Executive summary 

This ISD Investigation provides a comprehensive analysis of the availability, reach and social media dissemination of internet domains linked to sanctioned media affiliated with the Russian state. In March 2022, shortly after Russia’s full-scale invasion of Ukraine, the European Commission (EC) adopted nine sanction packages against entities and individuals to de-escalate the Kremlin’s hybrid threat, as well as address Russian military aggression and human rights violations. New and updated sanctions packages are released on a regular basis. 

Blocking access to content published by the sites of Kremlin-affiliated state media is central to these measures, alongside restricting the dissemination of their content on- and offline. As a result, EU Member States are expected to mandate internet service providers (ISPs) operating in their jurisdiction to block access to the sanctioned domains nationwide. In parallel, the EU’s Digital Services Act (DSA; see Glossary), which came into force in February 2024, requires very large online platforms (VLOPs; see Glossary) such as X and Facebook to restrict the dissemination of sanctioned state media on their platforms within the EU.

Three years on from the initial restrictions, sanctioned outlets are largely still active and accessible across Member States. As documented by ISD during the German federal (February 2025) and Polish presidential (May 2025) elections, these actors played a key role in spreading harmful propaganda and polarising audiences. This includes the denial of Russian involvement in war crimes in Ukraine, as well as false claims about Ukrainian refugees’ ideology and behaviour. 

This Investigation builds on ISD’s previous analyses of the effectiveness of EU sanctions against Russian state media, including RT’s (formerly Russia Today) circumvention of sanctions using mirror sites and aggregator domains covertly laundering content through fake news websites. Our most recent analysis showed how RT has been sidestepping sanctions in Italy by broadcasting its documentaries in public spaces with support from pro-Kremlin journalists and Russian officials. 

Key findings 

Analysts identified 58 domains linked to 26 entities sanctioned by the EC and mapped the three internet service providers (ISPs) with the largest broadband user bases in six EU Member States: Germany, France, Italy, Poland, Czech Republic and Slovakia. The results of this testing include: 

• The enforcement of sanctions on Russian state media by European ISPs remains inconsistent. Across the three largest ISPs in six Member States, less than a quarter of attempts to access the content were effectively blocked. 

• Even when ISPs were compliant, methods to circumvent sanctions remained easily accessible. ISPs in Germany and France were the most compliant, blocking between 43 to 57 and 24 to 48 percent of domains respectively. However, due to user settings on client devices, routers or applications (such as virtual private networks), DNS (Domain Name System; see Glossary) requests to resolve website addresses may not always rely on resolvers from ISP’s own infrastructure. Instead, they often use third-party resolvers operated by companies like Cloudflare or Russian-owned services, making the blocked content accessible to the user. 

• Sanctioned domains continue to attract significant online audiences, with a small number of high-traffic sites accounting for a disproportionate share of total reach. Domains only registered more than 50,000 monthly unique visitors in Germany (5) and France (1). Overall, Germany recorded the highest average monthly traffic, with three domains receiving hundreds of thousands of unique visitors.

• Content from banned, Kremlin-aligned media is still widely disseminated on X (formerly Twitter). Between 1 and 31 May, more than 49,000 posts from 2,450 accounts that featured links to sanctioned domains were found on X, predominantly in French and German. This analysis also surfaced anonymous accounts operating with the sole purpose of reposting media articles from sanctioned media. 

• Gaps in enforcement reflect technical, political and legal shortcomings. Practical issues, such as the failure of the EC to include sanctioned domains on official listings, leave national authorities and ISPs without the guidance needed for effective and targeted implementation. Individual Member States also face their own challenges: for example, legal mandates to enforce restrictions in Slovakia expired in late 2022. 

Glossary 

Autonomous Systems (ASNs) 

• An autonomous system (AS) is a large network or group of networks that operates under a unified routing policy. Every computer or device connected to the Internet belongs to an AS. Each AS is assigned an official number, or autonomous system number (ASN), similar to how every business has a business license with a unique, official number. Unlike businesses, ASes are often referred to externally by their ASN number alone. 

