplified isolationist views and encouraged grievance:

Isolationist Messaging: Using images of former President Trump, posts suggest that U.S. aid to Ukraine is unjustifiable given domestic challenges, presenting a false choice between international aid and domestic welfare. The domain fox-news[.]in was registered in late 2023 and resembles

  • Recorded Future mentioned fox-news[.in] in a report from December 2023. The journalist listed on the fox-news[.]in article is a real author, but her author page does not show the April 15 article attributed to her on fox-news[.]in.
  • One post featuring the article stated “seems like we’re being taxed to death.” Another said, “I don’t see why we should be burdened with the financial problems of Ukraine.”

Economic Concerns: Another post series focused on the housing market and economic issues, pushing a dichotomy between focusing on domestic versus international challenges. One post reads, “The billions given the Ukraine, Israel, and NATO could do wonders for the U.S. housing market.”

Farmer Protests in the EU: Specifically targeting Poland, the operation portrays the Polish Prime Minister Donald Tusk being insensitive to protesting farmers or placing Ukraine ahead of Polish citizens. It may aim to encourage resentment towards government figures and deepen societal divides.

See galleries for Isolationism and Farmer’s Protests.

Conspiracy Theories

See Conspiracy Beliefs gallery.


The URLs in this dataset resolved to one of the following domains rrn[.]media, spicyconspiracy[.]info, walla[.]re, 50statesoflie[.]com, uschina[.]press, fox-news[.]in, ukrlm[.]info, holylandherald[.]com, and liesofwallstreet[.]com. The operation also used an article from and one from You can see the content shared by probable accounts here: Table of URLs shared by accounts or linked in the galleries.

One of the domains in the jump from the link posted on the platform to the destination URL was The domain is connected to a Russian IP address, among others, which can be seen here: Virus Total graph. The domain has been flagged phishing 11 times and has been flagged as malicious in some way at least 13 times.

Do not visit the domain as it has been flagged over a dozen times for malicious activity.
Figure 2: Virus Total data visualization for on April 24, 2024

A news-like domain, the, exists in the jump between the Doppelganger URL posted on social media and its target or destination website. Although has been amplified by Doppelgänger bots recently, nothing definitively ties them together. The website is a mock news website that has published pro-Kremlin content from a Prigozhin-founded organization. See the report Mock News Sites Continue to Spread Disinformation About Ukraine for more information.

Doppelgänger Series

See all reports from this series on the series list page: Doppelgänger Series. Data from reports in this series can be accessed here:

InfoEpi Lab, 2024, "Doppelgänger Series Data",, Harvard Dataverse, V2.

dTeam, a group of U.S. researchers who track foreign influence, assisted with data collection and analysis.

Updated April 25, 2024 with additional information regarding imposter domains.


BibTeX citation:
  author = {InfoEpi Lab},
  publisher = {Information Epidemiology Lab},
  title = {Doppelgänger {Responds} to {U.S.} {Funding} {Vote}},
  journal = {InfoEpi Lab},
  date = {2024-04-24},
  url = {},
  langid = {en}
For attribution, please cite this work as:
InfoEpi Lab. 2024. “Doppelgänger Responds to U.S. Funding Vote.” InfoEpi Lab, April.