BOT DETECTION 16 MIN READ 2026-11-07 · M-21

EU Digital Services Act (Regulation (EU) 2022/2065, Articles 34, 35 & 40) & DISARM Framework Technical FIMI / CIB Report: Forensic Evidence Matrix of 1,839 Russian Bot Accounts (Facebook 615... UIDs, .XXXXXX Batch Autoregs, Unicode Homoglyphs, YouTube ru-RU Pool, Selective Moderation Schedule & Synchronous TASS / RIA Novosti Relays)

Structured forensic audit of Coordinated Inauthentic Behavior (CIB) and Foreign Information Manipulation and Interference (FIMI) as of November 2026: 1,839 verified Russian bot accounts (1,434 YouTube channels registered under Russian ru-RU OS locale suffixes -[U+044A]/-[U+044B]/-[U+044D], 189 six-digit .XXXXXX and .2025 batch autoregs, 78 Facebook numeric UIDs in series 615..., 63 Cyrillic-Latin Unicode homoglyph obfuscators and raw CSV templates, 117 cross-thread bridge bots across 24 dossiers), a 5-stage selective moderation pipeline, and 33 documented episodes of synchronous syndication by EU-sanctioned Russian state media (FSUE MIA Rossiya Segodnya / RIA Novosti / Ukraina.ru, TASS, Lenta.ru).

1. EU Regulatory Framework (Regulation (EU) 2022/2065 — Digital Services Act, Articles 34, 35 & 40) & EEAS FIMI / DISARM Taxonomy

Under Articles 34 and 35 of Regulation (EU) 2022/2065 (Digital Services Act — DSA), providers of designated Very Large Online Platforms (VLOPs — specifically Meta Platforms Ireland Limited for Facebook/Instagram and Google Ireland Limited for YouTube) are legally required to assess and mitigate systemic risks arising from the intentional and coordinated manipulation of their service (Coordinated Inauthentic Behavior — CIB), the deployment of automated or inauthentic accounts, and the exploitation of algorithmic recommender and comment-ranking systems by Foreign Information Manipulation and Interference (FIMI) networks. Furthermore, Article 2f of Council Regulation (EU) No 833/2014 prohibits broadcasting, enabling, or otherwise facilitating the distribution of content produced by designated Russian state media holdings (FSUE MIA Rossiya Segodnya / RIA Novosti / Ukraina.ru, TASS).

The machine-readable and visual forensic evidence matrix compiled by OPERBAZA.ORG (/en/bots#dsa-fimi-cib-matrix, /feeds/fimi-cib-dsa-matrix.json, /exports/en_bots.csv) consolidates 1,839 verified Russian botfarm accounts, 117 cross-thread bridge bots (operating simultaneously across 75 overlap pairs linking 24 political and media dossiers), 15 active non-geoblocked YouTube mirror channels of NSDC-sanctioned individuals (availableCountryCodes: "UA"), and 33 documented episodes of synchronous headline syndication by Russian federal state media outlets.

FIMI / CIB Forensic Dataset Metric (`OPERBAZA.ORG`)	Verified Count	Technical Forensic Signature & Primary Identifier Class	EU Regulatory Standard / DISARM Red Framework v1.5
Total Verified Bot & Autoreg Accounts in Registry (`/en/bots`)	`1,839`	Immutable numeric `UID`s, 24-character YouTube `Channel ID`s (`UC...`), archived profile/subscription/thread evidence	DSA Art. 34(1)(c), Art. 35(1)(c)-(d), Art. 40
Pillar 1A: Facebook Numeric `615...` Series UIDs (`profile.php?id=615...`)	`78` (72 in `numeric_615_autoreg` + 6 cross-tagged)	Series `6155...–6159...` without vanity slugs, `Digital Creator` shell mode, `0` city / `0` education / `0` bio, or inverted follower ratios (`82` followers / `433` following)	DISARM `TA05 / T0007` (Create Inauthentic Social Media Pages / Accounts)
Pillar 1B: 6-Digit Batch Autoregs (`.XXXXXX`) & `.2025` Series	`189` (`139` `.XXXXXX` + `42` `.2025` + `8` cross-tagged)	Serial URL suffixes (`.341541`, `.502469`, `.789992`, `.754565`, `.2025`), African/South Asian Reels warm-up graphs, locked `UID 1000...` shells	DISARM `TA05 / T0049` (Flood Information Space / Synthetic Swarm)
Pillar 1C: Unicode Cyrillic-Latin Homoglyphs & Raw CSV Templates	`63`	Substitution of Cyrillic `i` (`U+0456`), `s` (`U+0441`), `a` (`U+0430`), `o` (`U+043E`), `e` (`U+0435`) with Latin ASCII `i` (`U+0069`), `c` (`U+0063`), `a` (`U+0061`), `o` (`U+006F`), `e` (`U+0065`); raw CSV column header `Higher Education Kyiv` retained in profile education field	DISARM `TA06 / T0056` (Bypass Content Filters via Character Obfuscation)
Pillar 1D: YouTube `ru-RU` System Locale Botfarm (`-[U+044A] / -[U+044B] / -[U+044D]`)	`1,434` (+ `117` cross-thread bridge bots)	24-character `UC...` Channel IDs with auto-generated Russian OS locale suffixes (`U+044A` hard sign, `U+044B` yery, `U+044D` reverse-e) absent from the Ukrainian alphabet	DSA Art. 34 & 35 / EU Code of Practice Commitment 18
Active Unblocked YouTube Mirrors of NSDC-Sanctioned Subjects (`UA_OPEN: True`)	`15` (+ `24` nodes in `sanctioned_ru_project`)	Open country code `"UA"` in `availableCountryCodes` (`249` countries), `PlayabilityStatus: OK` without VPN in Ukraine, amplified by `ru-RU` bot accounts	DSA Art. 34(1)(a)-(c) / EU Accession Chapter 31 CFSP
Pillar 1E: Selective Moderation Schedule & Synchronous Russian State Media Relays	`76` dossiers / `33` state media relays	Deletion of verified citizen comments citing state registries (`EDR`, `EDRSR`, `Prozorro`) while preserving Russian bots in top-1..top-5 (`Most Relevant`) + pickup by TASS / RIA Novosti / Ukraina.ru within `15–120 min`	DISARM `TA08 / T0046` & `TA09 / T0116` / Council Reg. (EU) 833/2014 Art. 2f

