We Tracked the Trackers: Who’s Behind Russia’s TaNM Doxing Channel? An Interview with the OSINT Team

An open-source intelligence (OSINT) unit, The Unintelligence Agency (TUA), @UnintelAgency on X, has granted UNITED24 Media behind-the-scenes access to their investigation into exposing the administrators of one of the most prolific pro-Russian Telegram channels: “TrackANaziMerc” (TaNM).

TaNM “will 100% dig up anything ‘they’ can on you, I hope you’re prepared,” the OSINT team warned when preparing this article. 

TaNM has been aggressively pushing disinformation about Russia’s full-scale invasion of Ukraine since 2022. Its core mission is to dox  foreign nationals working in support of Ukraine, mocking and intimidating them, and whenever they get the chance, celebrating their deaths. 

Russia’s “Nazi” narrative is central to its war propaganda. The channel’s name suggests a mission to hunt down so-called “Nazi mercenaries”—foreigners fighting for Ukraine and resisting Russian aggression.

When hearing about the TUA’s expose on the group, one of the TaNM administrators wrote on X “Nazi sleuths are spending #Yurop-ean  tax payers' money to ‘identify’ people,” a rather ironic comment, as TaNM do exactly that—identify people. 

Many suspect that the Russian Security Services (FSB) are behind the channel, but not everything is as it seems. In fact, the information obtained by the OSINT group reveals—sometimes rather humorous—profiles of the European-wide TaNM group administrators. 

Exposing these individuals for what they truly are, and not the lies and fanciful personas that they've created for themselves, strips them of whatever credibility they may think they have. These aren't geopolitical experts, intel analysts, or experts on foreign affairs. They are little more than delusional LARPers and deranged individuals seeking validation online.

Anonymous “B”

The Unintelligence Agency (TUA)

We interviewed members of The Unintelligence Agency, who requested anonymity due to privacy concerns. Their insights—labeled Anonymous A, B, and C—offer a rare look into the minds behind TaNM and the wider disinformation ecosystem they operate in.

But first, here’s what the OSINT team uncovered about TaNM’s ties to Russian media and the people who run the channel.

TaNM’s connections to Russian state media and political assets

The TaNM channel grew exponentially in August 2023 after various other pro-Russian platforms and figures amplified it. Among them are Nikolay Valuev, a Russian politician and former heavyweight boxer, and Vladimir Solovyov, one of the Kremlin’s most infamous TV propagandists.

Rybar, owned by Mikhail Zvinchuk and Denis Shchukin, is one of several media channels that amplify TaNMs' content. Shchukin, a computer programmer with a prior cybercrime charge, renounced his German citizenship in 2021 in favor of a Russian passport, according to reports. Zvinchuk is a former press officer with Russia’s Defense Ministry. Both men have ties to the Internet Research Agency, the Kremlin-linked troll farm once associated with the Wagner Group, the OSINT group says.

TaNM’s reach is further amplified by UKR Leaks, a pro-Russian outlet operated by Vasily Prozorov, a former officer of Ukraine’s Security Service (SBU) and a known defector. Prozorov, who is currently wanted by Ukrainian authorities, has openly admitted to leaking sensitive information to Russian intelligence beginning in 2014, citing ideological motives. In April 2024, Prozorov was targeted in a car bomb attack in Moscow.

Having lost the honor of an officer due to drunkenness, Prozorov decided to trade his conscience and military oath, finding ‘worthy’ people in the Federal Security Service of the Russian Federation.

Ukrainian Secret Service (SBU)

TaNM has worked in coordination with Russian state media outlets, including Zvezda, which is owned by the Russian Defense Ministry, TUA reports. Other pro-Kremlin platforms, such as Komsomolskaya Pravda, War Gonzo, and so-called “war reporters” like Alexander Simonov, have also collaborated with the channel, amplifying its campaigns of doxxing, harassment, and targeted intimidation.

Another is Dmitry Astrakhan, a prominent mouthpiece for the so-called “Donetsk People’s Republic” (DNR). Now a war correspondent for RT Russia, Astrakhan began his career by “trolling” on social media. He later styled himself as the editor-in-chief of Pravda DNR—a propaganda outlet where, according to Evocation , the entire editorial board consisted of just one person: Astrakhan himself.

Who are the admins of the TrackANaziMerc group?

Daria Khaltourina

Daria Khaltourina, posting under her alias “Ekaterina II,” is the owner of TaNM and their “de facto ring leader,” who has close connections to Russia. According to her social media, she is the “Head of Department at Federal Research Institute for Health Organization and Informatization of the Ministry of Health of the Russian Federation.”

