Suspended accounts in retrospect: an analysis of twitter spam
Abstract
In this study, we examine the abuse of online social networks at the hands of spammers through the lens of the tools, techniques, and support infrastructure they rely upon. To perform our analysis, we identify over 1.1 million accounts suspended by Twitter for disruptive activities over the course of seven months. In the process, we collect a dataset of 1.8 billion tweets, 80 million of which belong to spam accounts. We use our dataset to characterize the behavior and lifetime of spam accounts, the campaigns they execute, and the wide-spread abuse of legitimate web services such as URL shorteners and free web hosting. We also identify an emerging marketplace of illegitimate programs operated by spammers that include Twitter account sellers, ad-based URL shorteners, and spam affiliate programs that help enable underground market diversification.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Bots and spamming accounts use tricks such as hijacking "trending" hashtags or keywords to gain visibility, and can distort statistics of datasets collected from social platforms.
“Such accounts use tricks such as hijacking “trending” hashtags of keywords to gain visibility (Thomas et al., 2011), and can (purposefully or accidentaly) distort the statistics of datasets collected from social platforms”
From Social Data: Biases, Methodological Pitfalls, and Ethical Boundaries (2019) · cites this paper as Thomas et al., 2011
Cites
Proceedings of the 11th USENIX Security Symposium
Boneh, D. (2002) · Cited by 2,513 · see citing works
Detecting spammers on social networks
Stringhini, G., Kruegel, C., & Vigna, G. (2010) · Proceedings of the 26th Annual Computer Security Applications Conference · doi:10.1145/1920261.1920263 · Cited by 791 · see citing works
Yu, H., Kaminsky, M., Gibbons, P. B., & Flaxman, A. D. (2006) · ACM SIGCOMM Computer Communication Review · doi:10.1145/1151659.1159945 · Cited by 734 · see citing works
Magno, G., Rodrigues, T., & Almeida, V. A. F. (2010) · Cited by 649 · see citing works
Uncovering social spammers: social honeypots + machine learning
Lee, K., Caverlee, J., & Webb, S. (2010) · Proceedings of the 33rd international ACM SIGIR conference on Research and development in information retrieval · doi:10.1145/1835449.1835522 · Cited by 619 · see citing works
Grier, C., Thomas, K., Paxson, V., & Zhang, M. (2010) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/1866307.1866311 · Cited by 558 · see citing works
Self-citationDesign and Evaluation of a Real-Time URL Spam Filtering Service
Thomas, K., Grier, C., Ma, J. H., Paxson, V., & Song, D. X. (2011) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2011.25 · Cited by 470 · see citing works
Self-citationDetecting and characterizing social spam campaigns
Gao, H., Hu, J. S., Wilson, C., Li, Z., Chen, Y., & Zhao, B. Y. (2010) · ACM Internet Measurement Conference (IMC) · doi:10.1145/1879141.1879147 · Cited by 420 · see citing works
SybilInfer: Detecting Sybil Nodes using Social Networks.
Danezis, G., & Mittal, P. (2009) · Cited by 407 · see citing works
Kanich, C., Kreibich, C., Levchenko, K., Enright, B., Voelker, G. M., Paxson, V., & Savage, S. (2008) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/1455770.1455774 · Cited by 323 · see citing works
Self-citationMeasuring and Detecting Fast-Flux Service Networks
Holz, T., Gorecki, C., Rieck, K., & Freiling, F. (2008) · Cited by 321 · see citing works
Filtering spam with behavioral blacklisting
Ramachandran, A., Feamster, N., & Vempala, S. (2007) · Proceedings of the ACM Conference on Computer and Communications Security · doi:10.1145/1315245.1315288 · Cited by 267 · see citing works
Click Trajectories: End-to-End Analysis of the Spam Value Chain
Levchenko, K., Pitsillidis, A., Chachra, N., Enright, B., Félegyházi, M., Grier, C., Halvorson, T., Kanich, C., Kreibich, C., Liu, H., et al. (2011) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2011.24 · Cited by 254 · see citing works
Self-citationSpam Filtering in Twitter Using Sender-Receiver Relationship
Song, J., Lee, S.-H., & Kim, J. K. (2011) · Lecture notes in computer science · doi:10.1007/978-3-642-23644-0_16 · Cited by 222 · see citing works
Spamscatter: characterizing internet scam hosting infrastructure
Anderson, D. S., Fleizach, C., Savage, S., et al. (2007) · eScholarship (California Digital Library) · Cited by 178 · see citing works
Jonathan Merrills BPharm, B., & Jonathan Fisher BA, L. (. (2001) · doi:10.1002/9780470690642.ch5 · Cited by 116 · see citing works
The Underground Economy of Fake Antivirus Software
Stone-Gross, B., Abman, R., Kemmerer, R. A., et al. (2012) · Springer eBooks · doi:10.1007/978-1-4614-1981-5_4 · Cited by 114 · see citing works
Shades of grey: On the effectiveness of reputation-based “blacklists”
Sinha, S., Bailey, M., & Jahanian, F. (2008) · International Conference on Malicious and Unwanted Software · doi:10.1109/malware.2008.4690858 · Cited by 106 · see citing works
Dirty jobs: the role of freelance labor in web service abuse
Motoyama, M., McCoy, D., Levchenko, K., Savage, S., & Voelker, G. M. (2011) · Cited by 94 · see citing works
Spamcraft: an inside look at spam campaign orchestration
Kreibich, C., Kanich, C., Levchenko, K., et al. (2009) · Cited by 87 · see citing works
The Underground Economy of Fake Antivirus SoftwarePreprint
Steigerwald, D. G., Vigna, G., Kruegel, C., et al. (2011) · RePEc: Research Papers in Economics · Cited by 43 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
Social Data: Biases, Methodological Pitfalls, and Ethical Boundaries
Olteanu, A., Castillo, C., Diaz, F., & Kıcıman, E. (2019) · Frontiers in Big Data · doi:10.3389/fdata.2019.00013 · Cited by 763 · see citing works
“For instance, network studies of peer influence and social contagion suffer from a stubborn challenge of disambiguating such effects from homophily among peers and within communities (Christakis and Fowler, 2007; Lyons, 2011; Shalizi and Thomas, 2011).”
