Checking Suspicious Posts

From ADTAC Disinformation Inventory

A clear indication that someone is a troll attempting to spread disinformation it is essential to check if their content is not only inflammatory or false, but also contained evidence that it is consistent with a wider plan to spread false information using multiple fake accounts. This is one of the steps necessary to identify creators of disinformation.

Check the content


  • The use of hashtags can give away an employee of a troll factory. They will jump on different hashtags to gain traction for their messaging, frequently polarizing or inflammatory hashtags.
  • Check if the account uses original hashtags or if they jump on existing hashtags. Check if if the hashtag is on other social media sites using: https://www.hashatit.com/ try to find the first user using the hashtag.
  • Use InVid reverse image tools to analyze media present in the viral post. Look for obvious inconsistencies in the post that reveal that the post is fake
  • Check if the content is original, trolls will steal media like video and images and reuse it. If they insist that the old video is new that is clear evidence of a troll.
  • Reverse search the text using quotation marks to see if there are already posts with the same text. Check if the text is stolen or if parts of the text were stolen.
  • look at the text for errors that a native English speaker would not make. A native speaker would find errors in the text and the troll may not be a native speaker.

Check Interaction with Other Users Around Content


  • Check if the account tagged other accounts and if they are high profile accounts. If they are high profile this may explain why a post goes viral.
  • Not engaging with users except for sending messages might be a sign of a paid troll. Low ranking trolls will often not engage with users.
  • If there is a link in the post reverse search the like, and if it suspicious and shared by suspicious accounts then look for similarities between the accounts.
  • Influence operations may have websites attached, check if there are strange websites repeatedly reappearing and check the background of the websites and the accounts sharing them.
  • Look at how fast a tweet or account spreads using Hoaxy: https://hoaxy.iuni.iu.edu/ look at strange accounts within the retweets or shares and likes.

Look at the Purpose of the Post


  • We should also try to understand the intention of the post. Is it to gain attention with an outrageous non political claim? A narcissistic ‘clout chasing’ troll trying to shock or to lure new followers? Or is the intent to shift public opinion by using a polarizing message? Or intimidation? Or by spreading very specific fake news?
  • Check if the messaging of the user change over time, or if their messages playing into the narrative of an ongoing campaign or geopolitical camp.