The Rabbit Files 5.0: A Flood Approaches

Approximately two weeks after the Shadow Brokers showed up and the 2016 Future of Cyber Security Europe announced that Guccifer 2 was going to appear via livestream at their September 13th event, members of the hacking collective, Anonymous, decided to start a #FreeMartyG campaign in support of Marty Gottesfeld, a hacker who was prosecuted for defacing the Boston Children’s Hospital’s website after the hospital allegedly mistreated one of their patients. The #FreeMartyG campaign announcement was written by @raincoaster, a long-time associate of Ray Johansen, the “hacktivist” mentioned in The Rabbit Files 4.0 for being closely related to and/or one of the administrators of the recently-suspended (and conveniently-timed) Twitter account, @Anonscan (Anonymous Scandinavia). He’s also the same guy who said that he received documents from Guccifer 2 via a whistleblower platform called

The #FreeMartyG announcement was released through the website,, shared by the largest Anonymous account on Twitter (@YourAnonNews), and liked by the Anonymous Scandinavia account. On November 15, 2016, Johansen himself tweeted to the @FreeMartyG Twitter account that he was “but one of the great ppl lucky enough to be able to be a part of supporting Lauri [Love] and Marty. God bless.” 

Four months later, at the start of January 2017, Beth Bogaerts (@HumanOfMind), an associate of both White Rabbit and Johansen, started campaigning for Gottesfield, as well (i.e. here, here , and here). It appears that she did so alongside someone who uses the name “Weda” (@dapaeple), another longtime associate of both Johansen and Aaron Kesel (@CensoredAK, @An0nAKn0wledge), another guy previously mentioned in The Rabbit Files for churning out endless disinfo (lies), usually in an effort to make activists believe things about him that are absolutely not true in order to gain sympathy and (false) credibility. For example, he claimed that he saw the unencrypted DNC emails before WikiLeaks published them, he introduced Guccifer 2 to Protonmail, and says that he was mentioned in both the Maria Butina case and the Mueller report (he wasn’t).

As for Gottsfeld, the case against him appears to be one of injustice but he isn’t one of the more well-known hacktivists to be imprisoned such as Jeremy Hammond who was recently released, so it remains unclear how Bogaerts, seemingly with no previous ties to the hacking community, got involved in this. Additionally, the @FreeMartyG Twitter account only follows approximately 350 people including Johansen, Bogaerts, @raincoaster, @YourAnonNews, and Weda.

At one point, Bogaerts was so dedicated to the cause that she made another Twitter account, @maat2053, to use for the campaign stating, “Hey guys I made an alt account for #FreeMartyG if you also want to follow me there…” What’s strange is that the @maat2053 account already existed in 2016, so it’s unclear if someone dropped the handle and Bogaerts picked it up in January 2017, or if this was yet another sock account she created and then repurposed later. 

This is also the same Twitter account that she later gave to Trish Negron before the White Rabbit thumb drive debacle. On or about March 17, 2017, Trish’s @panegron account was suspended so Bogaerts gave her the “MartyG” account. According to Trish, the two of them had known each other since 2016, and were working on a project together called U.S. News Corp.

After the White Rabbit debacle where White Rabbit deceptively led Jason Goodman, George Webb, and Trish to believe he had the Seth Rich thumb drive, Bogaerts deleted the @maat2053 account so Trish could no longer use it to promote the “Seth Rich files.” This, despite the fact that it was Bogaerts’ own friend who deliberately misled the three of them.

Bogaerts’ handle has changed a number of times over the last few years and at the time of the screenshot below, she was using @foxfire2112. She also used her GAB account to promote the #FreeMartyG campaign:

For the sensitive types, there’s no inference in this article as to how close any of these relationships were in nature except Johansen’s comments below about his online relationship with Bogaerts. Nor am I suggesting a conspiracy of some sort unless there’s something these actors would like to share with my audience. And there’s certainly nothing wrong with advocating against an unjust situation. I’m simply noting that all of these individuals were running in the same circles as early as January 2017, if not earlier, and at the very least they were each aware of one another or knew at least one other individual within this hacktivist crowd. In fact, seven days after Bogaerts started campaigning for Marty, on January 10, 2017, Weda announced:

“Yet again we are humbled, @foxfire2112 [Bogaerts] joining our team as an Editor 2017 is going to be a really good year…fides infintum.”

