How Fake Websites Trap Russians Seeking to Fight Alongside Ukraine

The Freedom Of Russia Legion is a Ukrainian-based paramilitary unit of Russian citizens, that opposes the Russian regime of Vladimir Putin and its invasion of Ukraine. 

In March 2023, Russia’s Supreme Court designated the Freedom of Russia Legion as a terrorist organization. Anyone charged under the article on  “participation in a terrorist organization,” faces 10 years to 20 years in a penal colony.

“Funny, the ‘nonexistent’ Legion has been declared a terrorist organization in Russia!” the Legion wrote on Telegram in response to the Supreme Court decision. “A terrorist state shifts blame and stubbornly fights against any expression of free thought… By the way, in the Legion, we long ago recognized the Supreme Court of the Russian Federation as a terrorist organization—and we’ll gladly ‘de-terrorize’ it!”

Netherlands-based web developer, Artem Tamoyan, has found several websites posing as the Legion’s official pages harvesting data from its users. He believes this to be Russia’s special services working to entrap anyone accessing these sites, ultimately sentencing them. 

Moscow’s 2nd Western District Military Court sentenced 50-year-old opposition activist Yevgeny Mischenko to 12 years in a penal colony on October 9, 2024, according to reports. Mischenko said that he “tried to contact this organization”, but insisted his “participation” in the Legion’s activities was via chat only. 

A few weeks before, Russian civilians Fedor Konovalov and Ivan Radchenko each received 11-year penal colony terms for posting leaflets supporting the “Freedom of Russia”. 

Ivan Kolosov, a Moscow Cossack Cadet Corps graduate and paramedic, was also sentenced to 9 years in a penal colony for allegedly contacting the Legion. 

How can you verify the Freedom Of Russia Legion official page?

The Legion has just one official website. In the contacts section, there are various methods to contact them for membership inquiries, such as Telegram, Whatsapp, and a phone number.

If the website or the Telegram bot username differs, even by one character—it's fake. 

The clone sites look exactly like the real one, and in many cases, the fake website has almost exactly the same URL which is hard to distinguish. The phishing sites  don’t seek any financial details and Tamoyan says that the sole purpose of these sites is to collect data on visitors, functioning as what he describes as a “honeypot” for unsuspecting users.

“It’s an ideal setup for Russian special services to generate criminal cases,” said Tamoyan. “People, perhaps earnestly, complete these forms, submit their details, and an FSB officer ends up with a ready-made dossier and an open-and-shut criminal case.”

Arseny Turbin, a 16-year-old schoolboy and one of Russia’s youngest political prisoners, was sentenced to 5 years for posting leaflets allegedly for the Legion after he spoke with @Legionrf_bot—a fake account. 

Arseny applied to have his sentence overturned but was only granted a 24-day reduction. He denied all the charges against him and said that he only researched the Legion, that he never applied and, therefore, committed no crime. 

His mother Irina said that no lawyer was present for his interrogation and she believes that the FSB added a confession of guilt to his interrogation transcript, she maintains his innocence. 

Arseny had a violent cellmate who attacked him, hit him on the head, and threatened him, reports said.

The Honeypot

Tamoyan is working to have these fake sites shut down as he believes that citizens of Russia should be able to oppose the Kremlins regime.

Phishing is universally illegal, even in Russia, this allows him to report them to providers and registrars, and have them shut down for “ToS breaches ”.

“My personal view is that those prepared to bear arms and resist the Putin regime deserve respect,” told reporters. “Even if it’s merely an intent, not necessarily acted upon. So, I figured it’d make sense to hamper FSB efforts to jail these people.”

It’s difficult to confirm Russia’s security services involvement, though Tomoyan has raised some key points that lead to this conclusion. 

Yandex is Russia’s top search engine over Google. Honeypots are featured mainly on Yandex search listings without any search history. Tamoyan spoke with many ex-Yandex employees who claim that Yandex likely manually boosted these sites to the top. 

Once one honeypot is taken down, almost immediately another appears. “It could be an individual or a group, but someone is actively pursuing this,” he said. “The Russian intelligence services are the only ones with a vested interest in this.”

He reported honeypots to Cloudflare's admin team, but one response indicated that their hosting provider was Stark Industries, a company linked to pro-Russian hacker groups.

Investigations found that Stark Industries frequently targets Europe’s digital infrastructure and since the full-scale invasion, has made money from it. 

“Much is already known about these people,” Tamoyan notes. “Even specific names tied directly to Russian government agencies, likely GRU or FSB, are known.”

Tomoyan has worked to keep these phishing sites off the top of the search engine's rankings, which he hopes has hampered efforts to entrap Russian civilians fighting the Russian regime. 

“It’s worth remembering that an FSB agent can always slide into DMs with provocations, so staying alert is key,” Tamoyan said. “Failing that, there may be no safeguarding people.”

Russia’s judicial system

Criminalizing dissent with terrorism and extremism charges is a tactic used by Russian authorities to continue their litany of war crimes, control the regime's narrative, and continue their justification for Russia’s illegal invasion. 

Political censorship is a long-standing Russian tradition, but in recent years Russia's suppression of freedom of speech is more apparent.

There are currently over 1000 people accused on various charges from treason to terrorism for supporting Ukraine in some format, with almost 300 people already in pre-trial detention centers or penal colonies.

The UN Special Rapporteur on Counter-terrorism and human rights defined terrorism-related offenses, in which a key element must involve lethal or serious physical violence or hostage-taking. 

Amnesty International raised concerns about the “qualification of ‘terrorism” as some of these acts did not pose a threat of serious injury, raising concerns that Russian authorities are abusing these charges.

Under international human rights law, as well as Russia’s Constitution, everyone has the right to hold opinions without interference and to peacefully exercise their freedom of expression, including seeking, receiving, and imparting information and ideas of all kinds.

When being charged with terrorism in Russia, rules within the courts change, and safeguarding for court processes is effectively either removed or drastically reduced. 

All cases are to be tried in military courts, often closed to the public and lawyers are often prohibited from disclosing any details or accusations of evidence. However, those who are found to contact who they think is the Freedom Of Russia Legion are exposed to potentially long prison sentences. This does not qualify as terrorism.