Thread by @conspirator0

How did these six seemingly unrelated tweets end up with thousands of likes but few or no retweets? Are the likes coming from a large astroturf botnet created over the last month? (Spoiler: yup.) #FridayAstroturf

cc: @ZellaQuixote

This botnet consists of (at least) 13870 accounts with lowercase display names created between July 29th and August 26th, 2021. None has tweeted as of yet, but all follow dozens or hundreds of accounts and most have liked dozens or hundreds of tweets.

The bots in this network do two things: like tweets and follow accounts. The account whose tweets they've liked most frequently is @JuanOrlandoH, the President of Honduras. Many (not all) of the other accounts that received lots of likes from the botnet are cryptocurrency-themed.

Interestingly, two of the accounts whose tweets were frequently liked by the botnet (@Jh8Uy and @bi3followers9) claim to be selling social media services such as followers and likes. It's not unlikely that the botnet is (part of) how these services are provided

The bots in this network mostly promotional/commercial accounts. As with the likes, many of the accounts followed have a focus on cryptocurrency/blockchain content, but it's a (mostly) different lineup of accounts. None of the bots follow @JuanOrlandoH, despite liking his tweets.

Here's a slideshow of follow order by creation date scatter plots for several of the accounts followed by the botnet. The bot followers show up as horizontal streaks of thousands of accounts with similar creation dates. (These streaks are how most of the botnet was identified.)

Update: it would appear that @bi3followers9 was not a fan of this thread.

https://twitter.com/conspirator0/status/1431410908073537540

Typo in this tweet, first sentence should be "The bots in this network mostly follow promotional/commercial accounts."

https://twitter.com/conspirator0/status/1431411003615584257