It's a holiday weekend, so let's look at a mostly-dormant botnet that follows YouTube political commentator @Timcast. #SundayShenanigans
cc: @ZellaQuixote
cc: @ZellaQuixote
We found a total of 1249 very similar looking accounts following @Timcast, created in batches at various points in 2016. All follow a three digit number of accounts but have almost no followers, tweets, or likes of their own.
Most of the tweets accounts in this network have tweeted are retweets, and this is where things get weirder. The tweets being retweeted all have far more retweets than likes, with many having ratios of 100-to-1 or greater.
By exploring the retweet and follower networks of the 1249 accounts following @Timcast, we found 4894 total accounts that we believe to be part of this botnet, mostly created in 2016 and active in 2016-2017, with the majority of tweets sent via Twitter Web Client.
These accounts fall into two distinct categories:
Followers: these accounts follow a 3 digit number of accounts and have rarely if ever tweeted.
Retweeters: these accounts follow few if any accounts and have tweeted a 3 digit number of times, mostly retweets.
Followers: these accounts follow a 3 digit number of accounts and have rarely if ever tweeted.
Retweeters: these accounts follow few if any accounts and have tweeted a 3 digit number of times, mostly retweets.
Who (other than @Timcast) do these accounts follow? It's an eclectic lineup, featuring everyone from the mayor of San Miguel, El Salvador, a former Apprentice UK contestant, and various artists, musicians, and journalists.
What content does this botnet amplify (or did - the accounts have been mostly silent since 2017)? As with who they follow, it's all over the map. Much is relatively benign advertising/promotions, but we did find both political content and accounts peddling fake engagement.
Correction: the y-axis of the accounts creation date chart shown in both these tweets should read "number of accounts", not "number of tweets."
Footnote: then this happened.
