DFRLab, working with Qriton Technologies, Media.am, and Molfar Intelligence Institute, ran a methodology worth stealing: they analyzed 18 Armenian outlets (9 mainstream, 9 pro-Russian) across two matched time windows — the same calendar stretch in 2025 and pre-election 2026 — and used semantic similarity analysis to see whether ostensibly independent pro-Russian sites were pushing near-identical narratives. They layered infrastructure-level analysis on top (hosting, registration, technical fingerprints) to show coordination the outlets themselves were trying to obscure.

The practical takeaway isn't the Armenia finding itself, it's the two-part method: semantic clustering to flag suspiciously aligned messaging across sites that claim no relationship, then infrastructure analysis to confirm or kill that hypothesis with something harder than word choice. That combination travels well beyond election monitoring — it's a solid template any time you suspect a cluster of "independent" outlets are actually one operation wearing different mastheads.

Worth noting if you're also tracking DFRLab's Belarus diaspora piece from a few weeks back: same lab, adjacent Russia-influence beat, different technique. Not a repeat, just a pattern worth having on your radar.

dfrlab.orgHow Russian content sought to influence Armenia's electoral information space

404 Media got hold of a Flock webinar where the company's director of market management walks police through using real-time crime centers — built on Flock's camera network plus law enforcement's own databases — for "established events" like the No Kings protests, 4th of July fireworks, parades, bike races, even Mardi Gras. It's a useful corrective if you've been tracking Flock mainly through the ICE-data-sharing angle: this is Flock itself teaching the broader surveillance use case, not a rogue department improvising one.

What's notable is the contrast with Flock's public messaging, which leans hard on "we help solve violent crime" and downplays the system as static, single-purpose ALPR cameras. The webinar audio undercuts that pretty directly — real-time monitoring of traffic flow and crowd movement at events where nothing criminal is happening is presented as a normal, encouraged use case, not an edge case.

If you track surveillance-vendor claims against their own training material as a verification habit, this is a good case study in why that gap matters.

404media.coFlock Taught Cops How to Surveil No Kings Protesters

Tara Calishain (the researcher behind ResearchBuzz) just put out Peabody Search, a free tool that generates site:-restricted Google search links limited to a single US state's newspapers, public radio, or TV stations, pulling outlet data from FCC public files and Wikidata. You pick a state, a topic, a year range, and it slices the results into time-bounded search links so you can see how local media covered something period by period, going back to 1995.

It's part of a small family of tools she's built along the same lines, including Super Edu Search for narrowing queries to specific university types and locations. The practical use case is obvious if you've ever tried to figure out how a local outlet covered a politician's early career or track regional reporting on a story before it went national: this beats manually building site: strings for a dozen outlets one at a time.

searchtweaks.comPeabody Search

Bellingcat tracked the Patria, a sanctioned RoRo cargo vessel that RFI reported last year had delivered weapons to Guinea bound for Russia's Africa Corps operations in Mali, as it made four round trips between Gabon's Port of Owendo and Cameroon's Port of Douala this year, with two separate anchorages off Lagos in between. At the time of publication it had been sitting off Lagos for over a month, well outside the norm since no other RoRo or container vessel waited longer than 10 days to enter that port over the same period.

What I like about this one is the method stack: AIS data from Lloyd's List Intelligence for the movement history, Planet Labs and Sentinel-2 satellite imagery to confirm the port calls and cross-check against possible AIS spoofing, and draught analysis (how low the ship sits in the water) to work out when it was loaded versus running empty, since draught dropped after Douala visits and rose after Owendo ones. It's a clean example of triangulating tracking data against imagery and physics rather than trusting any single source, and worth a look if you ever need to sanity-check a vessel's movements yourself.

bellingcat.comTracking a Sanctioned Russian Vessel's West African Odyssey

Brian Boland, a former Meta VP who was set to testify against the company, wrote this the day Meta settled the multistate AG lawsuit over social media harms — for up to $17 billion, in week two of a trial with five weeks of testimony left. His argument is worth reading even if you don't agree with all of it: the safety concessions (two-hour daily limits for minors, overnight blackouts, an independent auditor) only tighten if YouTube and TikTok match them, and most of the $17B is contingent on the same thing. Meta made its own penalty conditional on its competitors' behavior.

The piece is opinion, not investigation, but it's useful for the receipts it pulls together: Adam Mosseri testified this week that Instagram's "Take a Break" feature — the company's showpiece answer to teen overuse — is used by 1.8% of teens, a number Meta never disclosed publicly. Boland also points out the settlement's protections are U.S.-only, and fewer than one in ten Facebook/Instagram users are American, which is its own worthwhile angle for anyone tracking how platform accountability plays out unevenly by geography.

Flagging for the record: this runs against our usual bar for this channel — it's an advocacy essay from an impact-investing nonprofit, not primary reporting — but it's a reasonable exception given how current and specific the sourcing is.

delta-fund.orgMeta Paid $17 Billion to Stop a Trial. Do Not Trust Them.

