Thread by @josh_emerson

let's go on a #bothunt
You can still find most of these #russian #bots yourself.
And they did retweet during the #UK general election for Labour leader #JeremyCorbyn
thetimes.co.uk/article/expose…

some clues are the date ranges provided and the account types

External Tweet loading...
If nothing shows, it may have been deleted
by @XSovietNews view original on Twitter

1st thing we do is check @jeremycorbyn's timeline. He only has 9k tweets so we should be able to get the tweet IDs for that date range(may-june 2017)

after pulling his timeline. Filter out his retweets.
i grabbed the tweet IDs for 5/22/2017 - 5/16/2017
not that many.

what you want to do next is check the retweets of HIS tweets.
doing that gives me about 125k tweets to look at.
luckily the russians made this easy, they had their twitter UI set to "ru".
filter language by "ru"

filtering by lang. ru gives us 20 accounts to look at.
2 of them look suspect
random alphanumeric screen names and women's first+last name for the account name.

check those 2 accounts, hmm russian porn bots
@lsItgVciE6pmsuT
@79NgJsvDRAFnoKu
that also happen to tweet political accounts on the side:

just 2 russian accounts sucks, let's find some more:
so i pull the 2 accounts timelines
all the bots do is retweet.
so what you want is a list of tweet ids of the things they retweeted.

next use the twitter api to pull the retweets OF THOSE TWEETS.
in my case it's about a 1000 total tweets to check.
checking the retweets on those returns about 400k results.
or about 360K unique accounts.

after dropping the duplicates sort the data by creation date then by status counts. That way you have the accounts grouped by dates and similar numbers of tweets.
regular twitter data looks like this: all the accounts created on 6/9 but have a gradually increasing status count

bots look like this
all created the same day, all have a similar name style, all of them have similar stats.
these are russian bots with their UI set to english.

these are russian bots made just a few days ago.

of course they aren't always doing what you would expect them to be doing

in total I found about 1500 of these bots,
Google sheet spreadsheet here with accounts and urls.
docs.google.com/spreadsheets/d…

twitter list here:
i can only put 1000 a day on a list, will add the rest tomorrow.
twitter.com/josh_emerson/l…

checking around 600 of the accounts tweets here are the accounts they retweet the most.

filtering those 600ish accounts tweets just for RTs with "corbyn" or "labour" returns plenty of results.

added a million of these bots tweets to a google fusion table
google.com/fusiontables/D…

It's not all of the bots tweets but at least you can go in and search for terms like "trump"

this isn't the 1st time i have connected this exact set of russian bots to the St Petersburg #TrollFactory

External Tweet loading...
If nothing shows, it may have been deleted
by @josh_emerson view original on Twitter

they participated in #ReleaseTheMemo

External Tweet loading...
If nothing shows, it may have been deleted
by @josh_emerson view original on Twitter

the #Salisbury hashtag

External Tweet loading...
If nothing shows, it may have been deleted
by @josh_emerson view original on Twitter

i even have an old spreadsheet with mostly now suspended #russian "porn" #bots

External Tweet loading...
If nothing shows, it may have been deleted
by @josh_emerson view original on Twitter

here is how we trick dumb americans comrade: flip picture other way, hah 😂