We took a look at the other followers of some of the Arabic accounts followed by the now-suspended fake Sidney Powell account @SidneyPowell_, and found a portion of a bulk follow botnet following @aL7ijaaz. #TuesdayThoughts

cc: @ZellaQuixote Image
To find the rest of the network (or at least most of it), we recursively explored the followers of large accounts followed by the bots we'd already found. Many of the accounts the botnet follows appear to have almost no real followers whatsoever. Image
We found a total of 522180 accounts that we believe are part of this fake engagement network. All were created in batches between July 2013 and March 2014, frequently exceeding thousands of accounts per day. They have repetitive naming schemes, and none has ever liked a tweet. ImageImageImage
These accounts are now dormant, but when active they supposedly tweeted via Twitter Web Client (prior to October 2013) and Twitter for Android. The vast majority of their tweet content is in Arabic. ImageImage
The accounts in this botnet post both original tweets and retweets, with the majority of the content being highly repetitive original tweets. The most frequently repeated tweets (assuming Google Translate got things roughly right) are about gaining large numbers of followers. ImageImage
The accounts most frequently retweeted by this botnet and the accounts it follows are mostly Arabic-language accounts, albeit different sets of accounts. As mentioned earlier, many of the accounts it follows appear to have gained most or all of their followers from this botnet. ImageImage

• • •

Missing some Tweet in this thread? You can try to force a refresh
 

Keep Current with Conspirador Norteño

Conspirador Norteño Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @conspirator0

13 Dec
Earlier tonight, a Twitter account named @Fauci sent out a tweet impersonating Dr. Anthony Fauci and was quickly suspended. We did some research on it before the ban, and decided to present our findings as a tutorial of sorts on detecting impostor accounts.

cc: @ZellaQuixote
First off, the (subsequently suspended) @Fauci account sent what it claimed was its first tweet in December 2020, despite being created in 2009. It's also potentially odd that Fauci would retweet the Biden transition team while still working for the Trump administration.
Secondly, we looked at old tweets tagging @Fauci, and most of them don't appear to have much to do with virology or any other medical topic. Some are in Indonesian, which as far as we have been able to discern, the real Dr. Fauci does not speak.
Read 4 tweets
13 Dec
We've done a few analyses lately of anomalies lurking in the followers of various large #MAGA accounts. Here's a thread linking all of them. First up: the account presently known as @Wizard_Predicts (although it's had at least a dozen other names thus far).

cc: @ZellaQuixote
Next we have @ColumbiaBugle, recently retweeted by Trump. It began its existence with an infusion of empty accounts that seem to have been created exclusively to follow @ColumbiaBugle.
We found multiple anomalies in @SidneyPowell1's followers, one of which (a recent infusion of Japanese accounts) also turns up in the followers of fellow #Kraken tentacles @LLinWood and @RudyGiuliani.
Read 4 tweets
11 Dec
Meet @AppSame, a Conservative SuperPAC with 338418 followers, most of whom don't seem to be interested in retweeting its tweets. Since it attacks the legitimacy of other people's followers, its own follower growth is surely beyond reproach, right?

cc: @ZellaQuixote
Although @AppSame's last ~50K accounts look largely organic, the story is quite different early on, with lengthy streaks where it was followed by thousands or tens of thousands of accounts with zero likes or which follow more than 50 times as many accounts as they have followers.
200448 of @AppSame's 338418 followers (59.2%) followed it during these periods of inorganic growth. Helpfully, @AppSame was running a follower-tracking app back in its early days, confirming that it repeatedly gained tens of thousands of followers in a single day.
Read 6 tweets
11 Dec
It's a Thursday, and a bevy of identical tweets in Indonesian have been tweeted via TweetDeck. We took a gander. #Spamalicious

cc: @ZellaQuixote Image
The identical tweets were posted by a newly-created botnet, consisting of 10 accounts created over the span of 10 minutes on December 9th, 2020. All 10 accounts have female profile pics, and none has ever liked a tweet or followed another account. Image
As is often the case with spammy botnets, the profile pics are stolen, generally from stock photo sites. We found Google reverse image search effective for tracking them down (although we didn't try any other search site, as we didn't need to with this group). Image
Read 6 tweets
5 Dec
What's up with these accounts retweeting giveaway tweets using apps with names like "Twitter for HUAWEI Y9a"? #SaturdaySpam

cc: @ZellaQuixote
Unsurprisingly, they're part of a botnet, consisting of (at least) 19 accounts that use custom apps with names of the form "Twitter for HUAWEI<xxxx>", and occasionally "Twitter for Android6" (not the real Twitter Android phone app). Most were created in June or October 2020.
The bots in this network do two things: retweet and reply. In both cases, the accounts they interact with are accounts selling access to proxy servers and botting software.
Read 4 tweets
5 Dec
Here's an interesting duo: @POLICEFORTRUMPI and @SidneyPowell_ (not the real Sidney Powell). Both were created in Apr 2016 but silent until Dec 2020, both are demanding RETWEETS and FOLLOWS, and both started out by following large Arabic-language accounts.

cc: @ZellaQuixote
The RETWEETS and FOLLOWS verbiage on this pair of accounts is reminiscent of this recently-suspended network of fake #MAGA accounts, so they may be the same operation, but we don't have enough information to be 100% sure on that yet.
Yet another similar looking fake #MAGA account (@atensnut__, impersonating @atensnut) has emerged and is begging for RETWEETS and FOLLOWS. (Despite the claims of the impostor, the real @atensnut is still active and still has a full complement of followers.)
Read 5 tweets

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!

Follow Us on Twitter!