It's a Sunday, which is as good a time as any to see if RT editor-in-chief @M_Simonyan has any dormant botnets following her. (Survey says yes.) #SundaySpam
cc: @ZellaQuixote
cc: @ZellaQuixote
The streaks in this figure consist of accounts that were created in batches and followed @M_Simonyan in quick succession. They have other traits in common that we can use to filter out false positives:
• 0 likes
• 3 digit number of accounts followed
• Russian display names.
• 0 likes
• 3 digit number of accounts followed
• Russian display names.
We downloaded the batch-created accounts following @M_Simonyan and found two additional identifying characteristics:
• all tweets sent via "Twitter Web Client"
• duplicate tweets
After filtering out false positives, we were left with 2287 accounts. Is this the entire botnet?
• all tweets sent via "Twitter Web Client"
• duplicate tweets
After filtering out false positives, we were left with 2287 accounts. Is this the entire botnet?
To find more members of the botnet, we searched for other accounts tweeting the tweets most frequently repeated by the 2287 accounts we'd already found. We only used tweets that are at least 30 characters in length, as shorter tweets tend to result in a lot of false positives.
We found a total of 6448 accounts that we believe are part of the botnet. All were created in batches between Dec 2013 and May 2014, tweeted exclusively via the Twitter Web Client (supposedly), and were last active in 2016.
What did these accounts actually tweet? Almost all of the content is in Russian, which neither of us is fluent in, so it's hard to be sure, but based on Google translate the botnet is wishing everyone happy birthday, instructing people to urinate, and smiling at the cruel world.
What websites did this botnet link when active? Mostly Russian social media site VK, with Instagram, YouTube, and various news sites (mostly Russian, but Buzzfeed is in there too) rounding out the rest. #Новости ("news") was the hashtag mostly frequently tweeted by the network.
Finally, what accounts does this botnet follow? Based on a sample of 500 of the bots, they mostly follow A) each other and B) major media accounts - mostly Russian (@rianru, @interfax_news, @RT_russian, @M_Simonyan) but Chinese news source @XHNews turns up prominently as well.
