Peru's next president will be chosen in a runoff election on June 6th, and a network of recently-created accounts (many with stolen profile pics) is expressing its astroturfed preference for Keiko Fujimori over Pedro Castillo via TweetDeck. #FridayAstroturf
This network consists of 114 Spanish-language accounts created in batches between March 26th and April 30th, 2021. Thus far, these accounts have posted almost all of their content via TweetDeck (6989 of 7101 tweets, 98.4%).
These accounts tweet about the upcoming election, a mix of tweets promoting right-wing candidate Keiko Fujimori and tweets attacking left-wing candidate Pedro Castillo. They retweet each other's political content frequently, along with occasional retweets of large accounts.
The accounts also post repetitive non-political tweets. These are a mix of relatively mundane tweets and follower growth tweets. As always, take the English translations of the tweets with a grain of salt, as machine translation sometimes gets things quite wrong.
The hashtags posted by this botnet reflect these themes, with political hashtags related to the upcoming election as the primary theme and follower growth hashtags turning up prominently as well.
One final note: it may be a coincidence, but we found two similar-looking batch-created TweetDeck-based bot/sock networks tweeting about Ecuador's recent presidential election. Here are threads on those networks:
We did some further exploration of recently-created accounts that tweet in Spanish via TweetDeck, and found a few more groups of batch-created accounts:
8 accounts, location set to Guatemala
23 accounts, location set to República Dominicana
27 accounts, location set to Perú
Many of these batch created accounts have follow relationships (usually multiple) with the Perú election botnet described earlier in this thread, as well as with each other. Eight of the accounts with their location set to República Dominicana form a separate follow network.
Although the Guatemala and República Dominicana batch-created TweetDeck accounts have yet to tweet anything political, they have tweeted verbatim copies of some of the same "filler" tweets as the Perú election botnet, a possible sign that they are part of the same operation.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
This past Sunday (May 9th) was Mother's Day in multiple countries, and someone apparently chose to mark the occasion by creating a spam botnet to spread feel-good content related to #Xinjiang, China. #HolidayAstroturf
This botnet consists of 65 accounts with default profile pics created on May 9th, 2021. All have tweeted exactly three times, with the exception of @CaraLambrecht, which has only tweeted twice. All tweets thus far were (supposedly) sent via Twitter for Android.
Each account in this botnet has tweeted the same three tweets in the same order (again, with the exception of @CaraLambrecht, which skipped one). The most recent tweet from each account is a Xinhua YouTube video of children (allegedly in Xinjiang) saying "happy Mother's Day".
Here's an interesting account: @Right_n_Aware. Almost all of this account's tweets (177 of 193) have the curious property that they are duplicated verbatim on other accounts. #SpamTastic
We found a total of 78 accounts (including @Right_n_Aware) that frequently tweet the same tweets verbatim. Almost all were created in 2020 or 2021, and almost all have more tweets than likes. They post the majority of their tweets via "Twitter for Android".
This network's duplicate tweets are almost all political in nature, with criticism of the governments of China and Pakistan as the primary themes. Most of the duplicated tweets were tweeted first by either @Right_n_Aware or @ProwessSilent.
A May 3rd 2021 tweet from @SpokespersonCHN about a boy with serious arm injuries being flown to Xinjiang for medical treatment attracted a flurry of retweets and repetitive replies in multiple languages from accounts with default profile pics.
These replies are from a network of 479 accounts created in batches between January and April 2021. All accounts have English first and last names (first names are almost all female). These accounts have thus far posted all of their tweets via the Twitter Web App (allegedly).
This network's content is (mostly) a mix of replies and retweets. The replies are repeated verbatim across multiple accounts. Despite all of the accounts having English-looking names, the accounts are quite multilingual, having replied in 37 different languages thus far.
All twelve of these accounts have the same anomalous pattern in their followers: long spans of time post-2019 where nearly all their new followers are accounts created prior to mid-November 2018. What's up with that? #WednesdayWisdom
The twelve accounts don't have the same anomalous followers, however, and the anomalous followers in question by and large don't look like batch-created accounts or obvious bots. The twelve accounts do have something in common, however. . .
All twelve accounts are being promoted in Twitter's "who to follow" section. We're not precisely sure why, but there appears to be a correlation between this form of Twitter promotion and accounts mostly gaining followers created before November 2018.
Each of the five accounts in this botnet tweets via its own custom automation app, all of which have names beginning with "test" or "testing" and ending in long strings of digits.
The vast majority (90.9%) of this botnet's content is retweets, with replies rounding out the remainder. It mostly retweets and replies to giveaway tweets, generally from cryptocurrency or gaming accounts.
It's not often that the majority of the tweets containing a given hashtag turn out to have been posted with TweetDeck, but so it goes with #UnSoloPaís. 627 of 667 tweets (94%) posted over the last week containing this hashtag were sent via TweetDeck.
Most of these tweets came from a network of 107 Spanish-language accounts that tweet almost exclusively via TweetDeck. These accounts were created between August 2020 and April 2021, mostly in batches of multiple accounts.
These accounts tweet a variety of hashtags, with #UnSoloPais (the unaccented form of #UnSoloPaís) being the most frequent, and various hashtags supporting President-elect of Ecuador Guillermo Lasso and attacking his opponent Andrés Arauz turning up frequently.