Upload
nw
View
217
Download
0
Embed Size (px)
Citation preview
8/19/2019 Possible Sock Accounts on Twitter
1/93
Possible Sock Accounts
Note:
• Time gaps between tweets are rounded off to the minute.
• There are often multiple tweets made within one minute, therefore some entries will appear to be
duplicates.• Of interest are the times in which one account stops and another begins.
• Also of interest are the time periods in which no tweets are made and then more than one account
resumes tweeting within a minute (sometimes within seconds.
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
31 JANUARY 2016 (LAST TWEETS)
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
"#:$% KRT &ast tweet ('$ an
"":$# JOD &ast tweet ('$ an
##:$$ URC &ast tweet ('$ an
#$:$) WAC &ast tweet ('$ an$%:#) PIP &ast tweet (*"+ an
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
31 JANUARY ENDS
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
() hours, '$ mins No tweets from an account: #$:$) to #+:%+
!!!!!!!!
Note:After ) hours, '$ mins of no tweets from an account:
• KRT began tweeting at +:%+ am - after not tweeting for oer $" hours.
• / mins later URC began tweeting at +:01 am - after not tweeting for nearl $# hours.
• 1 mins later WAC began tweeting at $#:#" am - after not tweeting for nearl + hours.
• / mins later PIP began tweeting at $#:#+ am - after not tweeting for oer " das, "# hours
• $' mins later JOD began tweeting at $#:"" am - after not tweeting for oer $" hours.
No tweets:
• () hours %% mins WAC
• (+ hours %0 mins URC
• ($" hours $" mins JOD
• ($' hours '0 mins KRT
• (" das "# hours PIP
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
01 FEBRUARY 2016 BEGINS (173 Tweets)
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
8/19/2019 Possible Sock Accounts on Twitter
2/93
#+:%+ KRT 2irst tweet stopped
(/ mins
#+:01 URC 2irst tweet stopped
(1 mins$#:#" WAC 2irst tweet stopped
(/ mins
$#:#+ PIP 2irst tweet
($ min$#:$# KRT resumed
($ min
$#:$$ PIP 3 $#:$" ('
($ min$#:$' KRT stopped
($ min
$#:$% PIP 3 $#:"$ (%
($ min$#:"" JOD 2irst tweet
($ min
$#:"' PIP
(') secs
$#:"' JOD stopped(" mins
$#:"0 KRT resumed
(" mins$#:"/ PIP 3 $#:"+ stopped (0
!!!!!!!!!!!!!!!!
($) mins No tweets !!!!!!!!!!!!!!!!
$#:%/ URC resumed 3 $#:%) ("
($ min$#:%+ KRT resumed
($ min$#:0# URC stopped
(" mins$#:0" WAC resumed 3 $$:#% stopped ()
!!!!!!!!!!!!!!!!
(%) mins No tweets !!!!!!!!!!!!!!!!
$$:0" PIP resumed 3 $":#/ stopped ($%
!!!!!!!!!!!!!!!!
("# mins No tweets
!!!!!!!!!!!!!!!!
$":"/ WAC resumed 3 $":'1 (0
($ min
$":'/ PIP resumed
($ min$":') WAC
($ min
$":'+:%$ PIP
($ sec
8/19/2019 Possible Sock Accounts on Twitter
3/93
$":'+:%$ WAC
($ min
$":%#:$/ PIP
($+ secs$":%#:'1 WAC stopped
(0 mins
$":%0 PIP &ast tweet
!!!!!!!!!!!!!!!!
("" mins No tweets
!!!!!!!!!!!!!!!!
$':#/ JOD resumed stopped
!!!!!!!!!!!!!!!!
('" mins No tweets *Note: KRT 4 JOD resumed ' seconds apart !!!!!!!!!!!!!!!!
$':'+ KRT resumed
(' secs
$':'+ JOD resumed &ast tweet($$ mins
$':0# URC resumed stopped
($+ mins$%:#+ KRT 3 $0:0+ stopped ($#
!!!!!!!!!!!!!!!!
($ hour " mins No tweets !!!!!!!!!!!!!!!!
$/:#' KRT resumed 3 $/:'$ stopped (1
($% mins$/:%0 URC resumed 3 $/:0# stopped ('
($ min$/:0$ WAC resumed 3 $/:00 stopped (%
!!!!!!!!!!!!!!!!
('+ mins No tweets
!!!!!!!!!!!!!!!!
$):'% URC resumed 3 $):'0 ("
(/ mins
$):%" KRT resumed
(" mins$):%% WAC($ resumed
(" mins
$):%1 URC 3 $):0% stopped ("($) mins$+:$" KRT resumed 3 $+:$" &ast tweet ("
(' mins
$+:$0 URC resumed
!!!!!!!!!!!!!!!!
('$ mins No tweets
!!!!!!!!!!!!!!!!
8/19/2019 Possible Sock Accounts on Twitter
4/93
$+:%1 URC resumed 3 "#:$0 (1
!!!!!!!!!!!!!!!!
("$ mins No tweets !!!!!!!!!!!!!!!!
"#:'1 WAC resumed 3 "#:%# (%
("% secs"#:%# URC resumed
($ min
"#:%$ WAC 3 "#:%' (0
("% secs"#:%' URC
($ min
"#:%% WAC
($ sec"#:%% URC
($ min
"#:%0 WAC
(0 mins
"#:0# URC stopped(0 mins
"#:00 WAC 3 "":$1 ($)
(/ mins"":"' URC resumed
(' mins
"":"1 WAC
(% mins"":'# URC
(% mins
"":'% WAC 3 "":') ("
(' mins"":%$ URC
('$ secs"":%$ WAC
($ min"":%' URC
($ min
"":%% WAC
(1 mins"":0# URC
(" mins
"":0" WAC 3 "":0/ ('
(" mins"":0+ URC
(0 mins
"':#% WAC 3 "':#1 ("(% mins"':$# URC stopped
('# secs
"':$# WAC 3 "':'+ stopped ($)
!!!!!!!!!!!!!!!!
(%' mins No tweets
!!!!!!!!!!!!!!!!
8/19/2019 Possible Sock Accounts on Twitter
5/93
##:"" URC resumed 3 ##:"+ &ast tweet ("
!!!!!!!!!!!!!!!!
(0# mins No tweets !!!!!!!!!!!!!!!!
#$:$+ WAC resumed 3 #$:") (' &ast tweet
!!!!!!!!!!!!!!!!!!!!!!!!!!
01 FEBRUARY 2016 ENDS
!!!!!!!!!!!!!!!!!!!!!!!!!!
(1 hours 0# mins No tweets from an account: #$:") to #):$)
Note:After 1 hours 0# minutes no tweets from an account:
• WAC began tweeting at ):$) until ):'$ am - after not tweeting for nearl / hours
• ' mins later KRT began tweeting at ):'% am - after not tweeting for oer $' hours
• 0 mins later URC first tweeted at ):'+ am - after not tweeting for ) hours
!!!!!!!!!!!!!!!!
No tweets
• (1 hours 0# mins WAC
• () hours $# mins URC
• ($' hours "" mins KRT
• ("% hours "+ mins JOD
• ("1 hours $/ mins PIP
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
02 FEBRUARY 2016 BEGINS (271 tweets)
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
#):$) WAC 2irst tweet 3 #):'$ (0
(' mins
#):'% KRT 2irst tweet stopped($ min
#):'0 WAC 3 #):'/ ("
(" mins
#):'+ URC 2irst tweet stopped
($ sec #):'+ WAC 3 #+:## (+
($ min
#+:#$ KRT resumed (' mins
#+:#% URC resumed (1 mins
#+:$# WAC 3 #+:$" ("($ min
#+:$' KRT stopped
8/19/2019 Possible Sock Accounts on Twitter
6/93
(' mins
#+:$1 URC stopped(/ mins
#+:"' WAC 3 #+:'0 (1($$ mins
#+:%1 URC resumed stopped
!!!!!!!!!!!!!!!!
('# mins No tweets
!!!!!!!!!!!!!!!!
$#:$1 URC resumed 3 $#:$/ stopped ("
!!!!!!!!!!!!!!!!
($ hour '' mins No tweets !!!!!!!!!!!!!!!!
$$:0$ URC resumed stopped
!!!!!!!!!!!!!!!!
($ hour % mins No tweets
!!!!!!!!!!!!!!!!
$":01 KRT resumed stopped
!!!!!!!!!!!!!!!!
("" mins No tweets !!!!!!!!!!!!!!!!
$':$) WAC resumed
($ min$':$+ URC resumed
(% secs$':$+ WAC 3 $':"+ ()
() secs$':"+ URC
(" mins
$':'$ WAC 3 $':%# (+
($0 secs$':%# URC 3 $':%$ ("
(# secs
$':%$ WAC 3 $':%% (%
(' mins$':%/ URC
($ min
$':%) WAC ($ min$':%+ URC
($ min
$':0# WAC (1 mins
$':01 URC (' mins
$':0+ KRT resumed ($ min
8/19/2019 Possible Sock Accounts on Twitter
7/93
$%:## URC ($ min
$%:#$ WAC stopped($ min
$%:#" URC 3 $%:#/ (%($ min
$%:#) JOD 2irst tweet
($" secs$%:#) URC
(" mins
$%:$# JOD (" mins
$%:$$ URC ($# secs
$%:$$ KRT stopped(" mins
$%:$' JOD 3 $%:$+ (%(" mins
$%:"$ URC ("1 secs
$%:"$ JOD ($ min
$%:"" URC ($ min
$%:"' JOD 3 $%:"0 &ast tweet ("('% secs
$%:"0 URC 3 $%:"1 ("(' mins
$%:"+ WAC resumed ('$ secs
$%:"+ URC (" secs
$%:"+ WAC stopped
($ min$%:'$ URC 3 $%:'+ stopped (/
!!!!!!!!!!!!!!!!
("' mins No tweets
!!!!!!!!!!!!!!!!
$0:#" PIP 2irst tweet 3 $1:#% &ast tweet ($#
!!!!!!!!!!!!!!!!
(%' mins No tweets !!!!!!!!!!!!!!!!
$1:%/ KRT resumed stopped !!!!!!!!!!!!!!!!
($ hour %" mins No tweets
!!!!!!!!!!!!!!!!
$):"+ WAC resumed 3 $):%) ($#(" mins
$):0# URC resumed stopped
(' mins
8/19/2019 Possible Sock Accounts on Twitter
8/93
$):0' WAC 3 $+:$$ ($#('1 secs
$+:$$ URC resumed 3 $+:$' stopped ("(# secs
$+:$' WAC 3 $+:$0 stopped ('($# mins
$+:"0 KRT resumed 3 $+:'$ ("
($" secs$+:'$ URC resumed
(% mins
$+:'0 KRT ($ min
$+:'1 URC stopped(1 mins
$+:%" KRT 3 "#:#" &ast tweet (1() mins
"#:$$ URC resumed
("0 secs
"#:$$ WAC resumed 3 "#:$" ("($ min
"#:$' URC (" mins
"#:$0 WAC 3 "#:$) (%($ min
"#:$+ URC 3 "#:"# ("(' secs
"#:"# WAC 3 "#:"" ("("# secs
"#:"" URC (" mins
"#:"% WAC 3 "#:"0 ("($ min
"#:"1 URC
(" secs"#:"1 WAC 3 "#:'% (0
($ min"#:'0 URC
($ sec
"#:'0 WAC 3 "#:%' (/($ min
"#:%% URC ("0 secs
"#:%% WAC 3 "#:%/ (%($ min
"#:%) URC stopped($ min
"#:%+ WAC 3 "':$1 (1" *WAC ON&5 for " hours "/ mins($ min"':$/:#+ URC resumed
(') secs
"':$/:%/ WAC ($$ secs
"':$/ URC (" mins
"':$+ WAC 3 "':") (%($ min
8/19/2019 Possible Sock Accounts on Twitter
9/93
"':"+ URC ($' secs
"':"+ WAC ($1 secs
"':"+ URC ($ min
"':'# WAC 3 "':'+ ()
($" secs"':'+ URC stopped
($ min
"':%# WAC 3 "':%" &ast tweet (' !!!!!!!!!!!!!!!!
($ hour '+ mins No tweets
!!!!!!!!!!!!!!!!
#$:"$ URC resumed 3 #$:") &ast tweet ("
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
02 FEBRUARY 2016 ENDS
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
(1 hours '$ mins No tweets from an account: #$:") to #/:0+
*Note: JOD did not tweet on #' 2eb.
!!!!!!!!!!!!!!!!
No tweets:
• () hours + mins URC • () hours $/ mins WAC
• ("# hours "# mins KRT
• ("' hours '% mins PIP
• (" das % hours / mins JOD
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
03 FEBRUARY 2016 BEGINS (86 tweets)
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
#/:0+ WAC 2irst tweet stopped !!!!!!!!!!!!!!!!
($ hour ') mins No tweets !!!!!!!!!!!!!!!!
#+:'/ URC 2irst tweet 3 $#:%% stopped ("% !!!!!!!!!!!!!!!!
8/19/2019 Possible Sock Accounts on Twitter
10/93
(%# mins No tweets
!!!!!!!!!!!!!!!!
$$:"% URC resumed 3 $$:'" stopped ('($) mins
$$:0# WAC resumed 3 $":"$ stopped (1 !!!!!!!!!!!!!!!!
(" hours, %) mins No tweets
!!!!!!!!!!!!!!!!