2. Pillars 1A & 1B: Forensic Anatomy of Facebook Numeric `615...` UID Pools & 6-Digit Batch Autoregs (`.XXXXXX` / `.2025`)

Across Meta Platforms (Facebook), initial comment-thread saturation within the first 5–25 minutes of a target post relies on two standardized account-generation architectures:

Numeric 615... Series Pool (78 verified UIDs spanning 61551048542691 – 61595115906538): accounts are batch-registered without vanity usernames (https://www.facebook.com/profile.php?id=615...), switched into Digital Creator professional dashboard mode to mask empty friend lists behind follower/following counters, and exhibit zero biographical metadata (0 city, 0 education, 0 workplace).
6-Digit Batch Suffixes (.XXXXXX) & .2025 Wave (189 verified accounts): accounts bearing automated 6-digit numeric URL suffixes and Russian-to-ASCII transliteration script defects (ura.savickij.341541 UID 100058459429900, denis.borisov.502469, roman.novikov.789992 UID 100027614651933, larisa.kovaleva.754565 UID 100006721178005, ludmila.vasenko.679280 UID 100059986742650, aleksandr.mihajlovskij.343301 UID 100029970560548, simultaneous doubled-name factory clones galina.galina.772599 UID 100027749074181 and galina.galina.270337 UID 100039224829973, and .2025 batch shells jura.andrushko.2025 UID 100053283187923, fedor.fedir.2025 UID 100026693023411, mihail.gubanov.2025 UID 100078263889441, aleksei.sokolenko.2025 UID 100040230424870).

Verified Facebook UID	Profile Handle / Display Name	CIB Category	Technical Forensic Signature & Observed Thread Deployment
`61564945321609`	`Vitaliy Melnychenko` (`id=61564945321609`)	`numeric_615_autoreg`	`Digital Creator` shell (`67` followers / `78` following, `0` city, `0` education, `0` bio) posting Russian-calque invective in B. Bereza's thread (`30–31.10.2026`, Supreme Court lawsuit against NSDC sanctions)
`61594656912880`	`Andrey Olshansky` (`id=61594656912880`)	`homoglyph_farm` / `615...`	Locked autoreg pinned at Rank #1 (`Most Relevant`) on O. Goncharenko's wall under the US State Dept $2.1B FMS sale of 500 Patriot PAC-3 MSE interceptors: evades Meta filters via 3 Latin ASCII homoglyphs `i` (`U+0069`) embedded inside Cyrillic words
`61582015375009`	`Nataliya Kachan` (`id=61582015375009`)	`numeric_615_autoreg`	`6158...` numeric autoreg deploying Russian-surzhyk lexical calques on O. Stadnik's default wall under his wartime elections post (`pfbid0dTQUTV...`)
`61582753621994`	`Lyubava Prekrasna` (`id=61582753621994`)	`numeric_615_autoreg`	Inverted follower ratio (`82` followers / `433` following), posting two consecutive social-collapse comments on O. Popenko's default wall (`29.10.2026`, `pfbid02UxkuA3...`)
`61571748419988`	`Ulyana Mykolaychuk` (`id=61571748419988`)	`numeric_615_autoreg`	Paired `6157...` numeric autoreg deployed in the same O. Popenko thread (`29.10.2026`)
`61592089256402`	`Andriy Andriyiv` (`id=61592089256402`)	`numeric_615_autoreg`	`6159...` numeric autoreg admitted into the restricted comment whitelist on M. Bezuhla's page (`28–29.10.2026`)
`61585982231409`	`Druzenko. Krayina.` (`id=61585982231409`)	`pseudo_page` / `615...`	Brand-hijack pseudo-page on the `6158...` numeric range (`36k` followers, Reels with `236k` views), cross-seeding threads on D. Chekalkin and O. Drozdov
`100058459429900`	`Yura Savitskyi` (`ura.savickij.341541`)	`batch_autoreg_6digit`	65k-follower aggregator node with `.341541` 6-digit suffix and Russian surname spelling calque, amplifying night anti-mobilization Reels (`02–03.11.2026`)
`100027614651933`	`Roman Novikov` (`roman.novikov.789992`)	`batch_autoreg_6digit`	Locked Russian-language 6-digit batch autoreg (`.789992`, `0` city, `0` education, `0` bio) in top anti-mobilization comment slots
`100006721178005`	`Larisa Kovaleva` (`larisa.kovaleva.754565`)	`batch_autoreg_6digit`	6-digit batch profile in `Digital Creator` mode (`99` followers / `149` following, `0` bio) deployed in the same thread
`100027749074181` & `100039224829973`	`Galina Galina` (`galina.galina.772599` & `galina.galina.270337`)	`batch_autoreg_6digit`	Two simultaneous doubled-name `Galina Galina` factory clones with 6-digit suffixes `.772599` and `.270337` deployed in the exact same thread
`100053283187923`	`Jura Andrushko` (`jura.andrushko.2025`)	`autoreg_2025`	Serial `.2025` wave autoreg pinned at Rank #1 on the default comment wall

