The Kremlin’s Digital Pirates: How Russian Tracking Pixels Harvest Romanians’ Data to Fund Conspiracies and Extremism

For five months, we tracked over 100,000 ads displayed across 131 websites in Eastern Europe. After decoding the hidden mechanisms behind these ads, we uncovered a network of Russian companies. This investigation reveals what data is harvested from Romanians, who ends up receiving it, and why the ads shown on platforms with conspiratorial and extremist content are among the most valuable to this network.

This article is the result of a technical investigation into the code behind the ads running on Romanians’ computers. It builds upon previous investigations published by Snoop regarding the Russia-linked advertising network AdNow, which is used to steal Romanians’ data and promote online scams. The investigation was conducted in collaboration with journalists from across Eastern Europe.
We built custom software that allowed us to follow the Russian money flowing into Eastern European websites, including Romanian ones, over the past few months. We also monitored the methods used to harvest our data and route it to Novosibirsk, Russia.
Such databases serve purposes far beyond advertising: they can become tools for surveillance and behavioral manipulation when they end up in the hands of authoritarian states, warn international experts consulted by Snoop.
The analysis covered ads identified across 1,145 webpages belonging to 131 Eastern European websites. We tracked several online advertising companies with Russian origins, including AdNow, MGID, and AdsKeeper. We will publish our findings on the latter two in the next piece

The full investigation is available on Snoop website:

This investigation was supported by a grant from Journalism Science Alliance.

Contributions: CheckFirst (FIN), Timur Olevsky și Lisa Werner, The Insider (RU), Josef Šlerka, Investigace (CZ), Sorin Tamaș (RO)