It's a day ending in "y", and a bunch of similar-looking accounts are attaching four letter codes to their otherwise identical tweets denying genocide and downplaying human rights abuses in Xinjiang. #TuesdayAstroturf
We found a network of 113 accounts posting duplicate tweets about Xinjiang with random four letter codes appended. All were created between December 2020 and February 2021, generally in batches of accounts with similar naming schemes. Most use photos of scenery as profile pics.
These 113 accounts (allegedly) post all of their tweets via the Twitter Web App, generally in brief tweetstorms where most/all of the accounts tweet within an hour or so of each other. Most tweets are in English or Chinese, but the network has tweeted in 31 languages thus far.
This botnet links a variety of websites, mostly Chinese state media sites such as Global Times as CGTN or Chinese government sites (including multiple embassies). YouTube also turns up frequently.
This network's content is repetitive, with many tweets having been duplicated verbatim (other than the random 4 letter codes) by dozens of the accounts in the network. Many of the duplicate tweets are headlines from Chinese media sites without accompanying article links.
This network generally sends all copies of a given tweet on the same day (and usually within an hour or two of each other). Xinjiang is the dominant theme (specifically, claims that no genocide, forced labor, or other human rights violations are occurring there).
This is not the first time we've encountered astroturf networks pushing propaganda denying human rights abuses in Xinjiang. Here are two threads on previous networks (both of which have been shut down by Twitter):
Most of the Twitter account listings on accs-market(dot)com include the account's @-name, but in this case the seller has hidden it. The account's display name, profile pic, and follower count are included, and it is apparently verified (blue check), so maybe we can find it.
Sure enough, a verified account named @DakotaPrukop (ID 310045063) exists and has roughly the same number of followers as the account advertised as for sale. It appears to have changed its profile pic, but a recent archive of its feed shows the same pic featured in the listing.
Daylight savings time has begun (in the USA, at least), and what better way to mark the occasion than by looking at a quote tweet astroturf botnet? #SundaySpam
This network consists of 4399 accounts, created between January 23rd and January 25th 2021. The 4399 bots all follow the same 13 cryptocurrency/blockchain-themed accounts (or a subset thereof) and no other accounts.
The accounts in this network send all of their tweets via the Twitter Web App (allegedly). All of their content is either retweets or quote tweets - no original tweets or replies.
As it turns out, the @BlockchainCutie account amplified by the botnet described in this previous thread has a bunch of fake followers. We took a closer look at the largest network following it.
3117 of @BlockchainCutie's followers are batch-created accounts created in late 2020 that we believe to be part of a single botnet. To find the rest of the botnet, we explored the followers of the other accounts these 3117 bots follow.
This botnet consists of 9640 accounts, created in batches between October 15th and December 18th 2020. All of these accounts tweet exclusively via the Twitter Web App - no tweets sent via Android or iPhone, which is itself anomalous.
This network consists of 165 accounts that were all created on January 1st, 2021. All of them have retweeted, quote-tweeted, and liked the same @BlockchainCutie tweet, and most have no other tweets or likes. All their tweets thus far were (allegedly) sent via the Twitter Web App.
All of this network's content is either retweets or quote tweets. The majority are the aforementioned interactions with @BlockchainCutie's tweet, but a few of them have amplified other cryptocurrency/blockchain-themed accounts as well.
This botnet consists of 13 accounts created between 2017 and 2020. Each account is active 24/7 and ends most of its tweets via a unique custom app, most of which have names like "dfghji876". Judging by their follower/following ratios, the bots don't actually follow back.
The vast majority of this botnet's content (99.4% of recent tweets) consists of retweets of tweets containing #SigueMeYTeSigo (or stylized variants such as #𝙎𝙞𝙜𝙪𝙚𝙢𝙚𝙔𝙏𝙚𝙎𝙞𝙜𝙤 and #𝕊𝕀𝔾𝕌𝔼𝕄𝔼𝕐𝕋𝔼𝕊𝕀𝔾𝕆) sent via the custom apps mentioned earlier in this thread.
Although porn account @Online_agine has been around since December 2009, its massive follower growth does not appear to have started until September 2020. (A dataset we captured in March 2020 in which it showed up confirms that it only had 34 followers at that point.)
As it turns out, @Online_agine (permanent ID 97295448) wasn't always named @Online_agine. It appears to have been originally named @Allanymsantos, which was changed to @Mayaunmoor sometime prior to its massive follower growth, and then finally to its current name.