Yet again? Is this in reference to the #FreeMartyG campaign or something else? And what exactly she became an editor of is unknown, perhaps it was Weda’s own website,

February 2017: Vault 7 and Tracy Beanz

Bogaerts carried out the campaign for Marty on full octane throughout most of January, leading up to the Vault 7 hysteria that hit the following month. On February 1, 2017, WikiLeaks released an insurance file for the Vault 7 publication, after which the Anonymous Scandinavia account (@AnonScan) shortly followed suit. In fact, @AnonScan made it appear that “they” were closely connected to Julian Assange and they carried on this appearance with others in private. I’m not saying that at least one individual behind the account wasn’t connected to Assange, I have no idea. I’m simply pointing out how the account clearly wanted to be perceived by others which was in the exact same manner that everyone accused Thomas Schoenberger of doing.

Three days after the insurance file dropped, WikiLeaks started posting hints every day like “What is Vault 7?” and “Where is Vault 7?” and everyone should have seen NSA malware and hacking tools coming—or at least those who were following WikiLeaks back in 2016 should have seen them coming (and failed to tell the rest of us in 2017). As I noted previously, after the Shadow Brokers started leaking NSA cyber weapons in August 2016, WikiLeaks responded that they had a “pristine copy” of their own that they would be releasing. They never did release what the Shadow Brokers released but Vault 7 was, indeed, a massive tranche of documents pertaining to the NSA’s cyber warfare arsenal. 

Some of the accounts that @AnonScan was following in July 2017

It’s almost comical now to think about how many of us were trying to guess what Vault 7 was going to be about and it would be interesting for someone to go back through the Vault 7 documents to compare them with all the hints that both WikiLeaks and @AnonScan dropped, most of which you can find on my website. With that said, it should also be noted that even if Anonymous Scandinavia’s hints were a complete and utter sham, many of their tweets were educational for many people like myself who were completely ignorant about politics and government surveillance in 2017. Unfortunately, the people associated with the account have done far more damage and harm to others than good.

Personally, I was suckered into this whole thing fairly easily and I started blogging about WikiLeaks and @AnonScan’s hints and clues pretty early on. Tracy Beanz, a Youtuber and one of the earliest to push the Qanon conspiracy theory in late October 2017, reached out to me on February 8th to let me know that she thought my site had a “great breakdown” on the Vault 7 clues. She also asked me if I was getting DMs “from our friends in scandinavia,” meaning @AnonScan, noting that she herself had been in contact with them and that she had “their ear and attention.”

She added that “they” wanted the information “spread wide and far,” so she planned on doing a video based on my blog posts, which she did the following day. On February 9th she messaged me again, “If there’s anything else I can do to help you please please let me know.” Anonymous Scandinavia promoted her videos and tagged her on Twitter multiple times, giving her (and by extension, myself) way more exposure than we would have likely gotten without the account’s promotion.

Note what @AnonScan says here: They want their audience to believe that not only was WikiLeaks “compiling” Tracy Beanz’s videos, AnonScan was privy to the alleged inside information

Bogaerts’ friend, a Mexican national who uses the Twitter handle @ATafoyovsky and goes by a myriad of names including “Lestat,” has tried to tie me to Qanon because of my early dealings with Tracy Beanz despite the fact that Tracy and I were no longer communicating when Qanon appeared in October 2017. I have stated this repeatedly online, on my website, and in a court filing and yet Bogaerts and/or her associates continue to push this blatant defamation, indicating that they feel protected on some level. Lestat also admits that one of his only two sources for information comes from Bogaerts (@HumanOfMind) herself, reflecting her weird 18-month obsession with trying to ruin my reputation.

