Hashtag ESTexitEU, is being distributed by fake accounts connected to Russia

Propastop wrote about fake news distributed in the VK environment with the hashtag #ESTexitEU. The VK account named The Narva, posted news with photos that proved to be fake news when their background was checked.

The creation of this Hashtag

By studying the occurrence and spread of this hashtag, public sources suggest that the earliest reference to hashtag #ESTexitEU dates back to November 16, 2018 when three users published a picture on Twitter of a sticker which had the afore mentioned hashtag.

Heigo Ponn and Markus Roo published their postings with a photo showing a sticker with this hashtag on a metal pipe. Gennady Karpov however posted a photo with this sticker on a brick wall.

The next photo posting with this hashtag’s sticker, this time apparently from Tallinn, was posted from Heigo Ponn’s twitter account on 27. November. The posting shows a blurry picture of the hashtag sticker on a metal post. The Estonian Unit publishes this picture on twitter the same day.

Analyzing the accounts of the hashtag’s first postings, it is apparent that they all have the markings of being fake accounts. The supposed author of the first photo posting, Heigo Ponn is actually from the account of Aleksandr Gerasimov who lives in Nižni Novgorod.

Gennady Karpov’s twitter profile pictures are from the forum profile of Sergei Tatskii of Volgograd.

There is no internet background info on Markkus Roo and the Estonia Unit is an anonymous military themed account.

All four of the above mentioned twitter accounts were created at approximately the same time, in October or November of 2018.

Hate group on Facebook

At the end of December, Postimees published an article on the Facebook group, ESTONERS, who are actively and consciously disseminating messages that are meant to break up Estonian society. They are also one of the most active users of hashtag. The article inferred that the group is led by fake accounts.

We checked the authenticity of the group administrators mentioned in the Postimees article. We found that all of the accounts we checked were using someone else’s profile pictures and are absolutely fake accounts.

Oskar Kallas’s profile photo is found on Äripäev journalist, Askur Alas’es twitter account. Alas has confirmed that he is not the owner of the named account even though the picture is of him.

One of the account photos of an active group administrator, Oksana Söderholm is from the VK account of Anastasia Shefing who lives in Sosnogorsk. Another is from Karina Bogdanova’s VK account in Narva. Karina Bogdanova’s account on September 12. also shows a screen shot of Heigo Ponn’s hashtag twitter posting screenshot and she actively shares postings from the Narva website.

However, the photos in the FB group’s third administrator, Ivan Vasililev’s account are found on the VK account and Flirtic environment user David Satis. The fake Vasiliev has been noted on Facebook that he is actually the FB user Sandra Luik, whose profile photos come from different Social media channels and photo banks.

The profile pictures of the fourth administrator, Daniel Kaasik are mostly from Alexandr Baskov’s VK account.

These are just a few of the hashtag distributing individual’s accounts that we have controlled and that have all been proven to be fake accounts.

It is noteworthy that in October and November 2018, a larger number of fake accounts and webpages have been created on Social media channels to amplify the issues trying to break up Estonian society. They are deliberately or incidentally linked to Narva and mainly Russian materials have been used to create the accounts.

Propastop will continue to card and do background checks on the network and its accounts.

Photos: screenshots from social media environments