Josh Russell Profile picture
Apr 2, 2018 21 tweets 11 min read Read on X
tagging everyone who might listen. please help me.
I MUST DESTROY THIS BOTNET.
I got curious about this claim. I can't say who runs them but a massive botnet DID used this hashtag.

washingtonpost.com/news/worldview…
This is the same botnet that i have been tracking for weeks now. twitter suspended 20,000 of the bots and barely put a dent in them.
They are creating over 3500 accounts A DAY.
The tweet with the hashtag has been deleted by @LucilleMcGilli4
probably after noticing the bots RTing it.
so I just went and looked at what 3 of the bots were doing:
twitter.com/jenkrinninger1
twitter.com/rogge1068fg
twitter.com/geralyn66410343
they are retweeting this:
this:
and i checked a few other tweets for rts. this gives me about 7,000 accounts all exactly the same.
copy that data into a preexisting list i have been maintaining of 60,000 bots and set it to highlight the duplicate values in red.
same.
damn.
bots.
For reference:
here is the csv file for the data pull on the hashtag #IstandwithLaura at noon today.
open it in excel and filter the tweet_text column by "LucilleMcGilli4" to see the bots.

storage.googleapis.com/ru_accounts/%2…
this spreadsheet has the retweets on these 4 tweets:





all bots

docs.google.com/spreadsheets/d…
One of the tweets I checked for the original #DeleteFacebok hashtag, a completely obscure tweet that no one would rt. Up to almost 4K retweets.
The account gets 0 RTs most days.
This tweet HAD 41,000 retweets
Then twitter suspended 20k accounts that retweeted it. And it’s already back to like 47,000 retweets
so i refined that set of accounts that i pulled the retweets of those 4 tweets. leaving me 6700 bot accounts.
Then pulled the timeline for maybe 700 just to double check this is the same network that was tweeting #DeleteFacebok and it is.
i think i posted one of those data files here
this bot network now has 67,965 accounts. docs.google.com/spreadsheets/d…
who ever runs this botnet is a @realDonaldTrump fan.
they have set their bots to retweet @CieloInfierno_
anyone know anything about mexican politics? i think this account is pro-trump.
seems like some election interference.
small sample (6000 accounts) of the bots tweets available here so you can look for yourself
storage.googleapis.com/ru_accounts/tr…
bots are still going strong, all of the retweets for this #IStandWithLaura tweet except for one, are bots.

• • •

Missing some Tweet in this thread? You can try to force a refresh
 

Keep Current with Josh Russell

Josh Russell Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @josh_emerson

Oct 5, 2018
The flow of russian disinformation, and how russian cyber warfare works:

GRU hacks, russian media writes about it, russian bots take to twitter.

The bots I am looking at tweeted about "Cyber Berkut".

ncsc.gov.uk/news/reckless-…
GCHQ attributes Cyber Berkut to GRU.

In just what happened to be an odd coincidence I happened to be looking at russian bots when @rob_barry did a thread about "CyberCaliphate"
At some point in march 2014 after the russian invasion of crimea GRU setup Cyber Berkut and started attacking various Ukrainian infrastructure and websites.
motherjones.com/politics/2014/…
Read 24 tweets
Sep 17, 2018
There is definitely something going on.
If you look around twitter there are some very "odd" accounts.

#Macedonia #RussianMeddling #Russia #Skopje
apnews.com/b51d832612784b…
These tweets seem weird to me.
One uses a #QAnon hashtag.
Read 16 tweets
Aug 25, 2018
There are more of these thread.

Suspected Iranian Influence Operation Leverages Network of Inauthentic
News Sites & Social Media Targeting Audiences in U.S., UK, Latin
America, Middle East
fireeye.com/blog/threat-re…
we got 9 urls from FireEye's report.
and I had flagged another 13 back in march.

Mostly due to these reddit users:
/u/Mike_Rubin
/u/AllenDono
/u/finalin
/u/KevanKing
/u/Pazaj
/u/erickiskandar
Most of these sites share OR shared a common host at some point in time.
AS24940 hetzner[.]com
Read 61 tweets
Aug 4, 2018
Quick thread about a small set of bots I ran into this morning. Every once in a while I randomly check the @SecureDemocracy dashboard it's usually the same things. Today #WeAreCorbyn popped up. Figured I would check it out. #Botspot #Russia #KremlinTrolls
Tweeting this kinda as I go.
1st thing pull data on the hashtag.
visual studio code, python, and tweepy.
I only pulled about 40k tweets, not that many.
next step is to crack open that .csv file and remove all the duplicate accounts leaving only one row per account.
Then start sorting. IF there is a pattern you will notice it almost immediately.

Here 16 accounts show up with the same stats, sorted by tweet source. Bots.
Read 11 tweets
Aug 1, 2018
From the Senate Intelligence hearing on social media and foreign influence
intelligence.senate.gov/sites/default/…
websites they linked to:
some of these are new.
.ihavethetruth.com was for sure russian
securitytrails.com/domain/ihaveth…
It sat on a Choopa, LLC's server before being moved to cloudflare
Read 24 tweets
Jul 31, 2018
We have asked every social media platform for months now to take action @Reddit, @facebook, @Twitter will only do something after someone gets killed.

Michael Avenatti Targeted in Person by QAnon, the Crazy Pro-Trump Conspiracy Theory thebea.st/2M3HFig?source… via @thedailybeast
Facebook right now:
Reddit:
Read 11 tweets

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Don't want to be a Premium member but still want to support us?

Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us!

:(