Chapter 25. Mediabots. CBSNews. Part one

The true story

Earlier we wrote about pro-Trump twitter botnet. Chapter 19. The cyberfactory. Summary Donald Trump held a press conference on May 31 morning to account for funds he had previously claimedto have donated to a veterans groups.“Trump announces $5.6 million in donations to veterans groups” - according to this twitter query we got hundreds of results. Some of those tweets were made by pro-Trump bots, but the most of them were new to us.We found the group of account, this has tweeted the identical message with the same link to the CBSNewsarticle.

This is the CBSNews article. The link to archive.

We found 21 accounts, that use this short link. We use the service to expand the short URL.

What “utm” is? According to website owner can use utm_source to identify a search engine, newsletter name, or another source. Example: utm_source=google Why do we think it was a planned action?If you try to share the article from, you got another much longer link without any “utm” in URL.

Utm marks used as a part of Google analytics for identification the traffic source. Only the man, who is responsible for traffic can create the long URL and then use the link shorter service. is the private corporate service. Non-employee can’t use this domain as a URL shortener.

All tweets were posted at the same time. We have collectedall tweets in theliston archive web.And all of them have the same mistake, the word “Ppresumptive” with double P. All tweets were copied from a template by the same person.

The example 1

The example 2

The example 3

That are not retweets, all those tweets were made at the same time and with the same messages and the same links to corporate link shortener. These accounts belong to a special type of bots, “link posters”.

Some of the CBS link poster accounts has 8 from 9 identical friends in the same order.

Just the gif.

More evidence about the first account and the quality of the botnet you can find in the appendix, after the sad questions.

Daily visitors for according to

The bot’s facts

1. At least 21 twitter account has posted the same message with the mistake and the same link in the same time.

2. Those accounts use the link to CBS corporate link shorter.

3. The long link contains Google analytics “utm” marks for traffic source detection.

4. The active accounts are related to the inactive since 2013 media botnet.

The sad questions

1. Who clicks on those links if there are no people at all among followers of bot-linkposters?

2. What kind of 1M daily visitors shows their advertisers?

3. Are CBS Corporation executives know about web traffic source?

4. Are CBS Corporation stakeholders know about web traffic quality?

5. Is CBS the only TV broadcaster which uses bots-linkposter or other broadcasters use the same technique?

The appendix

All accounts, who has posted the same message and the same link.

The same account in the recent friends among link posters.

The account with the photo of the man in pink pants is inactive since 9 dec. 2013.

The same with the account with the photo of the girl in the pink pants.

The account was born in November 2013 and sleeping since dec. 2013.

Both pink pants account has posted tweets with headlines and password-like appendix. Silent friends are a good company for Silent Hills, not for the news junkies.Some of the friends have no pants.

That is amazing.

The examples of the first friend pack.

This account is the most popular as the first friend. It is 3 years old link poster, which is sleeping since 8 Dec 2013. Its most recent followers are bot templates.

Among its followers we can find the pair of the accounts without the description but with the same photo.

The moment when some followers have the description without the photo and when some followers have the photo without the description.