A Ukrainian politician’s ghost army of mysterious YouTube fans

Pro-Kremlin politician Victor Medvedchuk regularly posts YouTube videos receiving comments from accounts exhibiting potentially inauthentic behavior

(Source: @r_osadchuk/DFRLab via kremlin.ru, YouTube)

Mysterious accounts potentially exhibiting inauthentic behavior posted supportive comments under the YouTube videos of a Ukrainian pro-Kremlin politician, in a possible attempt to astroturf support for him before upcoming elections. The commenters displayed multiple indicators of inauthentic behavior, such as identical creation dates and similar commenting patterns.

The politician, Victor Medvedchuk, is a U.S.-sanctioned oligarch and veteran Ukrainian MP who served as head of the presidential administration from 2002–2005. Medvedchuk has business connections to Russia, where his family owns oil refineries. Putin is also the godfather of Medvedchuk’s daughter. Over the years, Medvedchuk has consolidated a powerful media empire in Ukraine that includes several TV channels and promotes certain politicians. He currently faces a significant local election on October 25, where he leads the pro-Russian party Opposition Bloc — For Life. The inauthentic YouTube comments may be an attempt to shore up support for him ahead of the elections.

Victor Medvedchuk, the YouTube channel

The Victor Medvedchuk YouTube channel was created on March 21, 2019 and had more than 71,000 subscribers as of October 15, 2020. The channel does not have a “verified” badge, but there are several details that suggest the channel is connected to Medvedchuk.

First, the channel is featured on ZIK’s ratings of the most popular political YouTube channels in the country. ZIK is a Ukrainian TV channel that Medvedchuk controls through his ally, Taras Kozak. ZIK reprinted the rating from the 1News information agency, which does not disclose its owner. The only difference between the two is the links to YouTube channels from the top list. ZIK used direct links to each channel, whereas 1News used the URL-shortener go.112.ua, which is notably used primarily on content from 112 Ukraine, which Medvedchuk owns, suggesting some connection between these media outlets.

The comparison of hyperlinks from 1News information agency (on the left) and ZIK (on the right) with the links and associated web addresses highlighted in green and blue boxes. (Source: 1News/archive, ZIK/archive)
Google search of “go.112.ua” links with usage on the official site of 112 Ukraine in blue boxes, and their official YouTube channel in green boxes. (Source: @r_osadchuk/DFRLab via Google)

Additionally, the Victor Medvedchuk channel promotes the channel of his wife, Oksana Marchenko. This channel has links to her official social media accounts on Instagram and Facebook, with tens of thousands of followers. It adds up to the channel’s credibility as the Medvedchuk-connected account.

Comments and commenters

To analyze the authenticity of comments, the DFRLab picked five recent videos from Medvedchuk’s channel posted in July and August 2020 that had at least 120,000 views and more than 400 comments. The majority of the 2,427 comments under these videos supported Medvedchuk, either praising his leadership or criticizing his opponents.

A table of analyzed videos. (Source: @r_osadchuk/DFRLab)

To analyze the data further, the DFRLab scraped the channels that commented under each video and “de-duped” them, e.g., leaving only unique accounts to avoid repetition. Subsequently, we analyzed how many commenters on each video also commented on other videos posted by the channel, as shown in the table below. For example the row value of “Video 1” under column “Video 2” means that 91.88 percent of all unique commenters for Video 1 also commented on Video 2.

Percentage of common commenters across pairs of the five analyzed videos. (Source: @r_osadchuk/DFRLab)

A high percentage of common commenters across similar videos may be a coincidence, or simply the result of a hardcore online fanbase. But there were other signs of inauthenticity across many of the accounts engaged in commenting: the vast majority of accounts did not have profile pictures, and a smaller fraction of accounts used anonymous photos, such as images of sea creatures, architecture, or natural scenery.

Examples of YouTube accounts that comment under Victor Medvedchuk’s videos. (Source: video/archive)

The DFRLab then collected creation dates for all of the unique accounts that commented on the five videos. Overall, 428 unique accounts were responsible for the 2,427 comments across all five videos combined. The distribution of creation dates is pictured below. For the sake of clarity, the graph shows only creation dates that repeated at least twice.

The distribution of creation dates for commenter accounts. (Source: @r_osadchuk/DFRLab)

The majority of accounts were created in April 2019 in the weeks following the channel’s launch, including 58 on April 5 alone. At least 198 accounts were opened within a two-week period in April 2019, roughly one month after the creation of Medvedchuk’s channel. The common creation dates are not a definitive indicator of inauthentic behavior, but if accounts were created independently, we would expect their creation dates to be more evenly distributed over time.


Roman Osadchuk is a Research Assistant, Eurasia, with the Digital Forensic Research Lab.

Follow along for more in-depth analysis from our #DigitalSherlocks.