3. Pillar 1C: Mixed-Script Unicode Homoglyph Obfuscation & Raw CSV Import Artifacts (`63` Accounts)

To bypass automated toxicity classifiers and keyword spam filters on Meta and YouTube, Russian botfarm operators systematically employ mixed-script Unicode homoglyph substitution: within Cyrillic words targeting air defense, mobilization, or state institutions, individual Cyrillic code points are replaced with visually identical Latin ASCII characters:

Cyrillic i (U+0456) $ ightarrow$ Latin ASCII i (U+0069) (documented in UID 61594656912880 Andrey Olshansky, UID 100033677342526 Eva Henova, UID 61571489427922 Andrey Semenov);
Cyrillic s (U+0441) $ ightarrow$ Latin ASCII c (U+0063) and Cyrillic o (U+043E) $ ightarrow$ Latin ASCII o (U+006F) (ludmila.bondarenko.45557, UID 61555369634837 tamara.cimona, and the Heorhiy Mazur account containing 4 homoglyphs in a single sentence);
Unedited CSV Column Header Artifact (UID 100011388163548 — kamila.zalevska): during automated bulk account creation from a spreadsheet, the profile's Education field literally retained the raw CSV column header Higher Education Kyiv, while its Instagram field retained an unparsed session hash string.

4. Pillar 1D: YouTube `ru-RU` System Locale Botfarm (`-[U+044A] / -[U+044B] / -[U+044D]`, `1,434` `UC...` Channels), `117` Cross-Thread Bridge Bots & `15` Active NSDC Mirrors

On YouTube (Google Ireland Limited), our audit documented 1,434 automated channels (UC...) masquerading as Ukrainian citizens while carrying an immutable forensic indicator of their creation environment. When bulk registration scripts create YouTube accounts with Cyrillic display names inside a browser or anti-detect environment configured with a Russian system locale (ru-RU), YouTube's automated @handle generator appends a 3-to-4 character disambiguation suffix drawn from the Russian phonetic table, injecting the strictly Russian letters hard sign (U+044A), yery (U+044B), and reverse-e (U+044D) — characters that do not exist in the Ukrainian alphabet or Ukrainian keyboard layout.

Cross-thread graph analysis across 40,224 parsed comments (39,311 on YouTube and 913 on Facebook) identified 117 cross-thread bridge bots (cross_lom_bridge_bots) operating synchronously across multiple independent political comment threads and NSDC-sanctioned mirror channels:

Technical YouTube `Channel ID` (`UC...`)	Auto-Generated Handle (Transliterated / Unicode)	Russian OS Locale Forensic Marker	Simultaneous Dossiers Amplified (`/en/dossiers`)
`UCYRzMzblP2LFgVfwBYD3k-A`	`@Bohdan-[U+044A]6yu6k`	Suffix `-[U+044A]6yu6k`: Russian hard sign `U+044A`	`4` dossiers: `bereza`, `chekalkin`, `poroshenko`, `zheleznyak`
`UCEjQMF0wEKSm2pGj6yfXulg`	`@VolodymyrPasichnyk-v2[U+044D]`	Suffix `-v2[U+044D]`: Russian letter `U+044D`	`4` dossiers: `bereza`, `chekalkin`, `drozdov`, `nudniy-pens`
`UCAH_yVgWKhk_cVMg5WXTwkQ`	`@MykolaFomenko-n1[U+044A]`	Suffix `-n1[U+044A]`: Russian hard sign `U+044A`	`4` dossiers: `ariev`, `chekalkin`, `nudniy-pens`, `poroshenko`
`UCbnz80Gw4QJFWxC23eXXlkA`	`@Lyza-s4s9[U+044A]`	Suffix `-s4s9[U+044A]`: Russian hard sign `U+044A`	`3` dossiers: `bereza`, `chekalkin`, `poroshenko` (+ NSDC mirror `UC7cv4INhQQwfJqiU-mel0QQ`)
`UCAGV2szZbDkLVjxw1hFxyHQ`	`@VolodymyrTarasyuk-[U+044A]7sh`	Suffix `-[U+044A]7sh`: Russian hard sign `U+044A`	`3` dossiers: `bereza`, `shabunin-nikolov`, `zheleznyak`
`UCp7KKsDkuV5sGm-R2wI3JoQ`	`@OlehPavlyk-[U+044B]4e`	Suffix `-[U+044B]4e`: Russian letter `U+044B`	`3` dossiers: `mosiychuk`, `sanctions-mirrors`, `soskin`
`UCG5fDE3L8jh2cILCvkGk40w`	`@Stepan-zh4[U+044A]2y`	Suffix `-zh4[U+044A]2y`: Russian hard sign `U+044A`	`3` dossiers: `bereza`, `chekalkin`, `drozdov`
`UCCEH0ScioEYKy2Q0AYJD2rg`	`@LarysaKravchenko-p7[U+044A]`	Suffix `-p7[U+044A]`: Russian hard sign `U+044A`	`3` dossiers: `bereza`, `chekalkin`, `shabunin-nikolov`
`UCWor0UszzYY3UF2oWYjfGxA`	`@EvhenyyaSavchenko-v3[U+044A]`	Suffix `-v3[U+044A]`: Russian hard sign `U+044A`	`3` dossiers: `bereza`, `goncharenko`, `sanctions-mirrors`
`UCx2BMxA-1IIAYsuA5n_mYKg`	`@Lena-[U+044B]8h9sh`	Suffix `-[U+044B]8h9sh`: Russian letter `U+044B`	`3` dossiers: `bereza`, `goncharenko`, `simutin-korupciya-info`
`UCEgaMRr4nEKESiPRNNzj1sw`	`@Kamy-[U+044D]4s`	Suffix `-[U+044D]4s`: Russian letter `U+044D`	`3` dossiers: `ariev`, `kushch`, `shariy`
`UCFpYTgpENsX2ao42oGl-MZg`	`@viktorserdyuk-[U+044B]5o`	Suffix `-[U+044B]5o`: Russian letter `U+044B`	`3` dossiers: `bereza`, `chekalkin`, `poroshenko`