When Russia’s full-scale invasion of Ukraine began, she posted on Facebook, “I condemn the war, I do not approve.” However, since then, as the owner of TaNM, she has consistently repeated pro-Kremlin narratives, claiming that civilians in the Bucha massacre  were killed by Ukrainians and that a 1930s Moscow-made famine and genocide—Holodomor—is a “propaganda lie created by Ukrainian nazis.”

We (TaNM) frame, expose mercs, make them cry and shiver all their lives.

Daria Khaltourina

Khaltourina is a founding member and board member of the International Longevity Alliance and Chair of the Board of the Russian Council for Public Health and Demography. In recent years, the Kremlin has been “crazy about eternal life,” making millions of dollars from state funds through anti-aging and genetic projects while promoting several “bizarre” ideas and conspiracies.

Virgil Hesse

“Love him or hate him, the man is interesting and boring at the same time,” wrote an Encyclopedia Dramatica user about Virgil Hesse, an Australian, likely from St. Kilda, Melbourne. One of the most active TaNM admins, Hesse has a long history of online trolling under aliases like “Lesleyblood” and now “Digitalfolklore.”

Once called a “bastion of ridiculousness” and “serial fantasist,” Hesse now mostly posts screenshots of interviews with Ukrainian POWs. For over 15 years, he’s collected, archived, and spread content online. The Unintelligence Agency (TUA) believes "Virgil Hesse" is a nom de plume .

“He's (ironically) a privacy advocate…and he's writing to the Australian government, so it seems in character he wouldn't use his real name when The Man is out to get him,” TUA said. In the early 2000s, as Lesleyblood, he regularly engaged in chaotic online arguments, which escalated and "turned into these bizarre back-and-forths” and led to mocking videos and leaked recordings of him. 

Offline, he’s been known to lodge “endless complaints with his local city council for a variety of banal issues,” like off-leash dog zones and bin removal. TUA found footage and documents of these efforts, along with Hesse’s submissions to Australian government inquiries on crypto and surveillance laws.

He claims to have “high-end education” but also says he “never went to high school or brainwashing camps.” On X, he once told Elon Musk he’d built a “bespoke, handmade... better than yours” version of Grok.

Though UA describes him as more of an archiver, Hesse likely sees himself as a hacker. He’s compiled an enormous collection of leaks, drone videos, and files tied to WikiLeaks, Anonymous, the war in Ukraine, and ISIS. He’s also filmed and posted drone footage from Melbourne and discussed drone-making in the TaNM chats.

TUA says Hesse’s accounts follow—and are followed by—Adam Bennett, aka “Lorax” CEO of Australian cybersecurity firm Red Piranha. Bennett once ran the Anonymous Australia Twitter and in 2016 received a suspended sentence for hacking government sites.Hesse is an active poster in “Beregini,” a Telegram group that brands itself as Ukrainian hacktivists, but is actually based in St. Petersburg. The group has pushed fake Ukrainian intel and taken credit for leaks.

As “Digitalfolklore,” Hesse also leaked a phone call between the FBI and Scotland Yard discussing LulzSec—a hacking group behind attacks on PlayStation Network and the CIA site. The FBI later confirmed Anonymous accessed an email containing the call code, raising further suspicions of Hesse’s links to the group. TUA adds he may have known people in Julian Assange’s  inner circle.

Nicolas Cinquini

Cinquini is a former French lieutenant detective and intelligence officer, dismissed from duty after his support for the yellow vest  protests in France. 

On social media, Cinquini portrays an intriguing, multifaceted personality, much like Hesse. Sharing Russian propaganda, videos of cats and dogs, to even arguing with Grok, Elon Musk's AI chatbot. 

Cinquini disseminates very typical pro-Kremlin narratives, promotes conspiracy theories, and spreads misinformation about Ukraine. He claims to be the intelligence lead for TaNM and has been suspected of leaking information about French volunteers, which Russia used to make false claims about their supposed deaths.

He didn’t even try to hide – his ego matched his idiocy. Once sworn to protect France, now cheers terrorists.

The Unintelligence Agency

On May 18, 2025, he was interviewed by Russian state-media Rossiya 1 where he discussed French fighters serving in the Ukrainian army against Russian aggression. Cinquini, during his interview, furthered his pro-Kremlin narrative and told Russian media that the Frenchmen TrackANaziMerc have identified, “competed with each other in fascism, and won their place in the cast through hard work.” He then went on to dox five servicemen throughout the interview. 

There are several more admins of the TaNM channel, some have maintained an anonymous identity. 

