Are tweets about Xinjiang from @ChineseEmbinUS being artificially amplified by a network of repetitively named batch-created accounts? (Spoiler: yes, and they retweet other Chinese diplomatic and state media accounts as well.)
We downloaded recent retweets of @ChineseEmbinUS's tweets, and noticed several spikes in account creation (mostly in early 2020). The accounts created during these spikes have distinctive patterns in their names, similar numbers of tweets/likes, and so on.
By exploring the retweeters of the other tweets retweeted by these accounts, we found a total of 674 batch-created accounts, created between December 2019 and January 2021. The naming schemes sometimes vary from batch to batch (table show representatives examples).
These 674 accounts allegedly tweet via the Twitter Android App and Twitter Web App (no iPhone/iPad tweets). We're uncertain whether these accounts are automated or the result of repetitive human activity, hence the use of the term "astroturf network" rather than "botnet".
This network posts both original tweets and retweets/quote tweets. Original tweets are repetitive and are mostly links to Chinese media sites and YouTube videos. Propaganda about Xinjiang and denial of the existence of forced labor camps are the primary themes.
Who does this network amplify via retweets and quote tweets? Mostly Chinese diplomatic and state media accounts, and as with the network's original tweets, propaganda about Xinjiang is the main theme.
418 of the 674 accounts in this network (62%) use default profile pics; the rest mostly use stolen pics. We found both TinEye and Google reverse image search reasonably effective at finding pics stolen from other websites.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
In Aug 2020, someone redirected antifa(dot)com to joebiden(dot)com, and has now switched it to whitehouse(dot)gov. Even though anyone can buy a domain and point it at any website, some folks falsely insist Biden is affiliated with the antifa(dot)com domain name.
Whoever bought the antifa(dot)com domain also appears to have briefly pointed it at kamalaharris(dot)org and buildbackbetter(dot)gov. Again, this does not require the consent or involvement of the website being redirected to.
We downloaded tweets containing links to antifa(dot)com. There are four spikes in tweet volume, corresponding to when major accounts noticed the redirect and tweeted about it. (Earlier traffic is off-topic and extremely light, and has thus been excluded from this analysis.)
This botnet consist of 71 accounts, the majority of which were made in 2017 or 2018 but were largely dormant until December 2020. Almost all recent content is automated via "Mobile App 9.2", with a few other custom apps thrown in. The accounts tweet on very similar schedules.
Almost all of this botnet's tweets are retweets (6045 of 6372 tweets, 94.8%), and almost all content is in Turkish (6202 of 6372 tweets, 97.3%).
A bogus claim from @amuse that Biden's transition team asked the National Guard not to station troops near Biden who have voted in GOP primaries/contributed to GOP candidates went viral recently, being retweeted thousands of times and copied by several accounts.
This is not @amuse's first disinfo rodeo. Previous hits include falsely claiming that the QAnon shaman is antifa (he's been identified as Trump supporter Jacob Chansley and arrested) and stating that both Biden and Trump got more than 270 electoral votes (this didn't happen).
One last thing: @amuse regularly deletes older tweets, hiding from the casual observer the account's track record of peddling disinformation. Plenty of @amuse's tweets have been archived, however, which is how we found most of the ones featured in this thread.
These three accounts are part of a group of 634 batch-created followers of @sputnikvaccine, all of which were made on December 21st or December 22nd, 2020, and all of which have default profile pics and follow no other accounts.
601 of these 634 accounts have tweeted, each of them exactly once. All of their tweets are retweets of the same @sputnikvaccine tweet, all (allegedly) posted via the Twitter Web App. 593 of them also liked the @sputnikvaccine tweet, and none has thus far liked another tweet.
We're only 15 days into 2021, and someone has already spun up a network of "news" accounts with GAN-generated face pics (similar to the output of thispersondoesnotexist.com). Most of the "authors" at the sites they promote also have GAN pics. #FridayShenaniGANs
We found a network of 11 accounts, all created on January 1st 2021 or later. Each account has a GAN-generated profile pic and tweets links to the "news" site listed in its profile (the sites are mostly cryptocurrency-themed), as well as retweeting other members of the network.
Most of these accounts' tweets are automated via "RSS Ground", and contain links to the "news" sites they promote. The automated tweets are sent on similar schedules, with occasional tweets via the Twitter website (mostly retweets of other accounts in the network).
This botnet would like you to know that online casino affiliates make big profits and earn continuous income, and has therefore said so hundreds of times. #TwinkleTwinkleLittleCasinoSpambots
This online casino spambot network consists of 15 accounts, all made in 2020 or 2021. Each account sends the majority of its tweets via a unique custom app with a numerical name. Most of the accounts tweet on very similar schedules.
This botnet sends both original tweets and retweets. The retweets, which comprise the lion's share of the volume, are sent via the numerically-named custom apps, while the original tweets are sent via automation service SocialDog.