DFRLab
Published in

DFRLab

#TrollTracker: Twitter Troll Farm Archives

Part Three — Assessing an covert Iranian social media influence campaign

(Source: @DFRLab)

Many Identities

Screenshot of the @real_iran profile picture, from the Wayback Machine. (Source: Twitter / @real_iran, via Wayback Machine)
Screenshot of the realiran.org page. Note the highlighted Twitter icon at the top right, and the Twitter URL at the bottom left, confirming that the website’s most recent Twitter account was @iran_reality. (Source: realiran.org)
Screenshot from Google archive showing some of the hashtags posted on by @realnienovosti1, including #islamic_revolution, #al-Quds, #persiangulf, and #multichild_family. (Source: Google)
Screenshot of the profile of @VoiceOfQuds, preserved in Google cache and archived on October 14, 2018. (Source: Twitter / @VoiceOfQuds, via Google)
Screenshot from profile picture of @riseagainstr, from the Wayback web archive. (Source: Twitter / @riseagainstr, via web.archive.org)
Screenshot showing a comparison of the profile pages of @libertyfrontpr and @berniecratss. Note the identical creation time and bio. FireEye witnessed the name change in July 2018. (Source: Twitter / @libertyfrontpr / @berniecratss. Image by @DFRLab.)

Priority Messaging

Timeline of posts by the Iranian accounts. (Source: DFRLab, based on Twitter data)
Screenshot from a scan of posts by Iranian accounts on the word “Noel” (translated from French: “Christmas”), showing the over 23,000 results, and the identical wording, posted to many other users. (Source: Twitter)
Screenshot from the same scan of posts by Iranian accounts on the word “Noel” (translated from French: “Christmas”), showing the hyperlinks to fr.awdnews.com. (Source: Twitter)

Foreign Policy

Number of times selected keywords were tweeted by the Iranian accounts. “Palestin” was chosen to allow results on “Palestine” and “Palestinian” in multiple languages. (Source: Twitter)
Number of times selected keywords were tweeted by the Iranian accounts. (Source: Twitter)

Saudi Arabia

Screenshot from a scan of posts by the Iranian accounts on September 11, 2015, showing the identical text and the number of posts. (Source: Twitter)
Screenshot from scan of posts by @marialuis91 on the Saudi Embassy, October 27, 2014. (Source: Twitter)

Israel

Syria

Turkey

Screenshot from scan of posts by @marialuis91 on September 16–17, 2014, showing the identical text posted to different users. (Source: Twitter)
Screenshot from scan of posts by @marialuis91 and @BenhadiiHedia on September 8, 2014, showing the identical text posted to different users. (Source: Twitter)

Messaging, Not Trolling

Tweets by @riseagsainstr, saved by the Wayback internet archive. Note the low engagement figures. (Source: Twitter / @riseagainstr, via web.archive.org)

Surprising Silence

Conclusion

--

--

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store
@DFRLab

@AtlanticCouncil's Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.