We ran across a genre of accounts that sell access to proxy servers of dubious provenance. Some of them have decent-sized followings, so let's see what there is to see. #SaturdayShenanigans
cc: @ZellaQuixote
cc: @ZellaQuixote
We looked at the followers of several of the proxy-hawking accounts and found a very similar-looking anomaly in four of them: @BlankProxies, @SlashProxies, @RedDirtProxies, and @UnknownProxies were all followed en masse in 2020 by a group of accounts created in 2012 and 2013.
These followers are from a network of 625 accounts created between 1/1/2012 and 1/1/2014 that were mostly dormant between 2014 and 2020. Since reactivating, all tweet exclusively via Mobile Web (M2). Many of their userpics are used by more than one account.
What does this botnet actually do? In its 2020 incarnation, it's a retweet botnet that amplifies accounts hawking two types of products/services:
• botting software/proxy servers
• virtual items in online games
• botting software/proxy servers
• virtual items in online games
The "botting software" promoted by these bots isn't social media botting software, btw; it's mostly software for automating purchases of items like limited-quantity shoes in hopes of reselling them at a substantial markup.
Despite being created in 2012/2013, most of the accounts in this botnet (415/625, 66.4%) never tweeted prior to 2020. Those that do have old tweets used a variety of apps and tweeted in a variety of languages, mostly promotional spam.
