Josh Russell Profile picture
Mar 23, 2018 45 tweets 22 min read Twitter logo Read on Twitter
Going to try to tweet this as I work through it. Someone out there doesn't like facebook. At least 3-4 different freshly minted botnets are retweeting anything with the #DeleteFacebook hashtag.
#Bot #TwitterBots
the 1st "set" of bots is very similar to the elon musk cryptocurrency scammer bots that are running wild on twitter.
they are retweeting everything this account tweets:
there are about 3200 accounts in this "network" and it looks like a cryptocurrency pump and dump scam that maybe happened to RT the hashtag., not exactly sure yet.
All the accounts created in the last few days, all of them with the same stats:
That many accounts created in 3-4 days just proves one thing, twitter has no idea how to stop automatic account creation.
what the accounts mostly "look" like:
next up:
kinda a funny one, this company offered to delete it's facebook if it got 1000 RT's and someone unleashed a botnet on it:
and they actually deleted it based on what they probably thought was organic interactions: never trust polls, petitions, or anything that can be gamed by bots online. they are all lies.
330 accounts that I can see right now that did this.
Again all made within the last few days.
All the accounts have the same 'stats".
this one is really interesting because it got hit by a botnet of new accounts and one of old accounts that are VERY similar to some internet research agency account both me(i tagged em 1st 😀) buzzfeed found @flashboy @jamesrbuk buzzfeed.com/tomphillips/we…
data that looks like this is NOT a coincidence.
Organic twitter data will never look like this.
Accounts made in the same time frame doing the same thing, i need to look at the accounts more but there is something going on here:
next up about 139 fresh bot accounts retweeted this:
and this:
all of them made over the last few days:
i would say probably these are all connected.
one of the tweets those accounts all RTed.
kinda hard to tell what the purpose of these bots is.
next "set" fresh bots. 40+ that retweeted this tweet.
(all of these bots could be the same network i don't exactly know yet)
the last "set" are these bots that don't do anything but tweet articles from the guardian using a shortlink, there are only 17 of them that I have found.
these are some odd bots....
google sheet available here with all 3660 bots info and a clickable url for each bot docs.google.com/spreadsheets/d…
The data file for a timeline pull is to large to put onto google sheets.
Here is a CSV you can download that has the accounts timeline pull.

storage.googleapis.com/ru_accounts/de…
Here is the initial data pull for the #DeleteFacebook hashtag storage.googleapis.com/ru_accounts/%2…
some updates on these bots:
The #deletefacebook Hashtag Is Being Targeted By Bots, Porn Accounts, And Cryptocurrency Hustlers buzzfeed.com/janelytvynenko… via @janelytv
after an inquiry by buzzfeed there are only 5 left.
3655 accounts suspended.
after looking at the timeline data for all the accounts there ended up being 2 main sets of bots.
one setup to boost visibility of the tron cryptocurrency.
They overwhelmingly did one thing, retweeted #@justinsuntron
in the bots spare time they retweeted @realDonaldTrump
some right wing conspiracy accounts
and in a very russian thing to do they retweeted @RealJamesWoods who was a HUGE fan of the internet research agency (He retweeted IRA accounts constantly )
not sure what this is but the bots retweeted it:
the most popular tweets with those bots:
As usual @TwitterSafety phones it in. Do engineers even work at the place?
There are STILL at least 5000 more of these bots that haven't been suspended.
All created between 3/18 and TODAY.
They are creating accounts faster than twitter can ban them.
@JaneLytv @cwarzel
Twitter didn't think this tweet getting 1200 retweets was suspect at all???
this is very easy:

