How Debunk.org Investigates FIMI: Our Method, Step by Step
In short: Debunk.org investigates foreign information manipulation and interference (FIMI) in six steps: we log a lead, check it against what is already known, examine the technical infrastructure, analyse how the accounts behave, weigh the evidence for attribution, and publish with the sources and our confidence. Every step uses open sources that others can check.
Learn these methods yourself: start FIMI 101 → debunkacademy.org Get our new investigations by email → debunk.org/subscribe
Also known as: FIMI investigation methodology; open-source investigation of influence operations.
Key facts
Debunk.org investigates FIMI with open-source methods: public records, domain and hosting data, platform transparency tools and published research.
Every Debunk.org investigation separates technical evidence (infrastructure) from behavioural evidence (how accounts act) and only raises its confidence when both point the same way.
Debunk.org describes incidents with the ABCDE framework and codes tactics with the DISARM framework, the same frameworks the EEAS has used in its FIMI threat reports since 2023.
Debunk.org analysis of Operation Overload emails received, September 2023 – July 2026: 1,166 emails, 97.9% of them sent Monday to Friday.
Debunk.org analysis of its Trusted Flagger reports to Meta, April–December 2025: 1,468 reports led to the removal of 26,255 Facebook pages and about 5.9 million ads.
Debunk.org uses the EEAS's four channel categories (official, state-controlled, state-linked, state-aligned) when describing who is behind an operation.
Updated October 2026 · By Debunk.org, an independent non-profit that researches disinformation
Contents: Our approach · Step 1: Log the lead · Step 2: Check what is already known · Step 3: Examine the infrastructure · Step 4: Analyse behaviour · Step 5: Weigh attribution · Step 6: Publish and act · What we don't do · FAQ · Sources
Our approach
Debunk.org's FIMI investigations follow one rule: describe what the evidence shows, separate what we saw from what others concluded, and state how sure we are.
Foreign information manipulation and interference (FIMI) is, in the EU's definition, a "mostly non-illegal pattern of behaviour" that is "manipulative in character" and "conducted in an intentional and coordinated manner". [1] Because it is about behaviour, not only false content, an investigation looks at who is acting, how they act and what infrastructure they use, not just whether a claim is true. Our What is FIMI? page explains the term.
Debunk EU is also one of seven partners in ADAC.io, an EU Horizon project (2024–2027) on the attribution, analysis and countering of FIMI, which published an updated attribution framework in 2025. [9]
Not every lead gets the same depth. A one-off suspicious website may need a quick check; a network that targets elections gets a full investigation. The steps are the same; how far we take each one depends on the stakes.
Get our new investigations by email. debunk.org/subscribe
Next: the techniques behind each step are in our guide to OSINT investigation techniques.
Step 1: Log the lead
An investigation starts with a lead: a suspicious website, account, ad, email or narrative, logged with the date, where it was seen and a saved copy.
Leads come from our daily monitoring, from readers and partners, from our work as an EU Digital Services Act trusted flagger, and sometimes from the operations themselves: Operation Overload has emailed Debunk.org fake content to "verify" more than a thousand times. [2] We save a copy (screenshot or archive) before anything else, because influence content disappears fast.
Step 2: Check what is already known
Before new research, we check whether the source has already been documented by governments, platforms, sanctions lists or other researchers.
This step saves time and prevents mistakes. We check:
official findings, such as EEAS threat reports and France's VIGINUM reports; [3]
sanctions lists of the EU, US and UK;
platform takedown reports, such as Meta's adversarial threat reports;
databases of known disinformation, such as EUvsDisinfo's; [4]
published research by organisations that track the same operations.
If a source is already attributed, our job is to add evidence, not to repeat the label.
Step 3: Examine the infrastructure
Technical checks show what a website or account is built on: when a domain was registered, where it is hosted, and what it shares with other sites.
For websites, analysts look at registration records, hosting and name servers, security certificates, and shared tracking or analytics codes. Shared infrastructure can connect a new site to a known network. It can also mislead: thousands of unrelated sites share the same large hosting providers, so a shared server alone proves little. Registration dates can be faked or hidden, so we compare several sources. [5]
For social-media accounts, we look at creation dates, name changes, page transparency information and ad libraries.
Step 4: Analyse behaviour
Behavioural analysis asks whether accounts act like a coordinated operation: posting in sync, copying each other, using fake personas or AI-generated media.
Typical signs include:
many accounts publishing the same content within minutes;
activity that follows one working day and one time zone (97.9% of the Operation Overload emails we received arrived Monday to Friday); [2]
fake profile photos, synthetic presenters or cloned voices;
impersonation of real media outlets, journalists or institutions;
the same content moved from platform to platform to look independent.
