In February 2025, an investigation by the Atlantic Council’s DFRLab and CheckFirst revealed how the Pravda network, a Russian website ecosystem, expanded its influence in one year. Our new report, named “Russia-linked Pravda network cited on Wikipedia, LLMs, and X”, shows how the operation related to the “Portal Kombat” network reaches global audiences by sparking false claims on X and Wikipedia, which are the sources of many large language models (LLMs). All data is available on our GitHub.
The Russian website ecosystem Pravda (“truth” in Russian) is related to the Crimea-based IT company TigerWeb. Exposed in February 2024 by the French watchdog Viginum, it mingles several hundred news aggregators that pass on content from Russian news sources, social media and Telegram channels. Since 2022, the network has been targeting Ukrainian and Western audiences. In our first investigation with DFRLab, we revealed that the network dramatically expanded in the leadup to the 2024 European parliamentary elections. New domains have been launched in the European Union and in African-countries, especially during election periods, in official and minority languages. In the fall of 2024 and in early 2025, the network utilised 140 subdomains targeting more than eighty-three countries.
Using Wikipedia’s API, we found that forty-four versions of the encyclopedia featured more than 1,900 Pravda network hyperlinks in many languages. Russian-language Wikipedia is the most involved, with 922 Pravda network-related entries. The Ukrainian version is also affected, with 580 articles referencing Pravda websites as sources, especially in topics related to the conflict with Russia. These findings are concerning, considering that LLMs such as Gemini, Copilot, Perplexity or ChatGPT use Wikipedia as a primary source. None of them gave warnings or redirected to other sources when we asked them about Pravda network-related content and reported unverified claims. As reported by the American Sunlight Project in February 2025, the content hosted on the news-pravda website could also potentially be AI-generated.
To estimate the influence of the Pravda network on X, we analysed 153 Community Notes referencing websites from the ecosystem to give context on disinformation. More than half of them (57%) were written in English. These 153 notes were produced over the course of 3 years. In contrast, in just 3 months of data collection, using our monitoring tool CrossOver, we gathered 2,018 tweets promoting news-pravda[.]com. This highlights that the Community Notes mechanism was only able to annotate a small fraction of “Pravda” propaganda and disinformation content spread on X.
Among annotated tweets, Ukraine-related disinformation was the most-recurring theme. Most of the Community Notes identify Pravda-related content as “fake”, some of them explicitly highlighting “Russian propaganda” and providing evidence such as WHOIS domain registration data and credible external sources.
Adequate measures need to be taken by social media platforms and by the Wikimedia Foundation to raise awareness about AI-generated articles and to make sure that their networks are not used to spread disinformation online.
Check First is a leading Finnish software and methodologies company, spearheading adversarial research techniques. We believe that everyone should be able to understand how and why content is presented to them. We advocate for online clarity and accountability, building solutions to attain this goal. Partnering with leading institutions, regulators, NGOs and educators, we aim at curbing the spread of disinformation and foreign influence manipulations.
Our story