Suspicious Georgian accounts come for Twitter

Anti-Western Georgian actors are moving to Twitter — along with suspicious dormant accounts

(Source: EtoBuziashvili/DFRLab via nomadflag)

This story was published in partnership with On.ge. სტატია ვრცლად წაიკითხეთ აქ.

After U.S. Rep. Adam Kinzinger took to Twitter to reprimand the Georgian government publicly for its lack of commitment to democratic values, suspicious Twitter accounts seemingly based in Georgia accused the congressman of interfering in the country’s domestic affairs. One particularly prominent account appeared to be associated with a Facebook page called “Anti-liberal doctrine,” which is known to spread pro-Russian, anti-Georgian opposition, and anti-Western content.

The DFRLab has previously covered Georgian far-right and pro-government actors’ influence activities on Facebook, the most popular social media platform in the country. Now, in an apparent diversification of their strategy, these actors appear to be moving to Twitter as well. Despite the low platform adoption rate within Georgia, Twitter has become increasingly relevant to the country’s public discourse. The international community has used it to publicly reprimand the Georgian government for what many perceive as a backsliding in the country’s democratic culture and governance. That anti-Western actors have now turned to Twitter suggests that their primary target is an international audience as a means of bolstering Georgia’s reputation on the world stage, rather than targeting’s Georgia’s domestic audience.

The appearance of these accounts on Twitter, some of which appear inauthentic, also comes ahead of the October 2020 Georgian parliamentary elections, a time when the country is already increasingly polarized. Far-right discourse online opaque and inauthentic accounts risks further exacerbating this polarization.

Georgian accounts’ increased activity on Twitter

According to StatCounter, Twitter’s penetration rate in Georgia is around 10 percent, while for Facebook it is above 50 percent. The DFRLab has covered disinformation campaigns on various topics targeting Georgian society via Facebook, both domestically as well as internationally.

Even though Georgians use Twitter less than Facebook, U.S. policymakers and European officials have actively expressed concerns about recent political and civic developments in Georgia on the platform. Most recently, they criticized the Georgian government’s decision to forego promised democratic reforms, as well as its targeting of political opponents, media, and international corporations. The international community has also used Twitter to draw attention to reports of violence against peaceful protesters in the country, as well as to Facebook’s decision to shut down a network of accounts linked to the ruling Georgian Dream Party.

On January 21, U.S. Rep. Adam Kinzinger (R-Illinois), who also serves as co-chair of the Congressional Georgia Caucus, expressed concerns on Twitter over the Georgian government’s “political targeting” and “declining economic trend.” He noted that a bipartisan group of congressional lawmakers had sent a letter to Georgian Prime Minister Giorgi Gakharia to that effect.

U.S. Representative Adam Kinzinger’s tweet expressing concerns over democratic backsliding in Georgia. (Source: @RepKinzinger/archive)

Soon after the tweet, accounts using Georgian names accused the congressman of interfering in Georgia’s internal politics and having links with Georgian opposition parties.

Accounts with Georgian names accused Rep. Kinzinger of interfering in Georgia’s domestic affairs and having ties with Georgia’s opposition parties. In the top right tweet, “national regime” is used in reference to the main opposition party in the country, United National Movement. (Source: Twitter)

One of the tweets was posted by an account allegedly belonging to Baqari “Beqa” Vardosanidze, who has been identified as a member of anti-liberal group Georgian March by the Media Development Foundation and as a far-right activist by the Democracy Research Institute. He has been active on Facebook and is notorious for his anti-liberal statements and hate speech.

Following the interaction with Kinzinger’s tweet, the Vardosanidze account announced it was going to become more active on Twitter. The account was created in 2010 but had not been active until early 2020. The same tweet also linked back to Vardosanidze’s Facebook page.

Georgian far-right activist Baqari Vardosanidze announced his intention to become more active on Twitter, while linking to his Facebook page. (Source: @beqa23a/archive)

Two other accounts that interacted with the congressman appeared suspicious. They both had female Georgian names followed by eight-digit numbers, were created in January 2020, and had very few followers.

Accounts with Georgian names which targeted the U.S. Congressman were created in January 2020 and their names were followed by eight-digit numbers. (Source: Twitter)

One of the two accounts, @Pikria99437631, had tweeted only three times since its creation at the time of the analysis, all in reply to Kinzinger in the two weeks following his tweet regarding the letter.

