The Rabbit Files 7.1: Timeline

January 2016

One reasearcher suggests that Guccifer 2 was a long wolf hacker who started hacking in January 2016.

February 2016

“Alice Donovan” starts submitting plagiarized articles to media outlets.

“She” lists in her Twitter bio; Aaron Kesel and Cassandra Fairbanks both worked there at the time.

Mueller never mentions Donovan’s Twitter account in his report despite the fact at least one media outlet spoke to “Alice” via Twitter DMs.

March 19, 2016

John Podesta becomes the target of a successful spear-phishing campaign.

March 20, 2016 is registered. Hacktivist Ray Johansen later claims he was “selected” to receive Guccifer 2 documents through

April 14-18, 2016

The DCCC and DNC are allegedly hacked by Russians.

April 19, 2016 is registered with

April 29, 2016 moves to the whistleblower-friendly hosting service, FlokiNET, headquartered in Iceland. Mueller never mentions this in his report.

May 5, 2016 is moved to a private server with Malaysian hosting service, Shinjiru Technology.

June 8, 2016 starts leaking documents; 72 of them are later found as attachments in the Podesta emails; @dcleaks_ Twitter account is created; DCLeaks Facebook account is created.

June 9, 2016

Cassandra Ford opens a Twitter account.

June 12, 2016

Assange announces that WikiLeaks has more material to publish *after* has already started leaking attachments from Podesta’s emails.

June 14, 2016

The Washington Post (and Crowdstrike) announce the DNC was hacked. They mention the Trump opposition file but it was later found in the Podesta emails, not the DNC emails.

June 15, 2016

Guccifer 2 creates a WordPress and takes credit for the DNC hacks. The online persona starts leaking docs including the Trump opposition file. The first five documents they release have Russian fingerprints deliberately planted in the metadata.

Mueller didn’t include this account or how it was related to any hacks or spear-phishing operation in his report.

June 16, 2016

Cassandra Ford changes her Twitter handle to @Guccifer2, essentially beating Guccifer 2 to the punch, forcing him/her/them to use a different handle: @GUCCIFER_2 (with the underscore). Ford was interviewed by the U.S. government about the account and appears to have been cleared of any wrong doing. However, in recent weeks Ray Johansen’s associates have taken to Twitter to call her a fed snitch.

Ford was previously part of Anonymous’ #OpIsis, as was Ray Johansen and his associates like Aaron Kesel, who claimed he worked with the CIA during the operation. Kesel later denied he said that (he did) after it was exposed on this website.

July 6, 2016

A VPN linked to is used to log into the @Guccifer_2 Twitter account.

July 10, 2016

Seth Rich is murdered. White Rabbit later claims that the .7z files he gave to Trish Negron were released before Rich’s death.

July 22, 2016

WikiLeaks publishes the DNC emails which range from January 2015 – May 2016. Ray Johansen’s associate, Aaron Kesel, later claims he saw the emails (unencrypted) before WikiLeaks published them.

August 15, 2016

The Shadow Brokers release a freebie of stolen NSA cyber weapons. WikiLeaks says they’ll release their own “pristine copy,” they never do.

Ray Johansen infers on Twitter that the Shadow Brokers contacted, the same org where he claims he was “selected” to receive G2 documents.

August 16, 2016

The 2016 Future of Cyber Security Europe announces that Guccifer 2 is going to appear via livestream at their September 13th event.

August 29, 2016

Available Twitter records show Beth Bogaerts (@HumanOfMind) and “Vetter” tweeting to each other as early as August 29th.

A campaign for hacktivist Marty Gottesfeld is launched. Ray Johansen’s associate, @Raincoaster, publishes a PR announcement two days later.

September 13, 2016

Guccifer 2 never shows up at the cyber conference. Instead, a Power Point presentation allegedly submitted by G2 is presented by one of the event’s organizers.

The presentation contains the link and password to the .7z files that White Rabbit downloaded and later gave to Trish Negron under the guise they were the “Seth Rich files.”

The Twitter account @AnonScandinavia (previously @AnonScan) later appears as the cyber conference’s guest speaker in both 2018 and 2019.

October 4, 2016

The Guccifer 2 WordPress account releases the cf.7z files (“Clinton Foundation” files). After WikiLeaks retweets the bogus files, someone suggests that the G2 account may be compromised.