$0:#+ WAC resumed 3 $0:$0 stopped (% !!!!!!!!!!!!!!!!
("' mins No tweets
!!!!!!!!!!!!!!!!
$0:') PIP 2irst tweet 3 $0:%) stopped (0 !!!!!!!!!!!!!!!!
('% mins No tweets !!!!!!!!!!!!!!!!
$1:"" KRT 2irst tweet 3 $1:"% ("(" mins
$1:"1 PIP resumed
(" mins
$1:") KRT 3 $1:'/ ("($ min
$1:') PIP 3 $1:%# ('(% mins
$1:%% KRT 3 $1:%/ ("($) mins
$/:#0 PIP &ast tweet(' mins
$/:#) KRT stopped !!!!!!!!!!!!!!!!
(%1 mins No tweets
!!!!!!!!!!!!!!!!
$/:0% KRT &ast tweet
($# mins
$):#% URC resumed 3 $):$/ stopped (0 !!!!!!!!!!!!!!!!
("0 mins No tweets !!!!!!!!!!!!!!!!
$):%" URC resumed stopped
!!!!!!!!!!!!!!!!
(%" mins No tweets
!!!!!!!!!!!!!!!!
$+:"% URC resumed 3 $+:%+ stopped ($'
8/19/2019 Possible Sock Accounts on Twitter
11/93
!!!!!!!!!!!!!!!!
($ hour %) mins No tweets
!!!!!!!!!!!!!!!!
"$:'/ URC resumed 3 "':01 stopped ($" !!!!!!!!!!!!!!!!
('% mins No tweets
!!!!!!!!!!!!!!!!
##:'# URC resumed 3 ##:'$ &ast tweet ("($/ mins
##:%) WAC resumed 3 #$:#/ &ast tweet ()
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
03 FEBRUARY 2016 ENDS
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
(1 hours "+ mins No tweets from an account: #$:#/ to #/:'1
Note: WAC did not tweet during #% 2eb 6session7.
!!!!!!!!!!!!!!!!
No tweets
• (/ hours 0 mins URC
• ($% hours 0% mins KRT
• ("" hours 0+ mins WAC
• ("" hours "# mins PIP
• (" das % hours / mins JOD
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
04 FEBRUARY 2016 BEGINS (80 t!!t")
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
#/:'1 URC 2irst tweet 3 #/:0$ stopped (0
!!!!!!!!!!!!!!!!
('$ mins No tweets
!!!!!!!!!!!!!!!!
#):"" URC resumed 3 #):'" stopped ('
!!!!!!!!!!!!!!!!
($1 mins No tweets
!!!!!!!!!!!!!!!!
#):%) KRT 2irst tweet stopped
8/19/2019 Possible Sock Accounts on Twitter
12/93
!!!!!!!!!!!!!!!!
("' mins No tweets
!!!!!!!!!!!!!!!!
#+:$$ KRT resumed stopped
!!!!!!!!!!!!!!!!
(" hours 0) mins No tweets
!!!!!!!!!!!!!!!!
$":#+ KRT resumed 3 $":"0 stopped (' !!!!!!!!!!!!!!!!
($ hour %+ mins No tweets
!!!!!!!!!!!!!!!!
$%:$% KRT resumed stopped
!!!!!!!!!!!!!!!!
($ hour $$ mins No tweets !!!!!!!!!!!!!!!!
$0:"0 PIP 2irst tweet 3 $0:"0 &ast tweet (" !!!!!!!!!!!!!!!!
(" hours $# mins No tweets
!!!!!!!!!!!!!!!!
$/:'0:0) KRT resumed stopped
!!!!!!!!!!!!!!!!
("/ mins No tweets
!!!!!!!!!!!!!!!!
$):#" KRT resumed(0 mins
$):#/ URC resumed stopped
($ min
$):#) KRT 3 $):$+ ("(% mins
$):"' #O$ 2irst tweet
(0/ secs
$):"' KRT 3 $):"% ("() mins
$):'" JOD 2irst tweet
($ min $):'' KRT 3 $):'0 ("($ min
$):'1 JOD stopped
(1 mins
$):%" KRT ($# mins
$):0" #O$ 3 $+:#" (%
(1 mins
$+:#) KRT 3 $+:$0 (/
8/19/2019 Possible Sock Accounts on Twitter
13/93
($ min
$+:$1 #O$
($ min
$+:$/ KRT 3 $+:"% (%(" mins
$+:"1 #O$ 3 $+:"/ ("
(" mins
$+:"+ KRT ($ min
$+:'# #O$ &ast tweet
!!!!!!!!!!!!!!!!
("' mins No tweets
!!!!!!!!!!!!!!!!
$+:0' KRT &ast tweet(%1 secs
$+:0' JOD resumed 3 "#:%0 stopped (0
!!!!!!!!!!!!!!!!
(") mins No tweets !!!!!!!!!!!!!!!!
"$:$' URC resumed($ min
"$:$% JOD resumed stopped
(' mins
"$:$/ URC 3 "$:%% stopped (/ !!!!!!!!!!!!!!!!
($ hour + mins No tweets
!!!!!!!!!!!!!!!!
"":0' URC resumed stopped !!!!!!!!!!!!!!!!
("+ mins No tweets
!!!!!!!!!!!!!!!!
"':"" JOD resumed stopped($$ mins
"':'' URC resumed stopped
!!!!!!!!!!!!!!!!
("" mins No tweets
!!!!!!!!!!!!!!!!
"':00 JOD resumed 3 "':0/ stopped ("($ min
"':0) URC resumed 3 ##:#$ ('
(0 mins
##:#1 WAC 2irst tweet 3 ##:$# (%(" mins
##:$" URC
($ min
##:$' WAC 3 ##:$% ("
8/19/2019 Possible Sock Accounts on Twitter
14/93
(/ mins
##:"$ URC
($ min
##:"" WAC &ast tweet(+ mins
##:'$ URC 3 ##:%$ &ast tweet ("
($' mins
##:0% JOD resumed 3 ##:0+ &ast tweet ("
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
04 FEBRUARY 2016 ENDS
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
(1 hours, 0% mins No tweets from an account ( JOD included: ##:0% to #/:0'(/ hours, $" mins No tweets from an account ( JOD e8cluded: ##:%$ to #/:0'
Note:
• WAC began at /:0' until ):#) am - after not tweeting for oer / hours
• " mins later KRT began at ):$# am - after not tweeting for oer $" hours
• / mins later URC began at ):$/ am - after not tweeting for oer / hours
• $0 mins later JOD began at ):'" am - after not tweeting for oer / hours
• "% seconds after JOD stopped ():') am WAC resumed
!!!!!!!!!!!!!!!!
No tweets
• (/ hours '$ mins WAC
• (/ hours '' mins JOD
• (/ hours '1 mins URC
• ($+ hours PIP• ($" hours $/ mins KRT
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
0& FEBRUARY 2016 BEGINS (222 tweets)
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
#/:0' WAC 2irst tweet 3 #):#) ($$
(" mins
#):$# KRT 2irst tweet stopped
(/ mins#):$/ URC 2irst tweet stopped
($0 mins
#):'" JOD 2irst tweet 3 #):') stopped ('("% secs
#):') WAC resumed 3 #):0# ('
(/ mins
#):0/ KRT resumed(+ mins
#+:#1 WAC
8/19/2019 Possible Sock Accounts on Twitter
15/93
($ min
#+:#/ KRT 3 #+:"1 stopped ('
(/ mins
#+:'' WAC 3 #+:'0 stopped (' !!!!!!!!!!!!!!!!
("0 mins No tweets
!!!!!!!!!!!!!!!!
$#:## WAC resumed 3 $#:$+ stopped (%
(1 mins
$#:"0 PIP 2irst tweet 9 stopped !!!!!!!!!!!!!!!!
("$ mins No tweets
!!!!!!!!!!!!!!!!
$#:%1 JOD resumed 3 $#:0# ("
($ min
$#:0$ #O$ 2irst tweet 9 stopped
($ min$#:0" JOD 3 $#:0% stopped ("
($ min
$#:00 KRT resumed stopped($/ mins
$$:$" WAC resumed 3 $":#/ stopped ($)
($1 mins
$":"' PIP resumed 3 $":'% stopped (1() mins
$":%" KRT resumed 3 $":0" ('
($ min
$":0' WAC resumed($ min
$":0% KRT ('+ secs
$":0% WAC stopped($" mins
$':#1 PIP resumed 3 $':#) stopped ("
(%/ secs
$':#) KRT 3 $':'% stopped ()($1 mins
$%:## JOD resumed 3 $%:#% stopped ('
!!!!!!!!!!!!!!!!
("% mins No tweets
!!!!!!!!!!!!!!!!
$%:") WAC resumed 3 $0:#0 ($)(% mins
$0:#+ KRT resumed
(" mins
$0:$$ WAC ($ min
$0:$" KRT
('0 secs
$0:$" WAC 3 $0:$% ("
8/19/2019 Possible Sock Accounts on Twitter
16/93
(%" secs
$0:$% KRT
(" mins
$0:$1 PIP resumed 3 $0:"# (&ast tweet ('("0 secs
$0:"# KRT 3 $0:"$ ("
(' mins
$0:"% WAC ($$ secs
$0:"% KRT
(1 mins
$0:'# WAC 3 $0:') ()($) secs
$0:') KRT
($ min
$0:'+ WAC (" mins
$0:%$ KRT stopped
($ min
$0:%" WAC 3 $0:%0 &ast tweet ('
!!!!!!!!!!!!!!!!
(%/ mins No tweets
!!!!!!!!!!!!!!!!
$1:'" KRT resumed
(/ mins
$1:'+ JOD resumed($ min
$1:%# KRT
($ min
$1:%$ JOD (' mins
$1:%% KRT ($ min
$1:%0 JOD 3 $1:%) ('($ min
$1:%+ KRT 3 $1:0# ("
($ min
$1:0$ JOD (" mins
$1:0' KRT
(%% secs
$1:0' JOD ($# mins
$/:#% KRT 3 $/:"' ('
(1 mins $/:"+ JOD 3 $/:'# ("($ min
$/:'$ KRT
($ min
$/:'" JOD (' mins
$/:'0 KRT stopped
($1 secs
$/:'0 JOD &ast tweet
8/19/2019 Possible Sock Accounts on Twitter
17/93
(+ mins
$/:%% URC resumed stopped
!!!!!!!!!!!!!!!!
('/ mins No tweets
!!!!!!!!!!!!!!!!
$):"$ URC resumed 3 $):%# (/($ min
$):%$ KRT resumed 3 $):%1 &ast tweet (1
(% mins
$):0# URC 3 $):01 stopped (' !!!!!!!!!!!!!!!!
(%0 mins No tweets
!!!!!!!!!!!!!!!!
$+:%$ URC resumed 3 "#:$' stopped (1
(" mins
"#:$0 #O$ resumed 3 "#:%+ stopped ($$
!!!!!!!!!!!!!!!!
("' mins No tweets
!!!!!!!!!!!!!!!!
"$:$" URC resumed
($ min
"$:$' #O$ resumed 3 "$:$' stopped ("(+ mins
"$:"" URC stopped
!!!!!!!!!!!!!!!!
("# mins No tweets
!!!!!!!!!!!!!!!!
"$:%" #O$ resumed stopped($" mins
"$:0% URC resumed 3 "":$" stopped ("
!!!!!!!!!!!!!!!!
("+ mins No tweets
!!!!!!!!!!!!!!!!
"":%$ #O$ resumed 3 "':"" ($%(" mins
"':"% URC resumed stopped
($ min "':"0 #O$ 3 ##:#" &ast tweet (% !!!!!!!!!!!!!!!!
(") mins No tweets
!!!!!!!!!!!!!!!!
##:'# URC resumed 3 ##:%% &ast tweet ("
8/19/2019 Possible Sock Accounts on Twitter
18/93
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
0& FEBRUARY 2016 ENDS
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
(1 hours %" mins No tweets from an account: ##:%% to #/:"1
!!!!!!!!!!!!!!!!
No tweets:
• (/ hours 00 mins URC
• ($% hours ' mins KRT
• ($0 hours %$ mins WAC
• ($1 hours $# mins JOD
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
06 FEBRUARY 2016 BEGINS (152 tweets) !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
#/:"1 WAC 2irst tweet 3 #/:0/ stopped (+
!!!!!!!!!!!!!!!!
(%" mins No tweets !!!!!!!!!!!!!!!!
#):'+ URC 2irst tweet 3 #):%% URC ("
(0 mins#):%+ KRT 2irst tweet
(+ secs
#):%+ URC
("1 secs#):%+ KRT stopped
(/ secs
#):%+ URC 3 #):%+ stopped ("
!!!!!!!!!!!!!!!!
(0% mins No tweets
*Note: after no tweets from an acct for 0% mins KRT 4 JOD resumed $ min apart
!!!!!!!!!!!!!!!!
#+:%% KRT resumed stopped
($ min
#+:%0 JOD 2irst tweet stopped($) mins
#+:0' KRT resumed
($# mins$#:#' URC resumed
(1 mins
$#:#+ KRT stopped
(/ secs$#:#+ URC 3 $#:"1 stopped ('
8/19/2019 Possible Sock Accounts on Twitter
19/93
!!!!!!!!!!!!!!!!
("# mins No tweets
!!!!!!!!!!!!!!!!
