,
12 tweets,
9 min read
Read on Twitter
Although the "Twitter censors X" traffic seemed largely driven by organic accounts, bots do turn up. Can we detect networks among them (related to the censorship topic or otherwise)?
cc: @ZellaQuixote
cc: @ZellaQuixote
One technique for finding botnets among a group of accounts: look for spikes in account creation (more here: .) We looked at the four largest spikes in the set of accounts with automated censorship-related tweets. 
The January 2016 spike leads to three possibly separate groups of accounts. We found a network of 24 currently dormant accounts created in slightly over an hour on January 23, 2016. All tweeted via IFTTT on the same schedule, and all follow the same naming scheme (FirstLastXX.)
When active, this group of accounts tweeted links to a now-dead website, castwb(dot)com. The site appears to have consisted of news articles copied from other sites.
We also found a couple of apparent false positives (such as @ShirleyTipton22) that were created during the spike that matched the naming scheme, but used different software and had different content than the others. A quick search reveals other accounts with the same tweets. . .
We found 98 automated accounts that tweeted the same tweet as @ShirleyTipton22. 37 of these use custom software ("Knitted74" in the case of @ShirleyTipton22) on a per-account basis as opposed to a popular automation service such as IFTTT.
Like the first set, this network does nothing but tweet links. Unlike the first set, it has variety. Many of the sites linked have disappeared from the internet, but those which remain look rather spammy.
The remaining 61 bots use IFTTT rather than individual apps, but otherwise look similar to the previous set. Their lineup of dodgy sites overlaps both of the first two sets; it's possible all three botnets are a single operation. Driving traffic to the sites is the likely goal.
Moving onward, we find a network of 31 newsbots created over 20 minutes in June 2012. They mostly link MSM and have the curious characteristic of listing the country before specific location in the location section of their profiles (i.e. "USA, Kansas" rather than "Kansas, USA".)
Next up, we have a network of 112 newsbots created in several batches between 12/2014 and 8/2015. These link a mix of MSM and far-right sites. All follow the same naming convention (POLS<city>), and all have "The most important news about politics in <city>" on their profiles.
Finally, we have 21 cryptocurrency-focused bots. The majority were made on October 12, 2017, with a small earlier batch in August. They tweet via three custom apps: "Such a nice business Ap", "ApplicationBizzUp", and "TraffUpMachine."
The common theme: all of these botnets piggybacked on the censorship-related traffic to push their own content - for example, the "Twitter is censoring cryptocurrency accounts!" tweets likely drew the cryptocurrency bots, and so on for the other groups.
