What's up with all these accounts created in May 2012 with "legit check" as their pinned tweet? #SeemsLegit
cc: @ZellaQuixote
cc: @ZellaQuixote
Answer: they're part of a botnet that retweets and replies to giveaway tweets. This network consists of 271 accounts created on May 1st, 2012 that have no tweets prior to December 2020. (Not all have the "legit check" pinned tweet, but they have other things in common...)
At present, the 271 accounts in this network all (allegedly) tweet via the Twitter Web App. They've gone through a variety of custom apps, however, many of which seem to be named to give the incorrect impression that they are official Twitter products ("Tɯitter for Samsung" etc).
Almost all of the tweets posted by this botnet are either retweets or replies. The tweets being retweeted are mostly giveaways of license keys for botting software for e-commerce sites and apps (primarily those that sell shoes).
The e-commerce botting software theme continues with the accounts that the botnet replies to. Many of the replies are repetitive, with the most common reply having been used 88 times total by 52 distinct accounts.
As is pretty common with astroturf networks, the accounts in this botnet use stolen profile pics. We had better luck reverse image searching this group with TinEye and Google than with Yandex.
One more interesting detail: almost all of the accounts in this network (263 of 271) changed their display names drastically at some point over the last year. (Comparison is based on an old dataset we have that includes all publicly-visible accounts created May 2012 or earlier.)
• • •
Missing some Tweet in this thread? You can try to
force a refresh
