A Tour of a Bot Factory
(possibly still under construction)
(possibly still under construction)
Something spammy turned up in Twitter search results this morning for the Nashville Waffle House shooting. Let's take a closer look. . . 
As of noon today, 684 accounts had linked to an article on verifiedtasks(dot)com titled "Travis Reinking: 5 Fast Facts You Need to Know". 620 of these have default profile pics and all seem to link the same posts on verifiedtasks. Also, they all post their tweets via IFTTT.
What is verifiedtasks(dot)com? The articles seem to be a mix of clickbaity general news, gaming, and cryptocurrency topics. Based on their "about" section cryptocurrency would appear to be the main focus.
This set of bots started tweeting back in September 2017, growing in number and volume over time. 245992 total tweets have been posted as of the time of this writing, most of them within the last month.
The combined tweet timings for the 620 bots reflect the growth in volume, and additionally show both round-the-clock operation and variation in daily schedule.
These bots were brought online in batches - generally, dozens are brought online in the span of a few hours to two days. This chart shows the bots clustered by date of first tweet and number of tweets. Once active, each bot generally tweets every tweet.
Let's take a look at two of the batches. First, here's an early one - note that the account names are more or less random combinations of letters. Time shown is the creation time of the account (as opposed to time of first tweet).
Here's a sample of a more recent batch, and it's starkly different. The accounts now have vaguely readable names. They are also being created in alphabetical order roughly every two minutes, which strongly suggests that the account creation process has been automated.
This chart shows a brief slice of the network's recent activity. Every three hours, a new set of tweets gets put into circulation and tweeted by each bot, mostly over the next hour or so.
One more behavior worth noting - most of the bots customize their tweets by adding additional text and a hashtag to the end or beginning of each tweet. It's possible this is intended to confuse spam-detection tools that look for repeated tweets, or it could just be for flavor.
Much appreciation to @ZellaQuixote for finding the target(s) and aiding with research for this thread.
