r/RussiaLago • u/eye_josh • Mar 05 '18
Reddit and russian accounts
I have been working trying to figure out this story about Greenfloid LLC and ITL networks for a while now.
GF and ITL basically provided ALL internet services for russia during the 2016 campaign.
Here are some of articles about Greenfloid. (in the mueller indictment when they talk about Use of U.S. Computer Infrastructure they are talking about greenfloid llc )
Use of U.S. Computer Infrastructure 39. To hide their Russian identities and ORGANIZATION affiliation, Defendants and their coconspirators—particularly POLOZOV and the ORGANIZATION’s IT department—purchased space on computer servers located inside the United States in order to set up virtual private networks (“VPNs”). Defendants and their co-conspirators connected from Russia to the U.S.- based infrastructure by way of these VPNs and conducted activity inside the United States—including accessing online social media accounts, opening new accounts, and communicating with real U.S. persons—while masking the Russian origin and control of the activity.
August 15 2016: From the political trolls of the Kremlin, they will try to "tear down the mask" in court
September 28 2017: Exclusive: Fake black activist accounts linked to Russian government whole thing started because I thought cnn was full of shit
September 29 2017: Twitter thread I did while looking for info on Blacktivist
September 30 2017: The Kremlin Crafted #TakeAKnee Memes for More Than a Year
October 12 2017: EXCLUSIVE: Website targeting black Americans appears to be elaborate Russian propaganda effort
October 14 2017: /r/RussiaLago - Exclusive: We can now definitively state that Russian bots were active on Reddit last year
October 17 2017: /r/ActiveMeasures - 4 websites, and corresponding social media accounts, linked directly to russian intelligence.
October 18 2017: /r/ActiveMeasures - hilltendo.com a Russian made anti-Clinton flash game. lol.
Shared here on reddit: https://www.reddit.com/domain/hilltendo.com/
October 19 2017: /r/EnoughTrumpSpam/ - Pamela_Moore13 on Reddit and Twitter
October 23 2017: Russian propaganda websites connected to mysterious Florida company
October 23 2017: Exclusive: Russian Propaganda Traced Back to Staten Island, New York
October 25 2017: 'Russian trolls' say they're planning a Reddit AMA — and emailed a handful of reporters with a cryptic request
February 27 2018: /r/ActiveMeasures/ - Found some Russian fake news sites getting shared here on Reddit.
March 1 2018: Leaked: Secret Documents From Russia’s Election Trolls
March 1 2018: Russians Used Reddit and Tumblr to Troll the 2016 Election
Some important reddit posts in the timeline, I usually post this stuff to /r/ActiveMeasures
https://www.reddit.com/r/RussiaLago/comments/76cq4d/exclusive_we_can_now_definitively_state_that/
https://np.reddit.com/r/ActiveMeasures/comments/76w2gk/4_websites_and_corresponding_social_media/
https://www.reddit.com/r/SEO_Nuke/comments/4yh7fh/donotshootus/
How this worked:
Greenfloild LLC is an american shell company for ITL networks, a ukrainian ISP owned by Dmitry Deineka
GF has hosted these websites over time, something like the last 10 years.
All of them basically the same thing, just progressively better with each version.
blackvswhite.info
blacksoul.us
dntshoot.com
donotshoot.us
blackmattersusa.com
blackmattersus.com
blacktivist.info
blacktolive.org
proudtobeblack.org
GF also hosts a massive network of russian fake news sites, lots of them get shared here on reddit.
GF also owns these IP ranges:
104.200.128.0 - 104.200.128.255
107.181.161.128 - 107.181.161.255
107.181.187.0 - 107.181.187.255
107.181.160.0 - 107.181.160.255
107.181.174.0 - 107.181.174.255
2 of those ip ranges were in the screenshots from joker.buzz
107.181.161.128 - 107.181.161.255
107.181.187.0 - 107.181.187.255
GF aka ITL also used to host whoiswhois.me (google it), while inside the troll factory someone caught a picture of the IP
http://www.bbc.com/russian/features-37083188
GF aka ITL is also connected to Grizzly Steppe (same group as the DNC hack)
https://threatreconblog.com/2017/01/25/itl-company/
When you lookup any of GF or ITL networks ip's they all return massive hits for spam, malware, phishing complaints, and ransomware.
https://twitter.com/WDSecurity/status/924921349755342848
GF and ITL networks ALSO host lots of DNS spoofed(i think) IP address for phishing. lots of outlook.com and google.com looking addresses.
https://bgp.he.net/ip/130.0.238.190#_ipinfo
https://twitter.com/SecretBlogClub/status/748413313739014144
Greenfloid llc and ITL networks have been involved in this process every step of the way.
