Thread by @conspirator0

What does the text in this tweet have to do with the image, which appears to be an ad for a credit repair service? Probably very little, but contextual failure of this sort can be a sign of automation. Let's dig in.

cc: @ZellaQuixote

Search for the text of that tweet yields 15 accounts that tweeted it (images vary), all of which appear to be hawking credit/legal services. Also, based on the use of automation services and the presence of round-the-clock activity, they're bots. Are there more like them?

We can expand the set by searching for various elements of the content of the existing accounts and limiting the results to those accounts that fit the profile. Examples of searches to try:

- tweet text
- websites being pushed
- the phone numbers being advertised

Using the above methods, we were able to flesh out the network to 209 accounts. It's possible there are stragglers that were missed, but this is likely close to a complete set. There are a few variants in terms of tweet schedule; representative examples shown.

Nearly all the content posted by the 209 accounts pushing credit repair service clickbait is automated via one of three services: dlvr(dot)it, IFTTT, and Google (WordPress is a notable runner-up). This botnet appears to have repeatedly ramped up its volume and then cut back.

Final note: the content is very, very repetitive. Although the bogus headline tweets are only used by 15-20 accounts each, the tweets listing credit services by state are much more prevalent. Ironically, the most common tweets appear to be error messages.

H/T @z3dster for the lead.