BANNER: A network map of tweets containing the phrase #istandwithputin or istandwithputin between February 23, 2022 and March 4, 2022. (Source: @jean_leroux/DFRLab via Gephi)

Over the week of February 28, 2022, the hashtag #IStandWithPutin trended in several regions, ostensibly in support of Russia’s invasion of Ukraine. A deeper look at the origin and amplification of the hashtag suggested this support was less widespread than social media trends indicated, and that engagement around the hashtag originated from a suspicious network of Twitter accounts, many of which were created on the day of Russia’s invasion.

The DFRLab identified what appeared to be two separate networks that amplified a selection of tweets to manipulate Twitter’s algorithm and inauthentically push the pro-Russia narrative to Twitter’s trending list. Once it escaped these echo chambers, the narrative was picked up by users that bought into the narrative without necessarily realizing the origins of the hashtag.

Other open-source researchers have also identified suspicious flags around the hashtag’s amplification. Professor Marc Owen Jones has posted multiple threads on the usage of the hashtag; his analysis of a sample of 20,000 tweets identified many of the same networks DFRLab did, and a separate thread identified the network’s use of fake profile pictures also used in dating scams. Conspirador Norteno, another open-source researcher with extensive experience in analyzing Twitter networks and botnets, also identified similar suspicious flags in a thread of their own.

An analysis performed using social media listening tool Meltwater Explore showed that, at 05:43 UTC on March 4, 2022, the phrases “#istandwithputin” or “istandwithputin” were mentioned 300,555 times by a total of 106,663 unique Twitter user accounts.

The narratives accompanying the hashtag were predominantly pro-Russian, calling Western countries hypocrites for the manner in which they dealt with other conflicts while condemning the invasion of Ukraine. Nearly 80 percent of the usage of the hashtag was retweets.

The content used to amplify this hashtag varied, but the most viral tweets all contained similar elements: the hashtag, some text, and a media file that furthered the narrative. These media files included infographics, a snippet from Trevor Noah’s The Daily Show, cartoons, and memes.

In addition, both the text and media were repurposed by other accounts in what seemed to be “copypasta” behavior, where the original posts were copied and reposted to appear as original content on other accounts. None of these posts appear to have gone viral. These posts all reused the infographics, memes, and images posted by the other accounts under the same hashtag.

To investigate the hashtag, the DFRLab collected and analyzed two datasets. The first dataset consisted of accounts that retweeted the top twelve most-retweeted posts containing the phrases #istandwitputin or istandwithputin as of 6:40 AM UTC on March 4, 2022. This dataset was further filtered to exclude any false positives and ensure only retweets relevant to one of these twelve posts were analyzed. The objective of this dataset was to analyze the accounts that retweeted one or more of the most engaged-with posts.

The second dataset consisted of tweets that mentioned “#istandwithputin” or “istandwithputin” as of 11:16 AM UTC on March 3, 2022. This dataset was not filtered and was intended to analyze interactions between various accounts using these phrases. Notably, this dataset contained both pro-Russian and anti-Russian posts, on the proviso that they used either of the search terms.

To construct the first dataset, the DFRLab used Meltwater Explore to identify the top twelve most-retweeted posts that contained either #istandwithputin or istandwithputin.

This also identified the first anomaly: the most retweeted accounts had suspiciously low follower numbers when compared to the extent of their retweets, especially when compared to significantly larger followings of anti-Russian tweets using the hashtag.

The DFRLab conducted a search in Meltwater Explore using the text of each of these twelve tweets and filtered the results to provide only those records that were retweets.

To rule out situations where an account retweeted one of the “copypasta” tweets highlighted above — which would contain the same text — the dataset was furthermore filtered using the “fingerprint” of each of the media files uploaded alongside the tweets. This is a unique identifier that Twitter assigns to uploaded media files, allowing the DFRLab to isolate retweets of the twelve posts it identified above.

Finally, this network was visualized using open-source graph network software Gephi.

The retweet network identified two distinct clusters. The first cluster, labeled in blue, is centered around the tweets posted on March 2, 2022. These tweets were retweeted and amplified mainly by accounts situated in the blue section of the network map.

A secondary cluster, labeled in orange, orbited a different set of tweets mainly posted on March 3, 2022. These were mainly retweeted by a different cluster of accounts, although there is some overlap between the two clusters.

This correlates with volume data from Meltwater Explore, which indicated that the tweets located in the blue cluster were mainly amplified on March 2, 2022, while the tweets from the orange cluster were amplified on March 3, 2022, matching a corresponding drop in volumes of the earlier tweets.

In addition, the accounts’ focus on these specific tweets appear to be coordinated — a stacked area chart of the volume of retweets over time shows distinct timeframes during which retweet volumes spiked before diminishing again.