Of course, pointing the finger at me about Tracy Beanz and Qanon is certainly one way to go when you’re trying to rewrite history like the fact that Anonymous Scandinavia was in contact with Tracy before I even knew who she was, let alone before she contacted me. Not only that, as noted below @AnonScan’s tweet above, @AnonScan led everyone to believe that WikiLeaks was “compiling” Tracy’s videos. This is who gave Tracy a platform and legitimacy for everything she produced later in teh year.

And then there was Warren Flood.

February – March 2017: Warren Flood

In early 2016, Adam Carter, the founder of the website, and who has done extensive research into Guccifer 2 documents, created a Twitter account that received little to no traction from the WikiLeaks/Assange community throughout most of the year. It wasn’t until November 2016, that the first hard-core Bernie and Assange supporter liked one of his tweets. Unbelievably, the account was @SenseOf_OUTRAGE who used to like virtually all of @AnonScan’s tweets before the account was suspended. He also likes all of Bogaerts’ tweets; she described him as a friend; and she appears to have known him since at least August 2016. It’s like the same characters keep showing up over and over again…

By January 2017, @AssangeFreedom, another pro-Assange account run by unknown individuals and with a fairly large following (it’s no longer active), also started liking Carter’s tweets well before it appeared that anyone was familiar with his account. Then, on February 5th, Carter registered the website,, and on the front page he hid a secret message that he had a contingency plan in place and if something happened to him it should be blamed on the “Clinton cartel.” Again, at this point it appeared that virtually no one was familiar with him or his website so why the concern?

All of that changed on March 2, 2017, when Anonymous Scandinavia posted a tweet (see retweet in cache) about DNC worker Warren Flood based on a post Carter had published in February entitled, “Metadata Shows DNC Contractor & G2’s Activities Only 30 Minutes Apart On Significant Date.” Here’s a snippet from the article:

“The first [Guccifer 2] document, “1.doc” (mirror), was given considerable coverage, while the name ‘Warren Flood’ was reported, the date in the report (rather than in the metadata) was reported and so it was attributed to Warren Flood on 12/19/15.

Gawker incorrectly claimed the metadata showed the document was created in 2015 when it actually indicated the document was created by Warren Flood at a much later date.

The truth is that the metadata shows the document being created 30 minutes before Guccifer2.0 appears to have gotten his hands on it….

It seems like there’s a very good chance Warren Flood has involvement to some degree but he personally had nothing to lose due to the emails, so, who would really be behind such a scheme? That’s where I struggle to find answers and have to leave the job up to the expert journalists.”

But expert journalists had, indeed, already reported on Warren Flood’s name found in the documents eight months prior and none of them chose the path of accusing Flood of being a DNC operative behind the Guccifer 2 persona, which is exactly what the WikiLeaks community chose to do after Carter’s publication. Some journalists even noted previously that Russian fingerprints were inexplicably left in the documents so none of this was stunning, breaking news unless you were someone like me who didn’t follow any of this back in 2016.

As we know now, some of the initial documents that Guccifer 2 leaked were manipulated using a template created by Warren Flood back in 2008 (I think, but no quotes on that exact year), but he wasn’t responsible for creating the manipulated documents that G2 released. And yet, that’s exactly how this was spread the second time around and it would be another year before the community vindicated Flood based on an anonymous figure called Forensicator who, according to Carter, claimed that he found “the source of Flood’s name in another document attached to Podesta’s emails.” And it’s this gross irresponsibility that I place solely on the shoulders of the WikiLeaks’ community. As I noted previously:

It would continue to be a pattern with the WikiLeaks community to push unverified or even erroneous information—or fail to give their followers a head’s up about the significance, or lack thereof, of information being released or leaked. 

Even the all-knowing “hacker” Anonymous Scandinavia who led people to believe they were close with Assange, WikiLeaks, and all their tech-savvy nerd and hacking friends were bizarrely incapable of figuring out that Flood wasn’t responsible. Worse, they claimed that he was responsible. That, or they purposely promoted disinformation that would help the WikiLeaks founder. What followed was a tsunami.

