Millstones of fakes

Sadbottrue investigation team tracks twitter activity of all competitors of race 2016. We have traced, that audience behavior of all politicians have the features of automated activity.

But the most powerful and large-scale had only one candidate. In November he became the president of the US.

A year ago we have found the core of pro-Trump botnet and cyberfactory, imitated his numerous supporters. The most surprising, of course, was the fact that it was the only candidate who quoted bots. And not just quoted, but even built his social media strategy on this technique, posting more than 1,000 quotations of fake supporters.

What has changed after the election? Almost nothing, but two things can be noted. Trump's social media campaign has been indulgent for the frequent use of six-digit numbers in engagement stats. The average sum of retweets and likes now is more than 100,000. And of course, he stopped quoting bots.

After the inauguration, Trump uses botnet for imitation of massive approval and endorsement of statements. For example, Trump’s tweet about media.

There is no need to verify each account, to understand how many real humans are in someone's social audience. The separate use of bots is meaningless. The simulation of the audience is carried out with a botnet, a network of accounts acting according to a predetermined algorithm.

If you find multiple synchronous operations or repetition in a certain order of any monotonous actions, then this will be a proof of automatic control of an artificial audience.

You do not need to check all the bots that were used to increase the audience. Scientific methodology allows to make least three tests to determine whether there is an artificial audience.

How can any journalist detect the pro-Trump botnet algorithms?

It is impossible to find consistent pattern studying fast flow because it permanently changed. But when the flow is frozen, you can collect the snapshots and analyze it.

The every tweet has the numbers of retweets, likes and the gallery with 9 profile pictures of accounts which liked/retweeted it most recently. This gallery is very suitable for visual analysis because it is easy to compare few stack of pictures and find patterns in a repetition of profiles.

The best time to collect trump’s likes is deep night 00:00 - 6:00 AM ET - because botnet should imitate the real human behavior, bots are sleeping too.

1. At the same time save different Trump`s tweets with the service This allows you to freeze the last 9 accounts, who retweeted/liked this tweet. Usually, in the long tail, there are just likes.

2. Create the timeline of saved tweets, study the recent likers, reveal the presence of simple patterns and algorithms.

3. Pay special attention to accounts with default picture. Check names of all eggs-profiles (make screenshots with hints or send links to separate accounts to

For comparison, we use both permanent tweet feed and separate picture stacks divided by the dates of the tweets. This way we can identify the most frequent repetition of the pictures and find the patterns in its behavior. Those account will are definitely automated.

Sadbottrue made three bot-dope-probes for Trump`s tweets engagement. First of all, we have sanded links to several dozens of Trump’s tweets at the same time to online vault “

We pick all Trump’s tweets since inauguration day 20 Jan till 8 Feb. We have sent the same pack of tweets to vault three times. Probe A - March 1, 2017. Probe B and C - March 11, 2017. We have made screenshots of saved trump’s tweets and have created the timeline. So, the groups of serial bot likers and algorithms of un human behavior became obvious.

Athlete, caught on the use of doping immediately disqualified. Not the removal of points or other penalties for every excess percentage of the content of the prohibited substance in the blood, only disqualification.

If someone is caught using algorithmic simulation, his entire audience must be recognized as falsified. There is no need to understand how many of them are real. The proven fact of simulation invalidates any stats.

Let's move on to the results of the study. The Trump’s bot-dope-probe A


The bots have enlarged the count of likes for pro-Trump media (for example @DRUDGE_REPORT @foxandfriends).

The same serial bot-likes, grouped by dates of tweet. Each group has own algorithm. You can see most frequent 11 profile pictures serial bot-likers.The main trigger for probe A is the man on glasses. This account looks like human, but it’s behaviour more suitable for serial bot-liker.

This account has liked all Trump`s tweets. All tweets have different content and different amount of likes, but we see the same group of account, which have liked all tweets in the same order.

All tweets have dozens of thousands and even hundred of thousands of likes. The same order of 11 accounts during several dozens of tweets means, that all was made at the same time.

30 Jan and 20 Jan 2017 are the most obvious evidence of artificial social media engagement. Other screens show us, that different account has an own algorithm, they can change the order, the tweets or be interrupted by other packs of a serial bot-likers.

