Skip to content

Trending tags

OSINT For Fun & Profit: @realDonaldTrump Edition

Andrew Patel

10.04.17 2 min. read

I’ve just started experimenting with Tweepy to write a series of scripts attempting to identify Twitter bots and sockpuppet rings. It’s been a while since I last played around with this kind of stuff, so I decided to start by writing a couple of small test scripts. In order to properly test it, I needed to point towards an active account. So, I opted for @realDonaldTrump.

After collecting data from the past 12 months, Sean and I realized that it should be broken into four separate sets to provide context. Here’s how we’ve broken it down.

  • All data from ~365 days ago, up until the day of the US presidential election (November 8th, 2016).
  • Data spanning the period between post-election and the inauguration (January 20th, 2017).
  • Data from the period after the inauguration… until a noticeable change in Trump’s Twitter habits which occurred on the weekend of March 4th/5th, 2017. More on this later.
  • All data after March 5th to present.

The following diagram shows activity based on time and day, broken down by the four time periods defined above. As you can see, the highest Twitter activity has always occurred between early and mid-afternoon. Note the almost complete lack of activity between 08:00 and 12:00. Anybody developing Twitter bots for trading purposes might want to flag any activity on this account during that time-slot as “out of band”, and worthy of closer attention.


Here’s the time of day data graphed. Notice that Trump’s daily Twitter activity pattern didn’t really change across this data set.

Notice the last graph? This is the change of behavior I alluded to earlier. Prior to March 7th, 2017, Tweets posted via “Twitter for Android” were always in the overwhelming majority. The only other data set that shows significant iPhone usage is the election campaign period. And those Tweets can be most likely attributed to campaign staff.

So, how much did @realDonaldTrump Tweet before and after becoming POTUS?

During the run up to the 2016 elections, @realDonaldTrump’s account posted about twice as many Tweets per week as in the following months. The above graph also nicely illustrated the switch from Android to iPhone on week 10 of 2017. Here’s another graph that illustrates it.

Well, why did @realDonaldTrump’s account suddenly shift from Android to iPhone? It could have been something that was in the works (for security reasons). Or… it might have something to do with this Tweet.

Whatever the reason, the “schedule” remains more or less the same.

Next steps?

Perhaps we’ll build a bot of our own. It’s a work in progress, and I’ll post on this more in the future.

Andrew Patel

10.04.17 2 min. read


Related posts


Newsletter modal

Thank you for your interest towards F-Secure newsletter. You will shortly get an email to confirm the subscription.

Gated Content modal

Congratulations – You can now access the content by clicking the button below.