Quick thread about a small set of bots I ran into this morning. Every once in a while I randomly check the @SecureDemocracy dashboard it's usually the same things. Today #WeAreCorbyn popped up. Figured I would check it out. #Botspot#Russia#KremlinTrolls
Tweeting this kinda as I go.
1st thing pull data on the hashtag.
visual studio code, python, and tweepy.
I only pulled about 40k tweets, not that many.
next step is to crack open that .csv file and remove all the duplicate accounts leaving only one row per account.
Then start sorting. IF there is a pattern you will notice it almost immediately.
Here 16 accounts show up with the same stats, sorted by tweet source. Bots.
It's completely fine to use tweetdeck to automate an account. The "non-authentic" or bot indicator is the fact they were all created in the same time frame, have the same stats, and are tweeting about the same things.
These are older accounts created in 2015, so most likely they have bought these accounts from somewhere.
Screenshots of some of the things these bots are tweeting:
I want to try to get as many of the accounts as i can. so the next step is to use the api to pull a full 3200 tweet timeline for each account.
Then sort that by newest tweet.
Grab those re-tweet IDs.
Run a retweet check on those IDs
And you end up with 25 bot accounts.
If i had the time tonight i would check the bots friends and followers for more bots.
To prove these are bots always post data of some type that people can check. i like to use a google sheet with a clickable link for each account.
In just what happened to be an odd coincidence I happened to be looking at russian bots when @rob_barry did a thread about "CyberCaliphate"
At some point in march 2014 after the russian invasion of crimea GRU setup Cyber Berkut and started attacking various Ukrainian infrastructure and websites. motherjones.com/politics/2014/…
Suspected Iranian Influence Operation Leverages Network of Inauthentic
News Sites & Social Media Targeting Audiences in U.S., UK, Latin
America, Middle East fireeye.com/blog/threat-re…
we got 9 urls from FireEye's report.
and I had flagged another 13 back in march.
Mostly due to these reddit users:
/u/Mike_Rubin
/u/AllenDono
/u/finalin
/u/KevanKing
/u/Pazaj
/u/erickiskandar
Most of these sites share OR shared a common host at some point in time.
AS24940 hetzner[.]com