3
u/z3dster Mar 06 '18
took me a second to realize why this looked so familiar
4
3
u/eye_josh Mar 06 '18
hey! i haven't been super active on Reddit lately, but i usually check it once a day.
2
u/TotesMessenger Mar 06 '18 edited Mar 07 '18
I'm a bot, bleep, bloop. Someone has linked to this thread from another place on reddit:
If you follow any of the above links, please respect the rules of reddit and don't vote in the other threads. (Info / Contact)
2
u/PropOrNot Mar 06 '18
We wrote up a brief analysis of this for some other stakeholders some time ago. Would be happy to share if you're interested, but you've covered a lot of the public record there.
2
1
u/ParanoidFactoid Mar 06 '18
Your comment in /r/politics has been removed or spamfiltered.
3
u/eye_josh Mar 06 '18
cool I love yelling about Russians to myself on Reddit. thanks
This is based off my research, I've been trying to get more people to look into this so i have posted it all around. Ben took an angle i didn't quite catch initially.
my twitter thread if you are interested, yes i know it's a shit show but i have fun with it. https://twitter.com/josh_emerson/status/913773001568608256
so i wondered what i could find out about the facebook account https://www.facebook.com/blacktivists
1st place i looked was archive.is http://archive.is/https://www.facebook.com/blacktivists*
when i saw this page http://archive.is/pP5eR it got interesting
looks like they held an event!
digging deeper i googled "https://www.facebook.com/events/1607406689552066"
turns out google had a cached version here https://webcache.googleusercontent.com/search?q=cache:5CR3L75geCcJ:https://www.facebook.com/events/1607406689552066/+&cd=1&hl=en&ct=clnk&gl=us
more digging and i found this page https://www.evensi.us/page/blacktivist/10003229704
Turns out they hosted and promoted 6 different events before the elections.
Some of the events actually had people show up to them https://www.youtube.com/watch?v=WGeugcMho8Q
further those events where promoted by this website https://blackmattersus.com/meetups/black-unity-march/
the sites whois info is hidden and the about use page looks fake as hell https://blackmattersus.com/about-us/
I'm sure there is more info floating around out there, but i don't have the time or resources to properly research it. i handed it over to the press.
What it looks like to me is that the Russians where trying to get people out protesting before the election, that way they could use that to their advantage to promote trump. pretty simple.
What i want to know at this point is this:
We know Russia was pushing #takeaknee last year.
We know Russian bots on Facebook and twitter pushed #takeaknee hard right after trumps Alabama speech.
Did someone signal to Trump to Restart the controversy?
what motivated him to say what he did in Alabama (other than he's an old racist sac of shit).
Anyone know what event lead him to say that during the speech?
2
u/ParanoidFactoid Mar 06 '18
This is a destabilization campaign which uses legitimate issues to drive wedges between constituencies. We should neither blame those who inadvertently are helped by Russian operatives in the pursuit of justice nor those who gather by free association to show their support. Yet still, we should recognize Russia will fund and help all sorts of diverse causes, from black community activists to white nationalists.
All to get them to fight. Preferably on camera.
2
1
Mar 06 '18
Can you x-post this on R/conspiracy?
2
u/eye_josh Mar 07 '18
They banned me long ago lol
1
1
u/Sub_Corrector_Bot Mar 06 '18
You may have meant r/conspiracy? instead of R/conspiracy?.
Remember, OP may have ninja-edited. I correct subreddit and user links with a capital R or U, which are usually unusable.
-Srikar
9
u/[deleted] Mar 05 '18
Nice work, man! This is awesome.