Meet @DaoThuyHanh1, @TrangKi26074705, @NguyenN16424388, and @TrinhNg82469771, four automated Twitter accounts that were created this morning (Feb 18 2021) and are already spewing exciting questions like "Do People Actually Use Cryptocurrency?" into the universe.
These accounts are part of a botnet consisting of 34 accounts created in Feb 2021. They all follow multiple other members of the botnet (and not much else). Their follow graph is split into two separate clusters, with bots in each cluster only following others in that cluster.
The majority of this network's content thus far is tweets containing linkings to cryptocurrency news articles and blog posts. These tweets are sent via the SocialChief automation service, which we've seen before:
Each account also has one or two tweets sent via the Twitter Web App (in most cases, just the account's first tweet). These are mostly short phrases in English or Vietnamese, although a few are images, some of which also show up as profile pics on other accounts in the network.
Speaking of profile pics, it will likely come as no surprise to you that this botnet uses stolen profile pics. In a few cases the same pic was used as the profile pic for multiple accounts in the network.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
What does "normal" Twitter traffic look like in terms of what percentage of it is automated/from accounts with default pics/new accounts etc? It turns out that the baseline values differ depending on tweet language.
We downloaded 100K random tweets in each of 9 languages: Arabic, Chinese, English, Japanese, Korean, Portuguese, Russian, Spanish, and Turkish. (We did this by choosing 1000 random cutoff times between Feb 8 and Feb 16, and downloading the preceding 100 tweets in each language.)
The percentage of tweets sent via automation apps (based on the "tweet source" field) varies widely by language. Tweets in Japanese have the highest rate of automation (16.9%) of tweets, with Arabic on the low end at only 0.9%. 5.9% of English-language tweets are automated.
It's a great day to look at an Arabic-language pornbot network that uses stolen profile pics. This particular botnet sometimes uses the same pic on multiple accounts, occasionally cropped differently. #MondaySpam
This network consists of 303 accounts created from November 2020 to January 2021, with particularly large batches created on November 13th, November 15th, and December 16th, 2020.
Most of this botnet's content is in Arabic, most of it is retweets, and most of it is (allegedly) sent via the Twitter Web App. The retweets were all sent via the web app, and its original content was posted via Twitter for Advertisers, Twitter Ads, and Tweetdeck.
How does one detect renamed Twitter accounts and find the previous names? There's no surefire way to do it, but here are four methods that sometimes work.
The first method is to do a Twitter search for old replies to the account in question. Use a search of this form to find replies prior to a given date and make sure to use "Latest" rather than "Top" results.
The previous name(s) will show up (sometimes alongside the current name) at the beginning of replies to the account's old tweets. This method doesn't always work, but it seems that when it does work, it works even if the tweets being replied to have been deleted.
60 of @Dilde97512368's followers have GAN-generated face pics, but that's not the only pattern. 15 of its followers use cat pics, 7 use anime pics, and some of the pics that are neither GAN faces, cats, nor anime pics are repeated across two or three of its followers.
We explored the follower networks of @Dilde97512368's followers, and found a total of 3204 accounts with the same mix of profile pics (anime, cats, GAN-generated faces, and repeated images), all created January 25th or later.
Answer: @Mippcivzla's tweets (and those of a few other large Venezuelan accounts) are being retweeted by a network of 2454 accounts, all allegedly using the Twitter Android app. These accounts post almost no original content (99.6% percent of their tweets are retweets).
These accounts have all retweeted hundreds of tweets or more, but have liked few or none. The content they boost reflects this - 98.6% of the tweets they retweeted got more retweets than likes. (Based on a set of 5M random tweets, only ~0.8% of tweets get more RTs than likes.)
The 9 accounts promoting monsterfundrise(dot)com discussed in this previous thread have been shut down by Twitter, but 15 new ones have taken their place. As before, their tweets appear be being astroturfed, garnering far more retweets than likes.
We downloaded the set of accounts amplifying the monsterfundrise tweets, and noticed that many of the other tweets they retweeted (particularly recent tweets from Punjab, Pakistan governor @ChMSarwar) also received more retweets than likes.
(some background info on the presence of more retweets than likes being a sign of astroturfing - average ratio is more than twice as many likes as retweets)