1. ANY account that follows or retweets @justinsuntron or @Tronfoundation IS PROBABLY BOT
2. ANY account that retweeted these tweets IS A BOT.
3. ANY account that retweeted these tweets, you guessed it: BOTS
another 5693 bots #TRON #cryptocurrency #bots
google sheet with clickable links
docs.google.com/spreadsheets/d…
As of this morning there are almost 15000 (14897) of these bots.
I've updated the spreadsheet above.
Whoever is running them has the ability to create almost 3500 accounts PER DAY.
They have made 192 just since midnight.
Just updated the main bot list here, there are now 16000 of these bots. docs.google.com/spreadsheets/d…
update: twitter suspended about 15800 of the bots yesterday.
unfortunately the bots are still being created, there are 2000 new ones already.
they are "restricting" them now so that's good.
this account was made just 30 minutes ago.
i've updated the main list with the 2k new bots at the bottom.
so far they have created 22000 bots over the last week.
Just out of curiosity i did a check this morning and found the botnet owners had created another 5000 accounts already.
I did a timeline pull on the bots to see what they have been tweeting.
of note here @BeltwayPundit @realDonaldTrump @RealJamesWoods and @justinsuntron
After doing a check on the retweets of about 30 of these tweets, i can add another 38425 twitter #bots to this network.
with the newest one created about an hour ago.
that brings the grand total to 60820 bots created from march 1st until now.
updated the main spreadsheet with all 60k bots, had to drop the 'ID' column due to excel not handling large numbers well
docs.google.com/spreadsheets/d…
accounts created per day, i'm sure that due to twitter's api limitations this is missing about 70% of the bots.

• • •

Missing some Tweet in this thread? You can try to force a refresh
 

Keep Current with Josh Russell

Josh Russell Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @josh_emerson

Oct 5, 2018
The flow of russian disinformation, and how russian cyber warfare works:

GRU hacks, russian media writes about it, russian bots take to twitter.

The bots I am looking at tweeted about "Cyber Berkut".

ncsc.gov.uk/news/reckless-…
GCHQ attributes Cyber Berkut to GRU.

In just what happened to be an odd coincidence I happened to be looking at russian bots when @rob_barry did a thread about "CyberCaliphate"
At some point in march 2014 after the russian invasion of crimea GRU setup Cyber Berkut and started attacking various Ukrainian infrastructure and websites.
motherjones.com/politics/2014/…
Read 24 tweets
Sep 17, 2018
There is definitely something going on.
If you look around twitter there are some very "odd" accounts.

#Macedonia #RussianMeddling #Russia #Skopje
apnews.com/b51d832612784b…
These tweets seem weird to me.
One uses a #QAnon hashtag.
Read 16 tweets
Aug 25, 2018
There are more of these thread.

Suspected Iranian Influence Operation Leverages Network of Inauthentic
News Sites & Social Media Targeting Audiences in U.S., UK, Latin
America, Middle East
fireeye.com/blog/threat-re…
we got 9 urls from FireEye's report.
and I had flagged another 13 back in march.

Mostly due to these reddit users:
/u/Mike_Rubin
/u/AllenDono
/u/finalin
/u/KevanKing
/u/Pazaj
/u/erickiskandar
Most of these sites share OR shared a common host at some point in time.
AS24940 hetzner[.]com
Read 61 tweets
Aug 4, 2018
Quick thread about a small set of bots I ran into this morning. Every once in a while I randomly check the @SecureDemocracy dashboard it's usually the same things. Today #WeAreCorbyn popped up. Figured I would check it out. #Botspot #Russia #KremlinTrolls
Tweeting this kinda as I go.
1st thing pull data on the hashtag.
visual studio code, python, and tweepy.
I only pulled about 40k tweets, not that many.
next step is to crack open that .csv file and remove all the duplicate accounts leaving only one row per account.
Then start sorting. IF there is a pattern you will notice it almost immediately.

Here 16 accounts show up with the same stats, sorted by tweet source. Bots.
Read 11 tweets
Aug 1, 2018
From the Senate Intelligence hearing on social media and foreign influence
intelligence.senate.gov/sites/default/…
websites they linked to:
some of these are new.
.ihavethetruth.com was for sure russian
securitytrails.com/domain/ihaveth…
It sat on a Choopa, LLC's server before being moved to cloudflare
Read 24 tweets
Jul 31, 2018
We have asked every social media platform for months now to take action @Reddit, @facebook, @Twitter will only do something after someone gets killed.

Michael Avenatti Targeted in Person by QAnon, the Crazy Pro-Trump Conspiracy Theory thebea.st/2M3HFig?source… via @thedailybeast
Facebook right now:
Reddit:
Read 11 tweets

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Don't want to be a Premium member but still want to support us?

Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us on Twitter!

:(