Here's an interesting duo: @POLICEFORTRUMPI and @SidneyPowell_ (not the real Sidney Powell). Both were created in Apr 2016 but silent until Dec 2020, both are demanding RETWEETS and FOLLOWS, and both started out by following large Arabic-language accounts.
The RETWEETS and FOLLOWS verbiage on this pair of accounts is reminiscent of this recently-suspended network of fake #MAGA accounts, so they may be the same operation, but we don't have enough information to be 100% sure on that yet.
Yet another similar looking fake #MAGA account (@atensnut__, impersonating @atensnut) has emerged and is begging for RETWEETS and FOLLOWS. (Despite the claims of the impostor, the real @atensnut is still active and still has a full complement of followers.)
Unsurprisingly, they're part of a botnet, consisting of (at least) 19 accounts that use custom apps with names of the form "Twitter for HUAWEI<xxxx>", and occasionally "Twitter for Android6" (not the real Twitter Android phone app). Most were created in June or October 2020.
The bots in this network do two things: retweet and reply. In both cases, the accounts they interact with are accounts selling access to proxy servers and botting software.
This pornbot network consists of 653 accounts with names beginning with "porn_click_" and ending with numbers, mostly created in batches at various points in 2020. They (allegedly) all tweeted via the Twitter website until mid-September 2020, when they swapped to TweetDeck.
The "videos" in these pornbots' tweets aren't actually videos. They're redirected links to obscure porn websites disguised as videos through the use of thumbnail images with fake "play" buttons. We suspect the links are unsafe and do not recommend clicking them.
Attorney @SidneyPowell1, known for representing Michael Flynn, filing multifarious election-related lawsuits, and overuse of the word "Kraken", has accumulated an impressive 1139718 Twitter followers, more than half of them since election day. We took a look.
At first glance, @SidneyPowell1's followers appear to be largely run-of-the-mill #MAGA and #QAnon accounts, and the hashtags used in their profiles corroborate this. Looking deeper, however, we ran across some interesting anomalies. . .
First off, @SidneyPowell1's Twitter account began its life with an infusion of fake followers from a fake engagement botnet we've previously encountered. (647 of her earliest followers are part of this network.)
Meet @DianaWi59797083, a newly-created pro-Trump account that can't seem to decide whether its name is Blake or Diana. It probably doesn't matter, since it's using a plagiarized profile pic that's been floating around the internet for years. #YouHadOneJob
Compounding the hilarity, the first account to retweet @DianaWi59797083 is @JasonMAGA4ever, an account created a couple weeks ago. In what is doubtless a total coincidence, @JasonMAGA4ever is also using a stolen profile photo.
We weren't able to retrieve the early retweets of @JasonMAGA4ever's tweets, so the saga ends there for now, but we wouldn't be surprised if its Twitter career was bootstrapped with the aid of additional bogus #MAGA accounts with stolen pics.
Answer: a few recent @globaltimesnews tweets have been amplified by two distinct groups of bots. (It's possible that they are part of the same network, but we can't prove this, so we treated them as two separate botnets for the sake of this analysis.) #ATaleOfTwoBotnets
The smaller of the two botnets consists of 76 accounts created in October and November 2020, all (allegedly) tweeting via the Twitter Android App. In an apparent lapse of creativity on the part of the botnet operators, 36 of the accounts are named either "Barb" or "Barbara".
Answer: the video, originally tweeted by @CindyScarbrou17, has been embedded in 1353 tweets from 1140 different accounts. Although none of the individual tweets got much attention, the video racked up a decent view count due to the the sheer number of tweets containing it.
These accounts are part of a Korean-language pornbot network consisting of (at least) 4291 accounts with repetitive naming schemes, created in batches between September 30th and November 18th, 2020. The older accounts host the original videos, and the newer ones embed them.