This same ru-RU bot pool actively amplifies 15 unblocked YouTube mirror and relay channels of NSDC-sanctioned subjects (UCyDRD4u-G9rUTlUGRein_hw, UC-uCKJq_bRs5pFE8bMNy6kQ, UCyeoETklSyLA-jQe565U03g, UC24jZmCZLi3w4j4H8MjJGEg, UCTvUuw11b844xI-JFT7tQew, UC7cv4INhQQwfJqiU-mel0QQ, UCYS8kqVQzP4pfpmw5XIagMA, UCvckh1Db64fbmfiddPoZ6LA, UC_iPAFzu0nkZkn9vaeWdPrA, UCS4aVDaOvIK0-3voQv49pKQ, UCUEiXr94u-obIqTkMAODg2w, UCurgcc4qcz3-_ibm3XxKUjQ, UCBSYa5zQvjL-Y2D89L_OyEw, UCiV8lEPfB0NVwfgWuSXSaiQ, UCgtxz5_xa6xkDTghNPkuRYw) streaming into Ukraine with open country code availableCountryCodes: "UA".

5. Pillar 1E: 5-Stage Selective Moderation Schedule & Binary Relay to TASS / RIA Novosti / Ukraina.ru (`33` Documented Relays)

A core forensic finding for EU regulators (DG CONNECT and EEAS StratCom) is that Russian synthetic botfarms on Facebook and YouTube operate as Stages 2 and 3 of an integrated 5-stage cross-platform FIMI relay pipeline:

T+00..05 min (Narrative Seeding / DISARM TA01): Publication of the primary narrative on a target page (e.g., attacking US FMS deliveries of 500 Patriot PAC-3 MSE missiles or domestic cruise/ballistic missile programs).
T+05..25 min (Coordinated Synthetic Swarm Injection / DISARM TA05): Synchronous entry of 615... numeric UIDs, .XXXXXX batch autoregs, homoglyph accounts, and ru-RU YouTube bots (-[U+044A]/-[U+044B]/-[U+044D]) cross-liking each other to capture the top slots of the default Most Relevant comment view.
T+15..45 min (Selective Moderation Schedule — Criterion #1 / DISARM TA06): Page moderators systematically delete comments from verified Ukrainian citizens citing official state registries (EDR, EDRSR, Prozorro) and block their authors, while leaving Russian synthetic bot accounts (615..., .XXXXXX, homoglyphs, ru-RU) untouched at Rank #1..#5 of the default thread view.
T+30..90 min (VLOP/VLOSE Algorithmic Recommender Exploitation / DSA Art. 34 & 35): Skewed comment sentiment and synthetic engagement velocity trigger Meta and YouTube recommender promotion.
T+15..120 min (Synchronous Binary Relay to Russian State Media — Criterion #2 / Council Reg. 833/2014 Art. 2f): EU-sanctioned Russian federal state media (FSUE MIA Rossiya Segodnya / RIA Novosti / Ukraina.ru, TASS, Lenta.ru) syndicate the post and cite the curated bot comments as "Ukrainian public outrage" (including *Ukraina.ru* composite article 1084102674 of 27.10.2026, 16:31 simultaneously citing V. Barvinenko, O. Goncharenko, and Y. Kasyanov against the FP-5 'Flamingo' missile program; *RIA Novosti* articles 2127422181 and 21277... of 28–29.10.2026; *Ukraina.ru* dispatches 1084063586, 1084040964, 1084064177, 1084033099 and *Lenta.ru* reports of 24–29.10.2026).

6. Technical Recommendations for Meta CIB Team, Google TAG / YouTube & European Commission DG CONNECT (DSA Enforcement)

For Meta Platforms Ireland Limited (CIB Threat Intelligence & DSA Art. 34/35 Compliance):
deploy automated cluster detection and batch remediation targeting profile.php?id=615... accounts in Digital Creator mode with zero biographical graph and 6-digit .XXXXXX / .2025 batch autoregs (78 + 189 verified profiles in /feeds/fimi-cib-dsa-matrix.json);
implement mixed-script Cyrillic-Latin homoglyph normalization (U+0069 $ ightarrow$ U+0456, U+0063 $ ightarrow$ U+0441, U+0061 $ ightarrow$ U+0430, U+0065 $ ightarrow$ U+0435, U+006F $ ightarrow$ U+043E) in the Most Relevant comment-ranking pre-processor and flag unedited CSV profile fields (Higher Education Kyiv in UID 100011388163548).
For Google Threat Analysis Group (TAG) & YouTube Trust & Safety (DSA Art. 34/35 Compliance):
execute batch forensic verification and takedown of the 1,434 YouTube channels (UC...) combining Ukrainian-persona display names with auto-generated Russian ru-RU OS locale suffixes (U+044A, U+044B, U+044D), prioritizing the 117 cross-thread bridge bots (UCYRzMzblP2LFgVfwBYD3k-A, UCEjQMF0wEKSm2pGj6yfXulg, UCAH_yVgWKhk_cVMg5WXTwkQ, etc.);
extend beneficial-owner geoblocking in Ukraine (availableCountryCodes) across all 15 active mirror channels (UC...) operating on behalf of NSDC-sanctioned individuals.
For the European Commission — DG CONNECT (Directorate F, DSA Systemic Risk & FIMI Enforcement) & EEAS StratCom:
incorporate selective comment moderation preserving synthetic bot swarms (Criterion #1) and synchronous relay to Russian state media designated under Article 2f of Regulation (EU) No 833/2014 (Criterion #2) into systemic risk audits of VLOPs/VLOSEs under Articles 34, 35, and 40 of the Digital Services Act.

