Armenia | Anatomy of a Threat: Phone Calls, Emails, and the Same IP Trace

On 3 June, 2026, EPDE member Helsinki Citizens’ Assembly-Vanadzor (HCAV) made public that it received telephone and electronic threats related to the upcoming elections on June 7. Analyses of language and IP addresses suggest a foreign origin of the threats. From Norayr Alekyan, HCAV IT Specialist.

The threats began with phone calls. Starting at 15:19, our office phone received calls from several numbers starting with Cyprus’s international country code. During the calls, demands to make the “right choice” and threats of violence were made. Two of the calls were recorded and attached to the application submitted to law enforcement authorities. Based on a preliminary auditory review, the voice sounds unnatural and may have been technically altered or synthetic, which requires a separate audio-forensic examination.

The threats continued electronically on the same day. At least 35 threatening emails were sent to the HCA Vanadzor’s official email  address, info@hcav.am, between 15։45 – 18։27.  They contained threats of violence, including harming family members, murder, claims of knowing their addresses, and other threats of violence. 

The technical headers of the emails reveal an important overlap: a number of emails sent from different Gmail addresses were transmitted to Gmail from the same outgoing IP address, 84.38.184.87. The same chain appears repeatedly in the headers: Received: from 84.38.184.87 … by smtp.gmail.com with ESMTPSA. This means that the emails were delivered to Gmail through an authenticated SMTP connection, not merely through a forged “From” field. In other words, this does not appear to be simple email spoofing, but rather a sending scheme involving several Gmail accounts and a shared technical point of origin.

According to open sources, the IP address 84.38.184.87 is part of the 84.38.184.0/23 network range, which is associated with the AS49505 autonomous system. On RIPEstat and IPinfo, the holder/organization field for AS49505 is listed as JSC Selectel or SELECTEL JSC Selectel, with the registered country indicated as RU / Russian Federation. This points to the hosting or cloud infrastructure used, but does not prove the identity of the final perpetrator, client, or their physical location.

The language of the emails also leaves traces. Some of the threats were written in Armenian using Latin characters, while others were written in Armenian script. In both groups, however, there are signs of unnatural Armenian, inconsistent transliteration, and phrasing that resembles literal translation. For example, the phrase “your life will become one big suffering” sounds artificial in Armenian, yet easily translates back into a standard Russian or English structure. In the same set of messages, the formal phrase “not to interfere with the electoral process” appears alongside crude violent threats, creating a noticeable mismatch in register. While this does not prove the original source, it supports the hypothesis that pre-written or mass-generated texts were used.  

During the same period, the Cyber Police of the Ministry of Internal Affairs of Armenia issued a warning about threatening calls with political overtones made from foreign or unknown-origin virtual phone numbers, as well as threatening emails sent from various email addresses. According to information received by us and publicly available reports, similar threats were also received by other citizens and organizations. These reports still require additional verification, but they allow our case to be viewed within the possible context of a broader threat campaign.

At this stage, HCA Vanadzor does not attribute the threats to any specific political force, state institution, or foreign actor. A final conclusion requires obtaining and cross-referencing data from Google, telephone operators, virtual phone services, and hosting infrastructure through legal channels. 

HCA Vanadzor has appealed to the Prosecutor General of the Republic of Armenia, requesting the initiation of criminal proceedings on the grounds of an apparent crime and the execution of a comprehensive, full, and impartial investigation.   

We assess the incident as an attempt to create an atmosphere of fear around the electoral process, weaken civic oversight, and exert psychological influence on the free expression of the citizens’ will.

Norayr Alekyan
IT Specialist, Helsinki Citizens’ Assembly-Vanadzor