Where it all started: first link

In June 2018, a mostly inactive Twitter account @viepepere (archived link) sent a threat message to @_rabbindesbois_ (French individual known for being a former Dark Net vendor according to his recent book). The now deleted tweet read, in Russian, “ Мы знаем, что вы делаете. Вы не должны были говорить. Глаза на вас. Руки скоро.” which roughly translates to “ We know what you’re doing. You were not supposed to tell/say. We are watching you and will react fast.”. According to a Russian-speaking friend, the word structuring is odd, this could either mean the person doesn’t know Russian well, used Google Translate or is from a former USSR country.

That alone could make for another story, but let’s focus on that particular account for a minute.

Weird mix of French and Russian, don’t you think? — Screenshot shows last activity (14 April 2017 and the Russian tweet of 13 June 2018)

Twitter OSINT

“viepepere” (French for “vie pépère”) means “CushyLife”

At first glance this account appears typical, we see a young French girl, apparently living in Paris (the cover picture showing the Eiffel Tower by night and the background of his profile picture showing Haussmannian buildings are available cues).

Looking more closely we observe that she is Muslim (as written in her profile description) and consistently trolling far-right activists by sending hatred messages, using hashtags like #musulmans (#muslims), #Marine2017 (far-right candidate), #islamophobie, #islam, etc.

So far, nothing too odd for Twitter, we all know trolls are pretty common on this social network and things can be a little heated. But something about her profile picture looks wrong…

A reverse Google Images search gives nothing in particular, so this is most likely a unique image (not ripped off from another profile).

No need to be a Photoshop expert to recognize the girl has been cropped or was behind some kind of green screen, we can notice a weird noise/glitch effect around the hair. We can confirm that the picture has been tampered with by looking at the difference between error levels, notably the same colors in the picture are showing different error levels (which is abnormal):

Error level analysis via FotoForensics

Now for any non-Parisian this may not seem obvious but she’s indeed in Paris. The careful observer might recognize the Pont d’Iéna in the bottom-left and the tall Grenelle towers in the background.

GEOINT to the rescue! Google Maps is a fantastic tool for that, and we can pinpoint the exact location where this picture was supposedly taken: near the the Hôtel Shangri-La at 10 Avenue d’Iéna, Paris.

Approximate location where the the profile picture was taken (10 Avenue d’Iéna, 75116 Paris, France)

Searching for the hotel gives this image as a first result

Profile picture and Google image are fitting (almost) perfectly

It’s a match! We can confirm the background is a photograph taken from the Terrace Suite room at the Hôtel Shangri-La.

Notice the matching clouds. Apparently the original image was resized/modified/rotated to some extent (maybe as a protection to avoid reverse-search detection?). This proves that the profile picture is fake and was carefully edited to make it look real.

Now what about the content of this account, you might ask. Well, it’s filled with hate messages targeting the French far-right:

“a good fascist is a dead fascist”

“But what are you talking about buffoon? 3 Muslims? What is this? If you come to talk shit, get out faggot!”

When an antifa befriends a far-right activist

One of the most mentioned and retweeted user is @oummoriste (archived link), quite at the opposite of the @viepepere persona. This ‘oummoriste’ account appears to be a far-right sympathizer, with a few Islamophobic tweets (“ISLAM GO TO HELL !”).

Both linked and being operated by the same group/person?

They both use a lowercase screen_name but all upper case displayed name “ISLAM, MON AMOUR” and “VIVE MARINE”;

Both accounts were created a few days apart on 1st of October and 2nd of October 2016;

Both are only using the Twitter Web Client (as seen from metadata);

Both are sending messages on and about French election topics such as (and mainly) immigration and islam;

They follow each other;

Both interacted with each other in a weird and awkward way;

They share the same activity calendar (see below);

Both are using similar e-mail address lo****@gmail.com:

Interactions and activity

The viepepere “galaxy” of interactions

The two personas will interact with each other the most, but also with lots of alt-right and far-right activists (“fachosphère” in French) — notably quite a few suspended accounts now (@AigleDissident, @corsica_lena, @JeremPatriote, …). They both interacted with approximately the same number of accounts (respectively 93 and 88 accounts for @viepepere and @oummoriste), which could mean they were both tasked the same workload on this propaganda mission.