All machine-readable datasets are available at:

Interactive FIMI / CIB Matrix: /en/bots#dsa-fimi-cib-matrix (UA: /bots#dsa-fimi-cib-matrix)
EU DSA / DISARM JSON Feed: /feeds/fimi-cib-dsa-matrix.json
Full Bot Registry CSV Export: /exports/en_bots.csv (UA: /exports/bots.csv)

[APPLY THIS METHODOLOGY IN PRACTICE: /en/bots#dsa-fimi-cib-matrix →]

Profiled Targets

[RED: 54] · [BLUE: 22] · [NBU #65: 47]

ROC / FSB Network (EDR + FNS)

74 / 26

74 active UA EDRPOU · Rosatom · SBU

Certified Bots (UID)

1839

FB homoglyphs, 615-UIDs, YT ru-RU

RU Defense Plants (VPK)

202

9 weapon chains · 369 execs unsanctioned

Investigations

PsyOps & network forensics

Matrix Nodes / Edges

201 / 151

Botfarm amplification & RU state media

DATA SOURCES — OFFICIAL OPEN RUSSIAN STATE REGISTRIES & OPENSANCTIONS (OSINT / COMPLIANCE): Corporate identifiers (TIN/INN, PSRN/OGRN), industrial facility coordinates, transliterated directors and chief engineers, official switchboard phones, and corporate e-mails derive from official open Russian state registries (FNS EGRUL, Rostekhnadzor, EIS Goszakupki, e-disclosure.ru) cross-referenced against international sanctions lists ([UA-NSDC], [US-OFAC] SDN/CSL, [EU] Council, [UK] FCDO as of 2026-10-30).

[ZAKhIDNIY KONTUR VPK · 6 MATRITs] [SANCTIONS GAP: 305 EXECS / 14 PLANTS] EXPORT FtM .JSONL EXPORT /vpk.json [879] EXPORT /vpk.csv (879 Excel)

INDUSTRIAL SUPPLY-CHAIN MATRIX: RUSSIAN WEAPON SYSTEM → 4 FACTORY TIERS (EXECUTIVES & CONTACTS)

Select a Russian weapon system to expand its 4-tier industrial supply chain (from prime design bureaus and propulsion to seekers, microelectronics, solid propellants, and explosives) with official registry executive contacts

RUSSIAN DEFENSE INDUSTRY SANCTIONS COMPLIANCE RADAR ([UA-NSDC] · [US-OFAC] · [EU] · [UK]) & SANCTIONS GAPS

Despite entity-level designations, 78.7% of executive & engineering leadership (369 of 469 general directors, chief engineers, and technical directors) and 22 upstream & component defense plants remain OUTSIDE personal or direct US, EU, and UK sanctions lists

SANCTIONS GAP WATCHLIST (305 / 14) → FtM .JSONL .JSON .CSV

DEFENSE ENTERPRISE REGISTRY & EXECUTIVE CONTACTS: All 202 Russian VPK Defense Plants

Showing: 202 of 202 enterprises

OPEN-SOURCE TRANSCRIPT CROSS-AUDIT (PUBLIC YOUTUBE INTERVIEWS): Forensic analysis based exclusively on officially published interviews with captured Russian soldiers on the channels of Dmytro Karpenko (“Apostol” / @DmytroKarpenko) and Volodymyr Zolkin (@VolodymyrZolkin). Every timestamped claim is cross-checked against engineering physics, military topography, clinical medicine, and open Russian state/court registries.

VERIFICATION METHODOLOGY: RUSSIAN POW DECEPTION PATTERNS & TECHNICAL INCONSISTENCIES

Systematization of cover stories ("water carriers / cooks / locksmiths") and engineering, medical, and tactical inconsistencies in open interviews

1. Tailored for Post-Exchange FSB Counterintelligence Filtration

Experienced contract personnel tailor their answers not for Ukrainian viewers, but for post-exchange FSB Military Counterintelligence interrogation at Mosrentgen: attributing technical/defense details to "engineers", avoiding war-crime admissions, and recording on camera that they ran out of ammunition and were captured by surprise.

2. Blind Spot #1: Engineering Physics ("9th-Grade Locksmith Commissioning 50m Lines")

Non-engineering interviewers miss technical contradictions in civilian cover stories: when a subject claims 9th-grade manual labor yet travels on industrial commissioning deployments for 50-meter production lines while reciting physical impossibilities about metallurgical or defense machinery.

3. Blind Spot #2: Clinical Impossibility of the "Water Carrier" Cover Story

The POW claims 30-km foot marches hauling heavy water and ration packs, yet admits in the same interview to a severed arm artery with post-surgical contracture, a punctured lung, and spinal disc herniation—conditions clinically incompatible with heavy porter duty.

4. Blind Spot #3: Masking Academy/University Years (Ages 17–21) with "Juvenile Prison"

To conceal military academy or technical university enrollment between ages 17 and 21, the operative fabricates a 3.5-year juvenile prison sentence—yet fails to recall the basic reason for his alleged first arrest.

5. Blind Spot #4: Unscripted Slips by Relatives During Live Phone Calls

Relatives on live phone calls do not know the cover story just told in the studio and expose reality within seconds: dug-in forward observation/hideout duty ("sitting buried on drops of water"), missing bank payouts, or sensitive contact names whom the POW abruptly silences.

6. Blind Spot #5: Instant Specialist Reflexes (Optics, Weapons & GRU Tactics)

An alleged untrained "water carrier" who claims to have fired a rifle twice on a range accurately identifies Ukrainian SOF weapon optics (side-mounted thermal sight + red-dot collimator) within a 3-second forest firefight and details neighboring GRU brigade tactics.