On the same day that Anonymous Scandinavia promoted Carter’s article, @BellaMagnani, an account that appears to be run by a WikiLeaks insider, retweeted it ten times until eventually WikiLeaks retweeted it themselves with the caveat, “@WikiLeaks does not endorse/disendorse the analysis,” while innocently noting what a “useful timeline” the article had. I mean, they might as well have added that they read Playboy for the articles. 

Between March 2nd through March 31st, @Anonscan, @BellaMagnani, @Greekemmy, @DefendAssange and @WikiLeaks collectively retweeted a link to Carter’s website at least 100 times, BellaMagnani by far the biggest offender. On March 12th, the account tweeted, “Most definitely NOT Russia. #Guccifer2 is in fact #DNC IT worker Warren Flood,” to which Anonymous Scandinavia replied, “…correct…” and linked to one of their previous tweets about Flood:

No, not correct but most of us bought the story they were peddling hook, line, and sinker. Another “big” Assange supporter @jaraparilla followed up with, “Wait what? ‘Russian’ #Guccifer is in fact #DNC IT worker Warren Flood…h/t @BellaMagnani @AnonScan.” 

A week later, BellaMagnani reached out to former actress and Playboy model, Robbin Young, before it became public knowledge that Young DM’d with Guccifer 2 back in 2016 (spoiler alert), and stated, “The metadata of @GUCCIFER_2’s docs show they were created by a #DNC IT guy, after #Assange announced upcoming #Clinton leaks,” with the implication, after fifty other tweets that Flood was our man, that the dude was operating the Guccifer 2 accounts. Someone with a little more sense than the rest of us at the time pointed out, “But why would he leave his name, Warren Flood? Looks equally like he was being framed.” Indeed.

Wouldn’t it be interesting if Guccifer 2, who never leaked a single thing that hurt any of WikiLeaks’ upcoming publications, was actually a stitch up job to frame the DNC and, by extension, Hillary Clinton, that got completely out of hand? Needless to say only three people liked the “looks equally like Flood was being framed” tweet.

At some point, @BellaMagnani must have grown bored with the Warren Flood narrative because seven months later they were off and running with a new conspiracy about who was behind Guccifer 2: Crowdstrike! And yes, the information technically stemmed from Carter but the point of his original tweet was the juicy detail that Shawn Henry of Crowdstrike used to be Sabu’s handler.

Prior to publishing his article, on February 18th, Carter posted an update on his website that stated, ““There has been some additional metadata (some including Warren Flood and some that relates to other identities) which has been pointed out since this page went public. – As such, this additional information will be collated during the week ahead and an update to this report will be published…” I spoke with Carter about who may have fed him this garbage about Flood and he said he spoke with a few people, some of whom no longer have active accounts, but he felt that it was his own research into Flood and a lack of knowledge/information at the time about Guccifer 2 using one of Flood’s document templates that led to his early conclusions.

I totally respect Carter for taking full responsibility for what he published on his website (some so-called Assange activists could learn a thing or two from him), but Carter’s lack of understanding and information at the time is exactly why WikiLeaks should have known better before retweeting an article that their own supporters were using to carelessly frame an innocent man. Pretty ironic, eh? Carter also posted a fairly explicit disclaimer on his website about Flood sometime in March, but it was too late to stop the deluge.

[P]lease be clear on one critical fact: There is still a possibility that someone else could have accessed a computer he owned to create these initial documents on or it could turn out there’s some other innocent explanation for his name being attached to the documents. – Even if he is involved, it’s an issue for government officials, FBI, etc. to resolve, please do NOT harass Warren Flood because of this report stating that Warren Flood appears to have done something… all we know for certain is that someone used an account with that name. The above statement supercedes and overrides any assertions expressed on this page or anywhere else on this site on the subject of any attribution to Warren Flood.

