How I found 75k Twitter Bot Accounts

I found around 75k twitter bot accounts. How? I went to the trending tab.

Really. That’s all I did.

I went to the trending tab because I was curious what the current events were, seeing that some had higher than normal tweets. I saw that there was something about truckers and Canada. After expanding the view, I see it’s about a vaccine mandate or something.

Enter the (usual) crazies.

I see a tweet by someone named clif that has some outlandish take, so I chuckle as I open to see the profile and read some other hot takes with no other objective than to laugh at the ridiculousness and more than likely report some for disinformation.

Score.

Colbert is promoting the vaccine and {the vaccine} is killing people.

Scrolling down, I take a peek at the replies to see what the other parrots are squaking about. But something was different than the usual insanity. Different than the couple bots i’ve seen. Gone are the days if the old (and mostly harmless, as you would have to be dumber than a box of rocks to fall for it) SEXY HOT GIRL profiles. Those innocent bot days are done. What I see are accounts where all they do is tag one another.

So many tweets of the same thing

There are so many that it would be a waste of time to report them all. I copy their mentions and paste them into the text file and do some searching for someone to contact about this. I could not find anyone. Nothing through their help portal, no specific email, no employee in Safety that has DMs open, nothing. I message a couple people in varying jobs/positions who do have DMs open asking if they have a contact. At this point I had not heard back from any.

Infatuated with what I am seeing, I open up a couple more accounts. Same spammy posts tagging more and more accounts. Copied them into a notepad. I noticed that a couple of the same accounts were getting tagged, so I ran the list through a deduplicator. About HALF of the accounts were duplicates. They are all linking back to each other and the connection web between the accounts is starting to look like a giant tumbleweed. The more accounts I copied and checked, the more the web grew in the same pattern.

The Taggers

Some of the accounts exist only to retweet other accounts. Some seemingly exist only to tag. The ‘Taggers’ do their job in some interesting patterns.

Some sort the mention by length. Some sort it a little wavy and wacky. Some go on ‘Follow Trains’ that somehow related to some random picture? Some took a break from political stuff and used some nice roses. This one has a picture of some attractive military guy.

The picture of Mr. Military seems… off. It looks like a picture taken in 2014 with an iPhone 4 and some crusty photo app filter. Let’s reverse image search. Oh! A Result! It shows a photo from postimg.cc so let’s see the context. Well hello there Mr. Military, or should I call you eSln_hQ_(1).

Most of these accounts have the same number of followers as following, which is usually my first red flag if an account is a bot. It is surprisingly accurate.

The Posters

These big shots make the content for all the other accounts to retweet. Nearly all of it is political, but let’s go through some popular themes. They do stay up to date with the latest topics, although I did not go far back as each account has TENS OF THOUSANDS of tweets. Today’s theme is Canada and Justin Trudeau and the Protesting Truckers, although a few days ago it was about people trying to ‘silence Joe Rogan’.

Fill in the blank with your favorite example!

• Donald Trump is _________ [amazing, my president, the rightful president, godlike, perfect, a man of class, anointed by God, the best president]

• Joe Biden is _________ [senile, old, dumb/stupid, the worst president, just Hillary Clinton with a penis (sfw) ]

• The Pandemic is _________ [fake, communism, planned, man made, made by Fauci, made by Bill Gates, bad because Fauci lied people died]

• Trudeau is _________ [a coward, scared of the protesting truckers, gay, a nazi, a gay nazi]

• Abortion is _________ [evil, murder, something democrats want, a life lost, etc.]

• I am a woman who _________ [is conservative, loves trump, has boobs and guns]

• The Covid Vaccine is _________ [Poison, evil, communism, has nanobots (from our old friend clif)]

There is a superstar account that has 73.5 thousand followers and a stock photo profile picture. Same generic, same poor grammar, and same poor formatting in the header. Same content as the rest of them. Content that has been reposted so many times you can almost count the pixels.

Side Note

Speaking of Clif, the account tweeted a suspicious a link to an image. The image is just a pr picture from Biden’s twitter account for Chinese New Year with some poorly added text at the top that doesn’t really make sense.

I was not interested in that. There was an IP address that I can check. Turns out the address is used by a company called ‘ColoCrossing’ and then used by a hosting provider called ‘racknerd.asia’, and according to .asia’s tld operator you have to be affiliated with an asian country in order to register. In fact the IPs that ColoCrossing have used were found annoying and spamming networks as far back as 2013.

Things are starting to make a little more sense! This is just your standard, run of the mill, average Chinese disinformation bot network that is taking over old accounts with compromised passwords. I say China, because they are statistically the most likely and have done this kind of thing many, many, many, times before. I don’t know for sure, but it’s a very good starting point.

The Repliers

Almost every single tweet has a reply from another bot. Nearly every reply has an image. Now tell me why each reply the account to thanking them for their post as they quote retweet with a generic image watermarked with their own username.

C’mon buddy, you have 40 thousand followers and can only get a single retweet on your reply? That’s a pretty bad engagement rating right there. Look at this edgy bad boy with the illegible font..webp) What a nice young lady in a pretty forest. She must let you know that she retweeted you.

More examples: [1] [2] [3] [4]

The further you go down the rabbit hole, the weirder it gets. Princess Diana and Trumps and Yellow Dress = 157. While the replies continue the gibberish.

There are a couple examples of the phrase or acronym IFAPB/IFBAP/IFBP being used. A web search doesn’t bring up anything useful, but a twitter search brings up more bot accounts with similar posting and retweeting habits as the rest. Are the accounts using Optical Character Recognition on the photos to find other accounts along with tagging them and using hashtags? Or even spookier, sending secret messages in public through the images? Am I now the main character in a spy movie against a vague foreign threat where I have to decrypt the messages to save America?

Cue the guns and fireworks and explosions while I proudly wave the flag of the USA in one hand with a rocket launcher in the other ready to defend the country

What? It’s just some stupid twitter accounts? Oh. ok. sorry. I got a little ahead of myself.

Footnotes

Here are some images that I didn’t include above that I still think are so bizarre that they are funny or more examples.
[Neil Young’s Boss is Pfizer]
[Blackface Elizabeth Warren??]
[Totally real person has totally legitemate heart problems after the pfizer vaccine]
[More Canada Trucker support]
[Covid swabs are now radioactive (ft. someone who doesn’t know how a geiger counter works trying to fake one)]
[anti-vax stance by this one]
[The funniest use of this meme format]
[Saying someone is fake pregnant because you can see their bra]
[Not exactly inconspicuous when you use ‘Mr Villan Quotes’]
[Close your DMs then?]
[Hot new style: Fauci Freedom Flip-Flops]
[Ani]-[morphs]