$#:%1 WAC resumed 3 $#:%/ ("
(% mins
$#:0$ URC resumed 3 $#:0' ("($ min
$#:0% WAC stopped
(" mins
$#:01 URC 3 $$:#) stopped (" !!!!!!!!!!!!!!!!
("+ mins No tweets
!!!!!!!!!!!!!!!!
$$:'/ WAC resumed 3 $$:%# stopped (0
($ min
$$:%$ URC resumed 3 $$:01 stopped (%
(% mins$":## WAC resumed
($' mins
$":$' KRT resumed 3 $":"$ stopped ("(" mins
$":"' WAC stopped
($+ mins
$":%" PIP 2irst tweet 3 $":%1 ("(" mins
$":%) WAC resumed 3 $":%) ('
($ min
$":%+ PIP 3 $":0# &ast tweet ('(" mins
$":0" WAC stopped !!!!!!!!!!!!!!!!
('0 mins No tweets
!!!!!!!!!!!!!!!!
$':"/ KRT resumed stopped($0 mins
$':%" WAC resumed 3 $1:#1 stopped ($'
($ min
$1:#/ KRT resumed stopped !!!!!!!!!!!!!!!!
($ hour + mins No tweets !!!!!!!!!!!!!!!!
$/:$1 URC resumed 3 $/:$/ stopped ("
($) mins
$/:'0 KRT resumed 3 $/:%1 stopped ("(0 mins
$/:0$ URC resumed stopped
!!!!!!!!!!!!!!!!
8/19/2019 Possible Sock Accounts on Twitter
20/93
("0 mins No tweets
!!!!!!!!!!!!!!!!
$):$1 WAC resumed 3 $):"1 (/("# secs
$):"1 JOD resumed &ast tweet
($ min
$):"/ KRT resumed &ast tweet(+ mins
$):'1 WAC 3 $):') stopped (%
!!!!!!!!!!!!!!!!
($ hour $' mins No tweets
!!!!!!!!!!!!!!!!
$+:0$ WAC resumed 3 "$:$" ($#(+ mins
"$:"$ #O$ 2irst tweet 9 &ast tweet
($ min
"$:"" WAC 3 "":%+ &ast tweet ($+
(" mins"":0$ URC resumed
(' mins
"":0% $AG 2irst tweet 3 "":0+ ('($ min
"':## URC
(" mins
"':#" $AG ($ min
"':#' URC
($ min
"':#% $AG -"':$/ ("('/ secs
"':$/ URC ($$ secs
"':$/ $AG 3 "':'1 ($#($# secs
"':'1 URC
($ min
"':'/ $AG 3 "':%+ &ast tweet ($#(' mins
"':0" URC 3 ##:') &ast tweet (+
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
06 FEBRUARY 2016 ENDS !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
(/ hours, '/ mins No tweets from an account 3 JOD included: ##:') to #):$0
(/ hours, 0' mins No tweets from an account 3 JOD e8cluded: ##:') to #):'$
!!!!!!!!!!!!!!!!
No tweets:
8/19/2019 Possible Sock Accounts on Twitter
21/93
• () hours $1 mins URC
• (+ hours %" mins WAC
• ($0 hours "+ mins KRT
• ("" hours '# mins JOD
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
0' FEBRUARY 2016 BEGINS
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
#):$0 JOD 2irst tweet stopped
($1 mins
#):'$ WAC 2irst tweet 3 #):0# ()(% mins
#):0% URC 2irst tweet
(' mins
#):0/ WAC 3 #+:#" (0
(0/ secs#+:#" JOD resumed stopped
($ min
#+:#' WAC 3 #+:#% ("($ min
#+:#0 URC
(" secs
#+:#0 WAC (' mins
#+:#) URC stopped
("/ secs
#+:#) WAC 3 #+:$# stopped (" !!!!!!!!!!!!!!!!
("" mins No tweets
!!!!!!!!!!!!!!!!
#+:'" URC resumed 3 #+:'' stopped
($+ mins
#+:0" WAC resumed 3 #+:00 ('($ min
#+:01 KRT 2irst tweet
($ min
#+:0/ URC resumed($ min
#+:0) WAC
(' mins
$#:#$ KRT ($# mins
$#:$$ URC
(% mins$#:$0 WAC
(' mins
$#:$) KRT
(" mins$#:"# URC 3 $#:'$ (0
8/19/2019 Possible Sock Accounts on Twitter
22/93
("% secs
$#:'$ KRT
($ min
$#:'" WAC ($ min
$#:'' KRT
(" mins
$#:'0 URC 3 $#:'1 ('(' mins
$#:'+ WAC
($0 secs
$#:'+ KRT (% mins
$#:%' WAC 3 $#:%% ("
() mins
$#:0" URC (/ mins
$#:0+ KRT
($/ secs
$#:0+ URC 3 $$:## ("
(" secs$$:## KRT ("
(% mins
$$:#% URC 3 $$:#0 stopped ("($ min
$$:#1 KRT 3 $$:#1 ("
($ min
$$:#/ WAC 3 $$:$$ stopped (%('1 secs
$$:$$ KRT stopped
($+ mins
$$:'# WAC resumed 3 $$:'' stopped (" !!!!!!!!!!!!!!!!
("1 mins No tweets
!!!!!!!!!!!!!!!!
$$:0+ WAC resumed 3 $":%1 stopped ()
!!!!!!!!!!!!!!!!
("+ mins No tweets
!!!!!!!!!!!!!!!!
$':$0 WAC resumed 3 $%:#/ stopped ()($' mins
$%:"# JOD resumed stopped
!!!!!!!!!!!!!!!!
('' mins No tweets
!!!!!!!!!!!!!!!!
$%:0' WAC resumed 3 $0:#" stopped (0 !!!!!!!!!!!!!!!!
($ hour %' mins No tweets
!!!!!!!!!!!!!!!!
8/19/2019 Possible Sock Accounts on Twitter
23/93
$1:%0 URC resumed 3 $1:0# stopped ("
($0 mins
$/:#0 KRT resumed(1 mins
$/:$$ URC
($ min
$/:$" KRT (1 mins
$/:$) URC 3 $/:"$ stopped ("
() mins
$/:"+ KRT 3 $):"$ ()() mins
$):"+ JOD resumed 3 $):'" &ast tweet ('
(% mins
$):'1 URC resumed stopped($ min
$):'/ KRT 3 $):%' stopped ('
!!!!!!!!!!!!!!!!
("/ mins No tweets !!!!!!!!!!!!!!!!
$+:$# URC resumed(1 mins
$+:$1 PIP 2irst tweet 3 $+:$/ &ast tweet ("
(% mins
$+:"$ KRT resumed 3 $+:') ('(/ secs
$+:') URC stopped
($ min
$+:'+ KRT 3 "#:$) ($)(' secs
"#:$) URC resumed($ min
"#:$+ KRT 3 "#:"" ("($ min
"#:"' URC
('$ secs
"#:"' KRT 3 "#:"0 &ast tweet ("(+ mins
"#:'% URC stopped
!!!!!!!!!!!!!!!!
(") mins No tweets
!!!!!!!!!!!!!!!!
"$:#" URC resumed 3 "$:%# stopped (' !!!!!!!!!!!!!!!!
("' mins No tweets
!!!!!!!!!!!!!!!!
"":#' URC resumed (% mins
"":#/ WAC resumed 3 "":$# ('
8/19/2019 Possible Sock Accounts on Twitter
24/93
($ min
"":$$ URC ($ min
"":$" WAC ($ min
"":$' URC (' mins
"":$1 WAC 3 "":$) ('($ min
"":$+ URC ('+ secs
"":$+ WAC (" mins
"":"$ URC (# secs
"":"$ WAC 3 "":0' ("#('' secs
"":0' URC (' mins
"":01 WAC ($ sec
"":01 URC ($ min
"":0/ WAC 3 "':$1 &ast tweet (0 !!!!!!!!!!!!!!!!
(0$ mins No tweets
!!!!!!!!!!!!!!!!
##:#/ URC 3 ##:"' &ast tweet (0
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
0' FEBRUARY 2016 ENDS
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
() hours % mins No tweets from an account: ##:"' to #):"/
Note:After ) hours % mins:
• URC began tweeting at +:$% am
• % minutes later KRT began tweeting at +:$) am
!!!!!!!!!!!!!!!!
No tweets:
• () hours 0$ mins URC
• (+ hours $$ mins WAC
• ($" hours 0' mins KRT
• ("# hours ' mins JOD
8/19/2019 Possible Sock Accounts on Twitter
25/93
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
08 FEBRUARY 2016 BEGINS
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
#):"/ WAC 2irst tweet 3 #):%' stopped ()
!!!!!!!!!!!!!!!!
("$ mins No tweets
!!!!!!!!!!!!!!!!
#+:$% URC 2irst tweet stopped
(% mins
#+:$) KRT 2irst tweet 3 #+:'# stopped ('
!!!!!!!!!!!!!!!!
($ hour % mins No tweets
!!!!!!!!!!!!!!!!
$#:'% KRT resumed 3 $#:0+ stopped (0 !!!!!!!!!!!!!!!!
(' hours $# mins No tweets !!!!!!!!!!!!!!!!
$%:#+ WAC resumed 3 $%:$% stopped (%
(0 mins$%:$+ PIP 2irst tweet stopped
($0 mins
$%:'% URC resumed 3 $%:'0 ("
($+ secs$%:'0 JOD 2irst tweet 3 $%:'/ ("
(" mins$%:'+ WAC resumed
(" mins$%:%$ JOD
(" mins
$%:%' WAC
($ min$%:%% JOD
(' mins
$%:%/ URC 3 $%:0$ stopped ('
(+ secs$%:0$ WAC 3 $%:0" ('
(" mins
$%:0% JOD 3 $%:01 stopped ("(/ mins$0:#' WAC stopped
($1 mins
$0:$+ KRT resumed stopped
!!!!!!!!!!!!!!!!
("# mins No tweets
!!!!!!!!!!!!!!!!
8/19/2019 Possible Sock Accounts on Twitter
26/93
$0:'+ URC resumed stopped
!!!!!!!!!!!!!!!!
("' mins No tweets !!!!!!!!!!!!!!!!
$1:#" WAC resumed stopped
(1 mins$1:#) JOD resumed 3 $1:$% stopped ("
($" mins
$1:"1 KRT resumed 3 $1:") stopped ('
(0 mins$/:'' PIP resumed 3 $/:%" ('
($ min
$/:%' WAC resumed
(' mins$/:%1 PIP
($ min
$/:%/ URC resumed 3 $/:0# stopped ("
(+ mins
$/:0+ WAC 3 $):#$ stopped ("($1 mins
$):$/ PIP stopped
!!!!!!!!!!!!!!!!
("" mins No tweets
!!!!!!!!!!!!!!!!
$):'+ URC resumed 3 $):%' ("
($" mins
$):00 PIP resumed 3 $):00 &ast tweet ("
(" mins$):0/ URC 3 $):0/ ("
() mins$+:#0 KRT resumed 3 $+:#/ ("
(" mins$+:#+ URC
($ min
$+:$# KRT
() mins$+:$) URC 3 $+:'1 stopped (%
!!!!!!!!!!!!!!!!
('" mins No tweets !!!!!!!!!!!!!!!!
"#:#) KRT &ast tweet($) mins"#:"1 JOD resumed 3 "#:") stopped ("
!!!!!!!!!!!!!!!!
("1 mins No tweets !!!!!!!!!!!!!!!!
"#:0% WAC resumed 3 "#:01 ('
($ min
8/19/2019 Possible Sock Accounts on Twitter
27/93
"#:0/ URC resumed (' mins
"$:## WAC 3 "$:#' ('($/ secs
"$:#' JOD resumed stopped
(" mins
"$:#0 WAC 3 "$:$# stopped (1
(% mins"$:$% URC stopped
!!!!!!!!!!!!!!!!
("$ mins No tweets !!!!!!!!!!!!!!!!
"$:'0 JOD resumed &ast tweet
($$ mins"$:%1 WAC resumed 3 "$:0' (%
(' secs
"$:0' URC resumed
(' mins
"$:01 WAC ($# secs
"$:01 URC
(" mins"$:0) WAC
(" mins
"$:0+ URC
($ min"":## WAC stopped
($ sec
"":## URC stopped
!!!!!!!!!!!!!!!!
('# mins No tweets !!!!!!!!!!!!!!!!
"":'# WAC resumed 3 "":'" stopped ('
!!!!!!!!!!!!!!!!
('1 mins No tweets !!!!!!!!!!!!!!!!
"':#) URC resumed 3 "':$" ("
(% mins"':$1 WAC resumed 3 "':$/ ("
($ min
"':$) URC ($ min"':$+ WAC &ast tweet
(" mins
"':"$ URC 3 "':'% ("
!!!!!!!!!!!!!!!!
(%/ mins No tweets
!!!!!!!!!!!!!!!!
8/19/2019 Possible Sock Accounts on Twitter
28/93
##:"$ URC resumed 3 ##:"1 &ast tweet ('
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
08 FEBRUARY 2016 ENDS
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
(/ hours 0+ mins No tweets from an account: ##:"1 to #):"0
Note:
After / hours 0+ mins KRT and URC began tweeting 0 mins apart.
!!!!!!!!!!!!!!!!
No tweets:
• () hours %0 mins URC
• (+ hours 1 mins WAC
• ($" hours 0) mins KRT
• ($+ hours '/ mins JOD
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
0 FEBRUARY 2016 BEGINS
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
#):"0 WAC 2irst tweet 3 #):%% stopped (/
!!!!!!!!!!!!!!!!
