Profile picture
MikeFarb @mikefarb1
, 26 tweets, 5 min read Read on Twitter
#unhackthevote

Bots Thread 2

This is the story of The Voty Twitter Botnet and The Attack on Senator Al Franken by the Alt-Right Army
On November 15th at 10:21 PM, Roger Stone, via the now-suspended @stonezonetweets Twitter account, tweeted the following:

Roger Stone says it’s Al Franken’s “time in the barrel”. Franken next in long list of Democrats accused of “grabby” behavior.
That same day the web domain realusa.site was registered in Japan developer named Atsufumi Otsuka (if the registration info is to be believed) and a pseudo-news website was established.
On November 16th Leeann Tweedon went public with her story of having been sexually assaulted by Senator Al Franken.
On November 20th Charles Johnson, a prominent member of the alt-right, said the following in a twitter thread:

"Thinking of offering money to people who go on tv saying Al Frank is a predator"
On the same day, a second domain, votyus.me was registered by Atsufumi Otsuka, and another pseudo-news website was established. Both websites use the same Google analytics account ID and Apple app ID.
In addition the name servers and registration information of the two are nearly identical. It was very clear that these two websites were related in some way.
On November 21st at 1:52 am, Mike Cernovich – another prominent member of the alt-right movement – tweeted:

"I will fully cover the legal expenses of any VICTIM of a Congressman who wants to come forward"
How are these tweets and these newly built “news” websites related?
On December 7, shortly after Senate Democrats had called on Senator Al Franken to resign due to mounting accusations of sexual misconduct, an anonymous security researcher came across some unusual tweets.
The content of these tweets is the title of an opinion piece by Ijeoma Oluo published at theestablishment.co.

With a Twitter following of under 10,000 people, this site itself has modest reach.
But a Twitter search for the article’s title: “Dear Al Franken, I’ll Miss You but You Can’t Matter Anymore” revealed a huge number of Twitter accounts amplifying the title of the story, which urged women and activists to stand down and accept Senator Franken’s resignation.
But rather than providing a link to the story itself, the tweets included links to the two “media” sites registered by our friend in Japan.
The interesting part of this discovery? The Twitter accounts linking to the two websites and tweeting the title of the article are all remarkably similar to each other.
These twitter bot accounts mainly tweeted mundane stories related to sports, bitcoin, and celebrity news. But sprinkled among these mundane links were a number of articles related to the Al Franken story.
Not every Twitter bot account was involved with the promotion of every weaponized story. It appeared someone was dictating how much promotion would occur for any particular partisan story.
This indicates that only a subset of Twitter bot accounts from a much larger pool of bot accounts were used for each tweet.
They each had 30 to 60 followers and many were not following anyone. They had all had thousands of tweets, even though many of them had only been recently created. All of them had a large majority of followers whose profile and all content was in Japanese.
A significant number of the suspect Twitter accounts had their first follower as either a Japanese or Russian account and many of the accounts used banner images with Russian-language text.
Here is a screenshot of some of the followers of one of these accounts. We can not think of any legitimate reason why all these Japanese accounts would take such an interest in the Al Franken story.
It is suspected that this legitimate opinion piece had been weaponized for political gain by dozens of twitter accounts, all of them repeatedly tweeting links to the two domains registered in Japan in late November.
This Twitter botnet may involve well over 400 Twitter accounts, although at any one time only a subset of this total is used to promote a particular story.
Such strong similarities amongst the accounts combined with a clear connection to the two recently established Japanese websites verified suspicions. This is a sophisticated botnet being used to spread alt-right propaganda.
We refer to this as the Voty Twitter Botnet.

And it’s still going strong.
Link to our full article can be found here:

unhackthevote.com/our-research/t…
Link to our full article can be found here:

unhackthevote.com/our-research/t…
Missing some Tweet in this thread?
You can try to force a refresh.

Like this thread? Get email updates or save it to PDF!

Subscribe to MikeFarb
Profile picture

Get real-time email alerts when new unrolls are available from this author!

This content may be removed anytime!

Twitter may remove this content at anytime, convert it as a PDF, save and print for later use!

Try unrolling a thread yourself!

how to unroll video

1) Follow Thread Reader App on Twitter so you can easily mention us!

2) Go to a Twitter thread (series of Tweets by the same owner) and mention us with a keyword "unroll" @threadreaderapp unroll

You can practice here first or read more on our help page!

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just three indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member and get exclusive features!

Premium member ($3.00/month or $30.00/year)

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!