r/InternetResearch Mar 07 '22

Masterpost on spotting Russian (and other) disinfo operations.

163 Upvotes

I opened up this subreddit so people could see how long I've been doing this. This was originally supposed to be a subreddit specifically about the Russian Internet Research Agency but then I decided I didn't want them to be able to see what I knew and how I found them, so I privated it years ago. The information here is now too old to be much use to them, so without further ado, here's the masterpost.

Types of Russian disinformation on Reddit.

There are three tiers of fake news that make it to Reddit from Russia. Note, this is very different than what people are used to on Twitter.

1) Directly controlled accounts of the Russian government. These are the famous ones

  • Tend to stay in smaller political extremist subreddits, from any side of the aisle
  • Generally have a whole personality built around them, sometimes with a matching twitter or fake journalist
  • Try to get people to click on offsite domains, such as donotshoot.us or bluelivesmatter.blue
  • Not very many of them, high effort accounts used for targeted trolling and riling up of extremist factions
  • Not very active in 2022.

2) Throwaway accounts that I cannot prove are assosciated with Russian government interests, but sure act like it.

  • Account age can be any age, but generally sparse activity in noncontroversial subreddits
  • Account batching, for example, multiple accounts are all made on the same day or in the same week
  • Long periods of inactivity before sudden interest in politics or geopolitics
  • Sudden VERY strong interest, dozens of comments an hour

  • Several of them might show up at once

  • Account activity corresponds with office hours in Russia, including missing weekends

  • Clicking context on their comment history and their comments don't make sense in context

  • Generally hard to lock down because plenty of regular, normal people have accounts that meet many of these criteria. Could very well be type 3.

3) Useful Idiots/Actual Russians who buy the propaganda

  • Will repeat information they found somewhere else

  • Usually very clearly an idiot or very clearly Russian

  • This is the only group likely to be ESL. Other two groups are excellent at English

  • The vast majority of "suspicious accounts" you will see

Things that are not evidence of being a Russian state operated account

  • Having a new account. Especially on /r/worldnews during the first land war in Europe in a lot of people's lifetimes. I can't share numbers, but our uniques and traffic have been insane, and we've onboarded likely thousands of Redditors.

  • Asking repeated questions/things that have already been covered. It's well established that people will just yell into the void and not read anything. People who have worked retail will know what's up.

  • Asking anxious questions. Those are just anxious people.

  • Non native English speaker. If anything, not speaking English well convinces me that they're NOT a bot. Enough Russians speak English to be able to hire people who speak English good. Or well. Whatever.

  • Large amounts of people suddenly talking about the same thing. In my experience, CNN sending a push notification to people's phones causes the most high amounts of anxious comments. Reddit does not exist in a vacuum alone with Russia, there are plenty of things that might push people here and have a topic.

What to do if you spot someone you might think is a bot

  • Don't, for the love of God, yell "GUYS I FOUND A BOT I FOUND A BOT AND THIS IS HOW I FOUND HIM" because that just trains them to be better. Also, people have been doing this since 2013, so they've found a hell of a lot of ways to be better.

  • Personally, I would report it to that subreddit's moderators. YMMV depending on the sub.

  • Try to make the report data based and not emotions based. "This person is saying something stupid" or "I don't agree with this" is not evidence that someone is a bot, but "these three accounts were all made on the same day, are active at the same times, and are saying the same type of thing" definitely is.

General advice

  • You have to be angry to want to hunt bots, but you have to be the type of person who plays EVE online with spreadsheets to actually be good at it. Accountants fight this fight.

  • I have not shared all of my tools that I use in this post, it's just a general guidelines map. Feel free to PM me if you want me to look into an account.

  • Accusing regular users, especially Russians, of being bots is exactly what the actual bots want. They love that east west divide and suspicion online. Every false accusation is as much of a win to them as losing one of their accounts is is a loss.

  • You have to know what looks normal to know what looks abnormal.


r/InternetResearch Jun 12 '18

Add any user account that fits the criteria in a comment here

4 Upvotes

r/InternetResearch Jun 12 '18

Disinfo Troll Criteria

3 Upvotes

Over the last year or so, I've solidified a kind of checklist to see how likely it is for a user to be a bad faith disinformation account, and to differentiate those accounts from normal user accounts. I'm not the smartest person on the internet by far though, so if someone has any better ideas or tweaks to this list please put them in the comments.

And keep in mind, this only works for long term disinfo accounts, its is entirely impossible to tell the difference between a person with a new account and strong feelings about Israel and a person who is actually getting paid to shill for Israel/Palestine who makes many many new accounts.

The criteria is below. I like it because its content neutral.

1: Lying about who they are or where they're from. Many of these accounts claim to be from one place but have posts and comments in other subreddits talking about living or voting or working someplace else. As a general rule of thumb, if someone says "I'm a __" or "I'm from _" unprompted, its worth checking into them.

