Active Measures

southfront_org: Kremlin disinfo production unit

Published: 2016 January 20

The work of southfront.org was featured in @EUvsDisinfo Review No. 10. Southfront doesn't just distribute or redistribute disinfo, it is a production center for Kremlin disinfo. The zashifrovka agenturno-operativnogo meropriyatiya is pretty good with this one, at least as regards the primary southfront.org domain. Quite professional in a way one would expect from an intelligence officer and/or criminal. Not good enough to completely hide their tracks, but better than what many others do.

The Domain
Southfront.org registered their domain name on 30 April 2015, and have taken care to hide their identity behind one or another domain whois proxy services ever since. The name was registered through reg.ru.

The Host
On or about 07 May 2015, DNS service for southfront.org was assigned to offshore hosting and DDoS mitigation provider koddos.com. "Offshore" in this case means Koddos servers are in the Netherlands.

As is the case with their client Southfront, Koddos makes considerable effort to hide who it is exactly one might be doing business with. Koddos is an alias of Esecurity S.A. and claim to have an office in Hong Kong. Person or persons operating as Koddos and ESecurity are also d/b/a Crypto-Trade, and the three names turn up consistently amid allegations of poor service and fraud, particularly as relates to bitcoin activities. In any event, Koddos is happy to accept payment transfers from Russian banks if that is what Southfront needs to do. While not entirely clear that Koddos is a Russian operation, signs point to yes.

The Other Domain
On 30 April 2015, at reg.ru, another domain name was registered. Southfront.net. Presumably held in reserve in the event something unfortunate happens to southfront.org, southfront.net was not registered to a whois proxy service, because who would examine the whois record of a domain that is not in use? Except for me. I do things like that. The southfront.net domain links the Southfront project to Chuguleva, Alena, claiming an address in Omsk.

The Product
Southfront produces, publishes, and/or aggregates analytical video and text analysis in English and clearly in line with worldview of the Kremlin. Some/most material is developed in-house, with additional items being aggregated from other sources and translated for Southfront. The videos are narrated by a woman with a decidedly British accent, though it is not clear who she may be.

The Personnel
The videos, and most of the text products, while branded as southfront.org work, are generally posted without by-lines or other credit save to mention the occasional author or translator of the work. The following names were found in relation southfront.org content. A few are real, some may be pseudonyms. What they reveal is a strong Balkan involvement in Southfront.

• Mario Andrijasevic
• Marko Milicevicic
• Stevo Marjanović
• Viktor Stoilov
• Joco Mijanic
• Peto Lucem
• Borislav
• Karin
• Elmo Goof
• J.Hawk

Additional information has turned up revealing more about the Russian staff of Southfront and their association with the ruling United Russia party and the President's Administration. To begin, the southfront.net domain, while currently held by Chuguleva, was first registered by Svetlana Olifenko (Олифенко Cветлана). The two whois records share a common email and phone number, but Olifenko claims an address in Simferopol. Olifenko was active on Facebook promoting the Russian side in East Ukraine until July of 2015. It seems likely she is partnered with Giuliano Elia, a Communist from northern Italy who at a minimum is very active in supporting the Russia side, and both Elia and Olifenko may actually be in Donbas, serving in combat and information roles respectively, though the last point is somewhat speculative.

Alena Chugleva (Чугулева Алена Анатольевна), the current holder of the southfront.net domain, is Secretary of the Omsk-based "Organizing Committee of Patriotism in Journalism" (patriot-in.ru). The Organizing Committee is partnered with Putin's United Russia party and the President's Administration. In addition, the bios of the other members of the Organizing Committee make plain their relationship with state security, military, and intelligence agencies - note in particular Volokitin, Igor Yurievich (Волокитин Игорь Юрьевич):

Оргкомитет конкурса:

Поминов Дмитрий Юрьевич – председатель оргкомитета, президент «АНО «ИАЦ «Отечество XXI век», член «Кадрового резерва – Профессиональной команды страны» («кадровый резерв Путина»).
Адрес для писем: pominov@patriot-in.ru

Гафнер Денис Яколвевич – исполнительный директор оргкомитета, исполнительный директор «АНО «ИАЦ «Отечество XXI век».
Адрес для писем: hafner@patriot-in.ru

Волокитин Игорь Юрьевич – член оргкомитета, соучредитель «АНО «ИАЦ «Отечество XXI век», президент “Группы ВИЮР”, вице-президент Федерации армейского рукопашного боя России, вице-президент фонда ветеранов сотрудников подразделений специального назначения и спецслужб органов государственной безопасности «Вымпел-Гарант».

