#IStandWithPutin hashtag trends amid dubious amplification efforts
The pro-Russian hashtag trended globally after it was amplified by suspect network of accounts
By Jean Le Roux
Over the week of February 28, 2022, the hashtag #IStandWithPutin trended in several regions, ostensibly in support of Russia’s invasion of Ukraine. A deeper look at the origin and amplification of the hashtag suggested this support was less widespread than social media trends indicated, and that engagement around the hashtag originated from a suspicious network of Twitter accounts, many of which were created on the day of Russia’s invasion.
The DFRLab identified what appeared to be two separate networks that amplified a selection of tweets to manipulate Twitter’s algorithm and inauthentically push the pro-Russia narrative to Twitter’s trending list. Once it escaped these echo chambers, the narrative was picked up by users that bought into the narrative without necessarily realizing the origins of the hashtag.
Other open-source researchers have also identified suspicious flags around the hashtag’s amplification. Professor Marc Owen Jones has posted multiple threads on the usage of the hashtag; his analysis of a sample of 20,000 tweets identified many of the same networks DFRLab did, and a separate thread identified the network’s use of fake profile pictures also used in dating scams. Conspirador Norteno, another open-source researcher with extensive experience in analyzing Twitter networks and botnets, also identified similar suspicious flags in a thread of their own.
General analysis
An analysis performed using social media listening tool Meltwater Explore showed that, at 05:43 UTC on March 4, 2022, the phrases “#istandwithputin” or “istandwithputin” were mentioned 300,555 times by a total of 106,663 unique Twitter user accounts.
The narratives accompanying the hashtag were predominantly pro-Russian, calling Western countries hypocrites for the manner in which they dealt with other conflicts while condemning the invasion of Ukraine. Nearly 80 percent of the usage of the hashtag was retweets.
The content used to amplify this hashtag varied, but the most viral tweets all contained similar elements: the hashtag, some text, and a media file that furthered the narrative. These media files included infographics, a snippet from Trevor Noah’s The Daily Show, cartoons, and memes.
In addition, both the text and media were repurposed by other accounts in what seemed to be “copypasta” behavior, where the original posts were copied and reposted to appear as original content on other accounts. None of these posts appear to have gone viral. These posts all reused the infographics, memes, and images posted by the other accounts under the same hashtag.
To investigate the hashtag, the DFRLab collected and analyzed two datasets. The first dataset consisted of accounts that retweeted the top twelve most-retweeted posts containing the phrases #istandwitputin or istandwithputin as of 6:40 AM UTC on March 4, 2022. This dataset was further filtered to exclude any false positives and ensure only retweets relevant to one of these twelve posts were analyzed. The objective of this dataset was to analyze the accounts that retweeted one or more of the most engaged-with posts.
The second dataset consisted of tweets that mentioned “#istandwithputin” or “istandwithputin” as of 11:16 AM UTC on March 3, 2022. This dataset was not filtered and was intended to analyze interactions between various accounts using these phrases. Notably, this dataset contained both pro-Russian and anti-Russian posts, on the proviso that they used either of the search terms.
First dataset
To construct the first dataset, the DFRLab used Meltwater Explore to identify the top twelve most-retweeted posts that contained either #istandwithputin or istandwithputin.
This also identified the first anomaly: the most retweeted accounts had suspiciously low follower numbers when compared to the extent of their retweets, especially when compared to significantly larger followings of anti-Russian tweets using the hashtag.
The DFRLab conducted a search in Meltwater Explore using the text of each of these twelve tweets and filtered the results to provide only those records that were retweets.
To rule out situations where an account retweeted one of the “copypasta” tweets highlighted above — which would contain the same text — the dataset was furthermore filtered using the “fingerprint” of each of the media files uploaded alongside the tweets. This is a unique identifier that Twitter assigns to uploaded media files, allowing the DFRLab to isolate retweets of the twelve posts it identified above.
Finally, this network was visualized using open-source graph network software Gephi.
The retweet network identified two distinct clusters. The first cluster, labeled in blue, is centered around the tweets posted on March 2, 2022. These tweets were retweeted and amplified mainly by accounts situated in the blue section of the network map.
A secondary cluster, labeled in orange, orbited a different set of tweets mainly posted on March 3, 2022. These were mainly retweeted by a different cluster of accounts, although there is some overlap between the two clusters.
This correlates with volume data from Meltwater Explore, which indicated that the tweets located in the blue cluster were mainly amplified on March 2, 2022, while the tweets from the orange cluster were amplified on March 3, 2022, matching a corresponding drop in volumes of the earlier tweets.
In addition, the accounts’ focus on these specific tweets appear to be coordinated — a stacked area chart of the volume of retweets over time shows distinct timeframes during which retweet volumes spiked before diminishing again.