EXPORT /pow.csv

[TIER 1: 31 FULL DOSSIERS] [TIER 2: 352 REGISTRY MATCHES] [TOTAL: 383 VERIFIED MATCHES · 0% NAMESAKES]

UKRAINIAN MINISTRY OF JUSTICE OPEN DATA (UO.XML & FOP.XML OF 2026-10-27), PROZORRO & UA NSDC SANCTIONS REGISTRY (NBU AML RESOLUTION NO. 65 / LAW NO. 1644-VII / UN CHARTER ART. 51): This section documents two structural corporate-registry and sanctions-compliance gaps across 383 100%-verified subjects (31 Tier-1 full dossiers + 352 Tier-2 consolidated registry records): (1) individuals matched via verified phones, corporate e-mails, and Tax IDs from the May 2014 “DPR” armed militant recruitment archive remain active owners, directors, and sole proprietors in Ukraine’s Unified State Register (including brand-new 2026 Kyiv companies, Prozorro public-procurement contractors, registered print media, construction, and security firms) without NSDC sanctions; (2) Russian billionaires and citizens under active 10-year Ukrainian NSDC and EU sanctions (including Svetofor / Mere, TechnoNICOL, and ex-Severstal) remain recorded as active Ultimate Beneficial Owners of unliquidated Ukrainian companies in live UO.xml.

EXPORT /edr.json [383] EU AUDIT (DG NEAR / DG FISMA): 12 EDR CLUSTERS + 15 MIRRORS [27] → METHODOLOGY M-20 (BRUSSELS RICOCHET) →

CROSS-MAPPING 2014 MILITANT ARCHIVES & NSDC / EU SANCTIONS AGAINST LIVE UKRAINIAN EDR (UO.XML / FOP.XML): TWO-TIER COMPLIANCE ARCHITECTURE (0% NAMESAKES)

Tier 1 (31 full SSR dossiers covering operating LLCs, Prozorro public-procurement contractors, and NSDC/EU-sanctioned Russian UBOs) + Tier 2 (352 compact FOP & corporate UBO records for rapid AML/KYC screening)

1. Static-Archive Blind Spot & Fresh 2026 Registrations

Without automated cross-mapping against live Ministry of Justice datasets (UO.xml and FOP.xml), compliance teams miss both long-running companies of 2014 militant applicants and brand-new LLCs and FOPs incorporated in April–September 2026 alongside Prozorro municipal contractors.

2. Strict Secondary-Key Filter (Zero-Namesake)

All surname/patronymic-only collisions were discarded. Every record is anchored by an independent secondary identifier: exact contact phone match in live EDR or Prozorro contracts (+380660824727, +380977788114, +380505656633), corporate e-mail (tne@ukr.net = LLC ‘T.N.E.’), or National Media Council Decision No. 1159 (R30-01797).

3. Sanctioned & Direct RF Capital Active in UO.xml (Law No. 1644-VII / CMU No. 187)

Direct parsing of <FOUNDER> and <BENEFICIARY> tags in the 2026-10-27 UO.xml snapshot exposed active Ukrainian companies totaling UAH 2.39B in Tier 1 and over UAH 26.7B across all 300 verified subjects, including entities linked to Rosatom (JSC TVEL), Rostec (Technopromexport), AFK Sistema, Svetofor / Mere, Guta Group, and January 2026 wartime registrations.

4. Two-Tier Structure for Banking AML/CFT (NBU Resolution No. 65)

To preserve investigative clarity, 31 high-impact corporate and sanctioned-UBO cases are published as full forensic SSR dossiers (Tier 1), while 352 additional verified FOPs and corporate UBOs are consolidated into a searchable reference table below (Tier 2) and exported in /edr.json.

[VERIFIED DATA SOURCES & TRANSPARENT PROVENANCE FOR /EDR]:

1) May 2014 Militant Network (22 subjects: 7 in Tier 1 + 15 in Tier 2): direct primary attribution to the Myrotvorets Center Database (myrotvorets.center) and the intercepted ‘DPR’ Mobilization Directorate / ‘Vostok’ Battalion archive (#4500idiotov, May 2014) with verbatim “How I can help DPR” pledges, TSV row numbers, phones, and e-mails; 2) Corporate & UBO Registry Layer (278 RF-capital subjects + all 300 records): official open-data dump of the Ministry of Justice of Ukraine (UO.xml and FOP.xml as of 2026-10-27) and Prozorro (prozorro.gov.ua); 3) Sanctions Layer: Ukraine NSDC State Register of Sanctions (drs.nsdc.gov.ua), EU (EUR-Lex), US (OFAC SDN), UK, Canada, Poland, and OpenSanctions.

SUMMARY CROSS-MAPPING MATRIX OF UKRAINE'S UNIFIED STATE REGISTER (31 TIER-1 FULL DOSSIERS + 352 TIER-2 REGISTRY MATCHES = 383 VERIFIED MATCHES · SNAPSHOT AS OF 2026-10-27):

Ukrainian State Registry EDR Cross-Mapping Matrix

UNIFIED EDR OBLAST FILTER (TIER 1 + TIER 2 · ISO 3166-2:UA):

All Oblasts of Ukraine (Kyiv City separate from Kyiv Oblast; regional capitals merged into their oblasts)

[TIER 1 · FULL FORENSIC CROSS-MAPPING CARDS & SSR DOSSIERS]: PRIORITY CORPORATE ENTITIES, PROZORRO CONTRACTORS & SANCTIONED RF UBOS [31]

CASES #01–#31 · VERIFIED IN UO.XML / FOP.XML (2026-10-27)

Consolidated Searchable Registry of UA EDR Entities & Sole Proprietors (Tier 2 — 352 Verified Matches)

352 / 352

Compact searchable & filterable AML/KYC screening table across 25 regions of Ukraine: 15 active FOP & LLC records matched to the Myrotvorets Center Database / #4500idiotov (2014) + 27 NSDC/EU/OFAC-sanctioned RF subjects + 233 active companies with direct Russian corporate/UBO capital in live UO.xml (2026-10-27)

