The European Union restricted RT and Sputnik in March 2022. The restriction was written against outlets and enforced against domains, and those are not the same object. Four years later the outlets are still reachable across most member states, and the gap between the statute and the resolver is now one of the better-documented case studies in open-source infrastructure tracking.
What the ban actually produced was a per-ISP blocklist. There was no registrar seizure, no coordinated takedown of hosting, no revocation at the top-level domain. Compliance was pushed down to individual telecom operators, each implementing DNS-level blocks against a named list of hostnames. Register a new hostname and the list is stale.
The Evidence Base
The Institute for Strategic Dialogue mapped 58 domains associated with 26 sanctioned entities. Its access testing across the three largest ISPs in six member states found that fewer than a quarter of attempts to reach the content were actually blocked. Correctiv, working the German market, found more than twenty RT DE mirror domains freely accessible from Germany in early 2026. Thirteen of those resolved consistently across every major German ISP.
The registration dates are the more useful finding. Those thirteen consistently available German domains were registered between July 2023 and September 2024, well after the original sanctions. This is not legacy infrastructure that enforcement failed to catch up with. It is active provisioning, running years into the restriction period, with new hostnames introduced faster than blocklists absorb them.
Separate mapping by Insight News Media put the operational footprint at more than 37 active clone domains and over a dozen Telegram channels. In July 2026, NewsGuard flagged a new account on X operating as an RT distribution point, which accumulated six million views in its first five days.
The Analyst Workflow
Tracking a mirror network of this shape does not require privileged access. The pivots are conventional and the data is public:
- Registration timeline clustering. Bulk-registered domains share creation dates, registrars, and often nameserver configuration. WHOIS privacy hides the registrant, not the pattern.
- Hosting and ASN overlap. Clone sites tend to consolidate on a small number of providers. Reverse IP and ASN enumeration turn one known mirror into a candidate list.
- Content fingerprinting. Mirrors reproduce article slugs, internal IDs, image paths, and CMS artifacts from the parent site. A distinctive string from a known article, searched across the index, surfaces the copies.
- Telegram as distribution index. New domains have to be announced to be useful. Channel monitoring gives an early feed of hostnames before they appear in traffic data.
- Multi-network resolver testing. Because blocking is implemented per operator, reachability has to be tested from inside each network. A domain blocked on one ISP and open on three others is the normal result, not the exception.
What the Measurement Says
The interesting question is not whether the ban worked. It is what “working” was ever going to mean when the enforcement surface is a list maintained by commercial operators with no incentive to update it aggressively. Sanctions on media infrastructure produce a measurable compliance rate, and that rate is empirically low.
RT’s editor-in-chief has said publicly that the outlet does not respect the sanctions. The domain data agrees with her.
Leave a Reply