The achilles’ heel of EU’s media sanctions: Reassessing RT Deutsch access ahead of Germany’s 2025 Federal Election

21 February 2025

By: Pablo Maristany de las Casas and Kevin D. Reyes

This is part one of a two-part series on how RT Deutsch content is evading domain bans and sanctions, published in partnership with the Alliance for Securing Democracy.

Although access to RT Deutsch has been restricted in the EU since March 2022, a network of mirror sites continues to replicate its content. This is particularly concerning ahead of the German federal elections on 23 February 2025. ISD found that more than a dozen sites mirroring RT content are accessible across Germany’s three largest Internet Service Providers (ISPs), with even more accessible via the fourth largest ISP. These domains appear to be exploiting gaps in enforcement. The most accessible have been registered recently, suggesting that they are not on ISPs’ blacklists. In other cases, ISPs are only partially blocking subdomains. 

EU sanctions have significantly reduced the reach of RT Deutsch’s legacy domain, with mirror sites collectively attracting only about one-third of the original site’s pre-sanction traffic. However, user engagement remained strong, sometimes even outperforming RT Deutsch’s original domain before sanctions were imposed. A substantial share of traffic to these mirrors appears to originate from Germany, raising concerns about sanction circumvention through VPNs or DNS changes. 

These findings underscore the persistence of RT Deutsch’s influence and the need for stricter enforcement of sanctions by enhanced monitoring and cooperation among German ISPs to counter state-controlled information manipulation.  

Key Findings 

  • Despite EU sanctions on Russian state media, ISD discovered 20 RT Deutsch mirror domains and 11 subdomains being spread by pro-Kremlin actors online. Almost half of the identified RT Deutsch mirror domains and subdomains remain accessible across the three ISPs with the most users in Germany. Many of the unblocked domains were registered recently, suggesting gaps in enforcement and updates to sanctioned domain lists. 
  • ISD found that none of the identified RT Deutsch domains were blocked on the fourth largest ISP, highlighting potential enforcement challenges among smaller providers.
  • This research shows EU sanctions have significantly reduced the traffic of the legacy RT Deutsch domain before the war, with mirror websites collectively attracting approximately one-third of the original site’s pre-sanction traffic. This indicates that while sanctions have reduced the number of visitors to RT Deutsch, mirror websites continue to draw in visitors at a similar or better rate than before the start of Russia’s full-scale invasion of Ukraine.
  •  Available mirrors tended to have higher unique visitor counts and slightly longer visit durations, while unavailable mirrors had considerably better bounce rates, indicating effective visitor retention across both categories.
  • A substantial portion of traffic to RT Deutsch mirror domains originates from Germany. For both available and unavailable domains, the majority recorded over 90 percent of traffic from German users, raising concerns about the extent of sanction circumvention through VPNs and DNS changes for unavailable domains in Germany.
  • Mirror domains exhibit strong user engagement, with bounce rates and visit durations comparable to or even exceeding RT Deutsch’s pre-war performance. Some less visited domains demonstrated particularly high retention rates, showing their potential for maintaining influence despite lower visitor numbers.

Findings underscore the need for more robust and comprehensive regulatory measures to limit the reach of domains mirroring RT Deutsch’s content including stronger collaboration between ISPs in the enforcement of sanctions. 

Methodology 

ISD discovered 20 RT Deutsch mirror domains and 11 subdomains (i.e. seemingly unrelated sites) hosted on different servers but containing identical content. Working with CASM Technology, ISD identified the most shared domains among German-speaking pro-Kremlin communities online. 

Our data collection covered:  

  • Content from Telegram from February 2022 to March 2024, 
  • Content from X (formerly Twitter), Facebook, Instagram, YouTube, VK and Telegram from November 2024, 
  • Content from 27 January to 14 February 2024 on Telegram and YouTube. 
  • Though this data stems from three different dashboards observing different timeframes, it is based on the same seed-list of pro-Kremlin communities.  

To assess the availability of the mirror domains, ISD used OONI Probe, a tool designed to measure internet censorship. Since the EU’s sanctions on Russian state media are implemented by ISPs on a national basis, ISD conducted this testing while connected to the four ISPs with the greatest number of users in Germany. To reflect the experience of an average online user, we did not make use of methods to circumvent sanctions, including virtual private networks (VPN) and changing domain name system (DNS) providers. 

ISD also used the search engine optimisation (SEO) tool Semrush to collect data on the monthly unique organic traffic to the mirror domains, the proportion of this traffic originating from Germany, and the average visit duration and bounce rate[1]. We also used publicly available information on the registration dates of mirror domains to assess their development over time and establish any potential overlaps of interest.  

Analysis 

Recently created RT Deutsch mirror (sub-)domains 

ISD’s analysis of RT’s Germany-oriented domains discovered that sanctions are having a limited effect in halting the spread of Russian state media content, with 20 domains and 11 subdomains that are part of the same infrastructure as RT’s main domain (RT[.]com).  

All 20 domains were confirmed to be part of RT’s domain infrastructure after an analysis of domain WHOIS records, websites, and IP addresses of web host servers. They were registered between 5 March 2022 and 24 September 2024, with the first being registered nine days after Russia’s full-scale invasion of Ukraine and just three days after the EU imposed sanctions on RT and Sputnik. Over half of the domains were registered within the past year, indicating that RT remains committed to evading EU sanctions. 

