We downloaded recent tweets linking to futuredanger(dot)com and found a network of 16 automated accounts dedicated to promoting the site. Each account tweets via its own custom app, accompanied by occasional organic tweets from @FutureDanger6.
The @FutureDanger6 account appears to be the hub of the network, and is mutual followers with the other 15 accounts (none of which follow any account other than @FutureDanger6).
We found a total of 80 accounts that fit the pattern, created between August 31st and September 21st, 2020. All are low volume and mostly tweet via Mobile Web (M2), with occasional tweets sent via Twitter Web App.
There doesn't appear to be any particular pattern to the content of Instagram and Facebook pages. Some are empty or don't exist, some are random small accounts, and some are major influencers.
We download the first few hours' worth of tweets containing "Hunter Biden", #HunterBiden, or Burisma following the report's release, yielding 196168 tweets from 72724 accounts. Traffic largely doesn't look automated.
We've previously observed that accounts that participate in #MAGA retweet rooms tend to have a lot of tweets/retweets with more retweets than likes. We can use this to estimate the amount of the Biden/Burisma traffic that came from accounts in these rooms.
The 2019-era fake followers following @dk_alsabah have neither tweeted nor liked a tweet, and all accounts have all lowercase first + last name display names. We explored the followers of other accounts they follow to find the rest of the network.
We found 4220 accounts that we believe are part of this fake follower botnet, all created between March 31st and May 31st, 2020. Since none of these accounts has ever tweeted, there's obviously not much to analyze in terms of content.
Interestingly, @sendthetrend swapped both mission and language after a 7 year hiatus. Back in 2013, it tweeted in English and promoted QVC merchandise. Fast-forward to 2020, and it has transformed into an Arabic-language account peddling fake engagement on Twitter and elsewhere.
Many of @sendthetrend's own tweets appear to be benefitting from artificial engagement. We found a group of 76 batch-created accounts with a mix of Arabic and Russian names retweeting it regularly via "Mobile Web (M2)". Are there more accounts that belong to the same botnet?
We downloaded the followers of several of the accounts followed by @jonathanling209, and repeated the process on accounts followed by their followers. Many of these accounts were followed by hundreds or thousands of accounts created in bulk in 2018/2019 (the circled regions).
We found a total of 6882 accounts created in batches between March 2018 and February 2019, with the majority created in January 2019. Many of these accounts have never tweeted. Those which have did so exclusively via "Twitter Web Client".
The duplicate "blessings from Miami, Florida" tweets came from a network of ten accounts created on Sept 4 2020. These accounts tweet on nearly identical schedules, and almost all of their tweets (96.3%) are replies. Tweets are (allegedly) sent via various Twitter web products.
These ten accounts have sent a multitude of repeated tweets in their two weeks on Twitter. The repeated tweets are a mix of generic pleasantries, praise for various cryptocurrency accounts, and attacks on a Massachusetts social worker.
We contacted the "24/7 email address" on twitterfollowersbuy(dot)com's "About Us" page, and quickly received a response providing @alkalineph20 as an example of an account followed by the followers offered by the site. Almost all of its followers were created July 2020 or later.
To find more accounts that are likely part of this fake follower network, we downloaded followers of other accounts followed by @alkalineph20's followers, and checked for periods where most of the accounts' followers were created July 2020 or later (orange circled areas).
These particular duplicate tweets (and others) were posted by @SunnQuest123, @GodMgga, @barbwire975, and @Sunnquest123W, a quartet of accounts who in a total coincidence all follow each other (and each account's first followers are the previously created members of the network).
The accounts in this network frequently duplicate both tweets and memes within and across accounts, with the text color/formatting on the memes occasionally changing. Three of four accounts are presently using variants on the same meme about voting as their pinned tweet.
In one of the more hilariously meta developments in recent Twitter botting history, retweet-to-win tweets from @SeigRobotics offering free access to some sort of Twitter botting tool are being retweeted by a bunch of bots. #MondayMotivation
We found 321 accounts that used one or more custom automation apps to retweet one or more of @SeigRobotics's recent tweets. We then looked at the retweets of other tweets those accounts had retweeted to find members of the same networks that haven't (yet) retweeted @SeigRobotics.
We found 49 groups of automated accounts (536 accounts total), each using a separate set of custom automation apps. (It's quite possible that there are fewer than 49 distinct botnets, as several of the smaller groups were created on the same day.)
The wildfires presently burning in the Western USA have given rise to various conspiracy theories claiming that the conflagrations are an organized campaign of arson conducted by antifa, with a side of climate change denialism.
We downloaded recent tweets containing "arson", "arsonist", or "arsonists", yielding 267136 tweets from 169105 accounts. The traffic largely doesn't look automated, but the accounts involved are disproportionately 2020 creations.
Retweet network for recent tweets containing arson/arsonist/arsonists. The largest cluster consists of right-wing accounts, most of which are putting forth the proposition that the wildfires are an act of political violence by antifa.
Answer: a botnet, consisting of 12 accounts with nearly identical tweet schedules linking YouTube videos via Plume for Android. This botnet has shared 640 different YouTube videos since June 1st 2020, all but one of which was tweeted by all 12 accounts.
Did we mention that these 12 accounts are tweeting on nearly identical schedules? On average, all 12 accounts tweet each YouTube video over a span of 5 seconds (tables show the most recent examples as of the time we pulled data).
