A website posing as the Toronto Sun falsely claimed that Ukrainian President Volodymyr Zelenskyy had bought a $42-million nuclear bunker in Nova Scotia as a personal escape plan (among other reasons). Within days, the story spread across X through a small number of prominent accounts, thousands of reposts and repeated messages accusing Ukraine’s leader of misusing Western aid.
The episode bears similarities to Russian campaigns that impersonate trusted news outlets, but the available evidence does not establish who created or directed this particular deception.
A real bunker, a fake newspaper story
On October 22, toronto-sun.ca published an article claiming Zelenskyy had secretly purchased a Cold War bunker in Debert, Nova Scotia. The address looked similar to that of the Canadian newspaper, but it was not the Toronto Sun’s website. The legitimate newspaper operates at torontosun.com. Note that the exact time of the publication of the fake report is unavailable.
The story was fabricated. When the fact-checking website, Lead Stories, contacted the newspaper, its deputy editor confirmed that the article was fake. The impersonator domain had been registered just eight days earlier. The article reused details and a stock photograph of the real Debert bunker, which has been the subject of redevelopment plans as a boutique hotel, claiming the purchase had be made. The article, however, provide zero credible evidence of a sale to Zelenskyy.
The allegations quickly moved beyond the” bunker”. Posts suggested that Zelenskyy was hiding Western assistance in private property, preparing an escape from Ukraine or profiting while Ukrainians endured the war. One widely shared message asserted that Western taxpayers were paying for the fighting while Zelenskyy was buying himself a safe haven. None of these accusations was supported by evidence of the supposed purchase.
The imitation of a familiar newspaper mattered. It offered social-media accounts an apparently respectable source for an allegation that would otherwise be an unsupported rumour.
How the story spread
DisinfoWatch collected 2,259posts from X/Twitter connected to the bunker claim between October 22 and 25. Of the total, 1,754 were simple reposts of someone else’s message. 505 posts were either original messages, comments or posts adding remarks. The posts had approximately 7.76 million recorded views. These counts represent the number of times a post was seen (one user can view more than once); they do not represent 7.76 million individual people, and they should not all be treated as views of false claims.
The reposting was remarkably concentrated. Four posts accounted for 99% (1,746 of the 1,754 reposts) captured in our research.
| Account and original post | Recorded views | Reposts found in our collection |
| @warintelfeed | 1,193,545 | 938 |
| @War_footageX | 1,255,198 | 113 |
| @its_The_Dr | 237,762 | 576 |
| @CZArmy01 | 210,184 | 119 |
Two posts, from accounts that are reportedly located in “West Asia”, @WWIIIAR and @RoaaWarStudies, each surpassed 860,000 recorded views. The earliest post in our collection linking directly to the fake article came from @ROYALMRBADNEWS at 3:59 p.m. Eastern on October 22 (201,400 total views). It is the earliest we found on X.
From an invented purchase to attacks on Canadian support for Ukraine
Canada also became part of the political message. Of the posts collected, we found 205 posts referring to Canada, Nova Scotia, Canadian political figures or taxpayers in this discussion. Together, these posts generated approximately 2/3rds of the conversation (5.35 million views of the total 7.76 million recorded views). This figure includes people challenging or correcting the allegation. A post by an account identified as being located in Canada, was viewed more than 70,000 times and used the fake story to make further unsupported accusations about Prime Minister Mark Carney and Canadian public money.
While X location labels are not independent proof of where someone lives or operates (i.e. users can fake the location of their account), none of the prominent accounts are listed as Canada-based; the four prominent accounts for which we examined X’s public account-information screens were listed as based in the United States (two), Europe, South Asia and West Asia. We cannot establish the countries of the other all of the accounts that amplified this content or how many Canadians saw the claim.
Did accounts work together?
The collection contains patterns that raise questions about possible coordination, but they do not prove that anyone organized the sharing.
