Read on Twitter
First, how did we get the profiles of all the accounts created over a 65-hour period? Twitter accounts have a permanent ID number, and those numbers back in the old days were assigned sequentially. We started with ID 589064281, and iterated backward, yielding 1493942 accounts.
We can then look for old bot/sock networks by scanning the profiles for patterns such as repeated bios. The most common bio ("Hi, I like football and Twitter. I have over 10 years experience about HR and management") is used by 51 mostly empty accounts; only 2 have tweeted.
Likewise, "Pejabat Rela Daerah Kota Kinabalu,Sabah UNIT MEDIA RELA NABAWAN38" (and variants thereof with differing capitalization) is the profile bio used by a batch of accounts that have thus far never tweeted. Some of these networks have been more active, though. . .
26 accounts with curiously similar names chose "Site gratuit permettant de publier les annonces de conférences, de manifestations culturelles, sportives, ou commerciales et leur diffusion par Twitter" as their bio, and these actually tweeted, albeit sparingly.
These 26 accounts (along with @WeekEndInfos, created earlier) appear to have been created to promote an iPhone app back in 2012. The app in question is no longer available on Apple's App Store, and the accounts have been silent for years.
The next network we looked at contains substantially more accounts using multiple repeated bios. Identifying characteristics:
- account name is @/First_Last, display name is "First Last"
- most accounts have few or no tweets; one or two with each biography have decent volume
- account name is @/First_Last, display name is "First Last"
- most accounts have few or no tweets; one or two with each biography have decent volume
We found 192 different profile biographies in use by this network, for a total of 2811 accounts. There may be additional accounts fitting the pattern that were created outside of the timespan we studied.
Not all of these 2811 accounts have tweeted, but the 822 that did used a variety of apps to post, most of them automated. Curiously, all the hypothetically "organic" tweets were sent via the Twitter website - no iPhone or Android app.
Do the accounts in this botnet repeat tweets? They sure do (in multiple languages), but each account tweeted any given tweet only once; repetition is only present across accounts. Most tweets link websites, with a variety of sites in the network's repertoire.
Finally, we have a dormant network consisting of 47 accounts whose bios are variants on "I <verb of appreciation> Sex but you can't/cannot have me :)". You can, however, potentially have malware if you click their links, so we advise against it.
We could easily add dozens (possibly hundreds) more networks to this thread based on profile bio repetition (and other patterns) in the accounts created over the ~3 day timespan we sampled, but these should suffice as proof-of-concept for the technique.
Footnote regarding account/tweet IDs: The system used for newer IDs is more complex and results in larger numbers; we explored it a bit in this older thread. Accounts IDs seem to have used the old system 'til mid-2012, after which it was slowly phased out. https://twitter.com/conspirator0/status/1227063249440509952?s=20
Tweepy for most of the (Twitter) data gathering, bokeh (usually) for visualization.
