Reports that NABU has allegedly uncovered a corruption scheme in a contract for 100 French Rafale fighters are disinformation. These claims are being spread through a fake website that merely imitates the official NABU website but has no connection to it.
Information is circulating online that the National Anti-Corruption Bureau of Ukraine (NABU) has allegedly uncovered a multi-billion-dollar corruption scheme related to a contract for the purchase of 100 French Rafale fighter jets. The publications claim that high-ranking Ukrainian and French officials and military personnel allegedly embezzled approximately 2 billion euros intended for the fighters, and planned to launder the remaining funds and transfer them to offshore accounts. According to various versions of these reports, the total value of the “contract” allegedly ranges from 15 to 30 billion euros.
The publications are accompanied by a two-minute video in French, resembling a news report, detailing the alleged scheme and its participants. The video and text claim that Andriy Yermak, Rustem Umerov, François-Xavier Polderman, Fabien Mandon, as well as, presumably, Ukrainian President Volodymyr Zelenskyy and French President Emmanuel Macron were allegedly involved in this “scheme.”
The publications authors cite the NABU website, which allegedly published a report on the morning of January 18 about an anti-corruption operation and the uncovering of an embezzlement scheme.
In fact, this information is untrue. NABU has not published any reports on its official platforms about an alleged corruption scheme surrounding the purchase of French Rafale fighter jets. The website cited by the fake news does not belong to NABU and is merely imitating the style of the agency’s official website.
This fake website superficially resembles NABU’s official website but uses a fake domain. The attackers registered the address nabu-gov.com, which is visually similar to the agency’s real domain, nabu.gov.ua, varying only in minor details. The domain name deliberately uses the “gov” part, intended to create the false impression that the site is affiliated with a government agency. However, the quality of the fake website is significantly lower: page elements are misaligned, the agency’s logo is in low resolution, font sizes vary. When navigating to certain sections, users are automatically redirected to the real NABU website.
A check of the nabu-gov.com domain using public registries revealed that this source has no connection to official Ukrainian government websites. According to ICANN Lookup data, the domain was registered on January 15, 2026, just a few days before the fake publications appeared and were shared. The domain was last updated on January 17, 2026, indicating its recent creation and the absence of any reputational or editorial history.
According to urlscan.io, the website is hosted on the commercial hosting service Hostinger. The server is physically located in Lithuania. The domain uses standard mass hosting infrastructure and DNS parking, which is unusual for official websites of government agencies or credible media outlets. It is also noted that the site’s TLS certificate was issued just a few days before the content was published and has a short validity period—a typical sign of temporary or disposable resources.
Data from ScamAdviser also indicates increased risks: the site has a low trust level, is very young, has low traffic, and lacks transparent ownership information. The SSL certificate, which fake distributors may cite, is not proof of legitimacy, as such certificates are now automatically issued to fake sites as well.
An additional Whois check confirms that the domain owner’s information is completely hidden using privacy protection, and the domain itself is registered through the commercial registrar Hostinger Operations. This makes it impossible to identify the real owner of the source and demonstrates a lack of any legal or editorial responsibility, contrary to the practices of official anti-corruption agencies.
Thus, a combination of technical data from independent sources indicates that nabu-gov.com is a fake website created to impersonate an official source and spread disinformation. This resource has no connection to the National Anti-Corruption Bureau of Ukraine or any other government agencies.
According to the Osavul service, the first publications about the alleged NABU “investigation” began appearing in the afternoon of January 19 on Russian propaganda Telegram channels. The first report about the “theft scheme” involved in the purchase of French Rafale fighter jets was published by the “Voice of Mordor” channel. It was then widely reposted by other sources with larger audiences, as well as by bots in the comments section of news articles. The article on the fake NABU website had been posted as early as January 18, but no Ukrainian or international media outlets cited it. These reports were shared exclusively by Russian resources, indicating a coordinated campaign.
As a reminder, in November 2025, Ukraine and France signed a declaration of intent, providing for the possibility of Ukraine purchasing up to 100 Dassault Rafale multirole fighter jets by 2035, as well as SAMP/T air defense systems and other weapons. The document, signed by Presidents Volodymyr Zelenskyy and Emmanuel Macron, is a framework document. It does not constitute a signed contract or the start of deliveries, but rather a first step toward potential long-term cooperation, which could be further formalized through separate agreements. There is currently no information in open sources indicating that procurement or deliveries of Rafale fighters have already begun.
Such fake news is part of Russia’s information attack against Ukraine and France. The aim of this campaign is to discredit the military and political leadership of both countries, undermine trust in Ukraine’s anti-corruption institutions, and create a false impression among international audiences that military aid is “inherently corrupt.” The use of fake websites, pseudo-news videos, and anonymous Telegram channels indicates a pre-planned operation aimed at undermining support for Ukraine from its Western partners.
StopFake previously refuted the false information that anti-corruption agencies found Yermak’s offshore companies and escape passports.