Some of the .7z files are found in the cf.7z files. Additionally, some of the cf.7z files had been released earlier by G2.

Ray Johansen’s associate, Aaron Kesel, repeatedly claims over the next four years that Guccifer 2 sent him the cf.7z files.

October 7, 2016

WikiLeaks starts releasing the Podesta emails.

December 15, 2016

Beth Bogaerts claims that she “met” both Trevor Fitzgibbon and Thomas Schoenberger on or around December 15th despite claiming that Schoenberger was behind the “Vetter” account, the same account she had been tweeting with since at least August.

She also admits that she’s only “guessing” about when she met Fitzgibbon.

Bogaerts says that it was the “Vetter” account that introduced her to Cicada 3301.


January 3, 2017 (if not earlier)

Beth Bogaerts starts working on the #FreeMartyG (Marty Gottesfeld) campaign either because of Trevor Fitzgibbon’s contacts or personal contacts she already had in the hacktivist community.

She refurbishes a sock account for the campaign. Exactly one week later, one of Ray Johansen’s friends “Weda” announces that they’ve brought Bogaerts on board (of something) as an editor.

January 5, 2017

Cicada 3301 releaes their 2017 puzzle, “A Fludd Approaches…” One of the puzzle’s clues leads to the Mojave desert phone booth which is owned by yet another associate of Ray Johansen. They give Cicada permission to use it.

January 29, 2017

An Anonymous group called “AnonIntelGroup” interviews Marty Gottesfeld’s wife, Dana.

February 1, 2017

WikiLeaks releases an insurance file for Vault 7.

February 4, 2017

WikiLeaks drops clues about Vault 7 for five days. @AnonScandinavia (previously @AnonScan) does the same while promoting Tracy Beanz’ videos. After I start blogging about the hints and clues being released, Beanz reaches out to me stating that she’s in contact with @AnonScan.

March 2, 2017

@AnonScandinavia starts promoting a bogus story that Warren Flood is a DNC operative behind the Guccifer 2 persona; WikiLeaks and other big pro-Assange accounts do the same despite the inaccuracy of the story that frames an innocent man.

@AnonScandinavia and others’ promotion of the Warren Flood story fuels rumors that Cicada 3301 is tied to them, Assange, and WikiLeaks because of their January puzzle, “A Fludd Approaches…” Bogaerts’ friend, “Vetter,” repeatedly pushes the narrative that they’re all related.

March 7, 2017

WikiLeaks starts publishing Vault 7.

March 16, 2017

The @AnonScan account (now @AnonScandinavia) publicly states that they have no special interest in Cicada 3301.

Despite following the account and liking each others’ tweets at the time, Beth Bogaerts apparently didn’t get the memo and believes Vetter three months later when they tell her that a complete stranger named “Thomas Schoenberger” is behind the @AnonScan account and besties with Assange.

March 23, 2017

Two weeks after WikiLeaks starts publishing Vault 7, AnonIntelGroup publishes an article accusing Assange of a host of things including churning out pro-CIA propaganda and maybe probably helping the Russians. .

The group included Ray Johansen, Kitty Hundal, Aaron Kesel, @Raincoaster (the one who wrote the PR for the #FreeMartyG campaign), and @AnonFoxfire, who some now believe is actually Beth Bogaerts (@HumanOfMind).

April 3, 2017

Beth Bogaerts makes a public plea to Twitter to reinstate the AnonIntelGroup’s Twitter account after it is suspended. On Twitter, she appears to call members of the group “amazing friends.”

May 2017

According to Trish Negron, Beth Bogaerts starts to peddle White Rabbit’s “Seth Rich files” (which were actually the .7z files released at the cyber conference where Guccifer 2 never showed up) to journalist Lara Logan, her husband, and herself. At some point, she puts White Rabbit and Negron in touch with each other so Negron can get the files.

May 12, 2017

By May 12, 2017, Beth Bogaerts had replaced her Twitter banner with a quote from the 2016 Cicada 3301 puzzle. Vetter also had this on his Twitter banner. It is unknown when she first considered herself a “member” of Cicada.

May 31, 2017

Beth Bogaerts encourages Trish Negron to help Trevor Fitzgibbon. Negron agrees and is able to get George Webb and Jason Goodman to interview Fitzgibbon a day before the White Rabbit thumb drive incident.