Most strikingly, @warintelfeed and @War_footageX (the top two accounts with the highest views above) published the same opening wording about a $42-million bunker just 100 seconds apart on October 23. Other accounts reused near-identical language about Western leaders sending billions while Zelenskyy allegedly bought property to survive the end of the world.
The overlap among those sharing the posts is also notable. 204 accounts in our collection reposted at least two of the four leading messages; 24 reposted all four. That points to some of the same users repeatedly circulating the allegation. That is worth investigating, but people who follow the same news accounts may also share the same posts without taking instructions from anyone.
Several prominent accounts had undergone multiple username changes, including @its_The_Dr (16 changes), @warintelfeed (eight) and @CZArmy01 (seven). Another major amplifier, @War_footageX (mentioned above), was created only in March 2026 and had already attracted more than 1.25 million recorded views for its post about the fabricated bunker story. While username changes and account age alone are not evidence of coordinated or deceptive activity, these account histories warrant further examination,
Does this resemble Russia’s Doppelganger operation?
Yes, in method—but that is not the same as proving Russian responsibility.
Russia’s documented Doppelganger campaign used lookalike websites to impersonate established news organizations and social-media accounts to circulate misleading stories. The United States seized 32 associated domains in 2024. The objective included weakening Western support for Ukraine.
Here, too, a convincing-looking newspaper address gave an anti-Ukrainian accusation a false appearance of credibility. The story then spread through accounts outside the apparent target country, with repeated text and concentrated reposting. Its message—that Western taxpayers are funding a corrupt Ukrainian president—also matches themes repeatedly used in Russian information operations.
Yet, these behaviours also align with another type of Russian operation. The European External Action Service’s 2026 assessment distinguishes Doppelganger from Storm-1516, another Russia-aligned operation that uses invented stories, fabricated websites, videos and online personalities to reach wider audiences.
The Toronto Sun deception shares features with both. But we have not linked toronto-sun.ca to the websites, technical infrastructure, financing or accounts of either operation. Naming a specific Russian operator would go beyond what this investigation establishes.
Are the domain and URLs associated with known adversarial domains?
Technical analysis contributed by Vigil Strategic Intelligence and its founder, John Gray, examined the site’s registration, hosting, internet addresses and security certificates against approximately 820 known adversary domains and 540 publicly reported indicators associated with Russia’s Doppelganger campaign. No shared technical infrastructure or related imitation sites targeting other Canadian news outlets were identified. However, the site’s ownership is concealed, its hosting is widely available, and public Doppelganger records lack sufficient technical details for a conclusive comparison.
While the website’s impersonation methods and anti-Ukrainian narrative resemble documented Russian-aligned information operations, there is insufficient evidence to establish foreign involvement or identify those responsible. A domestic hoax or independent operator remains possible. However, evidence does indicate that this is a case of deliberate deception.
What this incident shows
A fabricated article appeared under the name of a trusted Canadian newspaper. A handful of accounts brought it to large audiences. Others repeated the accusation and connected it to Canadian politics and Western military aid. Within days, a false claim about a property purchase had become another argument for distrusting Ukraine and the governments supporting it.
For journalists, public officials and civil society, the immediate lesson is straightforward: check the web address and the original publisher before treating a viral article as real.
For investigators, the unanswered questions are who registered and operated the impostor site, who produced the accompanying videos, and whether the same set of accounts that amplified this piece of false content, have pushed other fabricated news stories. Those answers—not the similarity of the tactics alone—are needed for confident attribution.
Methodology
DisinfoWatch used the X API to collect 2,259 posts containing the fake domain or variations of the bunker allegation, followed by targeted searches for additional posts. All 2,259 post IDs are unique, with no duplicate records. Some account names were unavailable through the API, but their post IDs and direct links are preserved. The sample covers October 22–25, 2026, but does not capture every public post, deletion or private account. Engagement figures were recorded during collection; repost totals refer to posts captured in our sample. Location information came only from five account-profile screenshots. While this post focuses specifically on the discussion on X, it’s important to emphasize that sharing of and engagement with this claim spans other social platforms (which is outside the scope of this report).