Domain Name System (DNS) 

• The Domain Name System (DNS) is the phonebook of the Internet. Humans access information online through domain names, like google.com. Web browsers interact through Internet Protocol (IP) addresses. DNS translates domain names to IP addresses so browsers can load Internet resources. 

 DNS-Level Blocking 

• DNS-level blocking is a method of restricting access to specific websites by manipulating the Domain Name System (DNS) responses that users receive when trying to reach a blocked domain. It is known to be the most common form of blocking in the EU due to its simplicity, non-invasiveness and targeted nature.   

Domain 

• A domain is the address of a website on the internet. It is what users type into their browser to visit a site, like “www.google.com.” A domain name has two main parts: the name itself (e.g., “google”) and the extension (e.g., “.com”, “.org”, or “.net”). 

Dynamic Sideblocking Orders (DSBOs) 

• Dynamic Sideblocking Orders (DSBOs) are judicial or regulatory mandates that require internet service providers (ISPs) to block access to specific content or domains dynamically and in real time. Unlike static blocklists, DSBOs are flexible and allow authorities or courts to update and expand the list of targeted domains or URLs as new variations (e.g., mirror sites or alternative domains) appear. This approach is commonly used to combat rapidly evolving threats like copyright infringement but can be applied to hamper the spread of illegal content, such as enforcing restrictions on content from sanctioned entities. 

Digital Services Coordinator (DSC) 

• The DSC is the national authority in each EU Member State responsible for overseeing and enforcing the Digital Services Act (DSA) within its jurisdiction. 

Information Operations 

• Information operations are coordinated efforts by state or non-state actors to manipulate or influence public opinion through the spread of disinformation, misinformation, propaganda and other deceptive tactics. 

Internet Service Provider (ISP) 

• An internet service provider (ISP) is the company that connects you to the internet, resolves domain names, routes internet traffic, and is responsible for helping to maintain the network infrastructure that makes the internet possible.  

Mirror Website 

• A mirror website is an identical copy of a website that is placed under a different URL.

Resolver 

• A resolver is like a digital phone book assistant for the internet. When typing a website name (e.g., ‘rt[.]com’) into the browser, a user’s device doesn’t know where that site is: it needs an IP address to find it. A DNS resolver is the service that takes the domain name entered and looks up the correct IP address, assisting the browser in where to take a user’s request. Resolvers are usually provided by users’ internet service provider (ISP) but can also use public providers like Google or Cloudflare. This affects which sites users can reach, e.g., when some are blocked or censored. 

Very Large Online Platform (VLOP) 

• A VLOP (Very Large Online Platform) refers to a platform designated as a Very Large Online Platform under the European Union’s Digital Services Act (DSA). The DSA requires platforms exceeding 45 million average monthly active users in the EU to adhere to specific regulations designed to address systemic risks associated with very large online services. 

Website 

• A website is a collection of web pages and multimedia content, which may be accessed through a device such as a laptop, smartphone, or another device with access to an internet connection.  

Methodology 

In order to assess how effectively restrictions on Russian state media have been implemented, ISD analysts compared the availability of domains associated with sanctioned entities across the three ISPs with the largest broadband user bases in six EU Member States: Germany, France, Italy, Poland, Czech Republic and Slovakia.^[1] Analysts used RIPE Atlas, a tool that allows remote, global measurement of domain performance and availability through any chosen ISP.^[2]

As of 1 June 2025, analysts identified 26 media entities listed by the EC in their announcements of sanctions against Russia and the three ISPs with the most users per country. This identification process was made more difficult by the lack of a definitive list of different domain iterations linked to each sanctioned entity, raising concerns about enforcement comprehensiveness. Analysts subsequently mapped a sample of 58 domains associated with these 26 entities before testing them.  

Following this, analysts conducted DNS testing to determine whether the collected banned domains were accessible via each of the ISPs identified. DNS-level blocking^[3] –the process by which users are blocked from accessing the website in question–is known to be the most common form of blocking in the EU due to its simplicity, non-invasiveness and targeted nature.^[4]   

To assess ISPs’ compliance with sanctions enforcement, analysts ran one DNS probe through resolvers located within the infrastructure of the three targeted ISPs for every country and sanctioned domain examined. Lastly, ISD used the social media analytics programme Brandwatch to assess how frequently sanctioned, state-affiliated domains were being shared on X to determine their popularity.  