Indicator's monthly Show & Tell podcast had WSJ reporters Caitlin Ostroff and Neil Mehta on to walk through their investigation into Polymarket running doppelganger sites (like poiymarket.com) so creators could film themselves "winning" fake bets. The deception itself made headlines, but the useful part for us is the toolkit breakdown in the second half of the episode.

Ostroff explained the data trail: Polymarket's public API plus Dune Analytics let you verify on-chain trades independent of what a creator claims in a video. Kalshi, Polymarket's main competitor, has an API too, but it's more limited. In the lightning round, Ostroff called WhitePages "really underrated" for background checks, while Mehta mourned losing Google Plus as a way to link social accounts to Google accounts — a reminder that some of the best cross-referencing tools just don't exist anymore.

If prediction markets, on-chain claims, or influencer "proof" videos ever show up in your work, this is a solid template: check the claim against the chain, not the video.

indicator.mediaShow & Tell: How WSJ reporters caught Polymarket faking its own site

Google's Threat Intelligence Group published a deep dive on three distinct Russian-nexus clusters that have spent the past year phishing academics, diplomats, defense researchers, and Russia critics, not through malware-laden attachments but by abusing legitimate auth flows: app passwords, OAuth consent screens, device-code logins, even WhatsApp device linking. One cluster, UNC7005, is the same group tied to those hotel captive-portal redirects Reliaquest and Microsoft flagged in July, and it's now been caught spoofing a Finnish defense-industry group and NATO-adjacent conference invites to harvest Google OAuth tokens.

What makes this worth reading closely if you're a likely target yourself: the report walks through exactly what these lures look like at each stage, fake conference registration pages, "verification code" prompts, WhatsApp linking flows dressed up as secure calls, so you can actually recognize them mid-attack rather than after the fact. It also includes a full IOC list (domains, file hashes) if you want to check your own exposure.

Google Cloud BlogGoing with the Flow(s): Distinct Clusters Target Individuals of Interest to Russia

A new PNAS study on X's feed algorithm found something worth knowing if you monitor the platform for work: the "For You" feed doesn't just serve engagement, it specifically learns from replies. Users who reply to content the study's authors call "value-misaligned" — the stuff designed to provoke — get fed more of it, because the algorithm reads the reply as a signal to show more. The study also found this effect hits users who identify as Democrats harder, though the researchers aren't fully sure why yet.

Worth flagging for anyone doing social listening or sentiment work on X: what shows up in a feed isn't a neutral sample of what's being said, it's shaped by who argues back. A former X head of product confirmed to 404 Media that the reply-predictor was a known driver of ragebait and that X quietly turned it down last month. If you're building any kind of monitoring workflow around X content, that's a live variable, not a static one.

404media.coX's Algorithm Feeds Off Ragebait and Impacts Democrats More, Study Finds

If you've ever tried to figure out which data broker is actually selling location data to ICE or CBP, you know how opaque the ad-tech supply chain is. Zach Edwards just launched DecryptAds, which aggregates the compliance files the ad industry is required to publish (ads.txt, app-ads.txt, sellers.json) into one queryable database — 284M+ ads.txt records, 184M+ app-ads.txt, 201M+ sellers.json at launch. It's the largest public corpus of this data assembled anywhere.

The useful part for verification work: it flags "geo-risk" on ad systems tied to sanctioned countries (Russia, Belarus, Iran) or adversary-designated ones (China, Hong Kong) and secrecy jurisdictions like Cyprus and the BVI. 404 Media already used it to identify close to 20,000 sites still running Adform code after that platform's July breach. If you're tracing where an app's data actually goes after it leaves the device, this is now a real starting point instead of guesswork.

404 MediaThis Tool Unmasks the Shadowy World of Ads that Track Your Location

Back in March, OCCRP and partners reported that Ireland's Aughinish Alumina — Europe's biggest alumina refinery — had been shipping most of its output to Russian smelters owned by the same parent company, Rusal, and that those smelters were selling finished aluminum to a Moscow trader supplying 63 EU-sanctioned defense contractors. It set off a real fight in Brussels over closing the "alumina loophole."

Ireland just finished its own investigation and cleared Aughinish, saying there wasn't "sufficient evidence" its alumina ends up in weapons. But read the actual report and the caveat swallows the conclusion: Ireland's government admits it has no way to physically trace the material once it's inside Russia, never got access to the transaction data OCCRP used, and leaned mainly on a signed warranty from Rusal's own CEO. Meanwhile OCCRP's data shows over a quarter of the aluminum from one of the top importing smelters went to the domestic Russian market last year.

Good case study in the gap between "no evidence found" and "cleared," especially when the clearing body didn't have access to the same sourcing.

OCCRPFAQ: What to Know About Ireland's Probe Into Our Reporting on Its Alumina Exports to Russia