Yandex was suspected of promoting the “trap sites” of the FSB to collect data on those who want to fight on the APU side. Do special services use such techniques?

Civil activists, developers Artem Tshoyan and Alexander Litreev suggested that several sites similar to the sites of the Legion “Freedom of Russia” and “Russian Volunteer Corps” (RDK) are actually “traps” of the FSB.

Due to the fact that these sites were shown at the top of the issuance of Yandex, were not shown in the search for Google and at the same time collected the data of those who potentially like to join in Russia, recognized in Russia with terrorist, Taxions and Litreev came to the conclusion that “ Yandex ”deliberately advertises fake sites that can be associated with Russian security forces. ITSHNIKS accused the company of cooperation with the FSB and assistance in the factory of criminal cases of extremism and terrorism against Russians.

Currently, fake sites that have discovered there are unavailable, however, cache versions are still on the first line of the issuance of Yandex, Medusa was convinced.

View screenshots

Fake sites differed from the present in one letter in the domain. This is a typical reception of a phishing attack (as a rule, scammers use it to steal money or person data). As Litreev noted (he studied the sites before they were disconnected), unlike the present, they were not indicated for donations. But both sites had a form for collecting data - about the field, age, contacts and location of the respondent. It was assumed that the user himself can send information through these forms.

The registrar (a company providing hosting and domain name) turned off the sites after a complaint of Litreev. Freedom of Russia confirmed that Yandex showed a fake site, and not the Mirror of the present.

However, the fake site of the RDK still has Bing (search engine Microsoft) and Duckduckgo (an independent search engine, the creator of which in March 2022 promised to lower the sites related to Russian epi - however, did not specify how) Medusa made sure Medusa made sure .

View screenshots

Unlike Yandex, these search engines give out both the real website of the RDK and the fake, and both are not on the first line of extradition. Yandex shows only a fake site - but the first line.

Short answer: We do not know.

Very often it is impossible to reliably say exactly who created or supports some kind of site. Some hosting providers and domain name registrars allow you to hide this information or, for example, indicate random addresses and phone numbers when registering hosting. Therefore, even if such data is indicated, this does not mean that the site is worth the one who is determined by them. Moreover, most often providers allow you to hide all contact details. During the investigations of cybercressions, the security forces to establish a person’s personality can send requests for a court order directly to the provider - and even this does not always help in the disclosure.

What can be said to be reliable is that the fake site of Freedom of Russia was registered in December 2023, and RDK in August of the same year. When registering domains, all data were hidden. The American company Namecheap was the registrar and hoster.

And we also know that the special services of different countries really use the method of “fishing for live bait”, or “honey trap” (“Hanipot” - from the English Honey Pot, “pot with honey”; this is how fake pages “Freedom of Russia” and RDK Artem Klaysuyan and Alexander Litreev called in their posts to detain criminals or those whom they consider objectionable in political or other motives. Therefore, the situation in which the FSB would create a fake site and collect the data of those who potentially like to join the Armed Forces of Ukraine, consisting of citizens of the Russian Federation, is quite possible.

There are many examples of this, both in authoritarian and in completely democratic countries (with strong special services).

For example, in Belarus at the beginning of 2024, the KGB created many fake sites to catch the left citizens. In particular, such portals were pretended by the opposition sites. On one of them it was possible to leave an application for a passport of New Belarus , the Belarusian Radio Liberty service said . The project turned out to be “successful”: the Investigative Committee of Belarus opened a criminal case against more than 100 representatives of the “people's embassies” and simply Belarusians abroad - they supposedly created an extremist community. And the propagandist Igor Tour in March showed a record of conversations with those who allegedly submitted documents for receiving documents. Also, phishing letters about such passports came to activists, wrote the Mirror.

The Belarusian Cyber ​​Partizans, the Belorpol organization and other activists over the past years have also repeatedly noticed that copies of opposition bots that collect the data of the “disagreed” have appeared in the telegram. It is assumed that special services are behind this project.

