Conspirador Norteño Profile picture
Data Scientist/Musician/Participant in the General Confusion @trutherbotprop #Resist I serve the realm.
Pensive™ 🇺🇸💯🔥🌹💚 Profile picture 🔔 ||| вєℓℓє ||| 🔔 Profile picture eDo Profile picture 🇬🇧Renton🐸🇺🇸⭐⭐⭐#ClearFlynn✝️🇧🇷🇮🇹⌛️🥓🤣🐶 Profile picture Adam Smithee Profile picture 19 added to My Authors
27 Sep
What's up with all these automated melodramatic news tweets mentioning "heatmaps" and linking to futuredanger(dot)com? #SundaySpam

cc: @ZellaQuixote Image
We downloaded recent tweets linking to futuredanger(dot)com and found a network of 16 automated accounts dedicated to promoting the site. Each account tweets via its own custom app, accompanied by occasional organic tweets from @FutureDanger6. ImageImageImage
The @FutureDanger6 account appears to be the hub of the network, and is mutual followers with the other 15 accounts (none of which follow any account other than @FutureDanger6). Image
Read 7 tweets
26 Sep
These Twitter accounts sure have a lot in common:

• recent creation dates
• @-name is a first name + 8 digits
• display name is random noun or adjective
• link to Instagram/Facebook page matching display name
• bio is a saying/aphorism

cc: @ZellaQuixote
We found a total of 80 accounts that fit the pattern, created between August 31st and September 21st, 2020. All are low volume and mostly tweet via Mobile Web (M2), with occasional tweets sent via Twitter Web App.
There doesn't appear to be any particular pattern to the content of Instagram and Facebook pages. Some are empty or don't exist, some are random small accounts, and some are major influencers.
Read 5 tweets
23 Sep
Over in #TheMighty200 #MAGA retweet rooms, a report (consisting largely of recycled allegations and rumors) on Hunter Biden and Burisma issued by @SenRonJohnson and @ChuckGrassley is among today's hot topics.

cc: @ZellaQuixote Image
We download the first few hours' worth of tweets containing "Hunter Biden", #HunterBiden, or Burisma following the report's release, yielding 196168 tweets from 72724 accounts. Traffic largely doesn't look automated. Image
We've previously observed that accounts that participate in #MAGA retweet rooms tend to have a lot of tweets/retweets with more retweets than likes. We can use this to estimate the amount of the Biden/Burisma traffic that came from accounts in these rooms.
Read 7 tweets
23 Sep
Some of the accounts retweeted by the @sendthetrend botnet also have fake followers. We took a quick look at a network of accounts created in 2019 that followed @dk_alsabah en masse.

cc: @ZellaQuixote Image
The 2019-era fake followers following @dk_alsabah have neither tweeted nor liked a tweet, and all accounts have all lowercase first + last name display names. We explored the followers of other accounts they follow to find the rest of the network. ImageImageImageImage
We found 4220 accounts that we believe are part of this fake follower botnet, all created between March 31st and May 31st, 2020. Since none of these accounts has ever tweeted, there's obviously not much to analyze in terms of content. Image
Read 4 tweets
21 Sep
Sometimes suspicious accounts helpfully make themselves known by following you, and so it is with aspiring blue-check seller of shady social media services @sendthetrend.

cc: @ZellaQuixote
Interestingly, @sendthetrend swapped both mission and language after a 7 year hiatus. Back in 2013, it tweeted in English and promoted QVC merchandise. Fast-forward to 2020, and it has transformed into an Arabic-language account peddling fake engagement on Twitter and elsewhere.
Many of @sendthetrend's own tweets appear to be benefitting from artificial engagement. We found a group of 76 batch-created accounts with a mix of Arabic and Russian names retweeting it regularly via "Mobile Web (M2)". Are there more accounts that belong to the same botnet?
Read 9 tweets
19 Sep
The link in this "Looking to boost your #Followers?" tweet is dead, but the fake follower botnet the account that tweeted it belongs to is still around.

cc: @ZellaQuixote
We downloaded the followers of several of the accounts followed by @jonathanling209, and repeated the process on accounts followed by their followers. Many of these accounts were followed by hundreds or thousands of accounts created in bulk in 2018/2019 (the circled regions).
We found a total of 6882 accounts created in batches between March 2018 and February 2019, with the majority created in January 2019. Many of these accounts have never tweeted. Those which have did so exclusively via "Twitter Web Client".
Read 6 tweets
17 Sep
Check out all the love and blessings from Miami, Florida, also known as Ohio and Texas. #YouHadOneJob #Spamtastic

cc: @ZellaQuixote Image
The duplicate "blessings from Miami, Florida" tweets came from a network of ten accounts created on Sept 4 2020. These accounts tweet on nearly identical schedules, and almost all of their tweets (96.3%) are replies. Tweets are (allegedly) sent via various Twitter web products. ImageImageImageImage
These ten accounts have sent a multitude of repeated tweets in their two weeks on Twitter. The repeated tweets are a mix of generic pleasantries, praise for various cryptocurrency accounts, and attacks on a Massachusetts social worker. Image
Read 5 tweets
17 Sep
Oh hey, it's a ten-week old website called twitterfollowersbuy(dot)com selling fake Twitter followers. #WednesdayWisdom #SeemsLegit

