Although tweeting via the Twitter website is generally a good indicator that an account’s activity is organic, exceptions exist. In the case of the Twitter mobile website (“Mobile Web (M2)”), at least 67% of tweets with links or videos come from botnets.
cc: @ZellaQuixote
cc: @ZellaQuixote
@ZellaQuixote The most prolific of these botnets we’ve already analyzed in detail. It consists of only three accounts (@rubestguy, @attacksn, and the shadow banned @teddypitcher) but is insanely prolific; each account tweets more than a thousand times a day.
@ZellaQuixote @rubestguy @attacksn @teddypitcher Next up, we have a network of 112 bots tweeting in Turkish and linking a website called birdahabak(dot)com. The accounts have incredibly similar tweet schedules (two basic patterns), are all from 2015 or earlier, and presently exclusively tweet links to the site in question.
@ZellaQuixote @rubestguy @attacksn @teddypitcher We don’t know Turkish, so we can’t be sure, but if we had to guess we’d call birdahabak(dot)com a clickbait website based on the photos and translated headlines. We could be way wrong.
@ZellaQuixote @rubestguy @attacksn @teddypitcher Mobile Web (M2) is not the first app this botnet has used to post; Buffer and SocialOomph have been recent favorites. Likewise, birdahabak(dot)com isn’t the only website this network has linked; it seems to change lineup every few months.
@ZellaQuixote @rubestguy @attacksn @teddypitcher Additional botnets (or maybe a single additional botnet) emerged from the Mobile Web (M2) traffic when we looked at account creation dates. As it turns out, each of those spikes consists primarily of Arabic-language accounts.
@ZellaQuixote @rubestguy @attacksn @teddypitcher We found 615 Arabic-language accounts with names that look algorithmically generated tweeting via Mobile Web (M2). Nearly all were created in batches. The content is more varied than the Turkish network, so it’s possible this is multiple botnets rather than one large one.
