,
13 tweets,
15 min read
Read on Twitter
Last wk we noticed that an entire subset of our #Hamilton68 accounts had been suspended in mass. We have seen suspended accounts from time to time but not a whole set. To be clear these were bot accnts so it made sense they would all get suspended at once. #infosec #osint 
We determined from our archive that they were mostly suspended around January 26th and this was the last tweet in our archive. #infosec #hamilton68 #osint
Some searching on Twitter & we found that our fellow bothunters @conspirator0 & @ZellaQuixote had already put out this excellent thread on Jan 24th outing most of the accounts in this small botnet. I apologize 4 missing it at the time #infosec #hamilton68
These accounts were also part of this mini botnet that @conspirator0 first reported on a few wks ago @BreakingNewsDJT & @_trumpnews_ & @DTrumpTrain & @_POTUSTRUMPNEWS a while back changed their handles to @DTrumpTrain_ & @TrumpNewsDaily_ respectively. #infosec #hamilton68 #osint
There is some irony in the promotion of this article back on Dec 27th 2018
by these now suspended propaganda bots. #hamilton68 #projectbirmingham #infosec #osint #psyops #disinfo
by these now suspended propaganda bots. #hamilton68 #projectbirmingham #infosec #osint #psyops #disinfo
A wordcloud of 11181 tweets from the still live accounts in January. What is interesting about these accounts is they rarely used hashtags & started as zapier automated accounts with some dlvrit and ended as mostly IFTTT for the automation client #hamilton68 #infosec #osint
Back in May of 2018 the automation client was mostly Zapier and they were promoting trumpservativenews[.]info at the time instead of more recently the trumpservativenews[.]club domain. They also all had their language set as Spanish (ES). #infosec #disinfo #osint #hamilton68
Similar to what @conspirator0 and @ZellaQuixote found the most recent top domains tweeted out by these bots was primarily trumpservativenews[.]club and amazon[.]com. #infosec #osint #hamilton68
Its interesting 2 note the Trumpservativenews[.]club website lists its primary twitter accnt as @TrumpNewsz one of the suspended bots that we & @conspirator0 found. Its also interesting these bots all had ES set as the language & domains were registered by a Jose from Houston TX
It begs the question, is Jose a real person and just running an entrepreneurial money-making endeavor? In which case these accounts would likely be mischaracterized as true #Hamilton68 accounts #infosec #osint
I was reminded of this excellent article in Rantt from March 2018 rantt.com/a-look-at-who-… that has this very relevant paragraph attributing ownership of trumpservativenews(.)info to Rodolfo Hernandez of Venezuela. #infosec #osint cc: @brazencapital
Okay there is also this via @brazencapital mediabiasfactcheck.com/trumpservative… so I take back my second guessing the #hamilton68 classification and suspension by Twitter. Looks like it was overdue. #infosec #disinfo #osint