As someone with little tech knowledge, I trusted that WikiLeaks knew WTF they were retweeting and because of their retweet, myself and others completely bought into the Flood/DNC/G2 story. With that said, I spoke with Carter about the Flood situation and he seemed to understand my frustration. He was also quite candid, friendly, open, and willing to discuss it with me.

As a fellow researcher and journalist, I don’t believe Carter published the article out of maliciousness or to purposely deceive others—at least that’s not the feeling I got when we discussed it. There’s also a mysterious figure involved in this story that I believed may have played a role in some of these shenanigans; someone that Carter had spoken to early on; someone that @AnonScan retweeted before retweeting Carter’s article; and someone that I may revisit later in this series.

Although, it’s not terribly surprising that there was renewed interest in Guccifer 2 in early 2017. On January 12, 2017, the Romanian persona returned to WordPress to let the world know that they had no relation to the Russian government and that the U.S. intelligence report on Russian hacking was essentially a joke…which it pretty much was. Super fun is the fact that they also mentioned the infamous 2016 “The Future of Cyber Security Europe conference that took place in London in last September,” the same conference where @AnonScan was the keynote speaker in both 2018 and 2019, and where one of the organizers presented a PowerPoint, allegedly created by G2, that contained the link and password to the files that White Rabbit passed along to Webb, Goodman, and Trish.

March-April 2017: AnonIntelGroup

While BellaMagnani was raging online over Warren Flood, on March 23, 2017, an offshoot of Anonymous that was formed sometime in or around 2015, called the “AnonIntelGroup,” published a Medium article called “#QuestionWikiLeaks…Because No One Is Above Questioning.” The article featured an illustration of Assange churning out propaganda from the Vault 7 files which, as was noted in the The GateKeeper Files, “immediately gives off a ‘he sold out’ anti-Assange vibe.”

According to an archived webpage of AnonIntelGroup, members—or associates of the group, I suppose—included Aaron Kesel, who, again, was mentioned in The Rabbit Files 4.0 for claiming that he had privately communicated with Guccifer 2 for at least six months and saw DNC emails prior to WikiLeaks publishing them; activist Kitty Hundal; @raincoster and @_Cryptosphere (the person who wrote the #FreeMartyG press release and the website it was released on), all of whom are long-time associates of Johansen who is also listed as @RayJoha2. Please note that Johansen stated previously that there was no actual “support team.”

It’s unknown who actually wrote the Medium article which basically accused Assange of influencing the 2016 election and probably maybe working with the Russians, among a host of other allegations. And there is absolutely no question that Johansen was well aware of the campaign and that Kitty Hundal promoted the Medium article based on her own tweets. However, after the campaign was exposed on my website, she inexplicably denied it and went on to gaslight her way to innocence. Hundal and Johansen (@NorwayAn0n):  

I take no issue with anyone questioning Assange and WikiLeaks but when you start denying that you promoted a campaign that accused him of working with Trump and maybe the Russians when the evidence is sitting right there in front of you in the form of your own tweets, well, that there is some sketchy, rotten fish. 

Additionally, despite consistently telling her audience how much she loves WikiLeaks and claiming to know their entire database, on April 3, 2017, Bogaerts tweeted out in support of the @AnonIntelGroup after their Twitter account was suspended and after they accused Assange of working with the Russians and helping to get Trump elected. It also appears that she called members of AnonIntelGroup “amazing friends” in the thread following her initial tweet and if this is news to you, join the club. If you go back to the screenshot from AnonIntelGroup’s website, the page also lists an “@AnonFoxfire,” a name similar to the handle that Bogaerts was using: Foxfire2112. 

There’s nothing to suggest that AnonFoxfire and Bogaerts are the same person aside from the similarity of their handles, their mutual interest in AnonIntelGroup, and mutual associates. So, in addition to being familiar with the hacktivist community as early as January 2017, if not earlier, based on the #FreeMartyG campaign, Bogaerts was obviously familiar and happily supportive of the AnonIntelGroup, otherwise why would she ask Twitter to reinstate an obscure Anonymous account she didn’t know? 