The fragile framework of domain sanctions 

More than three years after the first sanctions took effect, enforcement remains piecemeal. Fewer than a quarter (247 out of 1044) of sanctioned domains were blocked to some degree. This meant that for an overwhelming majority, accessing Russian state media sites on the sanctions list remains possible without restrictions.

Figure 2. Availability of sanctioned domains per country and ISP. A darker colour indicates a larger number of domains blocked. 

As shown above (Figure 2), of the six countries, Slovakia performed the worst in terms of enforcement: all sanctioned domains were available across all three of the largest ISPs in the country. Across all three Polish ISPs, at least 50 out of 59 domains were accessible without any blocks. The Czech Republic was slightly better, with the best-performing ISP blocking 17 domains. 

Italian ISPs were sharply divided in efficiency: the first ISP blocked more than two-thirds of domains while the other two did not block any sanctioned sites. Collectively, French ISPs were the second most effective behind Germany, blocking between 14 and 28 domains. Germany’s three ISPs were the most consistent, each blocking between 25 and 33 domains. Across all countries and ISPs, ‘voiceofeurope[.]com’ could not be accessed, indicating the domain is likely no longer active, rather than having been blocked throughout. 

Figure 3. Results for the DNS queries conducted for a sample of three Kremlin-affiliated domains across each of the ISPs mapped. 

The chart above further highlights how ISPs enforce blocks inconsistently depending on the domain. For the three example domains depicted, ‘sputnikglobe[.]com’ was notably only blocked by one of 18 ISPs, while ‘rt[.]com’ and ‘ria[.]ru’ were blocked by nine and eight domains respectively. 

All in all, ISPs failed to restrict more than three-quarters of attempts to access sanctioned sites in probes conducted within their own infrastructure, a clear failure in enforcement against Kremlin-affiliated state media. According to prior research, among the possible reasons for this disjointed firewall could be: 

• Lack of awareness and communication around ongoing sanction developments, thereby introducing a time-lag in the implementation of blocks against more recently sanctioned state media, 
• Lack of awareness of domain iterations linked to sanctioned entities (specific domains are not listed on the EC’s sanctions packages nor in its live sanctions tracker), 
• Failure to implement or update blocklists across all resolvers on ISPs’ own networks.
   

The challenge of traffic via third party resolvers  

In cases where successful blocking was observed, DNS queries resolved within the ISP’s own infrastructure manage to implement blocks effectively. However, DNS requests to resolve website addresses may not always rely on resolvers from ISP’s own infrastructure. In many cases, client devices, routers or applications are configured to use third-party DNS resolvers—either intentionally by users seeking to bypass restrictions or through default settings applied by manufacturers or software providers. Said third-party resolvers are operated by companies including Google, Cloudflare and some Russian-based services such as Yandex. 

This makes DNS-based blocking particularly inefficient in blocking access to sanctioned domains. Unless ISPs enforce so-called DNS redirection or hijacking, which is the process of redirecting DNS traffic to a specific IP address (in this case to the ISP’s own DNS resolvers), queries can exit ISP’s network and reach external, public resolvers where blocks are not applicable. As a result, even while technically on the ISP’s network, the DNS resolution process may be handled entirely outside of it.  

To illustrate this, analysts randomly conducted five probes for one of the collected domains (‘lenta[.]ru’) via a mapped ISP (DE ISP 2) without specifying that the query had to be handled within the ISP’s own network of resolvers.  

While the three queries that ran through the ISP’s own network were successfully blocked (“NXDOMAIN”)^[5] , two of the queries were handled outside of the ISP’s own infrastructure and redirected to a resolver owned by a Russian internet and media company. In these cases, blocks implemented by ISPs within their own infrastructure were not effectively enforced (“NOERROR”), meaning the domain is accessible to the user. ISPs’ inability to stop traffic to these domains via foreign resolvers raises serious questions about the effectiveness of DNS blocking and whether alternative solutions should be considered. 

