Are tweets about Xinjiang from @ChineseEmbinUS being artificially amplified by a network of repetitively named batch-created accounts? (Spoiler: yes, and they retweet other Chinese diplomatic and state media accounts as well.)

cc: @ZellaQuixote
We downloaded recent retweets of @ChineseEmbinUS's tweets, and noticed several spikes in account creation (mostly in early 2020). The accounts created during these spikes have distinctive patterns in their names, similar numbers of tweets/likes, and so on.
By exploring the retweeters of the other tweets retweeted by these accounts, we found a total of 674 batch-created accounts, created between December 2019 and January 2021. The naming schemes sometimes vary from batch to batch (table show representatives examples).
These 674 accounts allegedly tweet via the Twitter Android App and Twitter Web App (no iPhone/iPad tweets). We're uncertain whether these accounts are automated or the result of repetitive human activity, hence the use of the term "astroturf network" rather than "botnet".
This network posts both original tweets and retweets/quote tweets. Original tweets are repetitive and are mostly links to Chinese media sites and YouTube videos. Propaganda about Xinjiang and denial of the existence of forced labor camps are the primary themes.
Who does this network amplify via retweets and quote tweets? Mostly Chinese diplomatic and state media accounts, and as with the network's original tweets, propaganda about Xinjiang is the main theme.
418 of the 674 accounts in this network (62%) use default profile pics; the rest mostly use stolen pics. We found both TinEye and Google reverse image search reasonably effective at finding pics stolen from other websites.

• • •

Missing some Tweet in this thread? You can try to force a refresh
 

Keep Current with Conspirador Norteño

Conspirador Norteño Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @conspirator0

23 Jan
In Aug 2020, someone redirected antifa(dot)com to joebiden(dot)com, and has now switched it to whitehouse(dot)gov. Even though anyone can buy a domain and point it at any website, some folks falsely insist Biden is affiliated with the antifa(dot)com domain name.

cc @ZellaQuixote ImageImage
Whoever bought the antifa(dot)com domain also appears to have briefly pointed it at kamalaharris(dot)org and buildbackbetter(dot)gov. Again, this does not require the consent or involvement of the website being redirected to. Image
We downloaded tweets containing links to antifa(dot)com. There are four spikes in tweet volume, corresponding to when major accounts noticed the redirect and tweeted about it. (Earlier traffic is off-topic and extremely light, and has thus been excluded from this analysis.) Image
Read 7 tweets
20 Jan
It's a Tuesday in January, which is a great time to look at a retweet botnet that uses custom apps with official-sounding names like "Mobile App 9.2".

cc: @ZellaQuixote
This botnet consist of 71 accounts, the majority of which were made in 2017 or 2018 but were largely dormant until December 2020. Almost all recent content is automated via "Mobile App 9.2", with a few other custom apps thrown in. The accounts tweet on very similar schedules.
Almost all of this botnet's tweets are retweets (6045 of 6372 tweets, 94.8%), and almost all content is in Turkish (6202 of 6372 tweets, 97.3%).
Read 5 tweets
19 Jan
A bogus claim from @amuse that Biden's transition team asked the National Guard not to station troops near Biden who have voted in GOP primaries/contributed to GOP candidates went viral recently, being retweeted thousands of times and copied by several accounts.

cc @ZellaQuixote
This is not @amuse's first disinfo rodeo. Previous hits include falsely claiming that the QAnon shaman is antifa (he's been identified as Trump supporter Jacob Chansley and arrested) and stating that both Biden and Trump got more than 270 electoral votes (this didn't happen).
One last thing: @amuse regularly deletes older tweets, hiding from the casual observer the account's track record of peddling disinformation. Plenty of @amuse's tweets have been archived, however, which is how we found most of the ones featured in this thread.
Read 4 tweets
18 Jan
Meet @TammyRu55487107, @AshleyG05060977, @MollyBa23420160, who (along with hundreds of their friends) all joined Twitter in late December 2020, and have all retweeted the same @sputnikvaccine tweet and nothing else. #SundaySpam

cc: @ZellaQuixote Image
These three accounts are part of a group of 634 batch-created followers of @sputnikvaccine, all of which were made on December 21st or December 22nd, 2020, and all of which have default profile pics and follow no other accounts. ImageImageImageImage
601 of these 634 accounts have tweeted, each of them exactly once. All of their tweets are retweets of the same @sputnikvaccine tweet, all (allegedly) posted via the Twitter Web App. 593 of them also liked the @sputnikvaccine tweet, and none has thus far liked another tweet. Image
Read 4 tweets
16 Jan
We're only 15 days into 2021, and someone has already spun up a network of "news" accounts with GAN-generated face pics (similar to the output of thispersondoesnotexist.com). Most of the "authors" at the sites they promote also have GAN pics. #FridayShenaniGANs

cc: @ZellaQuixote
We found a network of 11 accounts, all created on January 1st 2021 or later. Each account has a GAN-generated profile pic and tweets links to the "news" site listed in its profile (the sites are mostly cryptocurrency-themed), as well as retweeting other members of the network.
Most of these accounts' tweets are automated via "RSS Ground", and contain links to the "news" sites they promote. The automated tweets are sent on similar schedules, with occasional tweets via the Twitter website (mostly retweets of other accounts in the network).
Read 7 tweets
14 Jan
This botnet would like you to know that online casino affiliates make big profits and earn continuous income, and has therefore said so hundreds of times. #TwinkleTwinkleLittleCasinoSpambots

cc: @ZellaQuixote
This online casino spambot network consists of 15 accounts, all made in 2020 or 2021. Each account sends the majority of its tweets via a unique custom app with a numerical name. Most of the accounts tweet on very similar schedules.
This botnet sends both original tweets and retweets. The retweets, which comprise the lion's share of the volume, are sent via the numerically-named custom apps, while the original tweets are sent via automation service SocialDog.
Read 5 tweets

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!

Follow Us on Twitter!