The oldest 423 of the batch-created accounts following @moekittaneh also follow @moretweeple, an account that was offering followers for sale via a now-defunct website back in 2012.
We found a total of 2319 accounts that we believe to be part of the @moretweeple fake follower network, all created in batches in 2011/2012. Most have never tweeted; the 437 that have sent repetitive tweets via various Twitter web products, with follower gain being a major theme.
Sometimes one runs across bots (automated accounts) that do multiple seemingly unrelated things, and @yasoo79644697oo is an example. Its most obvious behavior is retweeting tweets containing the word "neoliberal", which it has done at least 1597 times.
Another notable feature of @yasoo79644697oo's Twitter timeline: tweets promoting a variety of Android apps, complete with Google Play Store download links. Several are Twitter automation tools, offering amazing features such as following 100 accounts with a single click.
Each type of tweet posted by @yasoo79644697oo is sent via a different app. The "neoliberal" retweets are tweeted via custom app called "IntelligentAutoUnfollowSetting", while the Android app promo tweets use automation service twittbot(dot)net.
The Japanese-language pornbot network described in this June 2020 thread has been shut down by Twitter, but a replacement appears to have arisen and (like its predecessor) is soliciting DMs. #TuesdayThoughts
We found 614 accounts that we believe to be part of this botnet. All were created between July and September 2020 and have 8 character account names consisting of digits and lowercase letters (previous botnet used 7-char account names), follow 0 accounts, and have liked 0 tweets.
Almost all of this network's tweets were hypothetically sent via "Twitter Web Client" (which usually denotes the no-longer-available old version of the Twitter website). Nearly all accounts use anime/manga profile pics, sometimes duplicated across accounts.
#FBR lists are a perennially popular technique for gaining resistance followers, which also makes infiltrating them a perennially popular technique for folks who want to gain resistance followers under false pretenses. (The same is true of #MAGA trains, btw.)
We downloaded the most recent 200 tweets from each of 15402 accounts listed on #FBR/#FBRParty/#Resist followback lists since Aug 1st 2020, and looked for accounts that retweeted #MAGA accounts, foreign autocrats, or random spammers. Here are some of the more interesting ones. . .
First up: @ABirkshire, which transformed from #BlueWave2020 Democrat to enthusiastic Trump supporter in under two months, and is now being promoted on #MAGA trains. In that same time, it also went from knowing nothing about #QAnon to being a devotee/self-styled expert.
For $800, you could be the proud new owner of @coisasqncompro (permanent ID 1221072227120156674), an automated account with 277K followers that mostly tweets pictures. As it turns out, this account is part of a botnet. #SaturdaySpam
We found a total of 27 accounts tweeting via "Twitter for me memso". Almost all were created in 2019 or 2020, and most have massive numbers of followers. This botnet recently switched automation tools - prior to Aug 10 2020 most tweets were sent via "Jeito".
The automated tweets sent by this network are pretty much all images and videos, many of which (unsurprisingly given the large number of followers) receive large numbers of retweets and likes.
#PelosiMustGo trended for several hours yesterday (September 1st, 2020). We downloaded recent tweets containing the hashtag as of ~8 PM PDT, yielding 44274 tweets from 26160 accounts. Very little of the traffic looks automated.
Yesterday's #PelosiMustGo trend appears to be inspired by surveillance video released by Fox News of Nancy Pelosi at a hair salon. This is, however, not the first time this hashtag has gotten traction.
#PelosiMustGo first achieved noticeable volume Feb 4 2020, thanks to #MAGA accounts outraged at Pelosi's destruction of her copy of Trump's SOTU speech. The hashtag first trended in July, due to a mix of #MAGA accounts and supporters of Pelosi's Dem challenger, @ShahidForChange.
We found a total of 170 accounts using custom apps with names of the form ABC-123-XYZ to retweet various Japanese tweets. Many of these accounts also use either twittbot(dot) or various custom apps to post occasional original tweets.
Almost all of the tweets posted by this network (192925 of 193602 tweets, 99.7%) are sent via automated means, and the accounts are active 24/7. 86.2% of the content is retweets (sent via the ABC-123-XYZ apps), and the remainder is original tweets (all other apps).
The network described in this thread has grown and evolved somewhat in the 25 days since we posted it, and has amplified @ARTEM_KLYUSHIN's latest batch of tweets, including one containing #QAnon slogan "ENJOY THE SHOW" accompanied by Trump in a Guy Fawkes mask.
We found 145 accounts that retweeted or replied to @ARTEM_KLYUSHIN's recent tweets that appear to be part of the network. Most accounts have their profile location set to somewhere in the USA or UAE.
By exploring the follow relationships of the 145 accounts that interacted with @ARTEM_KLYUSHIN's tweets, we found 445 accounts that we believe to be part of this bot/sock network. Accounts are grouped into (mostly) distinct clusters of accounts that all follow each other.
We downloaded tweets containing #BidenRiots at roughly 8:30 PDT today (8/30), yielding 35222 tweets from 22924 accounts. Almost all the traffic is from the last 2 days, although the hashtag has been around since late May. The accounts are disproportionately recent creations.
#BidenRiots appears to have first been used on May 30, 2020, by @SteakPope who quote-tweeted congressional candidate @RealErinCruz with it. @Ocrazio1 was a prolific user of the hashtag, tweeting it a total of 538 times, but went silent 4 days ago.