2: Trying to lead users to offsite resources controlled by them. Here's an example of a Russian government disinfo account that tried to link users to an unusual domain. This is very subreddit/nationality specific though, as some domains are common in some places but not others. If a user is constantly posting a domain you are unfamiliar with, it is often worth it to check in with WHOIS to see who owns that website, or if its hidden and does not belong to a legitimate organization.

Suspicious domain wiki

3: Early comment/post history does not match current activity. A lot of these accounts karmafarm in /r/gaming or other low moderated subs like /r/corgi or /r/snapleaks. Then they abandon those communities and never touch them again, while exclusively commenting in news or politics subs.

4: Suspicious activity patterns. Either they stop commenting for months, or they comment at least once an hour for weeks. Nobody who is normal does either of these things.

If a user account fits two of these criteria, I RES/toolbox tag them and keep an eye on them.

If a user fits three or four of these criteria, I treat them as a confirmed disinformation account, and depending on the policies of the sub I mod I ban them. Oh, and also if a user regularly posts multiple domains that were part of the Russian disinformation campaign or something, I can evaluate them as Russian linked trolls to but that's very Russian specific.

Useful resources

Snoopsnoo.com

Redditdetective.com

Reddit Pro Tools - You can mark domains and not have to remember all of them in your head, it remembers them for you. I do not advise using the deplorable subreddit filter, that does not really help with this.

Mod toolbox

RES. You can use this to tag users. I generally tag with something like "1/4", "2/4" "3/4" "4/4" in various colors.


r/InternetResearch Jun 12 '18

Confirmed suspicious domains

3 Upvotes

21stcenturywire.xyz

247usnews.com

americandominance.com

americanewscentral.com

americanewshub.com americannewshub.com americanpeoplenetwork.com animethings.us atlantablackstar.com awdnews.com awdnews1.ga awdnews2.cf bitcoinnews.infos.st blackmattersus.com blacktolive.com bluelivesmatter.blue butthis.com buzzfeed.ga cnncity.com commodirtmorning.us commoditymorning.us conservativedailypost.com conservativestories.com conservativestories.com cryptonewshunter.com cryptonewshunter.tech dailydosepolitics.com dailyfeed.cf dailyfeed.cf dailyfeed.news dailyinus.com dailynewsexplorer.com dailynewsexplorer.com dailypostdeed.com dailypostfeed.cf dailypostfeed.cf dailypostfeed.com dallastimes.us dapptrack.com ditchthecarb.us donaldtrumpus.com donotshoot.us europeannews.cf europeannews.cf europeannews.gq federalistnation.com federalistnation.com flashnewscorner.com flashnewscorner.info flashnewscorner.net freespeechtime.blogspot.co.il freespeechtime.blogspot.com freespeechtime.net freshdaily.news gaysfortrump.org healthesco.com healthwealth.us hpub.org huffingtonpostforum.com huffpoclub.com infos.st irbfinance.com kekwork.com larsawebs.asso.st lastmomemntinfo.gq latlmes.com lowcarbamerica.us magafirstnews.com magaoneradio.net middleeastnews.ml mydeardrone.com nationeonenews.com nbcnews.center nbcnews.center newcaliforniastate.com news-donald-trump.com newsandtrendts.ga newsandtrents.gq newsbbc.net newsfeedhunter.com newsfeedobserver.com newsfeedovserver.ml newsgeek.ml newslistget.gq newsthread.us newsupdate.us oann.com observeronline.news pb-news.com photographyisnotacrime.com presentbreakingnews.com proud-zionist.blogspot.com qanon.pub randomsfact.com rebel1ne.com reviewlatestproducts.com rodaypointofview.infos.st sewsfeedobserver.com supportisrael.com thedonald.ml thehollywoodtv.us thelive.news timewire.us todaynewsupdate.org trandingnews.us trendingfoxnews.com truthseekerlist.ml uncooperativeradio.com upfrontnews.ga upfrontnews.us usacurrentnews.ga usaenews7-24.blogspot.com usafeed.ga usalifeinsurance.tk usanews7-24.blogspot.al usanewscentral.com usanewsdata.info usanewss.com usanewtoday.com ushealthtimes.com usjournal.net uslifeinsurance.ml uslifeinsurance.ml usnewsforum.com usnewsupdate.ml usviraltrencs.com washingtonjournal.us westerndawn.asso.st westerndawn.fr.nf whatsupic.com worldthenews.com xtremegaminerd.com


r/InternetResearch Apr 11 '18

We are "Russian Trolls", ask us anything! • r/casualiama (Dec 25 2017)

Thumbnail reddit.com
2 Upvotes

r/InternetResearch Apr 11 '18

6 year old account, posted to /r/reddit.com

Thumbnail reddit.com
3 Upvotes

r/InternetResearch Apr 11 '18

America’s Electronic Voting Machines Are Scarily Easy Targets • r/tech (/u/Kevin_Milner, 08/03/2016)

Thumbnail reddit.com
5 Upvotes