In fact, by the end of June 2017, a few weeks after the White Rabbit debacle during which time Bogaerts claimed that she was being harassed by George Webb and his “minions,” she was either no longer an editor, or had become both an editor and “contributor” (of something) that still involved Weda unless, of course, Weda just meant she was a contributor on Twitter meaning she tweets shiz like the rest of us. She was also being well protected online by this same individual (@WellTraveledFox is another handle Bogaerts has used in the past):

Who’s “we?” Why the threats? And how did Bogaerts become a protected member of Anonymous or, at the very least, the hacktivist community as a random Bernie and WikiLeaks supporter with seemingly no ties to Anonymous, hacking, or the hacktivist community whatsoever; a stay-at-home housewife who claims that she’s been nothing but a target and perpetual victim for the past four years, I guess, for inexplicably inserting herself into one sketchy situation after another; and during this time period she was doing research for Robert David Steele and making plans to start Shadowbox with Thomas Schoenberger and Trevor Fitzgibbon?

According to Johansen, he says that he’s been an associate of hers since at least 2017, claiming that he had some sort of sexual, online relationship/non-relationship with Mrs. Bogaerts. One source also told me that she had been asked to join Barrett Brown’s Pursuance Project, a project that Johansen was not only a part of, he was in charge of onboarding collaborators. According to the source, she declined the invitation.

Final thought: Unfortunately we’re not done with February-March 2017, and so I’ll be back with —> The Rabbit Files 5.1: A Fludd Approaches. And yes, the title’s correct.

Warning: Never use a lit match or open flame to check fuel level. Ten more pages of disclaimers to follow —
If you were mentioned in this article because your associate(s) did or said something stupid/dishonest, that’s not a suggestion that you did or said something stupid/dishonest or that you took part in it. Of course, some may conclude on their own that you associate with stupid/dishonest individuals but that’s called having the right to an opinion.

If I haven’t specifically stated that I believe (my opinion) someone is associated with someone else or an event, then it means just that. I haven’t reported an association nor is there any inference of association on my part. If I believe there’s an association between people and/or events, I’ll specifically report it. You should research on your own and come to your conclusions.

If anyone mentioned in this article wants to claim that I have associated them with someone else or an event because I didn’t disclose every single person and event in the world that they are NOT associated with, that’s called gaslighting an audience and it’s absurd hogwash i.e. “They mentioned that I liked bananas but they didn’t disclose that I don’t like apples. Why are they trying to associate me with apples???” Or something similar to this lovely gem, “I did NOT give Trish the thumb drive!” in order to make their lazy audience believe that it was reported they gave Trish the thumb drive when, in fact, that was never reported, let alone inferred.

That’s some of the BS I’m talking about so try not to act like a psychiatric patient, intelligence agent, or paid cyber mercenary by doing these things. If you would like to share your story, viewpoint, or any evidence that pertains to this article, or feel strongly that something needs to be clarified or corrected (again, that actually pertains to the article), you can reach me at with any questions or concerns.

This is an opinion piece about my own theories and viewpoint. You should research this story and events yourself and come to your own conclusions.

Post Disclaimer

This is an Op-ed article. The information contained in this post is for general information purposes only. While we endeavor to keep the information up to date and correct, we make no representations or warranties of any kind, express or implied, about the completeness, accuracy, reliability, suitability or availability with respect to the website or the information contained on the post for any purpose. The owner of this blog makes no representations as to the accuracy or completeness of any information on this site or found by following any link on this site.

The views or opinions represented in this blog do not represent those of people, institutions or organizations that the owner may or may not be associated with in professional or personal capacity, unless explicitly stated. Any views or opinions are not intended to malign any religion, ethnic group, club, organization, company, or individual.

The owner will not be liable for any errors or omissions in this information nor for the availability of this information.  The owner will not be liable for any losses, injuries, or damages from the display or use of this information.

Leave a Reply