Other admins behind the channel

Luico Festa says he is Italian-Croatian and claims to be affiliated with Camorra, an Italian Mafia-type criminal organization. He has openly threatened previous TaNM members, claiming that within Camorra, his purpose is extortion, drug dealing, and money laundering. Following the TUA’s leak, Festa deleted both his Facebook and VKontakte  pages.

“BulgARYAN”—“For someone in a group that supposedly hates Nazis they decided to spell their username with the word "Aryan" in all caps instead of the more usual -rian suffix” TUA said. 

Mikhail Yevgenevich Rapoport is a Russian national who has left several reviews about parks and businesses on Google Maps. He is thought to live near Kudrovo, a notorious town where Russia's largest residential complex, known as the “human anthill,” is located.

“Nataliahunter”—"Natalia is a common nickname Russian soldiers use when referring to Ukrainian women, which makes this individual, who claims to be in the Russian army, particularly disturbing,” TUA said. 

“Drexy baba” established a reputation of sorts as someone who collected and documented rare combat footage from the war in Afghanistan, always with a pro-Taliban angle, the OSINT team said.

It's cliché that the KGB recruited 'winners' who were really losers—but these guys aren't even that. The technical term is ‘useful idiot

Anonymous A

The Unintelligence Agency

Interviewing The Unintelligence Agency

Why do you want to expose the admins from TaNM?

Anonymous A: Combating channels like TaNM is a stop-gap, a temporary solution. For every group and individual we can ID, there will always be more. What we really need is a change in how we interact with social media, or rather, how social media interacts with us.

This is not to say that this will necessarily stop them from continuing what they're doing, but the truth matters and does have an impact.

Vote for people who don’t benefit from disinformation. Demand that whoever is in power acts to put an end to its prevalence and popularity on social media. Start petitions calling for action. Organise protests. Don’t ask—demand!

If we do nothing, then we will rapidly find ourselves in an oligarchy of those with the means to run massive disinformation campaigns that will be bowing down to dictators all over the world. 

Why is OSINT important in the modern digital world?

Anonymous A: Social media platforms have become central to how the world consumes news, yet they continue to allow, amplify, and even financially reward those who spread disinformation. 

By identifying people like the TaNM admins, we help map the architecture of propaganda networks, removing the mystery of where disinformation originates. More often than not, they aren’t listening to a renowned expert or someone with lived experiences in a subject, but a charlatan and a fraud. 

Anonymous C: Russia is using digital media a force multiplier for its soft power and propaganda apparatus, and Western governments haven't, by and large, figured out how to counter it effectively yet. Nor have they put sufficient resources into it. But Russia, very cheaply, can produce these outsize effects, largely aimed at shaping narratives, disrupting public discourse, and planting the seeds of doubt.

Their big picture goal is to cut Ukraine off from its allies and its support network. Russia goes about this by shaping public opinion in the West. Or in the case of the "Ukraine is overrun by Nazis" narrative, trying to give Westerners the impression that Ukraine is simply unworthy of support. 

What do you believe is TaNM’s main goal?

Anonymous A: After more than two years, it’s evident they’ve failed to stop or even slow the number of people choosing to defend freedom and democracy in Ukraine. Today, TaNM seems more like a small online community of socially isolated individuals who’ve found validation in a space that reinforces their fringe views. Their focus on doxxing and harassment appears less about impact and more about maintaining engagement with like-minded followers, creating a feedback loop of radicalisation.

The real danger isn’t their investigative abilities—often resembling little more than basic social media searches—but the fact that they’ve become a nexus for disinformation and extremism.

Anonymous B: While they claim to be documenting and tracking the presence of "foreign nazi mercenaries" in Ukraine, the true purpose of their channel is to sow doubt and fear. The doxxing serves as a form of intimidation, with people on their chat openly making violent threats and discussing ways to harass volunteers and their family members. Furthermore, there's a concerted effort to promote paranoia and suspicion amongst volunteers. 

Is there a common theme amongst admins from pro-Russian channels?

Anonymous C: Essentially, every Westerner cheering Russia that we've come across has been more or less the same archetype–an overinflated sense of self-worth with a lack of any real accomplishments, plus an inability to accept any responsibility for personal failings. 

Almost without fail, you can guarantee that they're online lying about accomplishments they never had, that they've all failed in their lives in some way, shape, or form, and all feel like something more was owed to them, but that somehow they were thwarted by the system. They all, therefore, resent the West, and at some level fantasize about how well they'd do if society were shaken up and whatever bit of the system it is they blame for not having succeeded were destroyed.

This archetype must be extremely fertile soil for the Russians because it keeps repeating in the people we come across.

Fundraiser For Peaceful Nights

$1,500,000 towards 10 Ukrainian AI-Controlled Turrets.

Donate