Conspirador Norteño Profile picture
Feb 10, 2018 27 tweets 16 min read Twitter logo Read on Twitter
There was a burst in activity on the #FireRosenstein hashtag this past weekend. Let's see what there is to see, shall we? (thanks @SpencerH8sTwitr for putting us on the hunt)
This diagram shows the retweet/reply relationships for #FireRosenstein. There are a few accounts in here that have turned up in previous analyses, such as jojoh888. The left and right-leaning accounts are mostly separate here, indicated by the dashed line.
The accounts pushing the #FireRosenstein hashtag are mostly right-wing accounts; however, the opposite is true of the phrase "fire Rosenstein" - here the #Resistance conversation is larger and louder.
Next, let's look for likely bot activity. Of 4275 accounts tweeting #FireRosenstein, there are 57 accounts that tweet 24 hours a day and 345 with default profile pictures. (The green "frequent fliers" category is for accounts that have appeared repeatedly in previous analyses).
Another way to visualize the same information - plotting the number of followers against the daily tweet rate for the accounts involved. Exploring this further is, for the moment, left as an exercise for the reader.
Time for a detour that isn't actually a detour: #OperationMockingbird (h/t @majorajam), a hashtag which seems to be related to the #FollowTheWhiteRabbit/#QAnon conspiracy theory. We'll return to the circled account (@realityblow) later in the thread.
The sets of accounts tweeting #FireRosenstein and #OperationMockingbird overlap - there are 304 accounts present in both, highlighted in red here in the network diagrams for each trend. The red nodes appear to be largely connected to one another, but let's verify.
This retweet/reply network was built from the most recent 1000 tweets from each of the 304 accounts in both sets. 302 are connected, and note that the degree of interconnection is high - most nodes connect to many others.
Here's the tweet volume for #OperationMockingbird for the last 10 days, with the portion from the accounts that also have #FireRosenstein tweets highlighted in red.
Like #FireRosenstein, #OperationMockingbird has some likely bot activity - 22 round-the-clock accounts, and 179 with default pictures out of 2305 total. 15 of the 22 round-the-clock accounts are also in the #FireRosenstein set. We'll take a quick look at three.
First up: @bamma0. This account is almost all retweets, and posts almost all of its tweets at 45 minutes past the hour, every hour.
Next, here's @ImmoralReport. This one is much higher volume - roughly 1000 tweets per day. It fires off a barrage of tweets every five minutes, with very occasion tweets at other times. Like @bamma1, @ImmoralReport seems to consist almsost exclusively of retweets.
(Correction to previous tweet - @bamma0, not bamma1)
Finally, here's @realityblow. This bot is a little different as it doesn't operate 24/7 and the schedule doesn't indicate automation. However, 87% of the tweets are malformed retweets (tweet starts with "RT " rather than being an actual retweet), and all are posted via IFTTT.
Thanks to @ZellaQuixote for various and sundry assistance throughout the course of this project.
We went back and looked at some of the more prominent nodes in the #FireRosenstein retweet network.
First, there's @rp4america1st. This account isn't even four months old and has already had four different handles. (Time of change is the time of the first tweet following the change.)
Here's @rp4america1st's tweet schedule. Didn't tweet much as spicey_kevin or maga4santa, but has been more active as tuckersface and rp4america1st.
Next up: @WeSupport45. This account got its start in late 2014/early 2015 promoting marijuana tourism to Colorado.
In mid-2016, @WeSupport45's business model changed. They now want to sell you a brick in a future border wall, despite the fact that any hypothetical border wall would not in fact be composed of bricks.
Here's @WeSupport45's tweet topics over time. It's our suspicion that the primary purpose of this account is to perpetrate various moneymaking schemes, and the political material is simply a means to that end.
Moving on, here's @TrumpSuperPAC, "the #1 Super PAC in American history reaching 1 million patriots a day". Strangely, there is no such super PAC on record with the FEC, and no PAC whose name contains "Trump Super PAC" located in NY.
Also? @TrumpSuperPAC's tweet schedule is bizarre if they're really based in New York.
One more: @os4185. Their educational history speaks for itself.
Finally, let's compare what the #FireRosenstein network looks like both with and without these accounts (jojoh888 and consmover were flagged as suspicious in previous analyses and are thus included as well). Among other things, the network breaks apart.
All I did was point out they were trying to sell useless bricks to Trump supporters. . .
In other news, once you've changed your Twitter handle four times, why not go for five, eh @rp4usa1st?