Second dataset
The second dataset consisted of tweets that mentioned #istandwithputin or istandwithputin ranging from February 23, 2022, until March 3, 2022. A total of 239,088 tweets by 81,606 user accounts was collected using the Twitter API, and the 436,753 connections between them visualized using Gephi.
Of particular interest was the outsized role played by accounts that engaged with one or more of the twelve most-retweeted posts. Even in the broader network of #istandwithputin, the position of the two retweet networks (for March 2 and 3 respectively) could be observed. The role of these networks became clearer after colorizing the graph to identify the accounts that had retweeted one or more of the twelve most-retweeted accounts.
Another indicator of suspicious behavior was a large number of very highly connected nodes. By filtering the graph network according to its maximum k-core value — the number of other unique accounts in the same network that an account interacted with — it became clear that a strongly interconnected network was nestled at the center of the pro-Russian part of the network.
This interconnected part of the network consisted of just 184 accounts but was responsible for slightly more than 16,000 interactions amongst each other. About 65 percent of these accounts were also part of the retweet network contained in the first dataset. The other 35 percent were not, however, and although some of these accounts were organic, this provided a strong indication that the retweet network was larger than simply the twelve accounts identified as the most-retweeted.
In addition, clusters of other networks could also be identified. A subsection of the network used the hashtag in an attempt to “taint” it with images of Ukraine’s President Volodymyr Zelensky. For example, the daughter of former South African President Jacob Zuma made extensive use of the hashtag in support of the Russian invasion. Another network in Africa used trending hashtags to market goods and services.
Twitter has already started taking action against some of the accounts involved. Over the weekend of March 5, Twitter suspended more than a 100 accounts for engaging in inauthentic behavior. While Twitter does not allow users to query the suspended status of accounts using its API, a rough estimate could be gained of the number of suspended or deleted accounts by requesting the profile information of the 81,606 accounts in the larger #istandwithputin dataset.
As at 07:42 AM UTC on March 7, 2022, some 433 accounts were no longer available, meaning the accounts had either been suspended or deleted. This does not necessarily mean the accounts were suspended for engaging with the hashtag.
The accounts
A large portion of the sampled accounts appeared to originate in India, as flagged from a query using Meltwater Explore of the hashtag and corroborated based on a review of several of these accounts. Language cues, tweets about local sports and politics, early follows (likely region-based suggestions), and the time zone in which the accounts were most active all pointed towards India as the origin of many of the accounts in the network.
It is unclear whether this was organic behavior or simply attempts to make the accounts seem more natural. Regardless, accounts that posted, and retweeted, the twelve most-retweeted posts presented anomalies.
First, the twelve accounts that posted the most-retweeted tweets had relatively low follower numbers when compared to the number of retweets they garnered, which made the virality of their tweets remarkable. This is compounded if one considers that multiple low-follower accounts had managed viral tweets on the same day using the same hashtag. For comparison, the most-retweeted post that was not pro-Russian was retweeted approximately 4,100 times, but that account had more than 226,000 followers.
Another curiosity is that, despite being retweeted by thousands of apparently like-minded users, none of these accounts secured any meaningful increases in their follower numbers.
A large proportion of the accounts in both datasets were created this year. February 24 — the day the invasion was launched — and March 2 stand out as days on which multiple new accounts were created. While the influx on February 24 might have been due to interest in the invasion, it would not explain why all of these accounts were keen on promoting the hashtag as well.
Several of these accounts’ first tweets promoted pro-Russian hashtags. For example, one account began tweeting pro-Russian hashtags within three minutes of the accounts being registered and retweeted three of the most-retweeted accounts within a span of two minutes, despite not following any of those accounts.
There were also indications of coordination around the batch-creation of accounts. Several of the Twitter accounts that engaged with the #istandwithputin hashtag were created in short succession, but this could again be explained by new users joining to get updates around the invasion. Others, however, showed indicators of batch-creation, including the use of similar default profile pictures automatically allocated to accounts that signed-up using their Google Account.
Social media algorithms are designed to propagate popular content, thereby ensuring users remain on their platforms long enough for their attention to be monetized. This can be exploited by bad actors who manipulate the amplification of hashtags, or specific tweets, in order to introduce a narrative to users outside their echo chamber.
In this instance, a hashtag supporting the military invasion of a sovereign state shows evidence of being artificially gamed to give the impression of support for Putin and Russia.
Jean Le Roux is a Research Associate, Southern Africa, with the Digital Forensic Research Lab.
The DFRLab team in Cape Town works in partnership with Code for Africa.
Cite this case study:
Jean Le Roux, “#IStandWithPutin hashtag trends amid dubious amplification efforts,” Digital Forensic Research Lab (DFRLab), March 8, 2022, https://medium.com/dfrlab/istandwithputin-hashtag-trends-amid-dubious-amplification-efforts-2b8090ac9630.