BackgroundMethodDetecting Automation of Twitter Accounts: Are You a Human, Bot, or Cyborg?
Chu, Z., Gianvecchio, S., Wang, H., & Jajodia, S. (2012) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2012.75 · Cited by 634 · see citing works
Fame for sale: Efficient detection of fake Twitter followers
Cresci, S., Di Pietro, R., Petrocchi, M., Spognardi, A., & Tesconi, M. (2015) · Decision Support Systems · doi:10.1016/j.dss.2015.09.003 · Cited by 461 · see citing works
“, in [27]) nor on correlations between accounts on different social platforms (as done, e.”
BackgroundEmpirical evaluation and new design for fighting evolving Twitter spammers
Yang, C., Harkreader, R., & Gu, G. (2013) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2013.2267732 · Cited by 346 · see citing works
Uncovering social network Sybils in the wild
Yang, Z., Wilson, C., Wang, X., Gao, T., Zhao, B. Y., & Dai, Y. (2014) · ACM Transactions on Knowledge Discovery from Data · doi:10.1145/2556609 · Cited by 290 · see citing works
Uncovering Large Groups of Active Malicious Accounts in Online Social Networks
Cao, Q., Yang, X., Yu, J., & Palow, C. (2014) · Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2660267.2660269 · Cited by 274 · see citing works
DeBot: Twitter Bot Detection via Warped Correlation
Chavoshi, N., Hamooni, H., & Mueen, A. (2016) · 2016 IEEE 16th International Conference on Data Mining (ICDM) · doi:10.1109/icdm.2016.0096 · Cited by 260 · see citing works
A generic statistical approach for spam detection in Online Social Networks
Ahmed, F., & Abulaish, M. (2013) · Computer Communications · doi:10.1016/j.comcom.2013.04.004 · Cited by 199 · see citing works
Uncovering social network sybils in the wild
Yang, Z., Wilson, C., Wang, X., Gao, T., Zhao, B. Y., & Dai, Y. (2011) · Proceedings of the 2011 ACM SIGCOMM conference on Internet measurement conference · doi:10.1145/2068816.2068841 · Cited by 164 · see citing works
What types of COVID-19 conspiracies are populated by Twitter bots?
Ferrara, E. (2020) · First Monday · doi:10.5210/fm.v25i6.10633 · Cited by 223 · see citing works
“nced Research Projects Agency) aimed at detecting bots used for anti-science misinformation [4]. More recently, large bot networks (botnets) have been discovered on Twitter by various research groups [43], [44], [46], [48]. The literature on bot detection has become very extensive [31], [36], [49]–[51]. In [31], we pr…”
BackgroundMethodIntegro: Leveraging Victim Prediction for Robust Fake Account Detection in OSNs
Boshmaf, Y., Logothetis, D., Siganos, G., Leria, J., Lorenzo, J., Ripeanu, M., & Beznosov, K. (2015) · Proceedings 2015 Network and Distributed System Security Symposium · doi:10.14722/ndss.2015.23260 · Cited by 134 · see citing works
Online Social Spammer Detection
Hu, X., Tang, J., & Liu, H. (2014) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v28i1.8728 · Cited by 133 · see citing works
Detecting Fake Accounts on Social Media
Khaled, S., El-Tazi, N., & Mokhtar, H. M. O. (2018) · 2018 IEEE International Conference on Big Data (Big Data) · doi:10.1109/bigdata.2018.8621913 · Cited by 131 · see citing works
De Cristofaro, E., Friedman, A., Jourjon, G., Kaafar, M. A., & Shafiq, M. Z. (2014) · Proceedings of the 2014 Conference on Internet Measurement Conference · doi:10.1145/2663716.2663729 · Cited by 85 · see citing works
“Yang et al. [27] performed an empirical analysis of social relationships between spam accounts on Twitter, and Dave et al. [11] proposed a methodology to measure and finger-print click-spam in ad networks.”
