Many of the accounts in the Turkish botnet described here have large numbers of followers. Are there other networks lurking among them? (Spoiler: yes, at least one.) #SaturdaySpam
cc: @ZellaQuixote
cc: @ZellaQuixote
@ZellaQuixote We took a look at the followers of one of the bots in the network, @agresifprofil. The anomaly circled in red on the plot indicates it was followed by a group of accounts created at roughly the same time, a potential sign that they were created en masse by a single entity. 
@ZellaQuixote @agresifprofil The anomaly in @agresifprofil's followers contains 252 Tuskish accounts with similar histories: high volume via SocialOomph in 2015, lower volume via TweetDeck in 2016, and even lower in 2019 via the Twitter website. Based on this, we found 262 more accounts, for a total of 514.
@ZellaQuixote @agresifprofil These 514 accounts were created between May 2012 and March 2015, slowly at first with larger and more frequent batches in late 2014 and early 2015. The table shows a sample of the accounts; all have very similar follower, followee, tweet, and like counts.
@ZellaQuixote @agresifprofil What does this botnet actually tweet? It's changed over time. The first and busiest incarnation (2015, automated via SocialOomph) consisted primarily of linking the same content from three websites over and over again - only 851 unique links over a whopping 1520750 tweets.
@ZellaQuixote @agresifprofil The second awakening of this botnet (2016, Tweetdeck) largely abandoned the linking behavior and instead tweets repetitive tweets in Turkish. We've included machine translations of a few with the usual caveat that machine translation is far from a perfect art.
@ZellaQuixote @agresifprofil The most recent activity is from Dec 2019, via the Twitter website. There's not much repetition within the botnet this time, but the content is stuff that has been tweeted repeatedly over the years. (This is a signature of tweetdecking, but other explanations are possible too.)
@ZellaQuixote @agresifprofil Other accounts in the Turkish botnet we originally looked at also have oddities lurking among their followers. Take @Maskeliprofil - there were several periods during which it gained hundreds of new followers without being followed by a single recently created account.
@ZellaQuixote @agresifprofil @Maskeliprofil The anomalies in @Maskeliprofil's followers lead to at least three long-slumbering botnets (possibly four, but with almost no tweets to analyze, we can't be sure that the default profile pic group is automated.) Like the botnet @Maskeliprofil is part of, these tweet in Turkish.
@ZellaQuixote @agresifprofil @Maskeliprofil The largest network is 3712 accounts tweeting via "Twitter for Windows" and "Twitter for Windows Phone." These went almost completely dormant in mid-2015 but were high-volume and repetitive back when they were active.
@ZellaQuixote @agresifprofil @Maskeliprofil Like the first botnet, the second is presently inactive. It consists of 698 accounts, and its mission seems to have been to spam links to various websites. The app used to post the tweets currently shows as "erased4877904" ("erased" indicates the app was banned by Twitter.)
@ZellaQuixote @agresifprofil @Maskeliprofil The third botnet (once again, mostly dormant since 2015) found amidst @Maskeliprofil's followers likewise used an app that has been shut down by Twitter (erased3825051), likely for linking to a malicious site (supposedly offering to grow your followers) based on the warning.