Domestic legislative hurdles and lack of political will – the case of Slovakia 

National legal frameworks and provisions protecting freedom of speech and access to information can also influence enforcement. In Slovakia, the National Security Authority (NSA) temporarily blocked four pro-Russian websites in March 2022–Armádny magazín, Hlavné správy, Hlavný denník, and InfoVojna–under the authority granted by the national Cybersecurity Act. However, the act only allowed such measures to remain in place for three months. Although Slovak lawmakers extended the mandate until 30 September 2022, no further legislative amendments were made, and the restrictions expired. As a result, both the previously banned pro-Russian media and sanctioned Russian state media sites (e.g., RT, Sputnik, etc.) are now accessible across the country. 

The case of Slovakia highlights a misalignment between the EU’s sanctions regime and its implementation by Member States whose legal systems are not structured to respond to hybrid threats. Further, it raises broader concerns about how countries with differing legal frameworks for the protection of the right to freedom of expression and access to information can effectively address the current threat of Foreign Information Manipulation and Interference (FIMI) from Russia. 

Reach of sanctioned domains 

Having established the availability of sanctioned domains across the countries and ISPs of interest, analysts used traffic analytics tool Semrush to provide estimates for traffic to determine the how popular they are.  

Monthly unique visitors, average visit duration and bounce rate 

Despite being sanctioned, we found that some of the sites received significant numbers of visits both from users in Member States and outside of the EU, however traffic was varied across the set. Of the 58 domains collected, 10 had between 1 million and 10 million unique monthly visitors, although 13 websites had fewer than one thousand monthly visitors. Taking this spread into account, ISD calculated the median number of monthly unique visitors to be around 47,300. 

Figure 6. Monthly traffic per sanctioned entity. Note: due to the size of the dataset, only a selection of the core domains is displayed (those with >300,000 unique visitors). 

Bounce rate^[6] and average visit duration are useful metrics to understand user behaviour. Of the 26 sites, 17 had a bounce rate below 40 percent across all countries, signalling a very good user retention rate: examples include RT France, Newsfront, Lenta or Sputnik Brasil, while another 15 sites had an average bounce rate between 40 and 60 percent globally (a reasonable rate). The remaining 24 sites had a bounce rate of over 60 percent and saw visitors swiftly leave their site, e.g. in the case of Sputnik India, Oriental Review or Tvzvezda.  

Conversely, half of the sites sampled recorded an average visit duration of more than five minutes; three of which recorded an average visit length of more than 10 minutes. According to Pew research on the average visit duration of the top 50 US newspaper websites by circulation, in 2020 the visit duration averaged nearly two minutes. For a live TV channel such as Rossiya 1, a long visit duration on average and steep bounce rate is fairly predictable; visitors to live streaming platforms normally record fewer clicks and longer visits in comparison to those accessing a news outlet, where users might access several written articles in a shorter time span. 

Figure 7. Bounce rate and average visit duration per sanctioned site. 

Taking into account the availability of sanctioned domains established above, determining the share of traffic from each of the six EU Member States is imperative for understanding the impact of any inefficiencies in sanction enforcement. 

Figure 8 shows that most EU-sanctioned, Kremlin-affiliated media domains receive fewer than 1,000 unique monthly visitors across all six countries, though a few received between 1,000 and 10,000. However, there were significant variations between countries: five domains received more than 50,000 visitors from Germany, despite German ISPs being the most efficient at enforcing sanctions, as highlighted above. By contrast, none of the domains received more than 30,000 unique monthly visitors from Italy, indicating that despite sanctioned domains being available in the country, traffic to these sites remains moderate.  

Figure 8. Number of sanctioned domains by monthly traffic volume and origin country 

This level of access across the countries further stresses the limitations of sanctions. It is unclear whether this stems from failures in the lack of enforcement by ISPs or the use of tools by the user to circumvent restrictions such as virtual private networks (VPN) or changing their DNS configuration on their devices. Although the exact reasons for continued access remain unclear, the high traffic to some of these sites suggests that it is still relatively easy for users to bypass restrictions and reach blocked content. 

Dissemination of Russian state media on X 

The restriction of sanctioned domains by ISPs is not the only relevant dimension to sanction enforcement: social media platforms also play a key role for users looking to rapidly disseminate and promote content from banned Kremlin-aligned media. 

