Visualizations of Duceybots (and bonus McCainbots)
Local Arizona reporter Hank Stephenson from the Tucson Star stumbled upon some suspicious Twitter accounts supporting the re-election campaign of Arizona governor Doug Ducey. He tweeted a thread on June 19 with several examples of Twitter imposters using stolen profile pictures from real people for fake accounts supporting Doug Ducey.
The #duceybots as they are now called made the local news:
Duceybots are obviously fake accounts. Besides using stolen profile photos, they all follow each other, retweet and like each other’s tweets as well as Doug Ducey’s tweets and those of members of his campaign staff and were mostly created in May and June of 2018.
The now suspended DominTanner’s tweet was liked and retweeted by several other duceybot accounts:
I found a second group of suspicious accounts that were created in 2016 and are using TweetDeck to retweet tweets associated with Doug Ducey’s campaign, including TerryOnTheWater (account created May 27, 2016) and ASUmom5 (account created August 5, 2016).
The Ducey campaign is also using TweetDeck. There is no way to know who is controlling these accounts but it is an odd coincidence that the accounts are tweeting using the same community management tool as Ducey’s campaign and retweeting tweets supporting the campaign.
The fake accounts are also tweeting from sources other than TweetDeck so the sources of their tweets change.
Here is a full list of the 48 suspicious accounts I found supporting Doug Ducey on Twitter.
- 10 of the accounts were created in 2016
- 8 of those 10 accounts are using TweetDeck to tweet
- 38 accounts were created in May and June of 2018
- 9 of the 38 accounts have either been suspended or deleted since local news reported on the duceybots
For reference, the TeamDucey Twitter account was created on April 30, 2018.
I downloaded tweets before several of the above accounts were deleted and/or suspended and was able to create network graphs of their activity.
1,237 #SecureAZ tweets from June 18 to June 20
User-to-hashtag network (u2h)
Nodes: 327
Edges: 164
Many of the suspicious accounts are linked to this campaign hashtag with heavy edges because they tweeted the hashtag multiple times. Several accounts in this graph are using TweetDeck and several members of the campaign staff are also in this network.
User-to-user (u2u) graph of accounts retweeting or mentioning DougDucey’s Twitter handle
Nodes: 4,466
Edges: 13,503
The duceybots are located in the pink cluster with TeamDucey. They are in this cluster because they are retweeting the same campaign-related tweets.
User-to-hashtag graph of accounts retweeting or mentioning Doug Ducey’s Twitter handle
Nodes: 1,595
Edges: 2038
The hashtag #duceybots appears in this graph because people on Twitter were mentioning Doug Ducey’s handle together with hashtag #duceybots and mocking the fake accounts supporting his campaign.
Several accounts in the upper right #SecureAZ green cluster which were identified as suspicious accounts and called out on the local news are now suspended (as of Friday June 22, 2018).
2016 McCainbots
As I mentioned above, while I was researching the network of fake accounts supporting Doug Ducey’s re-election campaign I stumbled upon another network of suspicious accounts that was created in the summer of 2016. Upon further digging I found more of these 2016 fake accounts — they were all supporting John McCain’s 2016 Senate campaign.
A few of the 2016 accounts are now tweeting for Doug Ducey but most of the accounts have not tweeted since 2016/2017. All of the accounts retweeted tweets from McCain’s 2016 campaign. At least 12 of the 33 accounts were using TweetDeck to tweet in 2016.
Similar to the duceybots, the 2016 accounts have fake profile pictures, like “Calvin Silva” whose avatar was lifted from dating websites.
Model Jessica Clements’s photo has been stolen for medirishx2’s account which supported McCain’s senate campaign in 2016, is currently supporting Doug Ducey’s re-election campaign and is tweeting using TweetDeck.
A photo of Eric Bischoff from 1993 was used for Carter Hall’s account which supported John McCain’s campaign in 2016, tweeted using TweetDeck but as of the time of writing this blog, has not tweeted in 231 days.
I found 71 suspicious accounts in total boosting either John McCain’s campaign in 2016, Doug Ducey’s current 2018 campaign or both. There are likely more than 71, but I had to make a cut off and wrap up this blog.
- 33 accounts were created in 2016 and supported McCain’s 2016 campaign
- 10 of those 33 accounts are still tweeting and shifted support to Doug Ducey in 2018
- 38 new accounts were created in May and June 2018 for the Ducey campaign
Here’s the full list of fake accounts, some are now suspended but most are still online:
Update: Shortly after I published this blog several people contacted me regarding the McCainbots. People did notice them in 2016 but these kinds of social media manipulation tactics were not a very salient topic at the time.
From 2016:
If you have any more info to add please contact me at @3r1nG on Twitter (open DMs) and I will update this post.
