Someone created a botnet on 3 million accounts, and Twitter didn’t even blink

Experts SadBotTrue found, according to their data, the largest operating botnet on Twitter: three million accounts, closed from the views of outsiders, have up to three million subscribers and the same name sfa_2000000000. To create such a network in 2014, someone has reserved 180 million Twitter ID.



Three million bots on Twitter with the same name and description, closed tweets, not associated with live accounts. Statistics can not be viewed. To discover this network, SadBotTrue used its own tools and methods for analyzing big data. Username - name, description - some kinda description. It is difficult to think of a situation in which three million similar accounts of the same type belong to three million real people.

The user under the nickname sfa_2000000000 has almost three million subscribers and 182 thousand tweets. If you look at the next account in order, sfa_2000000001, we will see a page with 34 followers, but with 97 thousand tweets. The same results are waiting for us if we randomly review accounts from sfa_2000000000 to sfa_2002999999.
')
According to specialists, the entire botnet has made 2.6 billion tweets and retweets since its inception. Now Twitter users publish about 500 million tweets per day. That is, the botnet made the same amount of messages that all Twitter users have been doing for five days.



But the most interesting thing is the coincidence of the logins of the bots with their Twitter ID. You can check the identifier using this service ; it cannot be done before registering. Therefore, in this case there are two options: someone has registered accounts, received an ID and changed nicknames, or was initially registered with the appropriate name. The first option is unlikely, given that we are talking about three million names of the same type - it will be difficult to guess.



Experts have found gaps in the reservation ID. In addition to the described botnet, there were two other types of accounts associated with the identifier: cas_2050000000 - cas_2050099999 and wt_2050100000 - wt_2050199999. Cas were registered from March 3 to 5, 2015, and wt from October 23 to November 22, 2014.

Sfa was registered from March to April 2014, although SadBotTrue writes for an unknown reason about a specific date: April 17, 2014.

Someone was able to reserve 168 million IDs at a time. This should be a person with admin rights or even superadmin. Reserved identifiers are not available for new registrations.



And once again briefly:

1. There are three million closed accounts with 2.6 billion tweets.
2. Someone has reserved 168 million Twitter ID.
3. 3 million accounts were registered on the same day (this item of SadBotTru research is in doubt).
4. 3 million accounts were selected by ID from 168 million reserved.
5. Each account nickname contains 10 digits user ID.
6. ID is not possible to register before registration.
7. The most active of accounts is sfa_2002997030 with 476,990 tweets and one follower.
8. The most active follower is sfa_2000000004, subscribed by 1.27 million users.

SadBotTrue at the end of the publication asks a few questions:

1. Why do I need to reserve 168 million ID?
2. Why create a botnet with an ID in the name?
3. Why are identifiers reserved in October 2013?
4. Why these three million accounts have posted 2.6 billion tweets?
5. Why and 168 million used only 3 million ID?
6. How does the size of the botnet relate to the destination for which it was created?

I have only one idea: the entire botnet was created by the Twitter employees themselves, and they did it for unknown working purposes. What do you think?