On 6 August, a false story began circulating on X claiming that a Ukrainian drone had been shot down near Ämari Air Base and that its debris had struck two Portuguese Air Force F-16 fighter jets, causing approximately €120 million in damage.
The posts also included a link to The Defense Post, an international publication covering defense and security issues.
No such incident occurred, and the entire claim is completely false.
A clone created to spread disinformation
A closer look reveals that the genuine news outlet cited in the posts operates at thedefensepost.com, while the link attached to the posts directed users to thedefensepost.eu.
The website using the .eu domain appears almost identical to the genuine publication. Even its articles were exact copies of the original site’s content up until 10 August. It is clearly a cloned website.
Uudist, millele postituses otselingiga viidati aga libaportaalist teiste lugude seast ei leia.
The domain used by the cloned news website was registered on 3 August 2026, just three days before the false story began circulating.
Sloppy craftsmanship
An analysis of the content and structure of the article shared on social media reveals that it was based on an article published by the genuine website on 6 August. The fabricated text and image were simply pasted into it.
The original webpage’s structure and design were retained, along with the name and details of the original article’s author.
The forgery was so poorly made that the original article, which discusses tests of AI-powered sonar systems, was left hidden in the page’s source code. The links attached to the social media sharing buttons also still contain the headline “Lockheed Sends New AI-Enabled Submarine Hunter Into Live Sea Trials”.
Even the Google Analytics ID used to measure website traffic remained unchanged.
The genuine domain, thedefensepost.com, appears 45 times in the page’s source code, while the fake domain appears only five times.
Social media attack from Portugal
A search on X shows that posts linking to the fake website appeared mainly between 6 and 9 August and were shared primarily by accounts connected to Portugal.
Remarkably, a search for the keyword thedefensepost.eu produced no other articles at the time of writing. The only result was the false story about Ämari.
This suggests that the entire fake website was created and copied specifically to spread disinformation aimed at discrediting the Portuguese Air Force currently deployed on rotation in Estonia.
A search on X shows that the first post was published on 6 August at 9:51 a.m. The Portuguese-language post was published by Raphael Machado and reads:
“A Ukrainian drone enters Estonian airspace and is shot down, but its debris still damages two Portuguese F-16 fighter jets protecting Baltic airspace.
Ukraine proves once again that a ‘precision strike’ is merely a recommendation.”
The post links to the fabricated article on the fake website and also includes an AI-manipulated video of Ämari Air Base. The video uses footage from an Estonian Defence Forces video report, into which an AI-generated clip showing burning aircraft wreckage has been inserted.
At 10:04 a.m., Lucas Leiroz published the following post in Portuguese:
“A Ukrainian drone enters Estonian airspace and is shot down. The debris hits two Portuguese F-16 fighter jets stationed at Ämari Air Base.
One fighter jet? €60 million. Who is going to sign that cheque, Zelenskyy?”
The post also included a link to the fabricated article and the manipulated video.
Once again, this was an original post rather than a share of someone else’s content.
At 10:10 a.m., Catarina Leiroz published a Portuguese-language post on the same subject:
“🇵🇹 ⁉️ Europe sends billions in aid to Ukraine…
…Ukraine sends a drone into Estonian airspace, and its debris damages Portuguese F-16 fighter jets.
And now Europeans will pay for the repairs?”
Once again, the post included a link to the fabricated article and the manipulated video.
Several similar original posts appeared over the following hours. They were then reposted to amplify the false story’s reach.
Lisaks portugali keelele iluvad mitmed postitused ka jaapani, hispaania ja inglise keeltes.
Esimeste päevadega saab teema X keskkonnas ligikaudu mõnisada jagamist ning vaatamiste arv jääb alla poole miljoni vaatamise.
Otsinguga leitud esimeste postitajate tausta vaadates hakkab silma nende venemeelsus. Jagamist leiavad nii Aleksandr Dugini postitused, Ukraina-vastane sisu kui ka Venemaa ja Kremli ülistamine.
Üks esimestest postitajatest kirjeldab ennast ajakirjanikuna ning väljendab X profiilil uhkust, et on USA mustas nimekirjas. Samuti on ta pidanud avaprofiilis välja tuua, et reisib pidevalt Brasiilia, Venemaa ja Valgevene vahet.
Rünnaku põhjusena võib näha nii soovi NATO kuvandit lõhkuda, Ukraina toetamise soovi vähendada kui ka Portugali sisepoliitilisi tagamaid.
Propastop jätkab selle libauudisekampaania edasist uurimist ja analüüsi.
Fotod: kuvatõmmised portaalidest ja X keskkonnast ning valeuudise lähtekoodist.
