Thread by @thepacketrat

Ok, so I now have the *full* 4-plus gigabytes of Internet Research Agency tweets (after debugging my LOAD command), and the full Iranian state-sponsored tweet pile, in my database. Some updates on the tweet analysis to follow 1/n

The extent to which the Russian tweetlords were targeting #BlackLivesMatter is significant. The top 45 most retweeted messages were from fake BLM accounts @Crystal1Johnson, @KaniJJackson, @JemiSHaaaZzz, @TrayneshaCole, @wokeluisa, @BleepThePolice, @BlackToLive, and @gloed_up.

Here's the top 20 or so.

The @TEN_GOP account had the most traction of all the fake alt-right, fake #MAGA accounts. Its tweet about a fake story about a voting machine in Pennsylvania on Election Day got wide play, as did the rest of these tweets:

We've got a whole bunch of crazy there, including some of the tweets that fueled Pizzagate.

Also, @TEN_GOP claimed London mayor Sadiq Khan was the lawyer for one of the 9/11 terrorists. This was a fabrication.snopes.com/fact-check/sad…

The campaign was still active as of May 30 2018 in the US, and Russian tweets continued until June 21, corresponding with Twitter's purges washingtonpost.com/technology/201…

How MAGA was the Russian tweet influence op? The hashtag MAGA appeared in 33,246 tweets.

Those came from 395 unique Twitter accounts -- and some of them were using MAGA as a troll (the BLM accounts I mentioned earlier used the hashtag a few times).

A single account with 2748 followers -- one of those 'No more HappyHolidays shit!!! It''s MerryChristmas!!!!! BuildTheWall DrainTheSwamp MAGA?? realDonaldTrump' accounts -- included MAGA in 20,048 tweets. That account tweeted over 50,000 times, starting in June of 2016.

Most of those were retweets of Trump, other Trump supporters, and... other bot accounts.

Now for a brief look at the Iranian data. The top followed fake accounts there were targeting Saudi Arabia. Who knew?

One of the other top accounts was for toonsonline.net, a domain that until last year was hosted in Iran....ripe.net/membership/ind…

I would be interested in any malware history for that host ( 5.144.132.122 ). Anyone?

One of the Saudi-focused accounts was @freesaudiawomen ,which is a typosquat for another legit account. There were also a fake Mexican news site, accounts posing as French journalists, a "berniecrats" account...

...And the Iranians were spoofing an account claiming to be associated with AgitPolk, a Russian civil society organization. agitpolk.ru/aboutus/

Also, the Iranian state-sponsored campaign included Twitter feeds promoting a certain point of view about Shia Islam.

The Iranian tweets that got the most traction retweet-wise: A fake #Resist account's tweets about former first ladies' disgust with the child separation policy; a fake Saudi Eastern Province news ("Saudi citizens complain of the plight of life in the Kingdom because of ...")...

..a tweet from the "Patriotic Palistinian Front" (The Moroccans supporting #Palestine In #Russia2018WorldCup before match beginning

https://twitter.com/PPF_Palestine/status/1007611837268070400/video/1

) and another account tweeting about "tensions" in Catalonia blackhouse.info/tensions-conti…

That URL, tho. Blackhouse dot info was hosted on a Russian server until 4/24/2017.

So, these accounts used Iranian and Russian hosted US domains to direct to "news" that may have been part of more than an information op.

Super weird thing: Russian IRA was running an account named ComradZampolit, purportedly in Moscow, associated with AgitPolk. Iran data shows an account with fewer followers, username not shown but screen name showing associated with AgitPolk, and location "ComradZampolit".

Pinging @vijaya and @yoyoel to see if they can shed light on that (if it's a data quality issue, or if there's something else going on there).

It appears to be bad data in the iranian_users_csv_hashed dump. I am not finding that account in the iranian_tweets_csv_hashed data.

Probably either data munge or my bad on CSV processing, as per @yoyoel. The account was retweeted once by an Iranian acct.

https://twitter.com/yoyoel/status/1054045908143288321

It's super fun that Iranians were retweeting Russian IRA accounts tho. :D

Ok, so let's talk tweets per day. The Russian "No more Happy Holidays Shit!" bot tweeted an average of 295 times a day over 543 days.

Just before the 2016 election, some bots were tweeting THOUSANDS of times a day.

This is a time series for all Russian IRA tweets.

Ramping up in 2015, the Internet Research Agency pumped out around 7.5k tweets per day, with blistering peaks that were much larger.

The first spikes came as Russia occupied and then annexed Crimea in 2014.