BackgroundWhat Happens After You Are Pwnd: Understanding the Use of Leaked Webmail Credentials in the Wild
Onaolapo, J., Mariconti, E., & Stringhini, G. (2016) · Proceedings of the 2016 Internet Measurement Conference · doi:10.1145/2987443.2987475 · Cited by 74 · see citing works
Smoke Screener or Straight Shooter: Detecting Elite Sybil Attacks in User-Review Social Networks
Zheng, H., Xue, M., Lu, H., Hao, S., Zhu, H., Liang, X., & Ross, K. (2018) · Proceedings 2018 Network and Distributed System Security Symposium · doi:10.14722/ndss.2018.23009 · Cited by 61 · see citing works
LOBO: Evaluation of Generalization Deficiencies in Twitter Bot Classifiers
Echeverra, J., De Cristofaro, E., Kourtellis, N., Leontiadis, I., Stringhini, G., & Zhou, S. (2018) · Proceedings of the 34th Annual Computer Security Applications Conference · doi:10.1145/3274694.3274738 · Cited by 61 · see citing works
Hate Raids on Twitch: Echoes of the Past, New Modalities, and Implications for Platform Governance
Han, C., Seering, J., Kumar, D., Hancock, J. T., & Durumeric, Z. (2023) · Proceedings of the ACM on Human-Computer Interaction · doi:10.1145/3579609 · Cited by 46 · see citing works
Survey on Fake Profile Detection on Social Sites by Using Machine Learning Algorithm
Patel, K., Agrahari, S., & Srivastava, S. (2020) · 2020 8th International Conference on Reliability, Infocom Technologies and Optimization (Trends and Future Directions) (ICRITO) · doi:10.1109/icrito48877.2020.9197935 · Cited by 34 · see citing works
Measuring, Characterizing, and Detecting Facebook Like Farms
Ikram, M., Onwuzurike, L., Farooqi, S., Cristofaro, E. D., Friedman, A., Jourjon, G., Kaafar, M. A., & Shafiq, M. Z. (2017) · ACM Transactions on Privacy and Security · doi:10.1145/3121134 · Cited by 27 · see citing works
“Nazir et al. [34] studied phantom profiles in Facebook gaming applications, while Thomas et al. [47] analyzed over 1.1 million accounts suspended by Twitter.”
BackgroundInfluentialThe Art and Craft of Fraudulent App Promotion in Google Play
Rahman, M., Hernandez, N., Recabarren, R., Ahmed, S. I., & Carbunar, B. (2019) · Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3319535.3345658 · Cited by 24 · see citing works
A Reliable Weighting Scheme for the Aggregation of Crowd Intelligence to Detect Fake News
Tchakounté, F., Faissal, A., Atemkeng, M., & Ntyam, A. (2020) · Information · doi:10.3390/info11060319 · Cited by 23 · see citing works
Hernandez, N., Recabarren, R., Carbunar, B., & Ahmed, S. I. (2021) · Proceedings of the 21st ACM Internet Measurement Conference · doi:10.1145/3487552.3487837 · Cited by 3 · see citing works
Exposing the Hidden Layer: Software Repositories in the Service of Seo Manipulation
Wu, M., Hong, G., Mai, W., Wu, X., Zhang, L., Pu, Y., Chai, H., Ying, L., Duan, H., & Yang, M. (2025) · 2025 IEEE/ACM 47th International Conference on Software Engineering (ICSE) · doi:10.1109/icse55347.2025.00147 · Cited by 3 · see citing works
He, H., Yang, H., Burckhardt, P., Kapravelos, A., Vasilescu, B., & Kästner, C. (2026) · Proceedings of the 2026 IEEE/ACM 48th International Conference on Software Engineering · doi:10.1145/3744916.3764531 · Cited by 2 · see citing works
- Authors
- Thomas, K., Grier, C., Song, D., & Paxson, V.
- Affiliations
- University of California, Berkeley (US)
- International Computer Science Institute (US)
- Venue
- Proceedings of the 2011 ACM SIGCOMM conference on Internet measurement conference
- Publisher
- ACM
- Published
- 2011-11-02
- Pages
- 243-258
- OpenAlex
- W2098395374
- Cited by
- 439
- References
- 21
- Citations by year
- 2026: 2 · 2025: 6 · 2024: 5 · 2023: 11 · 2022: 10 · 2021: 31 · 2020: 41 · 2019: 25 · 2018: 51 · 2017: 42 · 2016: 55 · 2015: 48 · 2014: 46 · 2013: 39 · 2012: 24
- FWCI
- 26.67
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- ACM Internet Measurement Conference (IMC) (publishedVersion)
- Topics
- Physical Sciences › Computer Science › Information Systems › Spam and Phishing Detection
- Physical Sciences › Computer Science › Information Systems › Cybercrime and Law Enforcement Studies
- Social Sciences › Sociology and Political Science › Misinformation and Its Impacts
- Keywords
- online spam, Twitter, account suspension, free web hosting, spam campaigns, social media abuse
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