("" mins No tweets !!!!!!!!!!!!!!!!
#+:#1 KRT 2irst tweet
(0 mins#+:$$ URC 2irst tweet 3 #+:$% ("
(% mins
#+:$) KRT
(' mins#+:"$ URC stopped
() mins
#+:"+ KRT stopped
($$ mins#+:%# URC resumed 3 $#:#% stopped (/
!!!!!!!!!!!!!!!!
('% mins No tweets !!!!!!!!!!!!!!!!
$#:') URC resumed 3 $#:%+ stopped (% !!!!!!!!!!!!!!!!
($ hour % mins No tweets
!!!!!!!!!!!!!!!!
8/19/2019 Possible Sock Accounts on Twitter
29/93
$$:0' URC resumed 3 $":$# stopped (%
!!!!!!!!!!!!!!!!
(' hours $/ mins No tweets !!!!!!!!!!!!!!!!
$0:"/ PIP 2irst tweet 3 $0:") stopped ("
!!!!!!!!!!!!!!!!
('% mins No tweets
!!!!!!!!!!!!!!!!
$1:#" URC resumed 3 $1:"0 stopped ('
(0 mins
$1:'# PIP resumed &ast tweet
!!!!!!!!!!!!!!!!
("0 mins No tweets
!!!!!!!!!!!!!!!!
$1:00 KRT resumed stopped
(' mins
$1:0) URC resumed 3 $/:#' stopped ("(+ mins
$/:$" JOD 2irst tweet stopped
!!!!!!!!!!!!!!!!
("/ mins No tweets
!!!!!!!!!!!!!!!!
$/:'+ KRT resumed stopped !!!!!!!!!!!!!!!!
("$ mins No tweets
!!!!!!!!!!!!!!!!
$):## KRT resumed &ast tweet
!!!!!!!!!!!!!!!!
(%$ mins No tweets
!!!!!!!!!!!!!!!!
$):%$ WAC resumed 3 $):%) stopped (0 !!!!!!!!!!!!!!!!
("$ mins No tweets !!!!!!!!!!!!!!!!
$+:#+ URC resumed stopped
!!!!!!!!!!!!!!!!
('1 mins No tweets
!!!!!!!!!!!!!!!!
$+:%0 WAC resumed 3 "#:#+ stopped (1
8/19/2019 Possible Sock Accounts on Twitter
30/93
($# mins
"#:$+ JOD resumed
($ min
"#:"# URC resumed($ min
"#:"$ JOD 3 "#:"/ &ast tweet ('
(1 mins
"#:'' URC 3 "#:'1 stopped (" !!!!!!!!!!!!!!!!
(") mins No tweets
!!!!!!!!!!!!!!!!
"$:#% WAC resumed 3 "$:"+ &ast tweet (/
!!!!!!!!!!!!!!!!
("1 mins No tweets
!!!!!!!!!!!!!!!!
"$:00 URC resumed 3 "":0% stopped ('
!!!!!!!!!!!!!!!!
('/ mins No tweets
!!!!!!!!!!!!!!!!
"':'$ URC resumed 3 "':%' &ast tweet ("
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
0 FEBRUARY 2016 ENDS
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
() hours 0' mins No tweets from an account: "':%' (#+ 2eb URC to #):'1 ($# 2eb URC
Note:
After ) hours 0' mins URC and WAC began tweeting + mins apart.
!!!!!!!!!!!!!!!!
No tweets:
() hours 0' mins URC
($$ hours $1 mins WAC
($" hours %' mins JOD
($1 hours 0) mins KRT
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
10 FEBRUARY 2016 BEGINS
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
#):'1 URC 2irst tweet 3 #):%# ('
(0 mins
8/19/2019 Possible Sock Accounts on Twitter
31/93
#):%0 WAC 2irst tweet 3 #):0$ (%
($ min
#):0" URC 3 #):0" ("
($ min#):0' WAC 3 #+:## stopped (1
($# mins
#+:$# JOD 2irst tweet 3 #+:$$ ("
(" mins#+:$' URC
($ min
#+:$% JOD stopped
("% secs#+:$% URC stopped
!!!!!!!!!!!!!!!!
(%" mins No tweets !!!!!!!!!!!!!!!!
#+:01 JOD resumed 3 $#:## stopped ('
!!!!!!!!!!!!!!!!
(0) mins No tweets
!!!!!!!!!!!!!!!!
$#:0) KRT 2irst tweet stopped
!!!!!!!!!!!!!!!!
(" hours '" mins No tweets !!!!!!!!!!!!!!!!
$':'# JOD resumed 3 $':%# stopped (0
!!!!!!!!!!!!!!!!
(0% mins No tweets !!!!!!!!!!!!!!!!
$%:'% PIP 2irst tweet 3 $%:') stopped ("
!!!!!!!!!!!!!!!!
($ hour '' mins No tweets !!!!!!!!!!!!!!!!
$1:$$ WAC resumed 3 $1:$" ("
(" mins$1:$% PIP resumed 3 $1:$0 stopped ('
($$ secs
$1:$0 WAC 3 $1:0# ($)($ min$1:0$ PIP resumed
("1 secs
$1:0$ WAC
(% secs$1:0$ KRT resumed
(" mins
$1:0' WAC 3 $1:00 ('
(' mins
8/19/2019 Possible Sock Accounts on Twitter
32/93
$1:0) KRT
($ min
$1:0+ JOD resumed 3 $/:## ("
($ min$/:#$ KRT
(% secs
$/:#$ PIP
($ min$/:#" JOD &ast tweet
(% mins
$/:#1 WAC 3 $/:$$ ("
($" secs$/:$$ KRT
(" mins
$/:$' WAC 3 $/:$0 ("
(' secs$/:$0 KRT
(' mins
$/:$) WAC 3 $/:$+ ("
(" mins
$/:"$ PIP (' secs
$/:"$ WAC
($0 secs$/:"$ KRT
(' mins
$/:"% WAC
($ min$/:"0 PIP
($% secs
$/:"0 WAC stopped
(" mins$/:"/ KRT 3 $/:'# ('
(0 mins$/:'0 PIP
(' mins$/:') KRT 3 $/:%/ (%
(% mins
$/:0# PIP
($ min$/:0$ KRT
(0 mins
$/:01 PIP 3 $/:0/ ("
($ min$/:0) KRT 3 $):#" (0
($ min
$):#' PIP &ast tweet(' mins$):#1 WAC resumed 3 $):#+ ("
($ min
$):$# URC resumed stopped
($ min$):$$ KRT
(") secs
$):$$ WAC
($ min
8/19/2019 Possible Sock Accounts on Twitter
33/93
$):$" KRT 3 $):$) (%
(' mins
$):"$ WAC 3 $):"0 (%
() secs$):"0 KRT
(" mins
$):"/ WAC 3 $):"+ ('
(' mins$):'" KRT
(' mins
$):'0 WAC
($ min$):'1 KRT 3 $):'/ ("
(" secs
$):'/ WAC
($ min$):') KRT
(" mins
$):%# WAC &ast tweet
($ min
$):%$ KRT 3 $+:#$ (+($ min
$+:#" URC resumed stopped
() mins$+:$# KRT 3 $+:$0 &ast tweet ("
!!!!!!!!!!!!!!!!
($ hour $0 mins No tweets !!!!!!!!!!!!!!!!
"#:'# URC resumed 3 "$:$0 (+ stopped
!!!!!!!!!!!!!!!!
(00 mins No tweets !!!!!!!!!!!!!!!!
"":$# URC resumed 3 "":"" stopped (%
!!!!!!!!!!!!!!!!
($ hour 1 mins No tweets !!!!!!!!!!!!!!!!
"':") URC resumed &ast tweet
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
10 FEBRUARY 2016 ENDS !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
() hours %+ mins No tweets from an account: "':") to #):$/
Note:
After ) hours %+ mins KRT and URC began tweeting + mins apart.
8/19/2019 Possible Sock Accounts on Twitter
34/93
!!!!!!!!!!!!!!!!
• () hours 0) mins URC
• ($' hours " mins KRT
• ($1 hours % mins WAC
• ("' hours $/ mins JOD
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
11 FEBRUARY 2016 BEGINS (72 tweets)
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
#):$/ KRT 2irst tweet stopped
(+ mins
#):"1 URC 2irst tweet 3 #):%0 stopped ('
!!!!!!!!!!!!!!!!
($ hour 0+ mins No tweets
!!!!!!!!!!!!!!!!
$#:%% WAC 2irst tweet 3 $$:$' stopped (0
!!!!!!!!!!!!!!!!
(% hours $ min No tweets
!!!!!!!!!!!!!!!!
$0:$% KRT resumed stopped !!!!!!!!!!!!!!!!
($ hour 0 mins No tweets
!!!!!!!!!!!!!!!!
$1:$+ JOD 2irst tweet 3 $1:"$ stopped ("
($" mins
$1:'' KRT resumed(+ mins
$1:%" PIP 2irst tweet
(+ secs
$1:%" KRT 3 $1:%/ ("(0 mins
$1:0" PIP
(" mins
$1:0% KRT 3 $1:0+ (%(% mins
$/:#' PIP 3 $/:$# (%(" mins
$/:$" KRT
(" mins
$/:$% PIP
(0 mins$/:$+ JOD resumed &ast tweet
8/19/2019 Possible Sock Accounts on Twitter
35/93
(' secs
$/:$+ PIP 3 $/:"1 ('
(0 mins
$/:'$ KRT 3 $/:'" ("(" mins
$/:'% PIP
(' mins
$/:'/ KRT 3$/:%# ("('# secs
$/:%# PIP
(/ mins
$/:0' KRT ($' mins
$/:01 PIP 3 $):'$ (%
($1 mins
$):%/ KRT (0 mins
$):0" PIP &ast tweet
(" mins
$):0% URC resumed
(" mins$):01 KRT 3 $+:#" ("
($1 mins
$+:$) URC ($$ mins
$+:"+ KRT &ast tweet
(0 mins
$+:'% URC stopped !!!!!!!!!!!!!!!!
("1 mins No tweets
!!!!!!!!!!!!!!!!
"#:## URC resumed 3 "":"+ stopped (/ !!!!!!!!!!!!!!!!
($ hour ) mins No tweets
!!!!!!!!!!!!!!!!
"':'/ URC resumed 3 "':'+ ("(% mins
"':%' WAC resumed 3"':%+ (%
($ min
"':0# URC 3 "':0$ &ast tweet ("($/ secs
"':0$ WAC 3 ##:"0 &ast tweet ($$
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
11 FEBRUARY 2016 ENDS
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
() hours, 0" mins No tweets from an account (PIP included: ##:"0 to #+:$/
8/19/2019 Possible Sock Accounts on Twitter
36/93
(+ hours, "% mins No tweets from an account ( JOD included9PIP e8cluded: ##:"0 to #+:%+
($$ hours, "/ mins No tweets from an account (PIP 4 JOD e8cluded: ##:"0 to $$:0"
Note:KRT did not tweet on $" 2eb.WAC did not tweet until "':'' on $" 2eb.
!!!!!!!!!!!!!!!!
No tweets:
• ($" hours $ mins URC
• ($1 hours '# mins JOD
• ("' hours ) mins WAC
• (" das $" hours 1 mins KRT
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
12 FEBRUARY 2016 BEGINS (68 tweets) !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
#+:$/ PIP 2irst tweet 3 #+:"% stopped ('
!!!!!!!!!!!!!!!!
("0 mins No tweets !!!!!!!!!!!!!!!!
#+:%+ JOD 2irst tweet
(" mins#+:0$ PIP resumed
(00 secs
#+:0$ JOD 3 #+:0) stopped ("
() mins$#:#0 PIP 3 $#:$0 stopped ("
!!!!!!!!!!!!!!!!
($ hour "' mins No tweets !!!!!!!!!!!!!!!!
$$:') PIP resumed 3 $$:0# ("
(" mins$$:0" URC 2irst tweet
(/ mins
$$:0+ PIP
($ min$":#$ URC
($ min
$":#" PIP (" mins
$":#% URC
(1 mins
$":$# PIP 3 $":$' ("($ min
8/19/2019 Possible Sock Accounts on Twitter
37/93
$":$% URC 3 $":$1 ("
($1 mins
$":'" PIP 3 $":%/ (/
(% mins$":0$ URC
(% mins
$":00 PIP
(" mins$":0/ URC
($" mins
$':#+ PIP 3 $':$1 (%
(1 mins$':"" URC stopped
(' mins
$':"0 PIP stopped
!!!!!!!!!!!!!!!!
(" hours ) mins No tweets
!!!!!!!!!!!!!!!!
$0:'' PIP resumed stopped !!!!!!!!!!!!!!!!
($ hour "1 mins No tweets !!!!!!!!!!!!!!!!
$1:0+ PIP resumed 3 $/:#" &ast tweet (%
!!!!!!!!!!!!!!!!
($ hour $+ mins No tweets
!!!!!!!!!!!!!!!!
$):"$ JOD resumed 3 $):"0 stopped ("
!!!!!!!!!!!!!!!!
(0% mins No tweets !!!!!!!!!!!!!!!!
$+:$+ JOD resumed 3 $+:') &ast tweet ('
($/ mins$+:00 URC resumed stopped
!!!!!!!!!!!!!!!!
("' mins No tweets !!!!!!!!!!!!!!!!
"#:$) URC resumed stopped !!!!!!!!!!!!!!!!