June 1, 2017

On or about June 1, 2017, White Rabbit gives Trish Negron a thumb drive and leads her to believe they’re the Seth Rich files. Goodman, Webb, and Negron go live that evening claiming that they have the Seth Rich files.

The next day, Negron tells White Rabbit that Bogaerts is upset with her over the files but White Rabbit sends her a screenshot that allegedly shows she’s okay with it. Despite this, Bogaerts continues to publicly defame her and shuts down a Twitter account she was letting Negron use (this is the Twitter account Bogaerts repurposed for the #FreeMartyG campaign). Negron is bewildered, “She’s smearing me for doing what SHE asked me to do.”

June 6, 2017

White Rabbit tells Trish Negron that George Webb is a honeypot trying to catch leakers and that Google “spoofed the files” (among a host of other crazy things)

June 24, 2017

DMs show Beth Bogaerts telling “Vetter” that she’s sorry she dragged “you guys” into the (Negron, Goodman, Webb) drama. Then she asks Vetter who “Thomas” is.

June 25, 2017

Vetter tells Bogaerts that Thomas Schoenberger is behind the @AnonScan account. Schoenberger then reaches out to Bogaerts via Facebook. She claims this is when she met Thomas Schoenberger as Schoenberger.

June 26, 2017

Ray Johansen’s associate, “Weda,” who was working with Bogaerts as early as January 2017, if not earlier, bizarrely threatens everyone on the internet on behalf of Bogaerts, stating that she’s off limits

Sources say that Bogaerts was invited to join Barrett Brown’s Pursuance Project. Johansen was in charge of onboarding and also brought in people like grifter and #Unity4J co-founder, Suzie Dawson.

June 30, 2017

Vetter tells Bogaerts that WikiLeaks loves Cicada 3301 and that Thomas Schoenberger and Julian Assange have been friends since 2003. Despite @AnonScan previously announcing publicly they had no interest in Cicada 3301, and Assange nor WikiLeaks ever acknowledging Schoenberger or Cicada 3301, Bogaerts allegedly believes this.

At this point, Vetter and Bogaerts have known each other for over six months, Vetter has allegedly already brought her into Cicada 3301, and Vetter spent five of those six months publicly saying that @AnonScan, Assange, and WikiLeaks were connected to Cicada. And yet back in March, she didn’t question why Vetter was trying to connect them after @AnonScan denied interest in Cicada.

Vice versa, she never tweeted that Cicada, Assange, WikiLeaks, and @AnonScan were connected despite Vetter saying they were publicly for 5 months and seemingly believing literally anything that Vetter told her.

July 7, 2017

After Bogaerts met Schoenberger, Trevor Fitzgibbon met Schoenberger (as Schoenberger) via email for the first time. Schoenberger suggests to him that they use Cicada 3301 to expose Jesselyn Radack on the deep web. He also mentions “Embassy Cat,” Julian Assange’s cat.

There’s also a Twitter account called @EmbassyCat that Ray Johansen claims to be behind, and an Embassy Cat website that @AnonScandinavia controls. Myself and others believe that Johansen is likely an administrator of the AnonScan Twitter account or a close associate.

July 9, 2017

After allegedly only knowing each other for two weeks, Thomas Schoenberger and Beth Bogaerts start discussing starting a PR firm together.

July 10, 2017

Thomas Schoenberger and Beth Bogaerts start doing research for Robert David Steele’s lawsuit against Jason Goodman. Attorney Steven Biss is representing Steele.

Schoenberger asks Biss’ wife if her husband can sue Goodman on behalf of White Rabbit, too. This, after White Rabbit knowingly set up Trish Negron and Jason Goodman with bogus files and then his associates lied about it…for years.

July 22, 2017

Evidence filed by Beth Bogaerts shows she started sending payments to Trevor Fitzgibbon in late July. The first four payments included “love” emojis and memos like “have fun.” In March 2020, she filed a lawsuit claiming she had a loan agreement with Fitzgibbon (she didn’t) and that all the monies she sent him were “personal loans.”

Months before filing the lawsuit, she admitted that she didn’t care about the money and was only suing him because she thought he was attacking her online behind anonymous Twitter accounts that she herself has never shown to be Fitzgibbon.

