It's Thursday, which makes it a great day to look at cryptocurrency/tech newsbot @TechFishNews and its three thousand slumbering friends.
cc: @ZellaQuixote
cc: @ZellaQuixote
As far as bots go, @TechFishNews itself is fairly straightforward - it mostly tweets links to its associated website, techfishnews(dot)com (and shortened variants thereof.) Hashtags are mostly technology or cryptocurrency related; #gamergate is a rare but interesting inclusion.
The majority of @TechFishNews's tweets are automated via dlvr(dot)it, although the account has dabbled in other automation tools in the past, with the most intense period of activity in early 2014.
Who's following @TechFishNews? This is where things get interesting - in early 2014 this English-language newsbot picked up thousands of mostly Russian-language accounts created in batches (the horizontal streaks indicate groups of followers created on or around the same day.)
Overall, we found 3061 accounts following @TechFishNews with the following characteristics:
- created in a batch of at least 10 accounts
- Russian display name, location, or tweet content
- less than 10 likes regardless of tweet count
- created in a batch of at least 10 accounts
- Russian display name, location, or tweet content
- less than 10 likes regardless of tweet count
Are these 3061 accounts bots? Survey says yes - 79.6% of their tweets were sent via one of 293 automation apps. Almost all of the hypothetically "organic" tweets were sent via the Twitter website rather than one of the phone apps. This botnet has been largely dormant since 2015.
What does (or did) this botnet tweet? Most of the content is links to a variety of Russian websites; since neither of us is fluent in Russian we're not going to attempt to infer motive, but from what we were able to glean, gaming (particularly Minecraft) was a major theme.
Does this botnet repeat tweets across accounts? Yes, but most tweets are only shared by a few dozen of the thousands of accounts, as the majority of the accounts in the network have posted relatively few tweets.
Do these bots use stolen profile pics? They sure do, at least the ones that didn't stick with the default image (1063 accounts); at least 1368 of 1998 accounts (68%) use a photo taken from another website (with the caveat that some are logos rather than pictures of human beings.)
What other accounts do these bots follow? As it turns out, they follow many of the same accounts. Among then is @sexuaigif, an account that decided its grand total of zero tweets required a "mature content" warning. Why does it have 43.1K followers?
cc: @ZellaQuixote
cc: @ZellaQuixote
Answer: @sexuaigif's following looks artificial to a degree we've rarely seen. Many of the accounts appear to have been created in batches and to have followed @sexuaigif en masse.
The batch-created followers of @sexuaigif seem to belong to two distinct networks, which we've highlighted with yellow (1) and purple (2) on this figure. The yellow group is the same botnet we found following @TechFishNews, but there are a lot more accounts than we first noticed.
Adding in those of @sexuaigif's followers that fit the pattern (massive batch creation, Russian tweet or profile content, smorgasbord of apps, few likes) brings the size of this botnet to 17913 accounts. We may yet uncover more as we explore further.
Moving onto the second network following @sexuiagifs, we have 1502 curiously similar accounts created between 2011-12-25 and 2012-06-01. All of them have a small number of original tweets in Russian (many with links) and all have retweeted multiple photos from @Gabriele_Corno.
Like the first network we looked at, these 1502 accounts have been mostly dormant for years. They use a mixture of automation tools and *potentially* organic sources (i.e. Twitter website or phone app.) The 2014 spike is mostly the aforementioned @Gabriele_Corno photo retweets.
What do these bots link? By and large, a wide variety of Russian websites (looks like blogs and promotional stuff with the caveat that we don't speak Russian), but the most frequently linked site is an online gaming site (gigam(dot)es, which redirects to game-insight(dot)com.)
Finally, although @Gabriele_Corno is by far the account this network has retweeted most frequently, it does retweet other accounts too. One of the more interesting inclusions is @ARTEM_KLYUSHIN. . .
. . .and this is not the first time we've found a swarm of bogus-looking accounts following @ARTEM_KLYUSHIN. (The majority of the accounts described in this thread appear to have been subsequently suspended.)
* (mistagged, should be @sexuaigif)
