Meet @RoosterMagaa and @No1biden. Although their political perspectives appear to differ, they're both offering to "grow ur followers everyday 200+ real <MAGA/Biden> followers 10k in 1 month" using the exact same verbiage. #MondayMotivation
Based on the identical verbiage, it seems quite possible that @RoosterMagaa and @No1Biden are operated by the same entity. To test this, we had @SeanSpammity DM a request for MAGA followers to the ostensibly pro-Biden account (accompanied by @RoosterMagaa's tweet)...
A few hours later, @No1Biden (allegedly a pro-Biden account) indeed replied with an offer to provide 10K "real MAGA Trump followers" for $300 or 25K for $500. (Needless to say, we're not going to pursue this opportunity.)
Well, that was a quick reaction from both accounts. #CancelCulture
Update: the account that was named @No1Biden at the time this thread was posted has renamed itself to @No1bidenfan (permanent account ID is 1362266283799052289).
In case @RoosterMagaa also changes names, that one's permanent ID is 1338814662373085186.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
In an interesting twist, @TwitterSafety's latest takedown announcement was greeted with a barrage of replies and quote tweets containing the hashtag #ArmenianGovernmentTrolls (and frequently no other text).
We downloaded tweets (excluding retweets) containing #ArmenianGovernmentTrolls, yielding 310 tweets from 204 accounts. The hashtag appears to have been started today by @FasliNabiyev shortly after @TwitterSafety's announcement.
The accounts tweeting #ArmenianGovernmentTrolls are disproportionately new accounts, with more than half of them having been created in July 2020 or later. 184 of 204 are accounts that previously spammed another hashtag we studied, #DontBelieveArmenia.
Trump is out of office and off of Twitter, but the MAGA follow trains continue to chug along. We took a look at #MAGA train activity subsequent to Twitter's January 8th 2021 QAnon crackdown. #SundaySpam
By starting with a few MAGA follow trains and recursively exploring the accounts that retweeted them in search of additional trains, we found 7523 trains posted between Jan 9 and Feb 20, 2021, listing 10310 accounts. 7757 are still online, mostly accounts created in 2020 or 2021.
A significant minority of these trains (1145 of 7523, 15.2%) contain the hashtag #BolsoTrump2021, often alongside images promoting both Trump and Brazilian President Jair Bolsonaro. 16 of 58 "conductors" (accounts that post trains) we looked at used the #BolsoTrump2021 hashtag.
Meet @DaoThuyHanh1, @TrangKi26074705, @NguyenN16424388, and @TrinhNg82469771, four automated Twitter accounts that were created this morning (Feb 18 2021) and are already spewing exciting questions like "Do People Actually Use Cryptocurrency?" into the universe.
These accounts are part of a botnet consisting of 34 accounts created in Feb 2021. They all follow multiple other members of the botnet (and not much else). Their follow graph is split into two separate clusters, with bots in each cluster only following others in that cluster.
The majority of this network's content thus far is tweets containing linkings to cryptocurrency news articles and blog posts. These tweets are sent via the SocialChief automation service, which we've seen before:
What does "normal" Twitter traffic look like in terms of what percentage of it is automated/from accounts with default pics/new accounts etc? It turns out that the baseline values differ depending on tweet language.
We downloaded 100K random tweets in each of 9 languages: Arabic, Chinese, English, Japanese, Korean, Portuguese, Russian, Spanish, and Turkish. (We did this by choosing 1000 random cutoff times between Feb 8 and Feb 16, and downloading the preceding 100 tweets in each language.)
The percentage of tweets sent via automation apps (based on the "tweet source" field) varies widely by language. Tweets in Japanese have the highest rate of automation (16.9%) of tweets, with Arabic on the low end at only 0.9%. 5.9% of English-language tweets are automated.
It's a great day to look at an Arabic-language pornbot network that uses stolen profile pics. This particular botnet sometimes uses the same pic on multiple accounts, occasionally cropped differently. #MondaySpam
This network consists of 303 accounts created from November 2020 to January 2021, with particularly large batches created on November 13th, November 15th, and December 16th, 2020.
Most of this botnet's content is in Arabic, most of it is retweets, and most of it is (allegedly) sent via the Twitter Web App. The retweets were all sent via the web app, and its original content was posted via Twitter for Advertisers, Twitter Ads, and Tweetdeck.
How does one detect renamed Twitter accounts and find the previous names? There's no surefire way to do it, but here are four methods that sometimes work.
The first method is to do a Twitter search for old replies to the account in question. Use a search of this form to find replies prior to a given date and make sure to use "Latest" rather than "Top" results.
The previous name(s) will show up (sometimes alongside the current name) at the beginning of replies to the account's old tweets. This method doesn't always work, but it seems that when it does work, it works even if the tweets being replied to have been deleted.