We snagged the last 10 days worth of replies sent via Mobile Web (M2), and noticed a couple of interesting spikes in the creation dates of the accounts (on October 29th and November 1st, 2020). What's up with that? #MondayMotivation
cc: @ZellaQuixote
cc: @ZellaQuixote
Answer: the two spikes in creation dates appear to be an Arabic-language retweet/reply botnet, consisting of (at least) 149 accounts created in late October/early November 2020.
(We think there are actually more accounts, but we'll get to that later.)
(We think there are actually more accounts, but we'll get to that later.)
The majority of this botnet's content is retweets of a variety of Arabic-langauge accounts. Based on Google's (potentially erroneous) translations of the most popular tweets, the majority of the content is discount codes for various products and services.
This botnet's replies are repetitive, which isn't unusual for these sorts of networks. Several of them reference "Twitter services" (per Google translate), which are also mentioned in the profile of @wajdi_alhamdan, the account the bots most frequently follow and reply to.
We downloaded @wajdi_alhamdan's followers, and it turns out that 435 of them are batch-created accounts. Some are the bots we already found, and the rest appear to be additional members of the botnet that we missed because they haven't tweeted in the last 10 days.
Incorporating the rest of @wajdi_alhamdan's batch-created followers into the set of accounts we initially found brings the size of the botnet to 570 accounts, all created between Sept and Nov 2020, and all tweeting (well, retweeting and replying) primarily via Mobile Web (M2).
(Also, we can't help but notice that the @wajdi_alhamdan account that all these bots are following appears to be a bot too, automated via a custom app named Alha1mdanWajdi. . .)
• • •
Missing some Tweet in this thread? You can try to
force a refresh