• • •

Missing some Tweet in this thread? You can try to force a refresh
 

Keep Current with Conspirador Norteño

Conspirador Norteño Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @conspirator0

Oct 9, 2018
Honey Pot Bots
Meet @ShawneeDeaver. This account's first tweet - and only non-reply tweet - is 2scEY0T, an apparently random 7-character alphanumeric code. The rest of the tweets are replies sent within hours of its creation; the collage is representative. (Thanks @OlgaNYC1211 for the lead).
We decided to look for more accounts like it. We started by harvesting the recent replies to the accounts that @ShawneeDeaver replied to, and filtering the results to accounts with a 7-character code as their first tweet and all subsequent tweets being quickly-launched replies.
Read 9 tweets
Oct 8, 2018
Let's take an updated look at the traffic related to Russia Insider, a Russian news site featuring sections such as "Western Collapse", "The Jewish Question", "Free Assange", "Russiahoax", and "EU Conservative Uprising".
(previous Russia Insider thread in which failed Congressional Candidate Paul Nehlen featured prominently)
We downloaded the last ten days worth of tweets linking to russia-insider(dot)com, resulting in 5357 tweets from 2779 accounts.
Read 13 tweets
Oct 6, 2018
While looking for streams of the Kavanaugh confirmation cloture vote yesterday, we stumbled on @Seekandfind, an account that linked Russia Today's stream. Spoiler alert - this account is (at least presently) a bot with signs of some human interjections.
This account is extremely high-volume (900+ tweets per day at present) and uses a massive cornucopia of different automation tools to tweet (mostly Microsoft PowerApps, Buffer, Integromat, IFTTT, and Zapier).
What does @Seekandfind tweet about? 37.1% of tweets contain one or more of the keywords shown in this chart - the Trump, Hillary Clinton, MSM/fake news, and deep state categories being the most prominent.
Read 10 tweets
Oct 5, 2018
On October 2nd, the news came out that envelopes containing suspected ricin had been mailed to the Pentagon and the White House. We downloaded tweets containing the word "ricin" a few hours after the news broke, resulting in 45007 tweets from 29308 accounts.
Here's the retweet network for "ricin" on 2018-10-02. It consists almost entirely of right wing accounts, most of which are speculating that the ricin mailing was left-wing terrorism.
We tested a sample of 10000 of the accounts with ricin tweets for automation (based on either 24/7 activity or 90%+ of tweets being posted via automation services/custom apps). 817 (8.2%) were flagged as bots. Let's look at a few of them.
Read 12 tweets
Oct 4, 2018
Yesterday (2018-10-02), four members of the white supremacist group known as the "Rise Above Movement" were arrested by the feds for their part in the violence at the #UniteTheRight rally in Charlottesville in August 2018. Let's take a look at related Twitter traffic.
(previous thread on the Twitter activity surrounding the #UniteTheRight hashtag leading up to and during the rally last year.)
We downloaded tweets containing "Charlottesville" and "arrests", resulting in 15082 tweets from 12331 accounts beginning with the first report of the arrests (from @HenryGraff).
Read 13 tweets
Sep 30, 2018
How does one go about detecting Twitter bots (automated accounts)? Let's take a look at three different tests for detecting signs of automation, and try them on three different sample sets of accounts.
The first two tests may be familiar from previous threads:

1. 24/7 tweet activity - this could point to multiple human operators, but is usually the result of automation/tweet scheduling.
2. Use of automation services such as IFTTT or custom apps built with the Twitter API.
The tweet schedule plots shown in the previous tweet can be used to visually perform both these tests. You can generate them yourself for accounts of interest here: makeadverbsgreatagain.org/allegedly
Read 9 tweets

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Don't want to be a Premium member but still want to support us?

Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us on Twitter!

:(