cc: @ZellaQuixote
We contacted the "24/7 email address" on twitterfollowersbuy(dot)com's "About Us" page, and quickly received a response providing @alkalineph20 as an example of an account followed by the followers offered by the site. Almost all of its followers were created July 2020 or later.
To find more accounts that are likely part of this fake follower network, we downloaded followers of other accounts followed by @alkalineph20's followers, and checked for periods where most of the accounts' followers were created July 2020 or later (orange circled areas).
Read 7 tweets
15 Sep
Oh look, a bunch of duplicate tweets. What's up with that? #Spamtastic

cc: @ZellaQuixote Image
These particular duplicate tweets (and others) were posted by @SunnQuest123, @GodMgga, @barbwire975, and @Sunnquest123W, a quartet of accounts who in a total coincidence all follow each other (and each account's first followers are the previously created members of the network). ImageImageImage
The accounts in this network frequently duplicate both tweets and memes within and across accounts, with the text color/formatting on the memes occasionally changing. Three of four accounts are presently using variants on the same meme about voting as their pinned tweet. ImageImageImage
Read 5 tweets
14 Sep
In one of the more hilariously meta developments in recent Twitter botting history, retweet-to-win tweets from @SeigRobotics offering free access to some sort of Twitter botting tool are being retweeted by a bunch of bots. #MondayMotivation

cc: @ZellaQuixote ImageImage
We found 321 accounts that used one or more custom automation apps to retweet one or more of @SeigRobotics's recent tweets. We then looked at the retweets of other tweets those accounts had retweeted to find members of the same networks that haven't (yet) retweeted @SeigRobotics.
We found 49 groups of automated accounts (536 accounts total), each using a separate set of custom automation apps. (It's quite possible that there are fewer than 49 distinct botnets, as several of the smaller groups were created on the same day.) Image
Read 7 tweets
13 Sep
The wildfires presently burning in the Western USA have given rise to various conspiracy theories claiming that the conflagrations are an organized campaign of arson conducted by antifa, with a side of climate change denialism.

cc: @ZellaQuixote
We downloaded recent tweets containing "arson", "arsonist", or "arsonists", yielding 267136 tweets from 169105 accounts. The traffic largely doesn't look automated, but the accounts involved are disproportionately 2020 creations.
Retweet network for recent tweets containing arson/arsonist/arsonists. The largest cluster consists of right-wing accounts, most of which are putting forth the proposition that the wildfires are an act of political violence by antifa.
Read 8 tweets
11 Sep
What's with all these accounts linking the same boat parade YouTube video at the exact same time? #Spamtastic #FridayFeeling?

cc: @ZellaQuixote Image
Answer: a botnet, consisting of 12 accounts with nearly identical tweet schedules linking YouTube videos via Plume for Android. This botnet has shared 640 different YouTube videos since June 1st 2020, all but one of which was tweeted by all 12 accounts. ImageImageImage
Did we mention that these 12 accounts are tweeting on nearly identical schedules? On average, all 12 accounts tweet each YouTube video over a span of 5 seconds (tables show the most recent examples as of the time we pulled data). ImageImageImageImage
Read 6 tweets
11 Sep
It's a Thursday, and a verified Twitter account by the name of @moekittaneh (permanent ID 47313068) with a couple thousand batch-created fake followers could be yours for $850.

cc: @ZellaQuixote
The oldest 423 of the batch-created accounts following @moekittaneh also follow @moretweeple, an account that was offering followers for sale via a now-defunct website back in 2012.
We found a total of 2319 accounts that we believe to be part of the @moretweeple fake follower network, all created in batches in 2011/2012. Most have never tweeted; the 437 that have sent repetitive tweets via various Twitter web products, with follower gain being a major theme.
Read 5 tweets
10 Sep
Sometimes one runs across bots (automated accounts) that do multiple seemingly unrelated things, and @yasoo79644697oo is an example. Its most obvious behavior is retweeting tweets containing the word "neoliberal", which it has done at least 1597 times.

cc: @ZellaQuixote
Another notable feature of @yasoo79644697oo's Twitter timeline: tweets promoting a variety of Android apps, complete with Google Play Store download links. Several are Twitter automation tools, offering amazing features such as following 100 accounts with a single click.
Each type of tweet posted by @yasoo79644697oo is sent via a different app. The "neoliberal" retweets are tweeted via custom app called "IntelligentAutoUnfollowSetting", while the Android app promo tweets use automation service twittbot(dot)net.
Read 5 tweets
9 Sep
The Japanese-language pornbot network described in this June 2020 thread has been shut down by Twitter, but a replacement appears to have arisen and (like its predecessor) is soliciting DMs. #TuesdayThoughts

cc: @ZellaQuixote Image
We found 614 accounts that we believe to be part of this botnet. All were created between July and September 2020 and have 8 character account names consisting of digits and lowercase letters (previous botnet used 7-char account names), follow 0 accounts, and have liked 0 tweets. ImageImage
Almost all of this network's tweets were hypothetically sent via "Twitter Web Client" (which usually denotes the no-longer-available old version of the Twitter website). Nearly all accounts use anime/manga profile pics, sometimes duplicated across accounts. ImageImage
Read 4 tweets
7 Sep
#FBR lists are a perennially popular technique for gaining resistance followers, which also makes infiltrating them a perennially popular technique for folks who want to gain resistance followers under false pretenses. (The same is true of #MAGA trains, btw.)

