When you look at social media accounts that are not what they claim to be, they fall into one of three general categories:
1. Real Person engaging in impersonation or astroturfing
This is still the most common behavior pattern. On the internet, you can be anybody you want to be, and you can pretend to be anywhere on the planet. Trollbot factories can have hundreds of fake accounts, many of them operated by the same person or group of people.
2. Partly automated trollbot account, sometimes operated by multiple persons
This is becoming more common. It gives trolling and social media subversion organizations the best of both worlds. In off-hours, the account will be set up to automatically post or replicate content from elsewhere. When the operators are awake, they will post and comment manually.
3. Fully automated bot
These are becoming less common, since they can be more easily spotted by tools. These are set up to post previously stored content, or to replicate content posted elsewhere by using keyword triggers to copy and re-post content. Usually, analysis shows that there is no original content from the account, it consists entirely of content copied from elsewhere. Sometimes hundreds of accounts are set up to re-post the same content.
Ways to spot accounts
So here is a base list of the ways in which you can spot accounts that are not what they claim to be. This is not exhaustive, and the trollbot factories are consistently coming up with new variations to try and outflank bot detection algorithms.
Account Names and bios
1. Account name that comprises mostly numeric digits, like Ann2865743. These are usually accounts created by an account mass creation or replication engine. These accounts usually have no picture or avatar and no bio.
2. Bio that consists of a long collection of hashtags or slogans like #MAGA, #TRUMP.
3. Use of a stock photo, or photo of a well-known person as the account avatar. Many fake accounts use stock images lifted from the internet, or images of famous people. (One account on Twitter that I suspected of being a Russian trollbot used an image of what turned out to be a Russian porn actress)
Posting patterns
1. Following huge number of people, but has next to no friends or followers
2. Creating massive numbers of postings or comments in a short time period, far more than a real human could reasonably be expected to type and submit. If you do the math and find that the account is creating 100 postings an hour…that is indicative of an automated bot account.
3. Discrepancy between stated location, time zone and actual posting patterns (this is especially obvious on Twitter accounts). If an account claims to be in Lost Angeles, but seems to be tweeting on Moscow time, that is a bit of a giveaway. (One Twitter account that I monitored claimed to be in the UK, but always posted on Moscow time).
4. Posting patterns point to the account operator residing in a time zone that clearly aligns with a notorious trollbot location (good examples are Moscow and Vladivostok).
5. Daily posting patterns show a spurt of postings over a 1-2 hour period, or constant posting over 24 hours. Neither of these are what you would expect if a real human being was operating the account. Humans do tend to sleep from time to time…
Posting content
6. Poor command of written English. Often the use of Google Translate results in stilted or grammatically incorrect sentences, since the authors link slogans and phrases to form a sentence without understanding the underlying English grammar rules (which are complicated compared to some other languages).
7. Discrepancies between postings concerning where the account is located, the age of the account owner, the account owner’s life etc. etc. When the account owner’s bio keeps changing from day to day, this is a bit of a giveaway.
8. Discrepancy between the dialect of English in use. Classic one is an account pretending to be in the UK, but constantly using spelling and idioms from American English.
9. Discrepancy between expected careabouts and actual careabouts. Example is account pretending to be in the USA but posting about European subjects. Many Russian trollbots constantly post about subjects like the Ukraine, which looks odd if they are claiming to be from Baltimore…
10. Inclusion of markup language tags in postings or comments due to poor software coding or usage skills. This is a real giveaway that this is an account that is (at least part of the time) set up to automatically post content.
11. Analysis of postings on the platform shows that the same content has been posted by dozens (sometimes hundreds) of accounts within a short period of time. A search often reveals identical text posted hundreds of times within a matter of minutes.
12. Analysis of the account shows that it was dormant for a long period of time, but has suddenly been posting massive amounts of content. This is indicative of an account that was created, but parked for later use. Many Twitter trollbot accounts were created as far back as 2009, but have only recently been active
13. Numerous account name changes over time. Real people tend to not change their account names that frequently. Trollbot accounts do it all the time, as they are re-purposed to post on the Latest Hot Topic.
