Case I Analysis: Naerankyeon” (내란견, literally “insurrection dog”) Keyword
Spamming Analysis




This analysis covers the results of spam posts containing the "Naerankyeon" keyword from July 4 to July 11, 2025, over a span of 8 days.



Key Findings:


- A total of 48 unique IDs (IP or ID) were used, and 366 spam posts were made.


-Posts using this keyword advocate for anti-liberal and pro-communist stances, mocking patriots as "traitor dogs."


- The phenomenon of shared file names suggests that a significant number of accounts may be related to 121.88.


- Over 80% of these accounts are likely 121.88 themselves, while the remaining accounts are presumed to be operated by the same company or organization.


- On July 11, 2025, at 14:08, a captured page showed that out of 42 total posts, 21 were spam posts related to manipulation. This is just a snapshot, and during the early hours, the proportion of spam posts exceeds 90%.



This analysis suggests that the activity is part of a coordinated effort to manipulate public opinion and spread specific political messages, with 121.88 likely at the core of this operation, with other accounts acting as supplementary agents. Further investigation is needed.





IP Count Summary table  (25-07-04 ~ 25-07-11)
“Naerankyeon” (내란견, literally “insurrection dog”) Keyword



IP or ID Total Count
58.140 96
121.88 84
120.142 34
ㅁㅁ(limit386) 27
118.176 24
221.138 17
112.171 9
118.40 6
61.2555
121.655
211.1194
찢-갈-이-아-님(pair5983)4
이재명그는신인가?(breast3371)4
ㅇㅇ(dldbrud23)4
121.1583
175.1133
ㅇㅇ(cling0183)3
175.2093
218.552
220.802
ㅇㅇ(stamp4748)2
ㅇㅇ(exceed6600)2
121.1622
ㅇㅇ(friend2158)2
평화와사랑(snowy2549)2
ㅇㅇ(clear7820)1
ㅇㅇ(teacher7657)1
112.2161
211.2431
61.351
58.2251
ㅇㅇ(manager5964)1
ㄱㄱ(61.85)1
116.341
개인식별코드(amtonglyeong)1
사회엘리트(ymphony4770)1
1.2111
ㅇㅇ(within2059)1
218.481
fancyha01021
천♡멸♡두♡창(profile7407)1
39.1221
59.111
124.591
117.551
222.1121
58.291
날아라돈까스(ease9463)1
정떡용계정 (frood5959)1





Evidence of Coordinated Activity: Shared File Names Across IPs


Evidence 1: 121.88, 58.140, and 118.176





https://gall.dcinside.com/mgallery/board/view/?id=uspolitics&no=2181930

<<부록>> 첨부파일명마저 동일한 3개의 ip118.176121.88그리고58.140https://m.dcinside.com/board/uspolitics/2166999 매크로 여론조작범죄집단 대표 121.88의 실체 - 미국 정치 마이너 갤러리오늘 16시 08gall.dcinside.com


Archive : https://archive.md/PWAIF




1) IP Address: 121.88


Post Date/Time: July 1, 2025, 14:49:04


ARCHIVE: https://archive.md/5YVwM


2) IP Address: 58.140


Post Date/Time: July 2, 2025, 18:03:24


ARCHIVE: https://archive.md/lLkuO

3) IP Address: 118.176


Post Date/Time: July 4, 2025, 10:59:07


ARCHIVE: https://archive.md/kQ9hK



Evidence 2: 58.140, 121.88


1) IP Address: 58.140


Post Date/Time: July 11, 2025, 18:50:21


ARCHIVE: https://archive.md/g702B



내란견 두!창견 망상견 마약견 신나는 노래그냥 웃기쥬ㅋㅋㅋㅋㅋㅋㅋㅋㅋ중국 망무세 고든창 안오쥬ㅋㅋㅋㅋㅋㅋㅋㅋ병신들gall.dcinside.com




78e59e77b18278eb2e9e98a518d604038d0de92c2c1f9077c326



78e59e77b18275873cf1c6bb11f11a3990f5f0ea7e90b6



2) IP Address: 121.88


Post Date/Time: July 11, 2025, 10:57:41


ARCHIVE: https://archive.md/W3hTj





7cef8168bd8a75e64ff1c6bb11f11a3997367050c9a374c705



7cef8168bd8a75a723ed98a518d60403c4e11e72aee41f85




Evidence 3. 120.142, 118.176


1) IP Address: 120.142

Post Date/Time: July 5, 2025, 14:52:34

ARCHIVE: https://archive.md/nVSzs




7cef8068b4866ae64cee98a518d6040321d93e516581d5402f91



7cef8068b4866a843cf1c6bb11f11a393e469c63d26890



2) IP Address: 118.176

Post Date/Time: July 4, 2025, 09:20:15

ARCHIVE : https://archive.md/uzwzp

archive.mdarchive.mdarchive.md




7cec8868b4856eeb4cee98a518d604032df72a0009b5458bd97c



7cec8868b4856ee64ced98a518d60403568fb615e179bbe8




Evidence 4 : 125.128, 58.140. 118.176, 121.88 - Same file



Archive : https://archive.md/ZRmUd

https://gall.dcinside.com/mgallery/board/view/?id=uspolitics&no=2180345&search_pos=-2196706&s_type=search_subject_memo&s_keyword=%EB%82%B4%EB%9E%80%EA%B2%AC&page=3
마크롱 대통령 부정선거 심각성 인지 모스탄과 회동하겠노? 병신 내란견새낔ㅋㅋㅋㅋㅋㅋㅋㅋㅋㅋㅋㅋㅋㅋㅋㅋㅋㅋㅋㅋㅋㅋㅋㅋㅋㅋㅋㅋㅋㅋㅋ - dc official Appgall.dcinside.com



The evidence provided above is merely a sample and represents only a tiny portion of the overall evidence.

Through thousands, if not tens of thousands, of spam posts, the same content and files have been repeatedly circulated, showing the scale of this coordinated effort to manipulate public opinion. This activity highlights the need for further investigation to fully understand the extent of these actions.







08aec42fe8d32ca36afff2bc05c5363491750336f7190edfca8ca8d35e3c9bab777d46a25e4333ec11b465a6f984f118630da03748efe3f0



The graph above visualizes the estimated distribution of approximately 1.5 million total posts over the past two years, categorized as follows:



- Macro Posts: Estimated between 100,000 to 200,000 macro posts, with both the lower and upper bounds displayed.


- Manipulation Posts: Approximately 800,000 manipulation posts, excluding macro posts.


- Deleted Posts: About 24% of all posts, estimated at 360,000.


- Remaining Posts: Estimated at 640,000 posts, assumed to be created by regular users.


- Total Posts: A total of approximately 1.5 million posts.



This structure provides a clear breakdown of the ratio between manipulation, user-generated content, deleted posts, and the overall post count.