What's up with these identical tweets sent via TweetDeck?
(Note: duplicate tweets embedding YouTube videos are sometimes the result of the title of the YouTube video being copied into the tweet text, but that's not the case here.)
Answer: the duplicate TweetDeck tweets are the work of a Spanish-language botnet, consisting of 10 accounts created in 11 minutes on August 22nd, 2020. All ten accounts have virtually identical schedules.
At present, all of these accounts tweet exclusively via TweetDeck, although prior to mid-January they also used Twitter for Android. While they could be human-operated given the software used, we suspect automation due to the identical schedules (and repetition, as we'll see).
These accounts do two things: post original tweets and reply to other accounts' tweets. Their original tweets are extremely repetitive, with many having been tweeted multiple times by all 10 accounts. (As always, the Google translations should be taken with a grain of salt.)
The accounts in this network mostly reply to Mexican political and media accounts. The replies are repetitive, although substantially less so than the network's original tweets, with no reply being repeated verbatim by more than 4 of the accounts in the network.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
Answer: they're part of a botnet that retweets and replies to giveaway tweets. This network consists of 271 accounts created on May 1st, 2012 that have no tweets prior to December 2020. (Not all have the "legit check" pinned tweet, but they have other things in common...)
At present, the 271 accounts in this network all (allegedly) tweet via the Twitter Web App. They've gone through a variety of custom apps, however, many of which seem to be named to give the incorrect impression that they are official Twitter products ("Tɯitter for Samsung" etc).
We started looking at who the accounts in the astroturf network documented in this thread from Feb 9th follow, and discovered a whole bunch more accounts that we believe to be part of the network. #SaturdayShenaniGANs
We found 64848 accounts that we believe to be part of the network (although we may still have missed some). With rare exceptions, they have few tweets and follow far more accounts than they have followers. They're mostly older accounts, almost all created 2018 or earlier.
Who do the accounts in this network follow? It's an eclectic mix that includes government officials from multiple countries, tech entrepreneurs, cryptocurrency accounts, and a "coronavirus news" account, among others.
Despite having tweeted #FollowMeJP daily for almost a decade (via automation tool twittbot(dot)net), none of these accounts has managed to pick up more than 100 followers. #WednesdayWisdom
These accounts are part of a botnet consisting of 125 Japanese-language accounts created on December 11th and 12th, 2011. Each account name consists of a lowercase English word with one or two random characters added to both the beginning and the end of the name.
These accounts behave in an extremely predictable fashion, posting exactly one tweet per day, resulting in 125 total tweets per day from the network (with rare exceptions). All tweets are sent via automation service twittbot(dot)net, and all 125 bots have default profile pics.
In an interesting twist, @TwitterSafety's latest takedown announcement was greeted with a barrage of replies and quote tweets containing the hashtag #ArmenianGovernmentTrolls (and frequently no other text).
We downloaded tweets (excluding retweets) containing #ArmenianGovernmentTrolls, yielding 310 tweets from 204 accounts. The hashtag appears to have been started today by @FasliNabiyev shortly after @TwitterSafety's announcement.
The accounts tweeting #ArmenianGovernmentTrolls are disproportionately new accounts, with more than half of them having been created in July 2020 or later. 184 of 204 are accounts that previously spammed another hashtag we studied, #DontBelieveArmenia.
Meet @RoosterMagaa and @No1biden. Although their political perspectives appear to differ, they're both offering to "grow ur followers everyday 200+ real <MAGA/Biden> followers 10k in 1 month" using the exact same verbiage. #MondayMotivation
Based on the identical verbiage, it seems quite possible that @RoosterMagaa and @No1Biden are operated by the same entity. To test this, we had @SeanSpammity DM a request for MAGA followers to the ostensibly pro-Biden account (accompanied by @RoosterMagaa's tweet)...
A few hours later, @No1Biden (allegedly a pro-Biden account) indeed replied with an offer to provide 10K "real MAGA Trump followers" for $300 or 25K for $500. (Needless to say, we're not going to pursue this opportunity.)
Trump is out of office and off of Twitter, but the MAGA follow trains continue to chug along. We took a look at #MAGA train activity subsequent to Twitter's January 8th 2021 QAnon crackdown. #SundaySpam
By starting with a few MAGA follow trains and recursively exploring the accounts that retweeted them in search of additional trains, we found 7523 trains posted between Jan 9 and Feb 20, 2021, listing 10310 accounts. 7757 are still online, mostly accounts created in 2020 or 2021.
A significant minority of these trains (1145 of 7523, 15.2%) contain the hashtag #BolsoTrump2021, often alongside images promoting both Trump and Brazilian President Jair Bolsonaro. 16 of 58 "conductors" (accounts that post trains) we looked at used the #BolsoTrump2021 hashtag.