The Hanipot is also placed in the West. One of the most famous “traps” of recent years has been the Trojan Shield operation. The FBI and the special services of other countries created an "secure" ANOM messenger. He was widely advertised in circles of cybercriminals, drug materials and underground hacker forums. The messenger was to provide users with confidentiality and protection against messages. In fact, he intercepted messages and handed them to special services. In the framework of Trojan Shield, millions of messages were intercepted. According to the results of the operation in 2021, more than 800 suspects were detained in 16 countries.

Another well -known case of fishing for cybercriminals using a fake site occurred in 2010. The FBI opened the Carder Profit forum dedicated to the carding. Hackers posted ads on the sale and purchase of stolen bank cards. As a result, the FBI has collected information about many criminals not only in the United States, but also in other countries of the world. As a result, 24 people were detained .

The discussion about the legality of the use of "Hanipot" continues. For example, the laws of the United States and EU countries involve the protection of private correspondence from reading by someone outsiders-including special services.

The fact that the FSB creates fake sites to identify “unreliable” was not known earlier. However, Russian special services regularly use the methods of dubious legality. For example, although, according to the law, they need to have some suspicions against a person and the sanction of the court on wiretap, surveillance and other similar actions, the security forces simply use bots to “break through” citizens, collect information and preliminary identification before detention. In particular, such measures were applied to those who wrote “extremist” comments in open chats in Telegram. Such actions of special services can hardly be called legal, but they must always be remembered.

It is also known that security forces use provocations. The most loud - the case of "new greatness" - was arranged in 2018. The provocateur Ruslan Danilov invited a group of young people to create a political movement, which the court later recognized as an extremist community and sentenced the defendants to a long time. Although there was no anonymous recruitment through the site then, and the movement itself would not exist without a provocateur - the essence of the method in the case of fake sites may be similar.

The FSB regularly reports on the disruption of the diversions of the Legion "Freedom of Russia" and the RDK and the detention of their supporters. How exactly the security forces receive information about the impending shares - and whether such shares are being prepared in general (or are these also provocations) is certainly unknown.

We also do not know this either. Like any other search engine, Yandex could answer that the only thing is that the fake site is better optimized for search goals than the real one. This was also indicated by some users of Twitter, who participated in the discussion of the phenomenon revealed by Tamoyan and Litrev.

On the other hand, the RDK and “Freedom of Russia” are included in the list of terrorist organizations banned in Russia, and their sites are blocked by Roskomnadzor. It seemed to be logical that Yandex did not show the sites of such organizations in the issuance. But in the first lines, along with the fake, the search engine gives real telegram channels of organizations. Like the sites of Medusa and Novaya Gazeta Europe, which are blocked in Russia. True, Yandex’s real sites still do not show.

But other (not Russian) search engines show real and fake sites on neighboring lines.

Litreev also noted that VKontakte deleted the collected links to real sites of organizations, but does not delete links to fake resources.

No. Back in 2018, Article 13.40 appeared in the Code of Administrative Offenses, according to which “search engine operators” cannot give users links to prohibited sites. Otherwise, a legal entity will be a fine of 500 to 700 thousand rubles, and with a repeated violation - from one and a half to five million.

We do not undertake to evaluate the justice of such methods (and certainly do not urge you to enter into any armed groups). Moreover, formally, “fishing on live bait”, perhaps, is not even illegal.

But the fact of the discovery of such a loophole is anxious. Today, special services are placing “traps” on potential participants in armed groups, but tomorrow they may be civilian activists and just people of opposition views or readers of independent media, who, in carelessly, will superiminate the “unwanted” organization through the fake site. This is a vicious practice, which in theory threatens a wide range of “disagreed” within the country.

Therefore, whenever you enter with someone in dialogues on politically sensitive topics or transmit your data, be as attentive as possible.

Dada Lindell