Flashback Friday: Taxi!
The curious case of a now-defunct political retweet botnet with a fondness for taxis and real estate
This post is a brief journey back in time to 2019, when multiple Democratic hopefuls were launching their bids for the U.S. presidency, X was still named Twitter, and a network of taxi and real estate-themed social media accounts prolifically boosted political content on the aforementioned platform by automated means. While these accounts theoretically existed to promote a variety of transportation, real estate, and tourism services in Virginia and Washington D.C., they primarily acted as retweet bots, amplifying tweets from random Twitter users based on the hashtags used. Although the majority of these accounts were shut down in late 2019, a few remained online and even continued posting periodically until the free Twitter API was shut down in 2023.
Shortly prior to being (mostly) shut down in October 2019, this botnet consisted of at least 98 Twitter accounts, most of which had taxi, real estate, or tourism themes. The majority of these accounts were created in 2018 or 2019, with a batch of new accounts whose names contained the word “flow” being created in September 2019, just a month before the bulk of the network was shut down. As mentioned earlier, many of these accounts had references to locations in Virginia or D.C. in their names or biographies.
How can we tell that these accounts were automated? In this particular case, it was relatively easy to make this determination, since the data returned by the Twitter API included the name of the app used to post each tweet. It turns out that less than 0.1% of this network’s tweets were posted manually (via the Twitter Web App). The remaining 99.9% of tweets were posted by a wide variety of custom apps implemented with the Twitter API, many of which had names matching the accounts that used them.
In another sign of automation, most of these accounts posted 24/7, taking no breaks for sleep or other activities. As seen in the figure above, some of these schedules had a rhythm of sorts wherein their tweet volume would increase and decrease on a four-hour cycle. Many of the accounts also routinely purged themselves of older tweets, another process that was likely automated.
The content posted by these accounts fell into two broad categories: tweets and retweets related to taxis, real estate, and other business ventures, and retweets of political tweets. Rather than amplifying popular accounts, as tends to be common with repost bots these days, the accounts in this botnet retweeted content based on hashtag used, resulting in frequent amplification of smaller accounts. The hashtags used by the botnet as triggers were mostly liberal political hashtags, including #Warren2020 and #MoscowMitch. At one point, roughly one in seven tweets containing the latter hashtag was a retweet from this botnet.
Notes: This article uses “Twitter” rather than “X” throughout because the events described therein all happened prior to the platform’s 2023 rebrand. The accounts studied were originally analyzed in these threads from 2019 by @ZellaQuixote and myself.