We can see, how algorithms have changed. “Brilliant” don’t work at 20 Jan.

“Chopra” switches the order and have tweets liked after the man in glasses. One of the egg become mute all day.


The Trump’s bot-dope-probe B

The most obvious, most cheap and most shameless imitation of the audience. In the world of counterfeit money, it will be a stack of paper between two $100 bills. It’s Trick for fooling.

Two different Trump`s tweets of two different days and two different themes have the exactly same order of 5 likes at the same time. That can`t be made by human in any way. It would be equivalent to the chance of winning “Powerball” jackpot twice in a row.

Four accounts are obvious serial bot-likers.

1. David Blackadar, @david_blackadar, joined December 2016, has just 1 tweet and 377 likes. It likes only Donald Trump.

2. m. rainwater, @mrainwater17, joined August 2015, has just 1 tweet and 389 likes. It likes only Donald Trump (classic canned account).

3. John Jackson, @johnnydougy, joined February 2017, has made 2 tweets and 420 likes. Mostly for Trump, Pence, and media accounts, covers Trump and his family.

4. BLS, @blsNiagaraFalls is disabled just a 24 hours after its activity spike. Earlier the account joined March 2016 and had 7 tweets and 80 likes Trump’s tweets with pictures. The account is dead for now.

5.Marion Franchini, @FranchiniMarion, joined August 2015. Active serial bot-liker, 10,000 likes for tweets of main actors of the pro-trump botnet and official supporters.

This pack of accounts has the same patterns with algorithms.


The Trump’s bot-dope-probe C

The third example is the account “Fiori”. It mimics to the corporate account of the small firm. But it has no interest in clients, but just in Trump’s tweets likes.

Another example of pack of serial bot-likers, with different algorithms.


We make the three independent probes with Trump’s tweets. We use the same technique, that anyone can check. And all three probes show us, that Trump`s social media team imitates the engagement with automated algorithms.

The review of the serial bot-likers algorithms

Among bot-likers, there are several groups of algorithms with a combination of different parameters.

How often bot likes Trump`s tweet.

1. Obvious bot-likers. (Liked all tweets).

2. Serial bot-likers (Liked group of tweets, for example only tweets with picture or tweets with a keyword).

3. Disposable bot-likers (Liked some tweets, then slept or switched on another type of activity)

From which botnet the account is.

1. Bot-likers, dedicated only on Trump.

2. Bot-likes, dedicated on Trump, his family, his official and unofficial supporters and loyal media.

3. Bot-likers, without the focus on Trump, but dedicated to another theme (for example on Kim Kardashian or porn).

4. Bot-likers without focus. There are accounts from the big botnet for imitation the activity of the social network.

The behavior of the account.

1. Booster. Active mostly for first hours after tweet appears.

2. Long tale. Active during months after tweet appears.

How does Trump's botnet works?

Each pack of accounts and algorithms has own triggers (keywords, events) and own cycle. A combination of the length of account lists, type of triggers and schedules forms the complicated wave of enlargement of social media counts. The examples of mathematically complicated waves you can see on screens above. Parts of the botnet, differing in size, algorithm, used in different combinations to different tweets, try to create the illusion of chaotic behavior of the crowd, just like on this gif.

Even an alternating set of algorithms is still reflected in the graphs as a mathematical sequence defined by formulas. But this is not exactly real people with their own interests, acting independently of each other.

A pro-trump botnet is the complicated combination of several dedicated pro-trump botnets, pro-republican media botnets, personal botnets of Trump’s official supporters etc. Every botnet has different algorithms with own formulas and variables.As you see. It is simple to spot any botnet and found automated accounts.

We needed patience and a high attention to detail, but in general, it is a quite feasible task even without complex computing and big data. According to the instructions, this can even be done by a student.

What do experts think about this?

A year ago in the first publication about Trump`s twitter botnet, founder Socialbakers Jan Rezab told that “bots are increasingly sophisticated and can mimic human behavior so closely that detecting them can be hard”.

Twitter co-founder, Jack Dorsey told “I feel very proud of the role of the service and what it stands for and everything that we’ve done, and that continues to accelerate every single day. Especially as it’s had such a spotlight on it through his usage and through the election.”

That awkward moment when millions of bots that increase the inflated capitalization of the company helped to elect the wrong candidate.