Josh Russell Profile picture
May 1, 2018 24 tweets 12 min read Twitter logo Read on Twitter
let's go on a #bothunt
You can still find most of these #russian #bots yourself.
And they did retweet during the #UK general election for Labour leader #JeremyCorbyn…
some clues are the date ranges provided and the account types
1st thing we do is check @jeremycorbyn's timeline. He only has 9k tweets so we should be able to get the tweet IDs for that date range(may-june 2017)
after pulling his timeline. Filter out his retweets.
i grabbed the tweet IDs for 5/22/2017 - 5/16/2017
not that many.
what you want to do next is check the retweets of HIS tweets.
doing that gives me about 125k tweets to look at.
luckily the russians made this easy, they had their twitter UI set to "ru".
filter language by "ru"
filtering by lang. ru gives us 20 accounts to look at.
2 of them look suspect
random alphanumeric screen names and women's first+last name for the account name.
check those 2 accounts, hmm russian porn bots
that also happen to tweet political accounts on the side:
just 2 russian accounts sucks, let's find some more:
so i pull the 2 accounts timelines
all the bots do is retweet.
so what you want is a list of tweet ids of the things they retweeted.
next use the twitter api to pull the retweets OF THOSE TWEETS.
in my case it's about a 1000 total tweets to check.
checking the retweets on those returns about 400k results.
or about 360K unique accounts.
after dropping the duplicates sort the data by creation date then by status counts. That way you have the accounts grouped by dates and similar numbers of tweets.
regular twitter data looks like this: all the accounts created on 6/9 but have a gradually increasing status count
bots look like this
all created the same day, all have a similar name style, all of them have similar stats.
these are russian bots with their UI set to english.
these are russian bots made just a few days ago.
of course they aren't always doing what you would expect them to be doing
in total I found about 1500 of these bots,
Google sheet spreadsheet here with accounts and urls.…
twitter list here:
i can only put 1000 a day on a list, will add the rest tomorrow.…
checking around 600 of the accounts tweets here are the accounts they retweet the most.
filtering those 600ish accounts tweets just for RTs with "corbyn" or "labour" returns plenty of results.
added a million of these bots tweets to a google fusion table…
It's not all of the bots tweets but at least you can go in and search for terms like "trump"
this isn't the 1st time i have connected this exact set of russian bots to the St Petersburg #TrollFactory

they participated in #ReleaseTheMemo

the #Salisbury hashtag

i even have an old spreadsheet with mostly now suspended #russian "porn" #bots

here is how we trick dumb americans comrade: flip picture other way, hah 😂

• • •

Missing some Tweet in this thread? You can try to force a refresh

Keep Current with Josh Russell

Josh Russell Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!


Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @josh_emerson

Oct 5, 2018
The flow of russian disinformation, and how russian cyber warfare works:

GRU hacks, russian media writes about it, russian bots take to twitter.

The bots I am looking at tweeted about "Cyber Berkut".…
GCHQ attributes Cyber Berkut to GRU.

In just what happened to be an odd coincidence I happened to be looking at russian bots when @rob_barry did a thread about "CyberCaliphate"
At some point in march 2014 after the russian invasion of crimea GRU setup Cyber Berkut and started attacking various Ukrainian infrastructure and websites.…
Read 24 tweets
Sep 17, 2018
There is definitely something going on.
If you look around twitter there are some very "odd" accounts.

#Macedonia #RussianMeddling #Russia #Skopje…
These tweets seem weird to me.
One uses a #QAnon hashtag.
Read 16 tweets
Aug 25, 2018
There are more of these thread.

Suspected Iranian Influence Operation Leverages Network of Inauthentic
News Sites & Social Media Targeting Audiences in U.S., UK, Latin
America, Middle East…
we got 9 urls from FireEye's report.
and I had flagged another 13 back in march.

Mostly due to these reddit users:
Most of these sites share OR shared a common host at some point in time.
AS24940 hetzner[.]com
Read 61 tweets
Aug 4, 2018
Quick thread about a small set of bots I ran into this morning. Every once in a while I randomly check the @SecureDemocracy dashboard it's usually the same things. Today #WeAreCorbyn popped up. Figured I would check it out. #Botspot #Russia #KremlinTrolls
Tweeting this kinda as I go.
1st thing pull data on the hashtag.
visual studio code, python, and tweepy.
I only pulled about 40k tweets, not that many.
next step is to crack open that .csv file and remove all the duplicate accounts leaving only one row per account.
Then start sorting. IF there is a pattern you will notice it almost immediately.

Here 16 accounts show up with the same stats, sorted by tweet source. Bots.
Read 11 tweets
Aug 1, 2018
From the Senate Intelligence hearing on social media and foreign influence…
websites they linked to:
some of these are new. was for sure russian…
It sat on a Choopa, LLC's server before being moved to cloudflare
Read 24 tweets
Jul 31, 2018
We have asked every social media platform for months now to take action @Reddit, @facebook, @Twitter will only do something after someone gets killed.

Michael Avenatti Targeted in Person by QAnon, the Crazy Pro-Trump Conspiracy Theory… via @thedailybeast
Facebook right now:
Read 11 tweets

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Don't want to be a Premium member but still want to support us?

Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!


0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy


3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us on Twitter!