("0 mins No tweets
!!!!!!!!!!!!!!!!
"#:%' URC resumed stopped
!!!!!!!!!!!!!!!!
(%# mins No tweets
8/19/2019 Possible Sock Accounts on Twitter
38/93
!!!!!!!!!!!!!!!!
"$:"' URC resumed stopped
!!!!!!!!!!!!!!!!
(%+ mins No tweets
!!!!!!!!!!!!!!!!
"":$" URC resumed 3 "':") ($1
(0 mins
"':'' WAC 2irst tweet stopped
(" mins"':'0 URC &ast tweet
!!!!!!!!!!!!!!!!
("$ mins No tweets !!!!!!!!!!!!!!!!
"':01 WAC resumed 3 ##:"1 &ast tweet ($#
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
12 FEBRUARY 2016 ENDS
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
() hours $) mins No tweets from an account: ##:"1 to #):%%
!!!!!!!!!!!!!!!!
No tweets:
• (+ hours + mins URC
• ($$ hours " mins WAC
• ($' hours %# mins JOD
• (" das $" hours 1 mins KRT
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
13 FEBRUARY 2016 BEGINS (75 tweets)
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
#):%% URC 2irst tweet 3 #):%0 stopped !!!!!!!!!!!!!!!!
('" mins No tweets
!!!!!!!!!!!!!!!!
#+:$) JOD 2irst tweet 3 #+:'% stopped
($ min#+:'0 URC resumed 3 #+:%# stopped
!!!!!!!!!!!!!!!!
(") mins No tweets !!!!!!!!!!!!!!!!
8/19/2019 Possible Sock Accounts on Twitter
39/93
$#:#) URC resumed 3 $#:%# stopped
!!!!!!!!!!!!!!!!
("$ mins No tweets
!!!!!!!!!!!!!!!!
$$:#$ URC resumed 3 $$:$" stopped
($) mins
$$:") WAC 2irst tweet
(" mins$$:'# URC resumed stopped
(/ mins
$$:'/ WAC stopped
(" mins$$:'+ PIP 2irst tweet 3 $":#%
(1 secs
$":#% WAC resumed
($ min
$":#0 PIP(" mins
$":#/ WAC stopped
($ min$":#) PIP 3 $":#) &ast tweet
(1 mins
$":$% URC resumed stopped
!!!!!!!!!!!!!!!!
($ hour ' mins No tweets
!!!!!!!!!!!!!!!!
$':$/ URC resumed stopped
!!!!!!!!!!!!!!!!
(" hours " mins No tweets !!!!!!!!!!!!!!!!
$0:$+ URC resumed 3 $0:"%
(% mins$0:") WAC resumed 3 $0:"+
(% mins
$0:'' URC
($ min$0:'% WAC 3 $0:'0 &ast tweet
($/ mins
$0:0" URC (% mins$0:01 JOD resumed
(" mins
$0:0) URC 3 $1:$" stopped
(% mins$1:$1 JOD 3 $1:"% stopped
!!!!!!!!!!!!!!!!
(0" mins No tweets
8/19/2019 Possible Sock Accounts on Twitter
40/93
!!!!!!!!!!!!!!!!
$/:$1 URC resumed 3 $/:$/ stopped
!!!!!!!!!!!!!!!!
("' mins No tweets
!!!!!!!!!!!!!!!!
$/:%# URC resumed stopped
!!!!!!!!!!!!!!!!
("" mins No tweets !!!!!!!!!!!!!!!!
$):#" JOD resumed 3 $):#/ stopped
!!!!!!!!!!!!!!!!
(" hours $$ mins No tweets
!!!!!!!!!!!!!!!!
"#:$) URC resumed 3 "$:$+ stopped !!!!!!!!!!!!!!!!
(%1 mins No tweets !!!!!!!!!!!!!!!!
"":#0 URC resumed 3 "":#/ stopped
(' mins"":$# JOD resumed 9 &ast tweet
!!!!!!!!!!!!!!!!
("/ mins No tweets !!!!!!!!!!!!!!!!
"":'/ URC resumed 3 ##:") &ast tweet
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
13 FEBRUARY 2016 ENDS
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
() hours, / mins No tweets from an account: ##:") to #):'0
Note:
After ) hours / mins no tweets from an account:
• KRT began at ):'0 am after " das $" hours no tweets
• " mins later JOD began at ):'/ am after $# hours "/ mins no tweets
• $% mins later URC began tweeting after oer ) hours no tweets
!!!!!!!!!!!!!!!!
No tweets:
8/19/2019 Possible Sock Accounts on Twitter
41/93
• () hours "0 mins URC
• ($# hours "/ mins JOD
• ($+ hours ") mins WAC
• (" das $" hours 1 mins KRT
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
14 FEBRUARY 2016 BEGINS
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
#):'0 KRT 2irst tweet
(" mins
#):'/ JOD 2irst tweet stopped(" mins
#):'+ KRT
($% mins
#):0' URC 2irst tweet 3 #):0/ stopped
($ min#):0) KRT stopped
!!!!!!!!!!!!!!!!
(%% mins No tweets
!!!!!!!!!!!!!!!!
#+:%" URC resumed 3 #+:%) stopped(0 mins
#+:0' KRT resumed 3 $#:#$ stopped
!!!!!!!!!!!!!!!!
(%/ mins No tweets
!!!!!!!!!!!!!!!!
$#:%) URC resumed stopped
($0 mins
$$:#' WAC 2irst tweet
(/ mins
$$:$# URC resumed stopped
(% mins
$$:$% WAC 3 $$:$/ stopped
($' mins
$$:'# KRT resumed stopped
(% mins
$$:'% URC resumed 3 $$:%$ stopped
!!!!!!!!!!!!!!!!
(%$ mins No tweets
!!!!!!!!!!!!!!!!
$":"" WAC resumed stopped
!!!!!!!!!!!!!!!!
("/ mins No tweets !!!!!!!!!!!!!!!!
8/19/2019 Possible Sock Accounts on Twitter
42/93
$":%+ KRT resumed 3 $":0$ stopped
(/ mins
$":0) WAC resumed 3 $':$1 stopped !!!!!!!!!!!!!!!!
('" mins No tweets
!!!!!!!!!!!!!!!!
$':%) WAC resumed 3 $':0+ stopped
(/ mins
$%:#1 KRT resumed stopped
!!!!!!!!!!!!!!!!
($ hour No tweets
!!!!!!!!!!!!!!!!
$0:#1 WAC resumed 3 $0:$# stopped
!!!!!!!!!!!!!!!!
('% mins No tweets !!!!!!!!!!!!!!!!
$0:%% WAC resumed() mins
$0:0" JOD resumed 3 $0:0)
($ min
$0:0+ 3 $1:#$ WAC stopped(% mins
$1:#0 JOD 3 $1:#+ stopped
!!!!!!!!!!!!!!!!
("% mins No tweets
!!!!!!!!!!!!!!!!
$1:'' URC resumed 3 $1:'1 stopped(% mins
$1:%# KRT resumed stopped
!!!!!!!!!!!!!!!!
("' mins No tweets
!!!!!!!!!!!!!!!!
$/:#' URC resumed() mins
$/:$$ KRT resumed
($ min $/:$" URC 3 $/:$% stopped(" mins
$/:$1 WAC resumed stopped
(/ mins
$/:"' KRT &ast tweet !!!!!!!!!!!!!!!!
(%' mins No tweets
!!!!!!!!!!!!!!!!
8/19/2019 Possible Sock Accounts on Twitter
43/93
$):#1 URC resumed 3 $):$$ stopped
!!!!!!!!!!!!!!!!
('+ mins No tweets
!!!!!!!!!!!!!!!!
$):0# URC resumed 3 $+:0$($# mins
"#:#$ JOD resumed 3 "#:#" stopped
($ min
"#:#' URC 3 "#:%# stopped !!!!!!!!!!!!!!!!
(") mins No tweets
!!!!!!!!!!!!!!!!
"$:#) URC resumed stopped
!!!!!!!!!!!!!!!!
("# mins No tweets !!!!!!!!!!!!!!!!
"$:") WAC resumed 3 "$:"+ ($' mins
"$:%" URC resumed
() mins
"$:0# WAC 3 "$:0%('' secs
"$:0% URC
() secs
"$:0% WAC 3 "$:01 ($# secs
"$:01 URC("1 secs
"$:01 WAC 3 "$:0/ (' mins
"":## URC
(0 mins
"":#0 WAC
(' mins
"":#) URC
($ min
"":#+ WAC 3 "":$) (% mins
"":"" JOD resumed stopped
(+ mins "":'$ WAC 3 "":''($1 secs
"":'' URC
(% mins
"":'/ WAC 3 "":%0 &ast tweet($ min
"":%1 URC 3 ##:%) &ast tweet
!!!!!!!!!!!!!!!!
8/19/2019 Possible Sock Accounts on Twitter
44/93
("+ mins No tweets
!!!!!!!!!!!!!!!!
#$:$/ JOD resumed 3 #$:$) &ast tweet
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
14 FEBRUARY 2016 ENDS
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
(/ hours, %1 mins No tweets from an account 3 JOD e8cluded
(/ hours, $1 mins No tweets from an account 3 JOD included
!!!!!!!!!!!!!!!!
No tweets:
• (/ hours 0+ mins JOD
• () hours 1 mins URC
•
($0 hours $$ mins KRT • ($" hours WAC
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
1& FEBRUARY 2016 BEGINS
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
#):'% KRT 2irst tweet 3 #):%0 stopped
(+ mins
#):0% URC 2irst tweet 3 #+:#+ () mins
#+:$/ JOD 2irst tweet
($ min
#+:$) 3 #+:"# URC stopped(%# secs
#+:"# 3 #+:"0 JOD stopped
!!!!!!!!!!!!!!!!
($0 mins No tweets
!!!!!!!!!!!!!!!!
#+:%# KRT resumed 3 #+:0) stopped(' mins
$#:#$ URC resumed 3 $#:#+ stopped
!!!!!!!!!!!!!!!!
($+ mins No tweets
!!!!!!!!!!!!!!!!
$#:") KRT resumed
(0 mins
$#:'' URC resumed
(/ mins$#:%# KRT
8/19/2019 Possible Sock Accounts on Twitter
45/93
(0 mins
$#:%0 WAC 2irst tweet 3 $#:0$
(" mins
$#:0' KRT stopped(/ mins
$$:## WAC 3 $$:'%
($ min
$$:'0 URC
($' secs
$$:'0 WAC 3 $$:'/ stopped
(' mins
$$:%# URC 3 $$:%/ stopped !!!!!!!!!!!!!!!!
("1 mins No tweets
!!!!!!!!!!!!!!!!
$":$' KRT resumed stopped
!!!!!!!!!!!!!!!!
($/ mins No tweets !!!!!!!!!!!!!!!!
$":'# URC resumed stopped
!!!!!!!!!!!!!!!!
(0# mins No tweets
!!!!!!!!!!!!!!!!
$':"# URC resumed 3 $%:#'
($# mins
$%:$' KRT resumed stopped($ min
$%:$% URC 3 $%:'/ (% mins
$%:%$ JOD resumed($" mins
$%:0' WAC resumed 3 $%:00
(% mins
$%:0+ 3 $0:#" URC
($ min
$0:#' 3 $0:#% JOD
(' mins
$0:#/ URC 3 $0:$$ stopped($0 mins
$0:"1 WAC
(+ mins $0:'0 JOD
(" mins
$0:'/ WAC 3 $0:00
($ min
$0:01 JOD stopped($ min
$0:0/ WAC 3 $1:$+ &ast tweet
() mins
$1:"/ KRT resumed stopped
8/19/2019 Possible Sock Accounts on Twitter
46/93
!!!!!!!!!!!!!!!!
('1 mins No tweets
!!!!!!!!!!!!!!!!
$/:#' URC resumed
(% mins
$/:#/ JOD resumed stopped
(" mins
$/:#+ URC 3 $/:$% stopped
(" mins
$/:$1 KRT resumed stopped
!!!!!!!!!!!!!!!!
("' mins No tweets
!!!!!!!!!!!!!!!!
$/:'+ JOD resumed stopped
(/ mins
$/:%1 URC resumed stopped
($ min$/:%/ KRT resumed stopped
!!!!!!!!!!!!!!!!
("" mins No tweets
!!!!!!!!!!!!!!!!
$):#+ KRT resumed stopped
() mins
$):$/ JOD resumed 3 $):$+ stopped
!!!!!!!!!!!!!!!!
($/ mins No tweets
!!!!!!!!!!!!!!!!
$):'1 KRT resumed 3 $):%)() mins
$):01 JOD resumed stopped
(% mins
$+:## KRT 3 $+:$" (% mins
$+:$1 PIP 2irst tweet
(' mins
$+:$+ KRT 3 $+:"%(' mins
$+:"/ PIP
($ min $+:") KRT
(1 mins
$+:'%:#) URC resumed stopped
($# secs
$+:'%:$) KRT 3 $+:%1:#% ("/ secs
$+:%1:'$ PIP
($ min
$+:%/ KRT 3 $+:0):#'
8/19/2019 Possible Sock Accounts on Twitter
47/93
(%/ secs
$+:0):0# PIP
($ min
$+:0+ KRT
($ min
"#:## PIP 3 "#:#+:"0
($ sec
"#:#+:"1 KRT
(" mins
"#:$$:0# PIP
(" secs
"#:$$:0" KRT 3 "#:$' &ast tweet($ min
"#:$% PIP 3 "#:$0 &ast tweet
!!!!!!!!!!!!!!!!