#	Subject & Region	Category & Source	Primary Record (Myrotvorets / Sanctions / UO.xml)	Active Status in Ukraine's EDR (UO.xml / FOP.xml · 2026-10-27)

[ECCLESIASTICAL-INTELLIGENCE NETWORK OF ROC / FSB · UA EDR + FNS RF EGRUL] 26 CASES · 74 ACTIVE UA EDRPOU ENTITIES · 31 SIGNED FNS RF EXTRACTS

ECCLESIASTICAL-INTELLIGENCE & PARAMILITARY NETWORK OF THE ROC / FSB IN UKRAINE, RF & EU (UA EDR + FNS RF)

Cross-registry matrix of 26 verified clusters: 74 active UOC-MP legal entities in Ukraine’s live Unified State Register (edr_live.sqlite as of 2026-10-31), Russian passports and 12-digit FNS TINs of hierarchs, 31 digitally signed FNS RF extracts (series YuE9965-...), FSB media proxies (SPZh, Pershyi Kozatskyi, Myriany), parish funding in RF/EU via Rosatom, and combat chaplains of Russian Armed Forces military units

EXPORT /en/rpts.json [26 / 74 UA EDRPOU] EXPORT CSV (Excel)

SECTOR 1 · EPARCHIES & LAVRAS IN UKRAINE [15]

74 Active UA EDRPOU Entities + SBU Verdicts

Active eparchial administrations, monasteries, and synodal departments in Ukraine’s EDR whose hierarchs hold Russian passports/TINs, reregistered eparchies in FNS RF EGRUL, or were convicted under Arts. 111 / 111-1 / 111-2 CCU.

SECTOR 2 · FSB MEDIA PROXIES [5]

SPZh · Pershyi Kozatskyi · Myriany

The largest FSB ecclesiastical-media network dismantled by the SBU in March 2024 (15+ indictments under Arts. 111, 255, 161, 436-2 CCU), whose legal entities remain active in Ukraine’s live EDR.

SECTOR 3 · ROSATOM & EU FUNDS [3]

Rosatom · MFA RF · European Parishes

Financing of Patriarchal ROC foundations, “Orthodox Initiative” grant programs, and European ROC-MP parishes via Rosatom State Corporation entities and the MFA RF Compatriots Fund.

SECTOR 4 · COMBAT CHAPLAINS OF RF UNITS [3]

Synodal Dept for RF MoD · VDV · Black Sea Fleet

Staff military chaplains of the ROC attached to VDV Airborne Divisions (v/ch 07264, 74268), the 810th Naval Infantry Brigade (v/ch 13140), and paramilitary Orthodox tactical centers (“Peresvet”, “Andreevsky Krest”).

MATRIX #1: UOC-MP EPARCHIES IN LIVE UKRAINIAN EDR (74 EDRPOU), RF PASSPORTS/TINS & SBU-EXPOSED MEDIA PROXIES

MATRIX #2: SIGNED FNS RF EGRUL EXTRACTS (31 DIGITALLY SIGNED PDFS), ROSATOM FUNDS IN RF/EU & COMBAT CHAPLAINS OF RF UNITS

Showing: 26 of 26 cases (74 UA EDRPOU)

1. EU Regulatory Framework (Regulation (EU) 2022/2065 — Digital Services Act, Articles 34, 35 & 40) & EEAS FIMI / DISARM Taxonomy

2. Pillars 1A & 1B: Forensic Anatomy of Facebook Numeric `615...` UID Pools & 6-Digit Batch Autoregs (`.XXXXXX` / `.2025`)

3. Pillar 1C: Mixed-Script Unicode Homoglyph Obfuscation & Raw CSV Import Artifacts (`63` Accounts)

4. Pillar 1D: YouTube `ru-RU` System Locale Botfarm (`-[U+044A] / -[U+044B] / -[U+044D]`, `1,434` `UC...` Channels), `117` Cross-Thread Bridge Bots & `15` Active NSDC Mirrors

5. Pillar 1E: 5-Stage Selective Moderation Schedule & Binary Relay to TASS / RIA Novosti / Ukraina.ru (`33` Documented Relays)

6. Technical Recommendations for Meta CIB Team, Google TAG / YouTube & European Commission DG CONNECT (DSA Enforcement)

CERTIFIED REGISTRY OF IDENTIFIED GRU BOTS, BATCH AUTOREGS & NETWORK IDENTIFIERS

SPECIAL OSINT INVESTIGATIONS & NETWORK FORENSICS

INDUSTRIAL SUPPLY-CHAIN MATRIX: RUSSIAN WEAPON SYSTEM → 4 FACTORY TIERS (EXECUTIVES & CONTACTS)

RUSSIAN DEFENSE INDUSTRY SANCTIONS COMPLIANCE RADAR ([UA-NSDC] · [US-OFAC] · [EU] · [UK]) & SANCTIONS GAPS

OPEN RUSSIAN SBP PHONES (+7 9...) & TELEGRAM @HANDLES OF Z-CHANNELS AND UAV/EW PROCUREMENT FUNDS

VERIFICATION METHODOLOGY: RUSSIAN POW DECEPTION PATTERNS & TECHNICAL INCONSISTENCIES

CROSS-MAPPING 2014 MILITANT ARCHIVES & NSDC / EU SANCTIONS AGAINST LIVE UKRAINIAN EDR (UO.XML / FOP.XML): TWO-TIER COMPLIANCE ARCHITECTURE (0% NAMESAKES)

[TIER 1 · FULL FORENSIC CROSS-MAPPING CARDS & SSR DOSSIERS]: PRIORITY CORPORATE ENTITIES, PROZORRO CONTRACTORS & SANCTIONED RF UBOS [31]

Consolidated Searchable Registry of UA EDR Entities & Sole Proprietors (Tier 2 — 352 Verified Matches)