We describe these behaviours with the DISARM framework, a shared catalogue of influence-operation techniques, and structure the case with the ABCDE framework: actor, behaviour, content, degree and effect. Shared codes let other analysts compare our findings with theirs; the EU and the US adopted DISARM, together with the STIX data standard, as a common standard for FIMI analysis in May 2023. [6][8]
Step 5: Weigh attribution
Attribution is a separate step: we compare the technical and behavioural evidence and only raise our confidence when both agree.
If both are weak, the source stays unattributed.
If behaviour is strong but infrastructure is not, the attribution stays cautious ("likely", at most).
If both are strong and consistent, a higher confidence level is possible.
If the evidence conflicts, we say it is contested.
We then place the channels in the EEAS's four categories, from official state channels to state-aligned channels, and state our confidence in plain words. The rules are set out on our Attribution and confidence levels page. [3]
Step 6: Publish and act
Findings are published with every source, a stated confidence level and a date, and harmful content is reported to platforms.
Public reports follow our editorial rules: false claims are quoted and attributed, never repeated as fact; fake content is shown only watermarked and with links removed; private individuals are not named.
Where content breaks platform rules or the law, we report it. As an EU Digital Services Act trusted flagger, Debunk.org's notices to Meta led to the removal of 26,255 Facebook pages and about 5.9 million ads between April and December 2025. [7]
What we don't do
Debunk.org does not hack, buy leaked data, pose as someone to gain access, or name private individuals.
We use open sources and data that platforms and governments publish.
We don't contact suspected operators under false identities.
We don't publish private people's names or personal data; we name organisations or individuals only when an official body has named them.
We don't take political sides. FIMI analysis is about manipulative behaviour, whoever benefits.
Want to investigate like this? FIMI 101 teaches the frameworks and open-source checks behind our investigations, on real cases. → Start FIMI 101
FAQ
How long does a FIMI investigation take? From an hour for a quick check of one website to several months for a network investigation such as our three-part analysis of Operation Overload (2024–2026).
Which tools do you use? Public tools: domain registration and hosting lookups, archive services, platform ad libraries and transparency pages, and reverse image search. The FIMI 101 course shows how to use them.
Can I send you something suspicious? Yes. Use the form on our contact page or email info@debunk.org, with a link or screenshot and where you saw it.
Who do you work with? We report harmful content to platforms as an EU Digital Services Act trusted flagger, and Debunk EU is a partner in ADAC.io, an EU Horizon research project on attributing and countering FIMI. We publish our methods so anyone can check them.
How is this different from fact-checking? Fact-checking asks whether a claim is true. A FIMI investigation asks who is spreading content, how, and with what infrastructure, even when individual claims are technically true.
Written by Debunk.org. Updated October 2026. Debunk.org is an independent non-profit that researches disinformation and FIMI and an EU Digital Services Act trusted flagger.
Sources
EEAS, 3rd EEAS Report on Foreign Information Manipulation and Interference Threats, March 2025, glossary (definition from the EEAS 2021 StratCom activity report). https://www.eeas.europa.eu/eeas/3rd-eeas-report-foreign-information-manipulation-and-interference-threats-0_en (accessed 22 Oct 2026)
Debunk.org analysis of Operation Overload emails received, September 2023 – July 2026. See the Operation Overload profile, https://www.debunk.org/operation-overload-debunk-org-s-case
EEAS, 3rd report (March 2025), FIMI Exposure Matrix, pp. 15–18; EEAS, 4th EEAS Report on FIMI Threats, March 2026. https://www.eeas.europa.eu/eeas/4th-eeas-annual-report-foreign-information-manipulation-and-interference-threats_en
EUvsDisinfo database. https://euvsdisinfo.eu/disinformation-cases/
Debunk.org, How to find who owns a website
DISARM Foundation, DISARM frameworks. https://github.com/DISARMFoundation/DISARMframeworks; James Pamment, The EU's Role in Fighting Disinformation: Crafting a Disinformation Framework, Carnegie Endowment, 24 September 2020. https://carnegieendowment.org/research/2020/09/the-eus-role-in-fighting-disinformation-crafting-a-disinformation-framework (accessed 22 Oct 2026)
Debunk.org, Trusted Flagger 2025 report. https://www.debunk.org/debunk-org-trusted-flagger-2025-report
EEAS, TTC Ministerial: Foreign Information Manipulation and Interference in Third Countries, 31 May 2023. https://www.eeas.europa.eu/eeas/ttc-ministerial-foreign-information-manipulation-and-interference-third-countries_en (accessed 22 Oct 2026)
Björn Palmertz, Elsa Isaksson and James Pamment, A Framework for Attribution of Information Influence Operations, ADAC.io Deliverable D1.1, Lund University, January 2025 (partner list on the inside cover). https://www.psychologicaldefence.lu.se/article/attribution-information-influence-operations (accessed 22 Oct 2026)
Comments