If you woke up this morning wondering if someone had made a cryptocurrency astroturf botnet that falls in love all over again every time it sees Sean Hannity, you're in luck.
This botnet consists of 266 accounts created on December 7th and December 8th 2020. All the accounts in this network have (allegedly) sent all of their tweets via the Twitter Web App.
What do the bots in this network do? They primarily amplify cryptocurrency giveaway/promotion tweets via retweets by retweeting, replying to, and quote-tweeting them. They primarily amplify a group of twelve accounts (although one, @Latestairdrop3, is suspended).
The accounts in this botnet activate for periods of few hours at a time and all fire off the same type of tweet when active, beginning with original tweets on Dec 7/8 2020, followed by retweets on Dec 10, followed by a week or so of quote tweets, followed by replies, and so on.
Unlike the majority of the botnet's content, the original tweets it generated when it first came online aren't cryptocurrency astroturf - they're images of scenery with (often grammatically incorrect) text captions. Both images and captions are repeated.
The replies and the majority of the quote tweets (and all of the retweets) are repetitive interactions with cryptocurrency tweets. A few of the quote tweets are quote tweets of popular accounts with the same (non-cryptocurrency-related) text as the early image tweets.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
This botnet would like you to know that online casino affiliates make big profits and earn continuous income, and has therefore said so hundreds of times. #TwinkleTwinkleLittleCasinoSpambots
This online casino spambot network consists of 15 accounts, all made in 2020 or 2021. Each account sends the majority of its tweets via a unique custom app with a numerical name. Most of the accounts tweet on very similar schedules.
This botnet sends both original tweets and retweets. The retweets, which comprise the lion's share of the volume, are sent via the numerically-named custom apps, while the original tweets are sent via automation service SocialDog.
We took a look at GOP Congressman @DrPaulGosar's followers, and discovered that on two occasions he received surges in followers that tweet in languages other than English: first Chinese, and later Portuguese.
When did @DrPaulGosar pick up these followers? The Chinese-language accounts mostly followed him in late March and early April 2020, with the Portuguese-language accounts showing up in mid-November 2020 (shortly after the U.S. presidential election).
The Chinese-language accounts following @DrPaulGosar link a variety of right-wing news sources, including Steve Bannon/Gui Wengui project GNews, Fox News, Epoch Times, and ZeroHedge.
We created a @DrunkAlexJones Parler account (parler.com/profile/DrunkA…) back in June 2020. Despite the fact that he has only followed 40 accounts and posted a grand total of twice, he has racked up 1756 followers (43 times as many accounts as he follows).
Most of DrunkAlexJones' Parler followers joined Parler at one of three points in time:
• shortly after Twitter first added a disclaimer to one of Trump's tweets
• in the week following the Nov 3, 2020 US presidential election
• shortly after Twitter banned @realDonaldTrump
188 of DrunkAlexJones' 1756 Parler followers (10.7%) have never posted, and 992 (56.5%) have posted fewer than 10 times. The empty accounts were disproportionately created during the post-election surge.
The Vatican experienced a blackout last night, and QAnon believers have responded in typical fashion by baking a conspiracy casserole involving the Pope being arrested for child trafficking and something about Dominion voting machines (of course).
Retweet network for tweets containing "Vatican" or "The Pope" for the evening of January 9th and morning of January 10th, 2020 (PST). Former QAnon congressional candidate @theangiestanton and a newborn "news" account named @WorldWireNews1 turn up prominently.
The @WorldWireNews1 account was created during the attack on the U.S. Capitol, at 1:49 PM on January 6th, 2020. It appears to be the successor to the now-suspended @WW_NEWS_ (@WorldWireNews1's "F" tweet is a reply to a now-removed tweet commenting on @WW_NEWS_'s ban).
This pornbot network consists of 690 accounts, created in batches between August 20th and November 16th, 2020. Thus far, all of their tweets have been (allegedly) sent via Twitter web app. Some (but not all) of the bots have liked tweets from porn accounts with large followings.
The tweets posted by this pornbot network are extremely repetitive, with many tweets having been posted by hundreds of accounts. (The repeated tweets are sometimes accompanied by hashtagged US city names, which we removed for the sake of generating this table.)
We found a network of 23 accounts promoting something called "EA FX ROBOT", created between October 2016 and March 2017. These accounts are automated, sending all of their tweets via a scheduling app called "Dynamic Tweets". Most of them operate on very similar schedules.
Hopefully you didn't get your hopes up about installing and running "EA FX ROBOT", because the associated website (eafxrobot(dot)com, the only site linked by the botnet) is no longer online and has been replaced with a generic landing page. The botnet soldiers on, though.