VLOPs including platforms like X are also required to restrict illegal content (which includes content from sanctioned entities), from their services across the EU, according to article 34.1(a) of the DSA. This reinforces existing EU sanctions prohibiting Kremlin-aligned media from broadcasting or distributing content across any platform within the EU including via television, online streaming services and social media platforms.  

However, following the EC’s sanctions against RT in 2022, RT’s accounts announced new alternative and mirror domains looking to circumvent blocks against their site, which were disseminated by followers and pro-Russian amplifiers that are not directly affiliated with the Kremlin. Ultimately, this meant that sanctioned content remained visible to online users in the EU, bypassing the restrictions imposed by platforms. It is important to note that unless legally mandated in countries outside the European Union, the content from sanctioned outlets’ accounts continues to be displayed to users in non-EU countries, meaning that the official accounts from sanctioned entities have not been completely removed.    

Posts, account and language volume 

Using Brandwatch, ISD analysts identified about 49,100 posts from roughly 2,450 authors posted on X during May 2025 that featured Kremlin-linked domains banned by the EC (excluding reposts).   

Among the languages from the six Member State countries of focus, German was the most prominent, accounting for more than two-thirds of the collected posts, followed by French (more than a quarter). Italian, Polish, Czech and Slovak each accounted for less than 3.4% of the posts. However, when factoring in posts across all languages, significantly more content appeared in English, Spanish, Russian or Arabic, along with a substantial number of posts where no language could be attributed. 

 

Figure 9. Number of posts in languages from focal countries versus posts in all languages, including posts where the language could not be determined, i.e. posts containing only URLs or emojis. 

Among all collected posts linking to sanctioned domains, RT-affiliated sites accounted for almost three quarters (74 percent) of total mentions on X; the most shared domains were English (‘rt[.]com’) and Spanish (‘actualidad[.]rt[.]com’). The next most mentioned domain, ‘sputnikglobe[.]com’, accounted for just around 5 percent. Despite RT and Sputnik being a focus of much research on Russian state media sanctions, this difference in mentions on X is notable. It shows that amongst all sanctioned domains; RT is the most prominently disseminated, reinforcing existing research on the outlet’s role in the information environment. 

Official accounts and anonymous reposters 

On a positive note, most of the official accounts linked to sanctioned state media were found to have been withheld by X in the EU. However, analysts did identify accounts associated with 11 sanctioned outlets that remain accessible in the EU, thereby clashing with the DSA’s provisions on illegal content. Accounts such as Sputnik India or Rubaltic do not directly target European audiences, as indicated by their written language and geographical focus. Nevertheless, irrespective of the geographies sanctioned domains target, the EU’s sanctions still apply to these outlets, and, as such, platforms should withhold their content from European audiences. 

During this analysis, ISD also identified anonymous accounts dedicated solely to posting links from banned media outlets in an apparent attempt to circumvent both platform moderation and sanctions. This was particularly evident in a type of anonymous account that exclusively posts recent articles from RT to their feed. These accounts, as shown below, have a limited number of followers and engagement on their posts. 

 

Sharing unbranded links to sanctioned state media without displaying their content does not technically qualify as illegal under the DSA. However, the widespread availability of these sites across Europe means that the presence of such links on VLOPs risks driving more traffic to them. This raises additional questions about how sanctions should be enforced to limit the reach of banned outlets while respecting laws upholding freedom of speech to address this. 

Conclusion 

Three years after the EU introduced sanctions against Kremlin-affiliated media following Russia’s full-scale invasion of Ukraine, the blocking of sanctioned domains by ISPs’ across Member States has proven largely ineffective. DNS-level blocking–the most commonly used method in the EU–is easily being circumvented, for example by routing DNS queries through third-party or foreign resolvers. Additional factors, such as technical limitations, outdated or incomplete domain listings by the EC, and gaps in national legal frameworks, clearly hinder an effective approach to enforcement. ISD’s findings show that the continued accessibility of these domains is particularly concerning given their ongoing traffic from EU countries, most notably from Germany. Lastly, although most official accounts operated by sanctioned state media actors are withheld in the EU, posts linking to banned domains continue to circulate widely on platforms like X, including via anonymous or foreign-based accounts. 