ECCLESIASTICAL-INTELLIGENCE & PARAMILITARY NETWORK OF THE ROC / FSB IN UKRAINE, RF & EU (UA EDR + FNS RF)

OPERATIONAL CHRONICLE & RUSSIAN STATE MEDIA RADAR

RUSSIAN STATE MEDIA CITATION ARCHIVE (ROSSIYA SEGODNYA · UKRAINA.RU · LENTA.RU · TASS)

TRADECRAFT & METHODS: ENGINEERING HYGIENE, BOT DETECTION & PSYOP ANATOMY

SLIPOTA VIDOMSTV: ZhIVIY LIChILNIK REAKTsIYi DERZhAVNIKh ORGANIV, ZAKhIDNIKh REGULYaTORIV TA AUDITORIV

INDUSTRIAL RUSSIAN BOTFARM MATRIX & MEDIA SYNDICATION GRAPH

CLASSIFICATION OF 6 INDUSTRIAL RUSSIAN BOTFARMS: TECHNICAL SIGNATURES & SERVICED CHANNELS

PER-SPEAKER BOTFARM & RUSSIAN STATE MEDIA LINKAGE REGISTRY

1. EU Regulatory Framework (Regulation (EU) 2022/2065 — Digital Services Act, Articles 34, 35 & 40) & EEAS FIMI / DISARM Taxonomy

2. Pillars 1A & 1B: Forensic Anatomy of Facebook Numeric 615... UID Pools & 6-Digit Batch Autoregs (.XXXXXX / .2025)

3. Pillar 1C: Mixed-Script Unicode Homoglyph Obfuscation & Raw CSV Import Artifacts (63 Accounts)

4. Pillar 1D: YouTube ru-RU System Locale Botfarm (-[U+044A] / -[U+044B] / -[U+044D], 1,434 UC... Channels), 117 Cross-Thread Bridge Bots & 15 Active NSDC Mirrors

5. Pillar 1E: 5-Stage Selective Moderation Schedule & Binary Relay to TASS / RIA Novosti / Ukraina.ru (33 Documented Relays)

6. Technical Recommendations for Meta CIB Team, Google TAG / YouTube & European Commission DG CONNECT (DSA Enforcement)

CERTIFIED REGISTRY OF IDENTIFIED GRU BOTS, BATCH AUTOREGS & NETWORK IDENTIFIERS

SPECIAL OSINT INVESTIGATIONS & NETWORK FORENSICS

INDUSTRIAL SUPPLY-CHAIN MATRIX: RUSSIAN WEAPON SYSTEM → 4 FACTORY TIERS (EXECUTIVES & CONTACTS)

RUSSIAN DEFENSE INDUSTRY SANCTIONS COMPLIANCE RADAR ([UA-NSDC] · [US-OFAC] · [EU] · [UK]) & SANCTIONS GAPS

OPEN RUSSIAN SBP PHONES (+7 9...) & TELEGRAM @HANDLES OF Z-CHANNELS AND UAV/EW PROCUREMENT FUNDS

VERIFICATION METHODOLOGY: RUSSIAN POW DECEPTION PATTERNS & TECHNICAL INCONSISTENCIES

CROSS-MAPPING 2014 MILITANT ARCHIVES & NSDC / EU SANCTIONS AGAINST LIVE UKRAINIAN EDR (UO.XML / FOP.XML): TWO-TIER COMPLIANCE ARCHITECTURE (0% NAMESAKES)

[TIER 1 · FULL FORENSIC CROSS-MAPPING CARDS & SSR DOSSIERS]: PRIORITY CORPORATE ENTITIES, PROZORRO CONTRACTORS & SANCTIONED RF UBOS [31]

Consolidated Searchable Registry of UA EDR Entities & Sole Proprietors (Tier 2 — 352 Verified Matches)

ECCLESIASTICAL-INTELLIGENCE & PARAMILITARY NETWORK OF THE ROC / FSB IN UKRAINE, RF & EU (UA EDR + FNS RF)

OPERATIONAL CHRONICLE & RUSSIAN STATE MEDIA RADAR

RUSSIAN STATE MEDIA CITATION ARCHIVE (ROSSIYA SEGODNYA · UKRAINA.RU · LENTA.RU · TASS)

TRADECRAFT & METHODS: ENGINEERING HYGIENE, BOT DETECTION & PSYOP ANATOMY

SLIPOTA VIDOMSTV: ZhIVIY LIChILNIK REAKTsIYi DERZhAVNIKh ORGANIV, ZAKhIDNIKh REGULYaTORIV TA AUDITORIV

INDUSTRIAL RUSSIAN BOTFARM MATRIX & MEDIA SYNDICATION GRAPH

CLASSIFICATION OF 6 INDUSTRIAL RUSSIAN BOTFARMS: TECHNICAL SIGNATURES & SERVICED CHANNELS

PER-SPEAKER BOTFARM & RUSSIAN STATE MEDIA LINKAGE REGISTRY

SUBMIT VERIFICATION LEAD

COMPLIANCE & CONTACT DESK

2. Pillars 1A & 1B: Forensic Anatomy of Facebook Numeric `615...` UID Pools & 6-Digit Batch Autoregs (`.XXXXXX` / `.2025`)

3. Pillar 1C: Mixed-Script Unicode Homoglyph Obfuscation & Raw CSV Import Artifacts (`63` Accounts)

4. Pillar 1D: YouTube `ru-RU` System Locale Botfarm (`-[U+044A] / -[U+044B] / -[U+044D]`, `1,434` `UC...` Channels), `117` Cross-Thread Bridge Bots & `15` Active NSDC Mirrors

5. Pillar 1E: 5-Stage Selective Moderation Schedule & Binary Relay to TASS / RIA Novosti / Ukraina.ru (`33` Documented Relays)