($) mins No tweets
!!!!!!!!!!!!!!!!
"#:'' URC resumed stopped
!!!!!!!!!!!!!!!!
('' mins No tweets
!!!!!!!!!!!!!!!!
"$:#1 JOD resumed stopped
!!!!!!!!!!!!!!!!
(") mins No tweets
!!!!!!!!!!!!!!!!
"$:'% URC resumed stopped
!!!!!!!!!!!!!!!!
($ hour $/ mins No tweets
!!!!!!!!!!!!!!!!
"":0$ URC resumed stopped
!!!!!!!!!!!!!!!!
("# mins No tweets
!!!!!!!!!!!!!!!!
"':$$ URC resumed($ min
"':$" JOD resumed 3 "':$" &ast tweet
(" mins "':$% URC &ast tweet
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
1& FEBRUARY 2016 ENDS
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
(+ hours 0 mins No tweets from an account: "':$% to #):$+
8/19/2019 Possible Sock Accounts on Twitter
48/93
!!!!!!!!!!!!!!!!
No tweets:
• ($# hours '0 mins URC
• ($$ hours %"mins JOD
•($" hours 1 mins KRT
• ("# hours '% mins WAC
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
16 FEBRUARY 2016 BEGINS
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
#):$+ KRT 2irst tweet 9 stopped
!!!!!!!!!!!!!!!!
('# mins No tweets
!!!!!!!!!!!!!!!!
#):%+ KRT resumed 3 #+:%1 stopped
(' mins#+:%+ URC 2irst tweet 9 stopped
!!!!!!!!!!!!!!!!
(%' mins No tweets !!!!!!!!!!!!!!!!
$#:'" KRT resumed stopped
!!!!!!!!!!!!!!!!
("" mins No tweets
!!!!!!!!!!!!!!!!
$#:0% JOD 2irst tweet 3 $#:0/ stopped
!!!!!!!!!!!!!!!!
("+ mins No tweets !!!!!!!!!!!!!!!!
$$:"1 URC resumed stopped
!!!!!!!!!!!!!!!!
($ hour "# mins No tweets
!!!!!!!!!!!!!!!!
$":%1 KRT resumed 3 $":0'
("/ secs
$":0' WAC 2irst tweet 3 $":01($ min
$":0/ KRT 3 $':##
($ min
$':#$ WAC 3 $':$#(" secs
8/19/2019 Possible Sock Accounts on Twitter
49/93
$':$# KRT 3 $':$%
($ min
$':$0 WAC 3 $':$1
() mins$':"% JOD resumed stopped
($ min
$':"0 KRT 3 $':'$
(" mins$':'' WAC
("' secs
$':'' KRT 3 $':'% stopped
(' secs$':'% WAC 3 $':%+ stopped
!!!!!!!!!!!!!!!!
($% mins No tweets !!!!!!!!!!!!!!!!
$%:#' KRT resumed stopped
!!!!!!!!!!!!!!!!
('$ mins No tweets
!!!!!!!!!!!!!!!!
$%:'% PIP 2irst tweet 3 $0:#"
($1 mins
$0:$) KRT resumed stopped
(" mins$0:"# URC resumed
(' mins
$0:"' PIP 3 $0:"% stopped
(' mins$0:"/ URC 3 $0:'' stopped
!!!!!!!!!!!!!!!!
('/ mins No tweets !!!!!!!!!!!!!!!!
$1:$# PIP resumed 3 $1:"/ &ast tweet
($# mins$1:'/ KRT resumed 3 $1:%$
(% mins
$1:%0 URC resumed 3 $/:#/
(%# secs$/:#/ KRT stopped
(+ mins
$/:$1 3 $/:"$ URC stopped !!!!!!!!!!!!!!!!
('" mins No tweets
!!!!!!!!!!!!!!!!
$/:0' KRT resumed 3 $):$%
(0 mins
$):$+ URC resumed
($ min
8/19/2019 Possible Sock Accounts on Twitter
50/93
$):"# KRT
($" secs
$):"# URC
(1 mins$):"1 KRT 3 $):"/ &ast tweet
($ min
$):") URC 3 $):'$ stopped
($" mins$):%' WAC resumed stopped
!!!!!!!!!!!!!!!!
(%$ mins No tweets !!!!!!!!!!!!!!!!
$+:"% URC resumed 3 $+:%# stopped
!!!!!!!!!!!!!!!!
("" mins No tweets
!!!!!!!!!!!!!!!!
"#:#" URC resumed 3 "#:"$ stopped !!!!!!!!!!!!!!!!
(%# mins No tweets !!!!!!!!!!!!!!!!
"$:#$ URC resumed stopped
!!!!!!!!!!!!!!!!
($ hour "+ mins No tweets
!!!!!!!!!!!!!!!!
"":'# JOD resumed stopped
!!!!!!!!!!!!!!!!
(%# mins No tweets !!!!!!!!!!!!!!!!
"':$# JOD resumed
($ min"':$$ URC resumed
($+ secs
"':$$ JOD 3 "':$0
(' mins"':$) URC 3 "':'0 &ast tweet
($% mins
"':%+ JOD &ast tweet !!!!!!!!!!!!!!!!
('$ mins No tweets
!!!!!!!!!!!!!!!!
##:"# WAC resumed 3 #':'% stopped (%0 tweets
!!!!!!!!!!!!!!!!
($ hour $' mins No tweets
8/19/2019 Possible Sock Accounts on Twitter
51/93
!!!!!!!!!!!!!!!!
#%:%/ WAC resumed 3 #1:0/ stopped ($# tweets
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
16 FEBRUARY 2016 ENDS
*Arbitrar 3 WAC tweeted off and on until #1:0/ $/ 2eb* !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
($ hour "# mins No tweets from an account: #1:0/ to #):$/() hours ") mins No tweets from an account (WAC e8cluded9 JOD included: "':%+ to #):$/
() hours %" mins No tweets from an account (WAC9 JOD e8cluded: "':'0 to #):$/
!!!!!!!!!!!!!!!!
No tweets:
• (1 hours + mins WAC
• (+ hours ' mins URC
• ($# hours "0 mins JOD
• ($' hours 0# mins KRT
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
1' FEBRUARY 2016 BEGINS
*Arbitrar 3 WAC tweeted off and on until #1:0/ $/ 2eb*
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
#):$/ KRT 2irst tweet 9 stopped
!!!!!!!!!!!!!!!!
("$ mins No tweets
!!!!!!!!!!!!!!!!
#):') URC 2irst tweet(" mins
#):%# KRT resumed stopped
(' mins
#):%' 3 #):%1 URC stopped !!!!!!!!!!!!!!!!
(") mins No tweets
!!!!!!!!!!!!!!!!
#+:$% URC resumed 3 #+:$/ stopped
!!!!!!!!!!!!!!!!
("# mins No tweets
!!!!!!!!!!!!!!!!
#+:'/ URC resumed 3 #+:0) stopped
8/19/2019 Possible Sock Accounts on Twitter
52/93
($1 mins
$#:$% JOD 2irst tweet 3 $#:$+ stopped
($ min
$#:"# KRT resumed 3 $#:"$($" mins
$#:'' PIP 2irst tweet 3 $#:'%
(' mins
$#:'/ KRT
($$ mins
$#:%) PIP
($ min
$#:%+ KRT 3 $#:0"() mins
$$:## PIP 3 $$:#"
(" mins
$$:#% KRT stopped($ min
$$:#0 PIP 3 $$:#+ stopped
(% mins
$$:$' URC resumed stopped
(" mins$$:$0 JOD resumed 3 $$:"# stopped
!!!!!!!!!!!!!!!!
($ hour %1 mins No tweets
!!!!!!!!!!!!!!!!
$':#1 WAC 2irst tweet 9 stopped !!!!!!!!!!!!!!!!
($ hour No tweets
!!!!!!!!!!!!!!!!
$%:#1 JOD resumed 3 $%:$" stopped !!!!!!!!!!!!!!!!
('" mins No tweets
!!!!!!!!!!!!!!!!
$%:%% PIP resumed 3 $%:%1 stopped !!!!!!!!!!!!!!!!
($ hour $) mins
!!!!!!!!!!!!!!!!
$1:#% KRT resumed 3 $1:#/ stopped
!!!!!!!!!!!!!!!!
($ hour $+ mins No tweets
!!!!!!!!!!!!!!!!
$/:"1 PIP resumed 3 $/:'"($" mins
$/:%% URC resumed 3 $/:%+ stopped
($ min
$/:0# KRT resumed
8/19/2019 Possible Sock Accounts on Twitter
53/93
(" mins
$/:0" PIP 3 $):#/
(" mins
$):#+ KRT stopped !!!!!!!!!!!!!!!!
("# mins No tweets
!!!!!!!!!!!!!!!!
$):"+ WAC resumed 3 $):'$ WAC
(" mins
$):'' JOD resumed &ast tweet($ min
$):'% WAC 3 $):'1
($ min
$):'/ PIP 3 $):'/($ min
$):') WAC
($ min
$):'+ PIP
($ min$):%# WAC
(" mins
$):%" PIP
(" mins
$):%% WAC
(+ secs
$):%% URC resumed($ min
$):%0 WAC 3 $):%0
(" mins
$):%/ PIP
($" secs
$):%/ WAC($# secs
$):%/ PIP
("' secs
$):%/ PIP
(# secs
$):%/ URC
($ min
$):%) WAC 3 $):%+
($$ secs
$):%+ URC
($0 secs
$):%+ PIP
(% mins $):0' WAC 3 $):0%(" mins
$):01 PIP stopped
(# secs
$):01 WAC 3 $+:#0 stopped(0 mins
$+:$# URC 3 $+:$% stopped
($$ mins
$+:"0 KRT resumed stopped
8/19/2019 Possible Sock Accounts on Twitter
54/93
(1 mins
$+:'$ WAC 3 "#:#1
($ min
"#:#/ KRT resumed(%/ secs
"#:#/ PIP resumed &ast tweet
(" mins
"#:#+ WAC
($ min
"#:$# KRT
(% secs
"#: WAC $# 3 "#:$%(" mins
"#:$1 KRT
(' secs
"#:$1 WAC
($ min
"#:$/ KRT
($ min
"#:$) WAC
(" mins"#:"# KRT
($0 secs
"#:"# WAC 3 "#:"'($ min
"#:"% KRT 3 "#:"1
() secs
"#:"1 WAC
(0 mins
"#:'$ KRT 3 "#:'%
(' mins
"#:'/ WAC stopped(0 mins
"#:%" KRT 3 "#:0# &ast tweet(/ mins
"#:0/ URC resumed 3 "$:#0() mins
"$:$' WAC resumed
(% mins
"$:$/ URC (" mins
"$:$+ WAC 3 "$:0% stopped
($) mins
"":$" URC stopped
!!!!!!!!!!!!!!!!
("0 mins No tweets !!!!!!!!!!!!!!!!
"":'/ URC resumed 3 "":0# stopped
!!!!!!!!!!!!!!!!
("# mins No tweets
!!!!!!!!!!!!!!!!
"':$# URC resumed 3 "':"% stopped
8/19/2019 Possible Sock Accounts on Twitter
55/93
!!!!!!!!!!!!!!!!
(0$ mins No tweets
!!!!!!!!!!!!!!!!
##:$0:$) URC 3 ##:'+:'1
(" mins
##:%$ WAC resumed(% mins
##:%0 URC
(" mins
##:%/ WAC 3 #$:#"($ min
#$:#' URC 3 #$:#)
(1 mins
#$:$% WAC stopped(0 mins
#$:$+ URC 3 #$:"' &ast tweet
!!!!!!!!!!!!!!!!
('+ mins No tweets !!!!!!!!!!!!!!!!
#":#" WAC resumed 3 #":$/ stopped !!!!!!!!!!!!!!!!
($ hour "$ mins No tweets
!!!!!!!!!!!!!!!!
#':') WAC resumed stopped
!!!!!!!!!!!!!!!!
($ hour 0' mins No tweets
!!!!!!!!!!!!!!!!
#0:'$ WAC resumed stopped
!!!!!!!!!!!!!!!!
(%' mins No tweets
!!!!!!!!!!!!!!!!
#1:$% WAC &ast tweet
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
1' FEBRUARY 2016 ENDS
*Arbitrar 3 WAC tweeted off and on until #1:$%* !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
($ hour "1 mins No tweets from an account ($AG included: #1:$% to #/:%#(" hours 00 mins No tweets from an account ($AG e8cluded: #1:$% to #+:#+
!!!!!!!!!!!!!!!!
8/19/2019 Possible Sock Accounts on Twitter
56/93
No tweets:
($$ hours "+ mins WAC
($" hours $+ mins KRT ($1 hours '" mins URC
("% hours " mins JOD
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
18 FEBRUARY 2016 BEGINS
*Arbitrar 3 WAC tweeted off and on until #1:$%* !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
#/:%# $AG 2irst tweet 9 stopped
!!!!!!!!!!!!!!!!
("0 mins No tweets
!!!!!!!!!!!!!!!!
#):#0 $AG resumed 3 #):$) &ast tweet !!!!!!!!!!!!!!!!
(0$ mins No tweets !!!!!!!!!!!!!!!!
#+:#+ KRT 2irst tweet 3 #+:%" stopped
!!!!!!!!!!!!!!!!
(%) mins No tweets
!!!!!!!!!!!!!!!!
