Infiltration and Coordination Evidence – The Case of funny7660



Funny7660, 121.88, 115.138 Same Entity Analysis

Introduction

Funny7660, 121.88, and 115.138 are core IPs connected to macro activity, which includes disinformation and physical threats. These IPs attack major figures, including Morse Tan, and spread violent messages, including assassination threats. Notably, 121.88 is the primary agent, uploading emotional audio recordings through the Funny7660 account, and 115.138 carries out assassination threats against Morse Tan. These actions suggest that All three (funny7660, 121.88, 115.138) are either the same person or part of the same organization, conducting coordinated, strategic disinformation and violent threats.


Before the emotional audio recordings were uploaded by Funny7660, there was a surge in disinformation targeting Morse Tan. Starting from the early hours of July 4, posts began accusing Morse Tan of being a Chinese national, and this disinformation campaign intensified significantly around 7 AM. The posts were extremely organized, with the same content being posted repeatedly across different IPs and accounts.
Archive : https://archive.md/qlu9W


The IPs used during this time were:

118.176
finally6985
211.236
211.209
117.123
funny7660
Working2073
112.148
49.1
115.140
zpzp00

At this point, Funny7660 and 121.88, along with 118.176, which has already been confirmed to be the same entity, as well as the other smaller accounts, begin their surge of posts. (It appears that all of these accounts are either the same entity or controlled by a small group of people.)



1. Key Evidence: Funny7660’s Audio Recordings

Funny7660 uploaded two audio recordings, unable to control its emotions. The key keywords from the recordings align with 121.88’s existing messaging and could also be connected to the assassination threats made by 115.138.


[record 1]




녹취 1

"큰게 오기는 씨발 서부지법 폭도새끼들아, 니네가 내란견이야. 조금 있으면 처벌 받을거다."


Audio Transcript 1

"Big things are coming, you fucking idiots at the Western District Court, you're the traitors. Soon, you'll be punished."



[record 2]




녹취 2

"고든창이랑 모스탄은 진짜 좆됐다. 얘네는 미국에서도 버림받은 카드인데 한국인들한테도 욕 존나먹고 교포들도 욕하고. 아마 누군가 조만간 찾아갈 수 있을거다."

Audio Transcript 2

"By the way, Gordon Chang
and Morse Tan are really fucked. These guys are discarded cards in the U.S., hated by Koreans and also disliked by the Korean community abroad. Someone might go after them soon."




2. The Connection Between 121.88’s Activities and Funny7660

121.88 is the core IP for macro spam and disinformation campaigns, and its activities are closely linked with the Funny7660 account. Specifically, using keywords like "Naerankyeon" (literally "insurrection dog"), "내란" (insurrection), "고든창" (Gordon Chang), and "모스탄" (Morse H. Tan) to attack and frame specific individuals is part of 121.88’s strategy. The keyword "Naerankyeon" has been used extensively in macro activities, with 121.88 posting it thousands of times as part of a campaign to undermine the credibility of targeted individuals by labeling them as traitors.

In addition, the phrase "큰 거" (literally "big things are coming") is another keyword used by 121.88 in sarcastic and mocking contexts. This phrase has been repeated thousands of times in the macro too.

Funny7660's audio recording, where "Morse H. Tan" and "Gordon Chang" are referred to as "좆됐다" (literally "really screwed"), matches 121.88's usual aggressive attack style. 121.88 frequently uses insulting language to undermine the credibility of individuals and distort public perception.

121.88 goes beyond online disinformation, extending into threatening messages that escalate into physical threats, which correlates with the incident where Funny7660 uploaded the second audio recording through an emotional outburst.



3. The Possible Collaboration Between 115.138 and Funny7660

115.138 is the IP that used physical threats with the phrase "Someone might come for them" against Morse Tan, and this aligns with Funny7660’s emotional outburst in uploading the second audio recording. The correlation between Funny7660's emotional outburst and 115.138's threatening messages strongly indicates coordination between the two.

Correlation Analysis
Funny7660 and 115.138 spread violent and threatening messages targeting the same individuals.

115.138 carried out assassination threats against Morse H. Tan in connection with Funny7660, and they jointly spread threatening messages. Funny7660 emotionally uploaded the recordings, showing that they were continuing coordinated disinformation efforts.


4. Possibility of Them Being the Same Entity


- Connection Between 121.88 and Funny7660
121.88 is the core IP for macro spam and disinformation campaigns, and its activities are strongly linked to the Funny7660 account. Funny7660 uploaded emotional audio recordings that align with 121.88's usual aggressive attack style, indicating that Funny7660 is not an isolated account, but closely associated with 121.88 in spreading disinformation and targeted threats.

In addition, the rush of attacks that occurred at the same time on July 4th, where Funny7660 and 121.88 launched a coordinated disinformation campaign targeting the same individuals, further indicates their connection. These attacks were repeated across multiple IPs and accounts, showing that both accounts are actively engaged in organized and cooperative activity.

- Connection Between Funny7660 and 115.138
The collaboration between Funny7660 and 115.138 becomes evident when looking at the emotional outburst by Funny7660, which aligns with 115.138's threatening messages targeting Morse Tan. The threatening nature of 115.138's messages and Funny7660's emotional recordings are connected, showing that both accounts are working in tandem to spread violent and coercive narratives.

- 121.88 and 115.138 Are Likely the Same Entity
Given the direct link between Funny7660 and 121.88, and the subsequent connection between Funny7660 and 115.138, it is highly likely that 121.88 and 115.138 are the same person or part of the same network. 115.138 appears to be a key player in the macro campaigns, regularly showing up in the disinformation activities associated with 121.88. The coordinated efforts across these accounts strongly suggest that 121.88 and 115.138 are part of the same entity or operation.





[Below are the past posts of Funny7660, recorded on July 3rd]