ISD analysis therefore found that EU sanctions have limited effectiveness in restricting the spread of content from Russian state media. Figure 1 shows how 17 of the 31 mirror domains identified were accessible via at least one of the top three ISPs in Germany. 13 were consistently available across all of them; figure 2 shows that all 13 were registered between 31 July 2023 and 24 September 2024, suggesting that ISPs are yet to add them to updated blacklists in line with the current EU sanctions on Russian state media. By contrast, the four remaining subdomains, registered on 6 April 2022, are all accessible through at least one of the top three ISPs. This suggests both loopholes in sanction enforcement and failures in cooperation between the providers. 

 

 

 ISD found further evidence of flaws in enforcement, with one of the three largest ISPs allowing access to subdomains “gegenzensur.rtde.world”2 and “fromrussiawithlove.rtde.world” despite their main domain “rtde.world” being blocked.  

While connected to a network provided by the fourth largest ISP, which is estimated to have a 17 percent share of user volume in Germany, analysts found an even more significant omission: none of the mirror domains or RT Deutsch’s original websites were blocked. Given that there are a number of other, smaller German ISPs, the scale and volume of lacking enforcement may be even higher than identified here. 

To understand the penetration of RT Deutsch’s mirror domains in Germany, we compared the available and unavailable mirror domains in December 2024, the most recent month with data from Semrush, with RT Deutsch’s original domain in December 2021, to have a more accurate month-to-month comparison.  

In December 2024, RT mirrors available via the three ISPs with the most users in Germany averaged 45,317 unique organic visitors. Figure 3 shows how the three most visited accessible mirror websites ranged between 102,100 and 213,900 unique organic visitors in December. This is significantly lower than traffic metrics on the main RT Deutsch’s website in December 2021, when it recorded 3.5 million unique visitors who spent an average of around seven minutes per visit.

  

In total, traffic to both available and unavailable mirror domains attracted roughly one-third of the original RT Deutsch’s site’s traffic in total before the war. Additionally, the number of monthly unique visitors to mirror domains unavailable among the top three German ISPs averaged almost 30 percent less than available domains (figure 4).  This means a significant portion of the German audience remains exposed to a sanctioned foreign media outlet known for actively manipulating German public discourse. 

The weighted average bounce rate among fully available domains was approximately 49 percent, considered average by Semrush. However, less visited available domains which received 46,000 or fewer unique monthly visitors (based on data from December) recorded excellent bounce rates, ranging between 11 and 33 percent. This shows that domains with a smaller visitor base may have a greater retention rate. Furthermore, ISD found that the average bounce rate of unavailable mirror domains among the top 3 ISPs was 37 percent. This indicates that while sanctions have reduced the number of visitors to RT Deutsch, mirror websites continue to draw in visitors at a similar or better rate than before the start of the Russian full-scale invasion of Ukraine. 

ISD also found that ahead of the German federal election, the bulk of monthly unique visitors for accessible and unavailable domains came from Germany (see figures 6 and 7). This might indicate a lack of sanction enforcement by German ISPs outside of the three with the most users – a concern reinforced by the availability testing conducted using the fourth largest German ISP. Another reason could be the use of Germany-based VPN servers, which normally allow unrestricted access to these sites, or other circumvention techniques. 

Conclusion 

This dispatch shows that RT Deutsch mirror sites are still widely available in Germany despite the EU’s sanctions on Russian state media. Among the three ISPs with the most users in Germany, 13 out of 31 mirror domains were recently registered and consistently accessible. Analysts found that the fourth largest German ISP did not block any of RT Deutsch’s original or mirror domains, suggesting that sanction enforcement might be an even bigger issue among smaller ISPs. 

At the same time, ISD analysis shows that EU sanctions have reduced RT Deutsch’s overall reach in Germany: mirror websites collectively attracted about one-third of the original site’s pre-war and pre-sanction traffic. However, accessible and unavailable domains exhibit differences in performance: unavailable mirrors have slightly lower unique visitor counts but better bounce rates, while available mirrors attract more visitors with slightly longer visit durations. Both types have strong user engagement comparable to or exceeding RT Deutsch’s pre-sanction metrics.  

Finally, in the two weeks leading up to the 2025 German elections, ISD was able to establish that an extensive percentage of traffic to both available and unavailable mirrors appeared to originate from Germany. This further raises concerns about potential gaps in sanction enforcement by ISPs outside the top three providers during critical moments for democratic process. 

Recommendations 

Bearing these findings in mind, ISD proposes the following recommendations: 

  • European regulators should actively track websites that share RT content to refine their policy responses against state-controlled information manipulation. This includes monitoring alternative RT domains, mirror sites, copy-paste platforms, and those redirecting traffic to RT. If these sites are linked to the Kremlin, they should face sanctions similar to those imposed on official RT domains, particularly when they replicate the same content under different domain names. 
  • Monetisation for websites featuring RT content or redirecting traffic to its domains should be restricted as part of broader regulatory measures, as ad tech companies can play a key role in implementing these restrictions. 
  • German ISPs should enhance their monitoring efforts to detect and block RT Deutsch mirror domains and subdomains effectively in accordance with EU sanctions. In doing so, they should foster cooperation and intelligence-sharing (e.g., common blacklists) among ISPs to ensure comprehensive enforcement across all providers. 
  • Search engines should step up their efforts to exclude both official RT domains and related alternative sites from search results. Likewise, social media platforms must fully enforce the ban. This is especially relevant for X, which seems to limit access to RT’s official domains based on user-reported location rather than IP addresses or other geolocation signals.

End notes

[1] Bounce rate is a metric that measures the percentage of unengaged sessions on your website or app. Meaning the session didn’t last longer than 10 seconds, trigger a conversion event, or include a second pageview or screenview.

Related