Wrote: Etrit Rexhepi
"Lithuania does not plan to appoint Bashkim Zeqiri as consul in Kosovo, squelching efforts to improve relations"
"Former US diplomat Christopher Hill testifies that Hashim Thaçi was a key decision-maker in the Kosovo Liberation Army"
"Kosovo Prosecution freezes assets against Minister Hajdari after self-confrontation with investigations"
“Recent diplomatic tensions between Kosovo and Bangladesh escalate after recognition was denied”
Here are some headlines of news articles about Kosovo. The headlines were found published in Albanian and English. What these contents have in common is that they are not correct.
But where is this content published?
Analyst Shenoll Muharremi, in a Facebook post on Sunday (November 9), announced the spread of fake news that was published in his name during election day. He explained that some dubious media outlets and websites had misinterpreted his public statements, attributing to him statements that he did not make (see here).
In the examples he shared, several sites with foreign domains such as "isna.ir" and "24tv.ua" had published headlines such as:
"Analyst Shenoll Muharremi approves the behavior of the acting Minister of Interior, Xhelal Sveçla"
"Shenoll Muharremi encourages political parties to be behind the closing of the polls"
Hibrid.info has checked the websites of the domains seen in this picture. "isna.ir” is the website of the Iranian students' news agency, while “24tv.ua" is a media outlet based in Ukraine.
After searching the search space within these websites, with the keywords "shenoll muharremi", no results appeared with articles that could report on the analyst in question (see here and here).
Since in Muharrem's post, the photos showed articles from Google search results, hibrid.info continued its research using this search engine.
After searching with the keywords “isna.ir kosovo” and “24tv.ua kosovo”, the results show a series of articles with titles in Albanian and English, reporting on events in our country (see here and here).
If one of the articles that appears in the search results is clicked, within a few seconds the user is redirected first to a page of the original medium, then to a news article that has a different look than the original medium, and finally ends up on a betting page.
These article titles have not been found shared on social media.
So, the research shows that this content is not published on the real websites of the alleged media outlets, but only appears as manipulated results on Google, created by external sites that use the name of foreign media outlets to appear trustworthy, while in reality redirecting users to fake articles and then to betting sites.
By distorting diplomatic, political, security, and electoral developments in and around Kosovo, all of these headlines create a false picture of reality, as each of these claims is the opposite of what actually happened in the events that were reported.
These events include headlines about alleged international tensions (such as those with Lithuania and Bangladesh), the testimony of Ambassador Christopher Hill in The Hague about the structure and leadership of the KLA, security incidents in the north of the country, as well as reports on the high turnout in the second round of local elections in Kosovo. The headlines also address domestic political developments such as Memli Krasniqi being confirmed as the head of the PDK, the measures of the Prosecutor's Office against Minister Hajdari, the actions of the border police in the region, as well as assessments of the political landscape that appears to be stable despite the challenges and tense narratives.
In fact, in an article that falsely reports on the record turnout in the second round of local elections in Kosovo, our country is referred to as “Kosovo and Metohija”. While another that focuses on a false incident in Mitrovica, uses the term “Kosovska Mitrovica”. These two terms are used by Serbia to refer to the territory of the Republic of Kosovo and the city of Mitrovica.
Hibrid.info, through the “urlscan.io” platform, which provides online services for technical analysis of websites, has entered the URLs of some of the above-mentioned articles to verify their activity. The analyses showed that these URLs, once scanned, were immediately redirected to the domains “1wirpm.com” or “rbbcsnn.com”, confirming that the published links did not lead to credible news content.
The analysis shows that “1wirpm.com” and “rbbcsnn.com” are new and potentially suspicious domains that do not have a safety rating from Google Safe Browsing or “urlscan.io”. Both use multiple redirects from the original news pages to other pages, often with suspicious or gambling content, using analytics and protection technologies such as Google Tag Manager, Hotjar and reCAPTCHA. The main IPs are located in Russia and the Marshall Islands through networks such as MFI-AS and CLOUDFLARENET, and communicate with many different IPs and domains in different countries. These characteristics indicate that the sites are not reliable news sources and can be used for fraud, data collection or redirection to suspicious pages.
Although similar practices have been encountered internationally before, hibrid.info was unable to identify the author or group behind these fake articles. There is no clear information on the individuals or organizations that created and distributed this content.
A report published in 2022 by EU DisinfoLab, a European non-governmental organization, had uncovered a Russian-based online influence network called Doppelgänger, which had been operating in Europe since May 2022. This network used copies of authentic media outlets to distribute fake articles, videos, and polls (identified as Russian propaganda). To achieve this, the fraudulent actors had purchased domains similar to those of real media outlets and copied their design, creating an illusion of credibility. The articles were distributed through smart redirects, fake social media profiles and technologies such as Google Tag Manager and Keitaro software, with the aim of manipulating public perception, promoting Russian propaganda on the war in Ukraine and creating fear among European citizens. EU DisinfoLab, in collaboration with Qurium Media Foundation, analyzed these operations using public sources and technical tools, identifying sophisticated strategies of cloning and imitating real media.
In the absence of transparency about authorship, it remains unclear whether this content is part of an organized disinformation campaign with a targeted purpose, or an attempt to generate clicks and traffic through technical fraud. However, the apparent modus operandi, such as media cloning, search result manipulation, automated redirects, and the inclusion of unknown domains with dubious reputations, indicates a certain level of coordination and technical knowledge.
The case of fake articles about Kosovo represents another example of how the global information space can be exploited to produce fabricated narratives, creating confusion, misinformation and distraction for local and international audiences. For this reason, it remains essential for users to verify sources, while institutions and platforms must take steps to identify and neutralize such manipulative practices in real time.