July 30, 2017

Emails show Schoenberger and Bogaerts discussing with others starting a PR/reputation firm. Despite now claiming that she was “pressured” into starting Shadowbox, a mountain of evidence suggests otherwise.

August 1, 2017

Beth Bogaerts, Thomas Schoenberger, and Trevor Fitzgibbon start a PR firm called Shadowbox and land their first client, Ed Butowsky.

August 18 – 19, 2017

18 days after landing Ed Butowsky as a client, Thomas Schoenberger and Manny Chavez are each paid $5,000 from Butowsky’s client fees.

Bogaerts sends Fitzgibbon $5,000 during this same time period. However, in 2020, she filed a lawsuit now claiming the $5,000 she sent to Fitzgibbon was a “personal loan” despite the fact the money looks like it came from Shadowbox/Butowsky. In April 2018, Bogaerts admitted that she controlled at least some (if not all) of the money that came in from Butowsky.

December 5, 2017

The @AnonScan account posts a tweet that includes some of the lyrics from a Jefferson Airplane song called White Rabbit as well as a link to the video.

Signal messages show that Ray Johansen claimed he was having some sort of online sexual relationship with Beth Bogaerts during this time period.

DisclaimerTen pages of disclaimers to follow.

If you were mentioned in this article because your associate(s) did or said something stupid/dishonest, that’s not a suggestion that you did or said something stupid/dishonest or that you took part in it. Of course, some may conclude on their own that you associate with stupid/dishonest individuals but that’s called having the right to an opinion. If I’ve questioned something that doesn’t make sense to me, that’s not me spinning the confusing material you’ve put out. That’s me trying to make sense out of something that doesn’t make sense. And if I’ve noted that you failed to back up your allegations that means I either missed where you posted it or you failed to back your shiz up.

If I haven’t specifically stated that I believe (my opinion) someone is associated with someone else or an event, then it means just that. I haven’t reported an association nor is there any inference of association on my part. For example, just because someone is mentioned in this article, it doesn’t mean that they’re involved or associated with everyone and everything else mentioned. If I believe that there’s an association between people and/or events, I’ll specifically report it. 

If anyone mentioned in this article wants to claim that I have associated them with someone else or an event because I didn’t disclose every single person and event in the world that they are NOT associated with, that’s called gaslighting an audience and it’s absurd hogwash i.e. “They mentioned that I liked bananas but they didn’t disclose that I don’t like apples. Why are they trying to associate me with apples???” Or something similar to this lovely gem, “I did NOT give Trish the thumb drive!” in order to make their lazy audience believe that it was reported they gave Trish the thumb drive when, in fact, that was never reported, let alone inferred.

That’s some of the BS I’m talking about so try not to act like a psychiatric patient, intelligence agent, or paid cyber mercenary by doing these things. If you would like to share your story, viewpoint, or any evidence that pertains to this article, or feel strongly that something needs to be clarified or corrected (again, that actually pertains to the article), you can reach me at with any questions or concerns.

I cannot confirm and am not confirming the legitimacy of any messages or emails in this article. Please see a doctor if sensitivity continues. If anyone asks, feel free to tell them that I work for Schoenberger, Fitzgibbon, Steven Biss, the CIA, or really just about any intelligence agency because your idiocy, ongoing defamation, and failure as a human is truly a sight to behold for the rest of us.

This is an opinion piece about my own theories and viewpoint. You should research this story and events yourself and come to your own conclusions.

Post Disclaimer

This is an Op-ed article. The information contained in this post is for general information purposes only. While we endeavor to keep the information up to date and correct, we make no representations or warranties of any kind, express or implied, about the completeness, accuracy, reliability, suitability or availability with respect to the website or the information contained on the post for any purpose. The owner of this blog makes no representations as to the accuracy or completeness of any information on this site or found by following any link on this site.

The views or opinions represented in this blog do not represent those of people, institutions or organizations that the owner may or may not be associated with in professional or personal capacity, unless explicitly stated. Any views or opinions are not intended to malign any religion, ethnic group, club, organization, company, or individual.

The owner will not be liable for any errors or omissions in this information nor for the availability of this information.  The owner will not be liable for any losses, injuries, or damages from the display or use of this information.

Leave a Reply