On August 24, an ostensibly Russian Twitter account with just 74 followers named “Lizynia Zikur” (handle @kirstenkellog_) posted an angry tweet attacking U.S. news website ProPublica as an “alt-left #HateGroup and #FakeNews site.” Within hours, the post was retweeted over 23,000 times. A second account followed up with a similar attack the following day.

The post from “Lizynia Zikur”. The account was suspended within hours of its post, but had already been archived.

Analysis shows that both attacking tweets were retweeted massively because they were amplified by a large, and probably rented, network of automated “bot” fake accounts, origin unknown.

The account which posted the original tweet was followed by accounts which started out in Russian-language; it may well have been of Russian-language origin itself. The account which posted the second tweet posed as a Russian-speaker, but seems to have used Google Translate to do so.

The major amplification was conducted by botnets whose primary purpose appears commercial. Their origin cannot and should not be attributed to any one group without further evidence.

English tweet, Russian account

The article which likely triggered the attack was one in which ProPublica assessed Russian and alt-right activity after the Charlottesville riots. Headlined “Pro-Russian bots take up the right-wing cause after Charlottesville,” the article drew, in part, on @DFRLab’s research.

ProPublica therefore shared a screenshot of the tweet with @DFRLab.

Screenshot of the post, shared by ProPublica.

The first question is the identity of the “Lizynia” account, and whether it is likely to originate from the Russian or English speaking world. Since the account reacted to an article criticizing both the alt-right and Russia, either is theoretically possible.

The tone of its (English-language) tweet was characteristic of the alt-right; the language of the account itself is Russian, and tagged to the town of Bagrationovsk, in Russia’s Kaliningrad region, near Poland and Lithuania.

“Lizynia’s” profile page, showing the location. The bio reads: “In a shop — Are those good toothbrushes? Yes, one a month is enough!” Note the follower number increased by two after its post. Archived on August 24, 2017.

There is no mechanism which would allow us to verify the location or identity. A reverse search of the profile picture did not return other results; a Google search for the name only returned copies of the same tweet.

One slight clue lies in the phrase “ProPublica is alt-left #HateGroup.” This is a non-native rendition: it omits “an”, which is a characteristic failing of Russian speakers, but also of other language groups. However, such phrasing is easily faked; it is too slender a thread to hang a conclusion on.

One thing which can be said is that the “Lizynia” user is singularly reticent. As of August 24, 2017, the account posted twelve tweets in its almost three-year existence; only one showed up on the profile, indicating that the others were already deleted. This is, in itself, curious; it also reduces the amount of evidence available.

Meet the “B” team bots

More can be deduced about Lizynia’s followers. Most appear to be automated “bots” in a small network, pre-programmed to amplify online messages; and this network does appear to originate in the Russian-speaking world.

@DFRLab viewed the account’s follower page before it was shut down, revealing a curious pattern: with one exception (an account which followed “Lizynia” after its final tweet), every single one of the 76 followers had a surname beginning with A, B or C, mostly B.

The “B” team. Screenshot of the archive of some of “Lizynia’s” followers.

The follower page has been archived, preserving some of the names: Marly Brideaux, Demi Bangs, Ona Buesnel, Jos Blofeld, Cilla Backshill, Juhana Blowin, Justinas Blunsom, Julijana Bloy, Hyacinth Bigby, Manel Breeton, Katlyn Boich, Eleanore Batch, Cedar Augie, Silas Cafe, Kelleigh Bollum, Jacinda Blackley and Kelebek Bollon.

These accounts have a number of features in common. They were created in 2014; they claim to be located in the United Kingdom; they only posted a few dozen times, but followed hundreds of accounts. Their handles do not match their screen names.