cc: @ZellaQuixote Image
We downloaded the most recent 200 tweets from each of 15402 accounts listed on #FBR/#FBRParty/#Resist followback lists since Aug 1st 2020, and looked for accounts that retweeted #MAGA accounts, foreign autocrats, or random spammers. Here are some of the more interesting ones. . . Image
First up: @ABirkshire, which transformed from #BlueWave2020 Democrat to enthusiastic Trump supporter in under two months, and is now being promoted on #MAGA trains. In that same time, it also went from knowing nothing about #QAnon to being a devotee/self-styled expert. ImageImageImageImage
Read 7 tweets
5 Sep
For $800, you could be the proud new owner of @coisasqncompro (permanent ID 1221072227120156674), an automated account with 277K followers that mostly tweets pictures. As it turns out, this account is part of a botnet. #SaturdaySpam

cc: @ZellaQuixote ImageImage
We found a total of 27 accounts tweeting via "Twitter for me memso". Almost all were created in 2019 or 2020, and most have massive numbers of followers. This botnet recently switched automation tools - prior to Aug 10 2020 most tweets were sent via "Jeito". ImageImageImage
The automated tweets sent by this network are pretty much all images and videos, many of which (unsurprisingly given the large number of followers) receive large numbers of retweets and likes. Image
Read 6 tweets
2 Sep
#PelosiMustGo trended for several hours yesterday (September 1st, 2020). We downloaded recent tweets containing the hashtag as of ~8 PM PDT, yielding 44274 tweets from 26160 accounts. Very little of the traffic looks automated.

cc: @ZellaQuixote Image
Yesterday's #PelosiMustGo trend appears to be inspired by surveillance video released by Fox News of Nancy Pelosi at a hair salon. This is, however, not the first time this hashtag has gotten traction. ImageImage
#PelosiMustGo first achieved noticeable volume Feb 4 2020, thanks to #MAGA accounts outraged at Pelosi's destruction of her copy of Trump's SOTU speech. The hashtag first trended in July, due to a mix of #MAGA accounts and supporters of Pelosi's Dem challenger, @ShahidForChange. ImageImageImage
Read 7 tweets
2 Sep
What's up with all these similarly-named automation apps being used to retweet Japanese #cryptocurrency account @hikari1985? #TuesdayThoughts

cc: @ZellaQuixote Image
We found a total of 170 accounts using custom apps with names of the form ABC-123-XYZ to retweet various Japanese tweets. Many of these accounts also use either twittbot(dot) or various custom apps to post occasional original tweets. ImageImageImageImage
Almost all of the tweets posted by this network (192925 of 193602 tweets, 99.7%) are sent via automated means, and the accounts are active 24/7. 86.2% of the content is retweets (sent via the ABC-123-XYZ apps), and the remainder is original tweets (all other apps). ImageImageImage
Read 5 tweets
1 Sep
The network described in this thread has grown and evolved somewhat in the 25 days since we posted it, and has amplified @ARTEM_KLYUSHIN's latest batch of tweets, including one containing #QAnon slogan "ENJOY THE SHOW" accompanied by Trump in a Guy Fawkes mask.

cc: @ZellaQuixote Image
We found 145 accounts that retweeted or replied to @ARTEM_KLYUSHIN's recent tweets that appear to be part of the network. Most accounts have their profile location set to somewhere in the USA or UAE. ImageImageImageImage
By exploring the follow relationships of the 145 accounts that interacted with @ARTEM_KLYUSHIN's tweets, we found 445 accounts that we believe to be part of this bot/sock network. Accounts are grouped into (mostly) distinct clusters of accounts that all follow each other. Image
Read 9 tweets
31 Aug
#BidenRiots has been trending off and on since the wee hours this morning (August 30th, 2020). How'd that come about?

cc: @ZellaQuixote
We downloaded tweets containing #BidenRiots at roughly 8:30 PDT today (8/30), yielding 35222 tweets from 22924 accounts. Almost all the traffic is from the last 2 days, although the hashtag has been around since late May. The accounts are disproportionately recent creations.
#BidenRiots appears to have first been used on May 30, 2020, by @SteakPope who quote-tweeted congressional candidate @RealErinCruz with it. @Ocrazio1 was a prolific user of the hashtag, tweeting it a total of 538 times, but went silent 4 days ago.
Read 5 tweets