Recommendations 

For the European Commission: 

Monitoring Kremlin-affiliated media and pro-Kremlin actors online 

• In line with the European Democracy Shield, the EC should support and coordinate with civil society organisations across Member States to regularly monitor the social media activity of sanctioned entities. This effort should also track pro-Russian accounts that promote Russia’s aggression against Ukraine and could act as amplifiers of sanctioned media entities, as part of systemic risk mitigation under Articles 34 and 35 of the DSA. 

Formal listing of all domain iterations associated with sanctioned outlets 

• The Commission should establish and maintain a continuously updated and publicly accessible list of domains linked to sanctioned entities — informing their inclusion through monitoring and knowledge-sharing with Member States. 

• These domains should be included in both official sanctions packages and the live EU sanctions tracker to facilitate real-time, targeted enforcement by Member States and internet service providers (ISPs) alike. 

Observe platforms’ compliance with DSA regulations on sanctioned state media 

• The Commission should ensure VLOPs comply with their systematic risk mitigation obligations under DSA Article 35.1, to restrict content from sanctioned state media in the EU. National Digital Services Coordinators (DSCs) should support this process by monitoring relevant trends within their jurisdictions. 

• National DSCs should support the Commission by monitoring the spread and the content of posts containing URLs directing the user to the sites of sanctioned state media in their jurisdictions and sharing relevant evidence. 

For Member States

Judiciary: Mandate ISPs with the replacement or complementation of DNS-based blocking mechanisms with legally mandated Dynamic Site Blocking Orders (DSBOs)  

• DSBOs could offer a more effective and adaptive alternative to DNS blocking. They allow for real-time updates and multi-layered enforcement against sanctioned domains, including alternative domains and mirrors. Unlike DNS blocking, which is often inconsistent and easily circumvented, DSBOs should be legally mandated, transparent and precise.  

• To respect transparency and freedom of expression standards, DSBOs should include judicial oversight, clear legal basis, public blocklists, redress mechanisms, narrowly scoped targets (e.g., domain or URL level) and time-limited application subject to regular review. 

For all stakeholders 

Promote cross-sector coordination for sanctions enforcement  

• Member States, civil society organisations and ISPs should coordinate to identify and report the circulation of sanctioned domains, as well as any resulting alternative or mirror iterations. The Commission should support the development of secure notification mechanisms to enable VLOPs to strengthen automated detection and moderation of such content. Existing intergovernmental forums such as the External Action Service’s Rapid Alert System should be leveraged for this. 

• This would allow platforms to automate detection and moderation of such content more effectively. 

End notes

[1]  To reflect sanctioned domains’ availability in a resource-effective but representative way, ISD chose to limit the selection of ISPs to the three providers with most users in each of the countries of study. Thereby, this investigation hopes to reflect the state of enforcement by the most frequently used ISPs in every country, as well as the average user’s experience when attempting to access sanctioned domains. 

[2]  Special thanks to the engineers at RIPE Atlas for providing ISD with community credits to conduct the measurements for this study. 

[3]  DNS-level blocking could be compared to removing a phone number from the phone book: While the website still exists, a user’s device cannot find a way to reach it. 

[4]  As opposed to, e.g., IP-level blocking, where a range of websites hosted on the same IP address might be collaterally and unjustly. affected. 

[5]  The “NXDOMAIN” results code signals that a DNS query could not find the desired domain. Bearing the EC’s sanctions on Russian state media in mind, this outcome is a very strong indicator of ISPs complying with sanctions and accordingly blocking the sanctioned domain. 

[6]  Bounce rate is a metric that measures the percentage of unengaged sessions on a website or app, meaning the session didn’t last longer than 10 seconds, trigger a conversion event, or include a second pageview or screen view. 

The sole responsibility for any content supported by the European Media and Information Fund lies with the author(s) and it may not necessarily reflect the positions of the EMIF and the Fund Partners, the Calouste Gulbenkian Foundation and the European University Institute. 
Emif-2026