Чугулева Алена Анатольевна, секретарь оргкомитета.
Адрес для писем: info@patriot-in.ru
Тел/факс: 8-800-100-0774

Контакты:
107076, г. Москва, Колодезный пер., д. 14, оргкомитет конкурса патриотической журналистики «ОТЕЧЕСТВО»
Телефон: 8-800-100-0774, e-mail: info@patriot-in.ru
Source: http://yojo.ru/?p=3483

The Partners
Southfront counts 30 different entities as part of their "Front", most of which are Facebook groups in various languages. Their main partners are

• The Saker (formerly d/b/a vinyardsaker)
• Global Research
• Veterans Today
• Al-Masdar News
• SOTT
• ИН4С

Note that the person d/b/a The Saker is a resident of Florida, and claims to be a former "NATO intelligence analyst" which probably means he's Bulgarian or Hungarian. By his own account he is a resident alien, not a naturalized citizen.

The Fundraising
One thing about which there is little doubt is that Southfront is in desperate need of funds. They claim they need $5,000/month to run at capacity. They have raised something like $1,400 so far this month. Donations are made via Paypal (in Russian), Western Union, Tinypass, and Bitcoin. One suspects that funding from the Kremlin has dried up on account of the price of oil.

Addendum

southfront.org whois record sample

Domain Name: SOUTHFRONT.ORG
Domain ID: D176142767-LROR
WHOIS Server: whois.reg.com
Referral URL: http://www.reg.com
Updated Date: 2015-06-30T03:48:33Z
Creation Date: 2015-04-30T11:38:20Z
Registry Expiry Date: 2016-04-30T11:38:20Z
Sponsoring Registrar: Registrar of Domain Names REG.RU LLC
Sponsoring Registrar IANA ID: 1606
Domain Status: clientTransferProhibited https://www.icann.org/epp#clientTransferProhibited
Registrant ID: PP-SP-001
Registrant Name: Domain Admin
Registrant Organization: Privacy Protection Service INC d/b/a PrivacyProtect.org
Registrant Street: C/O ID#10760, PO Box 16
Registrant Street: Note - Visit PrivacyProtect.org
Registrant Street: to contact the domain owner/operator
Registrant City: Nobby Beach
Registrant State/Province: Queensland
Registrant Postal Code: QLD 4218
Registrant Country: AU
Registrant Phone: +45.36946676
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: contact@privacyprotect.org
Admin ID: PP-SP-001
Admin Name: Domain Admin
Admin Organization: Privacy Protection Service INC d/b/a PrivacyProtect.org
Admin Street: C/O ID#10760, PO Box 16
Admin Street: Note - Visit PrivacyProtect.org
Admin Street: to contact the domain owner/operator
Admin City: Nobby Beach
Admin State/Province: Queensland
Admin Postal Code: QLD 4218
Admin Country: AU
Admin Phone: +45.36946676
Admin Phone Ext:
Admin Fax:
Admin Fax Ext:
Admin Email: contact@privacyprotect.org
Tech ID: PP-SP-001
Tech Name: Domain Admin
Tech Organization: Privacy Protection Service INC d/b/a PrivacyProtect.org
Tech Street: C/O ID#10760, PO Box 16
Tech Street: Note - Visit PrivacyProtect.org
Tech Street: to contact the domain owner/operator
Tech City: Nobby Beach
Tech State/Province: Queensland
Tech Postal Code: QLD 4218
Tech Country: AU
Tech Phone: +45.36946676
Tech Phone Ext:
Tech Fax:
Tech Fax Ext:
Tech Email: contact@privacyprotect.org
Name Server: NS7.KODDOS.COM
Name Server: NS8.KODDOS.COM

