New report: Twitter botnets detection in sports event

ElevenPaths    20 December, 2018
New report: Twitter botnets detection in sports event imagen

We all know that a botnet is a number of Internet-connected devices, each of which is running one or more bots. Botnets can be used to perform DDoS attacks, steal data, send spam and allows the attacker to access the device and its connection. The owner can control the botnet using C&C software.

Many Twitter users are bots, which are accounts controlled and sometimes created by computers. Twitter bots can send spam tweets, manipulate public opinion, be used for online fraud, and in our case, for promoting URL access to illegal sport content. The botnet contains a single type of bot, showing the same properties throughout the botnet. Bots are sold for money as fake followers.

This report is an analysis of social botnets. We have analyzed two different Twitter large conversations and identified the behavior of several groups of profiles with automatic and non-standard activities. The first conversation focuses on the 2018 FIFA World Cup, held between the 14th of June and the 15th of July. We worked on the communities of the entire conversation and discovered several profile groups behaving oddly. After applying proprietary algorithms, we confirmed that those communities were content diffusing botnets that were activated during the football games to share illegal streaming URL’s.

Tweets with links to illegal football games streamings imagen
Figure 1,2,3: Tweets with links to illegal football games streamings

In order to make a wider analysis, we investigated a larger scope of sports in the entire world for five weeks; from the 1st of November until the 10th of December. This new conversation covered the sports streaming theme in Twitter and included important events like the Premier League, UEFA Champions League, cricket games or the weekly NFL games in the US.

Tweets heat map related to the 5 weeks sport events monitoring image
Tweets heat map related to the 5 weeks sport events monitoring

To have a clear view of the sport’s streaming diffusion in Twitter, we created a query formed by the major sports and leagues of the world and streaming related terminology. Aldara’s graph analysis helps clearing out the conversation’s noise and focus on the core areas of interest.

Twitter conversation about the streaming of several sports image
Twitter conversation about the streaming of several sports.

Not only we discovered that some of the botnets identified in the FIFA World Cup were still active and diffusing current content, but new botnets were found focused in different sports. The size and composition of the botnets changes often as the accounts are very often suspended or deleted in Twitter.
As a result, we have learnt how to identify this kind of networks based on the “particular shape” of the composition and based of several algorithms. This “know-how” has also been applied in several use cases, such as in reputational crisis.
Expected behavior of a legal broadcasting (unidirectional behavior) image
Expected behavior of a legal broadcasting (unidirectional behavior)



Twitter botnet (chaotic and multidirectional) image
Twitter botnet (chaotic and multidirectional)



In addition to the analysis of the botnets of the conversation, we have analyzed the IP addresses of the streaming websites distributed in the tweets.



Number of Servers per country image



Number of Servers per country



To prevent this type of illegal broadcasting, the TSA (Telco Security Alliance) has different methods to fight against this cybercrime which goes from specific procedures with the main ISPs in the world to perform the necessary takedowns up to investing in start-ups that to protect intellectual property and improper use of your digital contents.


After analyzing the results, one of the conclusions is that, in proportion with the complete buzz of the sport, the most illegally broadcasted sport is the American football. The number of tweets that shared American football streaming links represents the 0,5% of the total number of results related to American football (including games, players, advertising, etc.)







Helene Aguirre
Mindeguia
Julio Gómez Ortega
Carlos González Álvarez
Sebastián García De
Saint-Léger
Pablo Moreno González





Leave a Reply

Your email address will not be published. Required fields are marked *