The entirety of @Pikria99437631’s tweets, all in reply to Representative Kinzinger. (Source: @Pikria99437631/archive)

The other account, @ninonin56919210, has mostly tweeted anti-opposition and pro-government content concerning Georgia.

The account @ninonin56919210 tweets anti-opposition and pro-government content concerning Georgia. (Source: @ninonin56919210/archive)

Perhaps more interesting, however, was its constant amplification via retweets of the account @IRAKLI22414771, which joined Twitter in January 2020. The cover photo of the latter accounts read “Anti-liberal doctrine” (ანტილიბერალური დოქტრინა) in green letters in Georgian.

The cover photo of the Twitter user @IRAKLI22414771 read “Anti-liberal doctrine” (ანტილიბერალური დოქტრინა) in green letters in Georgian. (Source: @IRAKLI22414771/archive)

“Anti-liberal doctrine” moves to Twitter

@IRAKLI22414771’s tweets have been frequently retweeted by two additional Twitter accounts, one in English and one in Georgian, both named “Anti-liberal doctrine.” These accounts were also created in January 2020.

English and Georgian language Twitter accounts with the display name “Anti-liberal doctrine” were created in January 2020. (Source: Twitter)

The Twitter accounts appeared to be linked to a page by the same name on Facebook, which in turn was connected to the Twitter account @IRAKLI22414771. The Facebook page ანტილიბერალური დოქტრინა (“Anti-liberal doctrine”) usually posted anti-Western content, as well as content targeting opposition parties in Georgia. The page also had same cover photo as @IRAKLI22414771 on Twitter –text reading “anti-liberal doctrine” superimposed over news headlines and a photo of Merkel and Putin shaking hands.

The Georgian Facebook page “Anti-liberal doctrine.” (Source: ანტილიბერალური დოქტრინა./archive)

The Facebook page posted a video in which an individual named Irakli Jankarashvili identified himself as the owner of the page.

In the video posted to the Facebook page “Anti-liberal Doctrine,” an individual referring to himself as Irakli Jankarashvili said that he managed the page. (Source: ანტილიბერალური დოქტრინა./archive)

The person in the Facebook video and in the Twitter profile photo of the user @IRAKLI22414771 appeared to be the same individual, suggesting that the Facebook page with a penchant for spreading anti-Western and anti-liberal narratives had moved to Twitter with at least three different accounts: the “Anti-liberal doctrine” accounts in English and Georgian and that of the page owner, @IRAKLI22414771.

The same individual appeared in the video posted by the “Anti-liberal doctrine” Facebook page and the Twitter profile photo of the user @IRAKLI22414771. (Sources: Facebook and Twitter)

Dormant accounts

An analysis using the Twitter analysis tool Tweetbeaver showed that @IRAKLI22414771 followed around 70 suspicious accounts. The account also follows some politicians and news agencies.

Many of the suspicious accounts were created in January and February 2020. The handles of more than half of them were followed by eight-digit numbers — alphanumerical handles are one of the main indicators of accounts engaging in bot-like behavior. Moreover, their activity on Twitter was zero or close to zero, and their number of followers was also close to zero.

Since these accounts had extremely limited activity, it was difficult to assess what their purpose was or whether they were automated. The similarity in the creation dates, handle pattern, and Twitter activity raise the possibility that they may be dormant inauthentic accounts created as part of a botnet.

Examples of Twitter accounts that have Georgian names, handles with eight-digit numbers, January 2020 creation dates, and that have zero or close to zero activity. (Source: Twitter)
Some of the Twitter accounts followed by @IRAKLI22414771 with Georgian names, creation date and activity. (Source: @EtoBuziashvili/DFRLab via Tweatbeaver)

On Twitter, it is common that bot accounts to follow influential accounts, who in turn follow these automated accounts back — a courtesy known as a “followback.” In theory, this could explain why @IRAKLI22414771 follows these suspicious accounts. The dormant accounts, however, do not currently follow @IRAKLI22414771, raising questions on why @IRAKLI22414771 would follow them.


Eto Buziashvili is a Research Associate, Caucasus, with the Digital Forensic Research Lab and is based in Georgia.

This research is part of the #ElectionWatch Georgia project in partnership with On.ge, made possible through support from East-West Management Institute (EWMI) and US Agency for International Development (USAID). Contents of this report are the sole responsibility of the author and do not necessarily reflect the views of EWMI, USAID or US Government.

Follow along for more in-depth analysis from our #DigitalSherlocks.