southfront.net whois record sample 1

Domain name: southfront.net
Domain idn name: southfront.net
Status: clientTransferProhibited http://www.icann.org/epp#clientTransferProhibited
Registry Domain ID:
Registrar WHOIS Server: whois.reg.com
Registrar URL: https://www.reg.com/
Registrar URL: https://www.reg.ru/
Registrar URL: https://www.reg.ua/
Updated Date: 2015-10-17
Creation Date: 2015-04-30T18:13:32Z
Registrar Registration Expiration Date: 2016-04-30
Registrar: Registrar of domain names REG.RU LLC
Registrar IANA ID: 1606
Registrar Abuse Contact Email: abuse@reg.ru
Registrar Abuse Contact Phone: +7.4955801111
Registry Registrant ID:
Registrant Name: Alena Chuguleva
Registrant Organization: Private Person
Registrant Street:  50 Let Profsoyuzov ugol Mamina-Sibiryaka, 114/20, kv.222
Registrant City: Omsk
Registrant State/Province: Omskaya oblast
Registrant Postal Code: 644000
Registrant Country: RU
Registrant Phone: +79781128460
Registrant Phone Ext:
Registrant Fax: 
Registrant Fax Ext:
Registrant Email: aeoa34@yandex.ru
Registry Admin ID:
Admin Name: Alena Chuguleva
Admin Organization: Private Person
Admin Street:  50 Let Profsoyuzov ugol Mamina-Sibiryaka, 114/20, kv.222
Admin City: Omsk
Admin State/Province: Omskaya oblast
Admin Postal Code: 644000
Admin Country: RU
Admin Phone: +79781128460
Admin Phone Ext:
Admin Fax: 
Admin Fax Ext:
Admin Email: aeoa34@yandex.ru
Registry Tech ID:
Tech Name: Alena Chuguleva
Tech Organization: Private Person
Tech Street:  50 Let Profsoyuzov ugol Mamina-Sibiryaka, 114/20, kv.222
Tech City: Omsk
Tech State/Province: Omskaya oblast
Tech Postal Code: 644000
Tech Country: RU
Tech Phone: +79781128460
Tech Phone Ext:
Tech Fax: 
Tech Fax Ext:
Tech Email: aeoa34@yandex.ru
Name Server: ns1.reg.ru 
Name Server: ns2.reg.ru

southfront.net whois record sample 2

Domain name: southfront.net
Domain idn name: southfront.net
Status: clientTransferProhibited http://www.icann.org/epp#clientTransferProhibited
Registry Domain ID:
Registrar WHOIS Server: whois.reg.ru
Registrar URL: https://www.reg.com/
Registrar URL: https://www.reg.ru/
Registrar URL: https://www.reg.ua/
Updated Date: 2015-04-30
Creation Date: 2015-04-30T18:13:32Z
Registrar Registration Expiration Date: 2016-04-30
Registrar: Domain names registrar REG.RU LLC
Registrar IANA ID: 1606
Registrar Abuse Contact Email: abuse@reg.ru
Registrar Abuse Contact Phone: +7.4955801111
Registry Registrant ID:
Registrant Name: Svetlana Olifenko
Registrant Organization: Private Person
Registrant Street: Z. Rukhadze 27/21 #30
Registrant City: Simferopol
Registrant State/Province: Krim
Registrant Postal Code: 95000
Registrant Country: UA
Registrant Phone: +79781128460
Registrant Phone Ext:
Registrant Fax: 
Registrant Fax Ext:
Registrant Email: aeoa34@yandex.ru
Registry Admin ID:
Admin Name: Svetlana Olifenko
Admin Organization: Private Person
Admin Street: Z. Rukhadze 27/21 #30
Admin City: Simferopol
Admin State/Province: Krim
Admin Postal Code: 95000
Admin Country: UA
Admin Phone: +79781128460
Admin Phone Ext:
Admin Fax: 
Admin Fax Ext:
Admin Email: aeoa34@yandex.ru
Registry Tech ID:
Tech Name: Svetlana Olifenko
Tech Organization: Private Person
Tech Street: Z. Rukhadze 27/21 #30
Tech City: Simferopol
Tech State/Province: Krim
Tech Postal Code: 95000
Tech Country: UA
Tech Phone: +79781128460
Tech Phone Ext:
Tech Fax: 
Tech Fax Ext:
Tech Email: aeoa34@yandex.ru
Name Server: ns1.reg.ru 
Name Server: ns2.reg.ru