Coordinated Keyword Manipulation and Provocation Tactics





1. Overview


This report analyzes the linguistic and behavioral patterns used in ongoing macro-based psychological operations, particularly on the US Politics board of DCInside. Multiple identifiers (such as IPs 121.88, 118.176, 180.230, and 58.140) and aliases (e.g., "기독교는앵벌이", "엳돌", "굥이놈", “갓물주”, “한국공산당”) are engaged in a coordinated campaign of repeated provocation, misinformation, and social destabilization via automated and semi-automated accounts.




1) Core Keywords and Their Functions



- Main Keywords Used:



① “두1창”: A derogatory variation of “윤두창” (used to mock President Yoon Suk-yeol). Variants include “두23창,” “윤/두창,” “두창이,” etc., to avoid detection.


② “내란견”: Suggesting the president is a traitor or responsible for insurrection.


③ Religious Slurs: Particularly targeting Christianity, including terms like “이만희,” “앵벌이,” 


④ Personality Attacks: Targeting specific political and cultural figures: Trump, Morse Tan, Yoon Suk-yeol, etc.


⑤ Divisive Language: Posts designed to trigger generational, gender, or ideological divisions (e.g., 4050 vs. MZ, men vs. women).




These keywords are not merely provocative but are weaponized in psychological operations, aimed at:



- Creating a toxic environment to drive out genuine users.


- Baiting users into emotional responses.


- Justifying eventual account bans, resets, or narrative shifts.



2) Operational Strategy Breakdown



Macro users utilize a cyclical infiltration strategy with five stages:


① Impersonation — Pretending to be a moderate or typical user (e.g., “미정갤러” identity).


② False Support — Feigning support for one side (e.g., praising 윤석열 while attacking opposition).


③  Seeded Disruption — Inserting toxic comments or fringe narratives (e.g., anti-US sentiment, conspiracy framing).


④  Reveal and Retreat — Once exposed, the account becomes extreme, then vanishes.


⑤  Recycling Accounts — A new alias or fixed-name (고닉) is created, and the cycle repeats.



Examples include dozens of identically named accounts like “기독교는앵벌이,” “한국공산당,” and “갓물주,” reused across waves.



3) Cloning, IP Shifts, and Cross-Account Behavior


- IPs like 121.88 and 118.176 are directly connected to psychological attack posts.


- The same actors switch IPs mid-conversation (e.g., 121.88 → 58.140) and reuse filenames.


- Past macro operations include use of 180.230.


- Hundreds of posts with impersonation tactics were deployed using copied user IPs.




4) New Forms of Religious Distortion


- New macros mimic religious arguments, using AI-generated texts or fragmented theological points to distort Christianity.


- Specific accounts repeatedly deploy the phrase “이만희” to associate users with cults or fringe groups.




5) Evidence of Strategic Deletion and Tampering


- Macro operators regularly delete posts once exposed.


- Archive snapshots confirm multiple deletions after keyword detection or user backlash.


- In some cases, board moderators appear complicit, with suspect posts vanishing within minutes of exposure.


This indicates not just rogue users but a systemized attempt at narrative control and evidence destruction, possibly in cooperation with internal platform moderation.




<Next: [EV07-03] Case I >