$#:'# KRT resumed stopped
!!!!!!!!!!!!!!!!
(' hours ) mins No tweets !!!!!!!!!!!!!!!!
$':') KRT resumed stopped
!!!!!!!!!!!!!!!!
(%/ mins No tweets
!!!!!!!!!!!!!!!!
$%:"0 KRT resumed 3 $%:'# stopped
!!!!!!!!!!!!!!!!
($ hour "" mins No tweets !!!!!!!!!!!!!!!!
$0:0" PIP 2irst tweet 3 $1:$#
(" mins$1:$" KRT resumed 3 $1:$/ stopped
(' mins
$1:"# PIP 3 $1:"' stopped
!!!!!!!!!!!!!!!!
8/19/2019 Possible Sock Accounts on Twitter
57/93
('1 mins No tweets
!!!!!!!!!!!!!!!!
$1:0+ KRT resumed 3 $/:"" stopped
!!!!!!!!!!!!!!!!
("$ mins No tweets !!!!!!!!!!!!!!!!
$/:%' WAC 2irst tweet (after $$ hrs "+ mins 3 $/:0"
(' mins$/:00 URC 2irst tweet 9 stopped
(0 mins
$):## WAC 3 $):#0 stopped
!!!!!!!!!!!!!!!!
($0 mins No tweets
!!!!!!!!!!!!!!!!
$):"# KRT resumed(" mins
$):"" WAC resumed 3 $):'% stopped
($ min$):'0 URC resumed stopped
($/ secs
$):'0 JOD 2irst tweet
($ min$):'1 KRT
($ min
$):'/ JOD
(0" secs$):'/ KRT &ast tweet
($ min$):') PIP resumed &ast tweet
(" mins$):%# JOD stopped
(' mins
$):%' URC resumed 3 $):%% stopped
($ sec$):%% WAC resumed stopped
!!!!!!!!!!!!!!!!
($0 mins No tweets !!!!!!!!!!!!!!!!
$):0+ URC resumed stopped
($ min$+:## WAC resumed stopped
(' mins
$+:#' URC resumed 3 $+:"% stopped
!!!!!!!!!!!!!!!!
("0 mins No tweets
!!!!!!!!!!!!!!!!
8/19/2019 Possible Sock Accounts on Twitter
58/93
$+:%+ JOD resumed 3 "#:#" stopped
!!!!!!!!!!!!!!!!
($ hour $+ mins No tweets !!!!!!!!!!!!!!!!
"$:"$ URC resumed stopped
!!!!!!!!!!!!!!!!
(%% mins No tweets
!!!!!!!!!!!!!!!!
"":#0 URC resumed stopped
(/ mins
"":$" JOD resumed &ast tweet
!!!!!!!!!!!!!!!!
($ hour $' mins No tweets
!!!!!!!!!!!!!!!!
"':"0 URC resumed stopped
!!!!!!!!!!!!!!!!
('+ mins No tweets !!!!!!!!!!!!!!!!
##:#% URC resumed &ast tweet
!!!!!!!!!!!!!!!!
(%% mins No tweets
!!!!!!!!!!!!!!!!
##:%) WAC resumed 3 #":"/ stopped
!!!!!!!!!!!!!!!!
(' hours / mins No tweets !!!!!!!!!!!!!!!!
#0:'% WAC resumed 3 #0:'0 stopped
!!!!!!!!!!!!!!!!
($ hour " mins No tweets
!!!!!!!!!!!!!!!!
#1:'/ WAC resumed 3 #/:#" &ast tweet
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
18 FEBRUARY 2016 ENDS
*Arbitrar 3 WAC tweeted off and on until #/:#"*
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
(%1 mins No tweets from an account: #/:#" to #/:%)
8/19/2019 Possible Sock Accounts on Twitter
59/93
Note: The $) 2eb session neer reall ended. See aboe.
!!!!!!!!!!!!!!!!
No tweets:
•
(/ hours, %% mins URC• ($# hours JOD
• ($1 hours ) mins KRT
• ($1 hours "% mins WAC
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
1 FEBRUARY 2016 BEGINS
*Arbitrar 3 WAC tweeted off and on until #/:#"*
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
#/:%) URC 2irst tweet 9 stopped !!!!!!!!!!!!!!!!
($+ mins No tweets !!!!!!!!!!!!!!!!
#):#/ URC resumed stopped
(0 mins#):$" JOD 2irst tweet 3 #):$% stopped
!!!!!!!!!!!!!!!!
($ hour %) mins No tweets !!!!!!!!!!!!!!!!
$#:#" PIP 2irst tweet 3 $#:$/ stopped
!!!!!!!!!!!!!!!!
(") mins No tweets
!!!!!!!!!!!!!!!!
$#:%0 KRT 2irst tweet 3 $#:%) stopped
(0 mins
$#:0' JOD resumed 3 $#:0% stopped
!!!!!!!!!!!!!!!!
($ hour 0$ mins No tweets
!!!!!!!!!!!!!!!!
$":%0 PIP resumed stopped
() mins
$":0' KRT resumed 3 $":0) stopped !!!!!!!!!!!!!!!!
('" mins No tweets
!!!!!!!!!!!!!!!!
8/19/2019 Possible Sock Accounts on Twitter
60/93
$':'# PIP resumed
(1 mins
$':'1 KRT resumed stopped
($% mins$':0# PIP &ast tweet
!!!!!!!!!!!!!!!!
($ hour 0 mins No tweets !!!!!!!!!!!!!!!!
$%:00 KRT resumed stopped
!!!!!!!!!!!!!!!!
($ hour " mins No tweets
!!!!!!!!!!!!!!!!
$0:0/ KRT resumed stopped
!!!!!!!!!!!!!!!!
($ hour '+ mins No tweets
!!!!!!!!!!!!!!!!
$/:'1 KRT resumed stopped
!!!!!!!!!!!!!!!!
("1 mins No tweets
!!!!!!!!!!!!!!!!
$):#" KRT resumed 3 $):$)
($1 mins
$):'% JOD resumed stopped
(" mins$):'1 KRT 3 $):%1 stopped
!!!!!!!!!!!!!!!!
(%' mins No tweets !!!!!!!!!!!!!!!!
$+:"+ KRT resumed 3 $+:'' &ast tweet
($' mins$+:%1 JOD resumed 3 $+:0# stopped
!!!!!!!!!!!!!!!!
($ hour ') mins No tweets !!!!!!!!!!!!!!!!
"$:") JOD resumed 3 "$:'' stopped !!!!!!!!!!!!!!!!
('/ mins No tweets
!!!!!!!!!!!!!!!!
"":$# JOD resumed 3 "":0$ &ast tweet
!!!!!!!!!!!!!!!!
('0 mins No tweets
8/19/2019 Possible Sock Accounts on Twitter
61/93
!!!!!!!!!!!!!!!!
"':"1 WAC 2irst tweet 3 ##:0'
($1 mins#$:#+ URC resumed 3 #$:$1
($% secs
#$:$1 WAC
(" mins#$:$) URC
(" mins
#$:"# WAC &ast tweet
(" mins#$:"" URC 3 #$:'+ &ast tweet
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
1 FEBRUARY 2016 ENDS
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
(' hours '1 mins No tweets from an account: #$:'+ to #0:$0
!!!!!!!!!!!!!!!!
No tweets:
• (' hours '1 mins URC
• () hours '# mins WAC
• ($$ hours "$ mins JOD
• ($' hours "# mins KRT
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
20 FEBRUARY 2016 BEGINS
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
#0:$0 URC 2irst tweet 3 #0:") stopped
!!!!!!!!!!!!!!!!
(' hours "0 mins No tweets
!!!!!!!!!!!!!!!!
#):0' KRT 2irst tweet 3 #+:$+(" mins
#+:"$ URC resumed
($ min
#+:"" KRT 3 #+:")() mins
#+:'1 URC
('0 secs#+:'1 KRT 3 #+:'/
($# mins
#+:%/ URC stopped
($# mins#+:0# WAC 2irst tweet 3 #+:0'
8/19/2019 Possible Sock Accounts on Twitter
62/93
("# secs
#+:0' KRT 3 #+:0' stopped
(" mins
#+:00 WAC 3 $#:$$($ min
$#:$" JOD 2irst tweet 3 $#:$' stopped
(% mins
$#:$/ WAC 3 $#:00 stopped(" mins
$#:0/ JOD resumed stopped
($/ mins
$$:$% URC resumed stopped !!!!!!!!!!!!!!!!
(") mins No tweets
!!!!!!!!!!!!!!!!
$$:%" URC resumed 3 $$:0$ stopped
(1 mins
$":#0 $AG 2irst tweet 9 &ast tweet
($% mins$":"$ WAC resumed 3 $":"/ stopped
(% mins
$":'$ KRT resumed 3 $":'+ stopped !!!!!!!!!!!!!!!!
("" mins No tweets
!!!!!!!!!!!!!!!!
$':#$ KRT resumed 3 $':#%
($ min
$':#0 WAC resumed 3 $':$" stopped(+ mins
$':"$ URC resumed($ min
$':"" KRT
(" mins
$':"% URC 3 $':'#
($ min
$':'$ KRT stopped($# mins
$':%$ WAC resumed 3 $':%"
($ min
$':%' URC stopped($ min
$':%% WAC stopped
!!!!!!!!!!!!!!!!
(%$ mins No tweets
!!!!!!!!!!!!!!!!
$%:"0 URC resumed 3 $%:"/ stopped(% mins
$%:'$ PIP 2irst tweet 9 stopped
!!!!!!!!!!!!!!!!
8/19/2019 Possible Sock Accounts on Twitter
63/93
("1 mins No tweets
!!!!!!!!!!!!!!!!
$%:0/ URC resumed(" mins
$%:0+ KRT resumed &ast tweet
($# mins
$0:#+ URC stopped !!!!!!!!!!!!!!!!
("" mins No tweets
!!!!!!!!!!!!!!!!
$0:'$ WAC resumed 3 $0:0" stopped
!!!!!!!!!!!!!!!!
(01 mins No tweets
!!!!!!!!!!!!!!!!
$1:%) WAC resumed 3 $1:0#
(/ mins$1:0/ PIP resumed
(% mins
$/:#$ WAC
($/ secs
$/:#$ PIP
(" mins
$/:#' WAC 3 $/:"0 (1 mins
$/:'$ URC resumed
('' secs
$/:'$ WAC
($' secs
$/:'' PIP("# secs
$/:'' WAC
($0 secs
$/:'' PIP
(% mins
$/:'/ URC
(" mins
$/:'+ PIP
($ min
$/:%# WAC
($ min
$/:%$ PIP *Note: PIP made % tweets at $/:%$
(" secs $/:%$ WAC
(' mins
$/:%% URC
("+ secs
$/:%% WAC
($$ secs
$/:%% PIP
(% mins
$/:%) WAC
8/19/2019 Possible Sock Accounts on Twitter
64/93
($ min
$/:%+ PIP 3 $/:0"
(% mins
$/:01 URC
(0$ secs
$/:01 PIP
($ min
$/:0/ WAC stopped($ min
$/:0) PIP 3 $):#"
(" mins
$):#% URC
(' mins
$):#/ PIP
(' mins
$):$# URC
(% mins
$):$% PIP &ast tweet
($ min
$):$0 WAC resumed
($# mins$):"0 URC 3 $):'$
(' mins
$):'% WAC
("+ secs
$):'% URC
($ min
$):'0 WAC
($ min
$):'1 URC stopped
($ min
$):'/ WAC 3 $):%/ ($$ mins
$):0) URC resumed($# mins
$+:#) WAC 3 $+:"+ (% mins
$+:'' JOD resumed &ast tweet
("0 secs
$+:'' WAC stopped(' mins
$+:'1 URC stopped
!!!!!!!!!!!!!!!!
('0 mins No tweets
!!!!!!!!!!!!!!!!
"#:$$ WAC resumed 3 "#:$+(' mins
"#:"" URC resumed stopped
(% mins
"#:"/ WAC 3 "#:%1 stopped !!!!!!!!!!!!!!!!
(0# mins No tweets
!!!!!!!!!!!!!!!!
8/19/2019 Possible Sock Accounts on Twitter
65/93
"$:'1 WAC resumed 3 "":%1
(0 mins
"":0$ URC resumed stopped
(" mins
"":0' WAC 3 "':$"
($ min
"':$' URC resumed($" secs
"':$' WAC 3 "':"0 stopped
(/ mins
"':'" URC &ast tweet !!!!!!!!!!!!!!!!
('' mins No tweets
!!!!!!!!!!!!!!!!
##:#0 WAC resumed 3 ##:0" &ast tweet
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
20 FEBRUARY 2016 ENDS
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
(1 hours ") mins No tweets from an account: ##:0" to #/:"#
!!!!!!!!!!!!!!!!
N t!!t"*
• () hours %" mins URC
• ($1 hours "$ mins KRT
• ($) hours 0) mins WAC
• ($) hours 0) mins JOD
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
21 FEBRUARY 2016 BEGINS
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
#/:"# KRT 2irst tweet stopped
!!!!!!!!!!!!!!!!
(0% mins No tweets
!!!!!!!!!!!!!!!!
#):$% URC 2irst tweet 3 #):"#
() mins
#):") KRT
() mins
#):'1 URC stopped
(1 mins
#):%" KRT stopped !!!!!!!!!!!!!!!!
8/19/2019 Possible Sock Accounts on Twitter
66/93
('% mins No tweets
!!!!!!!!!!!!!!!!
#+:$1 URC resumed stopped
!!!!!!!!!!!!!!!!
("1 mins No tweets !!!!!!!!!!!!!!!!
#+:%" KRT resumed stopped
!!!!!!!!!!!!!!!!
(" hours 0' mins
!!!!!!!!!!!!!!!!
$":'0 KRT resumed stopped
!!!!!!!!!!!!!!!!
($ hour 00 mins No tweets
!!!!!!!!!!!!!!!!
$%:'# KRT resumed
($ min$%:'$ JOD 2irst tweet 9 stopped
($1 mins
$%:%/ KRT 3 $0:$%
($ sec$0:$% URC resumed 3 $0:$0 stopped
("+ secs
$0:$0 KRT 3 $0:"+ stopped
!!!!!!!!!!!!!!!!
("1 mins No tweets !!!!!!!!!!!!!!!!
$0:00 KRT resumed 3 $0:0+ stopped
!!!!!!!!!!!!!!!!
($ hour $1 mins No tweets !!!!!!!!!!!!!!!!
$/:$0 KRT resume 3 $/:%0 stopped
!!!!!!!!!!!!!!!!
('1 mins No tweets
!!!!!!!!!!!!!!!!
$):"$ KRT resumed 9 &ast tweet
!!!!!!!!!!!!!!!!
("% mins No tweets !!!!!!!!!!!!!!!!
$):%0 URC resumed 3 $):0% stopped
!!!!!!!!!!!!!!!!
8/19/2019 Possible Sock Accounts on Twitter
67/93
("1 mins No tweets
!!!!!!!!!!!!!!!!
$+:"# URC resumed stopped
!!!!!!!!!!!!!!!!
('# mins No tweets !!!!!!!!!!!!!!!!
$+:0# WAC 2irst tweet 3 "$:#$ stopped
!!!!!!!!!!!!!!!!
('+ mins No tweets
!!!!!!!!!!!!!!!!
"$:%# WAC resumed 3 "$:%'
($$ mins
"$:0% URC resumed stopped
($' mins
"":#/ WAC 3 "":#) !!!!!!!!!!!!!!!!
('0 mins No tweets !!!!!!!!!!!!!!!!
"":%' URC &ast tweet
($0 mins"":0) WAC resumed stopped
!!!!!!!!!!!!!!!!
('0 mins No tweets !!!!!!!!!!!!!!!!
"':'' JOD resumed 3 "':%% &ast tweet
!!!!!!!!!!!!!!!!
("+ mins No tweets
!!!!!!!!!!!!!!!!
##:$' WAC resumed 3 #":#/ &ast tweet ('0 tweets
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
21 FEBRUARY 2016 ENDS
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
(1 hours No tweets from an account: #":#/ to #):#/
Note:
*"+/ tweets from $" am ("$ 2eb to $" am ("" 2eb
!!!!!!!!!!!!!!!!
N t!!t"*
8/19/2019 Possible Sock Accounts on Twitter
68/93
• () hours %' mins WAC
• (+ hours "% mins URC
• (+ hours %/ mins JOD
• ("" hours $$ mins KRT
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
22 FEBRUARY 2016 BEGINS
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
#):#/ URC 2irst tweet 9 stopped
!!!!!!!!!!!!!!!!
($ hour "% mins No tweets
!!!!!!!!!!!!!!!!
#+:'$ JOD 2irst tweet 3 #+:%"
($/ mins#+:0+ URC resumed 3 $#:#"
(" mins
$#:#% JOD stopped($0 mins
$#:$+ URC 3 $#:"% stopped
($% mins
$#:') PIP 2irst tweet 3 $#:%+ ($ min
$#:0# WAC 2irst tweet
(' mins
$#:0% PIP
(" mins
$#:01 WAC
($ min
$#:0/ PIP 3 $#:0)(# secs
$#:0) WAC 3 $$:#"
(' mins
$$:#0 URC resumed($ min
$$:#1 PIP
($ min
$$:#/ URC
($ min
$$:#) PIP 3 $$:#)
($ min
$$:#+ URC($ min
$$:$# WAC 3 $$:$"
($1 secs$$:$" URC
($ min
$$:$' WAC
(' mins$$:$1 URC 3 $$:"$
8/19/2019 Possible Sock Accounts on Twitter
69/93
(%$ secs
$$:"$ WAC
(' mins
$$:"% PIP
(# secs
$$:"% WAC 3 $$:"1
(" mins
$$:") PIP
($ min
$$:"+ URC stopped
($1 secs
$$:"+ WAC
(" mins
$$:'$ PIP
(" mins
$$:'' WAC 3 $$:'1 (% secs
$$:'1 PIP 3 $$:')
($ min
$$:'+ WAC 3 $$:%'
(% mins$$:%/ PIP 3 $$:0#
($% secs
$$:0# WAC 3 $":$$ (' mins
$":$% PIP stopped
($ min
$":$0 WAC 3 $":'0 ($ min
$":'1 URC resumed
(' mins
$":'+ WAC
(" mins
$":%$ URC(" mins
$":%' WAC
($ min
$":%% PIP resumed 3 $":%+
($ min
$":0# WAC 3 $":0" (" mins
$":0% PIP 3 $':#1
(' mins
$':#+ URC
($ min
$':$# WAC 3 $':$+
() mins $':"/ PIP
(" mins
$':"+ WAC 3 $':'$
($ min
$':'" PIP 3 $':'" (% secs
$':'" WAC 3 $':'/
(" secs
$':'/ URC
8/19/2019 Possible Sock Accounts on Twitter
70/93
(%% secs
$':'/ WAC 3 $':%#
($ min
$':%$ PIP
(" mins
$':%' WAC stopped
($' secs
$':%' URC stopped() mins
$':0$ PIP stopped
!!!!!!!!!!!!!!!!
(00 mins No tweets
!!!!!!!!!!!!!!!!
$%:%1 PIP resumed 3 $%:%/ stopped !!!!!!!!!!!!!!!!
('/ mins No tweets
!!!!!!!!!!!!!!!!
$0:"% PIP resumed 3 $0:"0
(0 mins
$0:'# URC resumed 3 $0:'1(% mins
$0:%# PIP
(" mins
$0:%" URC
(' mins
$0:%0 WAC resumed 3 $0:0/
(' mins
$1:## URC stopped($ min
$1:#$ WAC 3 $1:#+ (" mins
$1:$$ PIP
(' mins
$1:$% WAC 3 $1:'"
(0 secs
$1:'" KRT 2irst tweet(% mins
$1:'1 PIP 3 $1:'1
($ min
$1:'/ KRT stopped($ min
$1:') WAC
(/ mins $1:%0 PIP &ast tweet($/ mins
$/:#" WAC 3 $):#$ stopped
(1 mins
$):#/ KRT resumed 3 $):0" stopped(" mins
$):0% URC resumed 3 $+:$0 stopped
!!!!!!!!!!!!!!!!
8/19/2019 Possible Sock Accounts on Twitter
71/93
($+ mins No tweets
!!!!!!!!!!!!!!!!
$+:'% URC resumed($ min
$+:'0 WAC resumed 3 $+:')
($ min
$+:'+ KRT resumed &ast tweet($ min
$+:%# WAC 3 $+:%%
(" mins
$+:%1 URC
($ min
$+:%/ WAC 3 $+:0#
(' mins
$+:0' JOD resumed("' secs
$+:0' WAC 3 $+:0%
($ min
$+:00 JOD
($ min$+:01 WAC 3 $+:01
(' mins
$+:0+ JOD
(% mins
"#:#' URC
($ min
"#:#% JOD
(' mins
"#:#/ URC stopped
(% mins
"#:$$ JOD
("/ secs
"#:$$ WAC(' mins
"#:$% JOD 3 "#:$)(1 mins
"#:"% WAC 3 "#:"0 stopped
(/ mins
"#:'" JOD 3 "#:'0 stopped !!!!!!!!!!!!!!!!
($ hour 0# mins No tweets
!!!!!!!!!!!!!!!!
"":"0 WAC 3 "':"1
("% secs"':"1 JOD resumed($ min
"':"/ WAC 3 "':"+
(1 secs
"':"+ JOD
($ min
"':'# WAC
(% mins
"':'% JOD stopped 9 &ast tweet
8/19/2019 Possible Sock Accounts on Twitter
72/93
($ min
"':'0 WAC 3 "':%) stopped
!!!!!!!!!!!!!!!!
($+ mins No tweets
!!!!!!!!!!!!!!!!
##:#/ WAC resumed($ min
##:#) URC resumed
($ min
##:#+ WAC 3 ##:$0 (" mins
##:$/ URC 3 ##:"#
(' secs
##:"# WAC 3 ##:"" (% secs
##:"" URC
(") secs
##:"" WAC 3 ##:"0
($) secs##:"0 URC
("" secs
##:"0 WAC 3 ##:") (% secs
##:") URC
($ min
##:"+ WAC 3 ##:'#($+ secs
##:'# URC
("0 secs
##:'# WAC 3 ##:'" ($ min
##:'' URC(" mins
##:'0 WAC 3 ##:'1 ($ min
##:'/ URC
($ min
##:') WAC 3 ##:%$ ($ min
##:%" URC 3 ##:0" &ast tweet
(0 mins
##:0 WAC 3 #':%1 stopped !!!!!!!!!!!!!!!!
("" mins No tweets !!!!!!!!!!!!!!!!
#%:#) WAC resumed 3 #0:"$ stopped
!!!!!!!!!!!!!!!!
('$ mins No tweets
!!!!!!!!!!!!!!!!
#0:0" WAC resumed 3 #1:$1 stopped
8/19/2019 Possible Sock Accounts on Twitter
73/93
!!!!!!!!!!!!!!!!
('' mins No tweets
!!!!!!!!!!!!!!!!
#1:%+ WAC resumed stopped
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
22 FEBRUARY 2016 ENDS
*Arbitrar 3 WAC tweeted off and on until #):%"* !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Note:WAC tweeted on and off for "$ hours 0" mins 3 from 2eb "" $#:0# until 2eb "' #):%".WAC resumed ) hours, %% mins later on 2eb "' at $/:"1.
!!!!!!!!!!!!!!!!
N t!!t"*
• (1 hours "1 mins URC
• ($# hours $" mins JOD
• ($" hours "0 mins KRT
• WAC (See note aboe
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
23 FEBRUARY 2016 BEGINS
*Arbitrar 3 WAC tweeted off and on until #):%"*
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
#/:$' WAC resumed
(' mins
#/:$) URC 2irst tweet 9 stopped
(' mins#/:"$ WAC 3 #/:'0 stopped
!!!!!!!!!!!!!!!!
("+ mins No tweets !!!!!!!!!!!!!!!!
#):#% KRT 2irst tweet 3 #):$/
(0 mins#):"" WAC resumed
(+ secs
#):"" KRT
(" mins
#):"% URC resumed
(" mins
#):"1 WAC 3 #):'"(% mins
8/19/2019 Possible Sock Accounts on Twitter
74/93
#):'1 URC
($ sec
#):'1 KRT stopped
(%' secs#):'1 WAC
(" mins
#):') URC 3 #):%#
($ min#):%$ WAC 3 #):%" stopped (&ast tweet 2eb "" session
(0 mins
#):%/ URC 3 #+:#+ stopped
!!!!!!!!!!!!!!!!
('/ mins No tweets
!!!!!!!!!!!!!!!!
#+:%1 JOD 2irst tweet 3 #+:0" stopped
!!!!!!!!!!!!!!!!
(00 mins No tweets
!!!!!!!!!!!!!!!!
$#:%/ KRT resumed 3 $#:%+
($ min$#:0# JOD resumed 3 $#:0'
(' mins
$#:01 KRT
($ secs$#:01 JOD stopped
('+ secs
$#:01 KRT stopped
!!!!!!!!!!!!!!!!
(%' mins No tweets !!!!!!!!!!!!!!!!
$$:'+ URC resumed 3 $$:0' stopped
!!!!!!!!!!!!!!!!
("" mins No tweets !!!!!!!!!!!!!!!!
$":$0 URC resumed 3 $":%% stopped
($/ mins$':#$ KRT resumed 3 $':0' stopped
!!!!!!!!!!!!!!!!
('/ mins No tweets !!!!!!!!!!!!!!!!
$%:'# KRT resumed stopped
!!!!!!!!!!!!!!!!
(%+ mins No tweets
!!!!!!!!!!!!!!!!
8/19/2019 Possible Sock Accounts on Twitter
75/93
$0:$+ KRT resumed 9stopped
(1 mins
$0:"0 PIP 2irst tweet
(" mins$0:%% URC resumed
($ min
$0:%1 PIP
(/ mins$0:0' URC 3 $0:0/
(" mins
$0:0+ KRT resumed
($+ secs$0:0+ URC 3 $1:#'
(% mins
$1:$' PIP 3 $1:"% &ast tweet
(+ mins$1:'' KRT
() secs
$1:'' URC 3 $1:'%
($ min
$1:'0 KRT($ min
$1:'1 URC 3 $1:%$
($ min$1:%" KRT
(' mins
$1:%0 URC stopped
(0 mins$/:## KRT stopped
!!!!!!!!!!!!!!!!
("1 mins No tweets !!!!!!!!!!!!!!!!
$/:"1 WAC 2irst tweet 3 $):#) stopped
() mins$):$1 KRT resumed 3 $):00 &ast tweet