Malicious and Low Credibility URLs on Twitter during the AstraZeneca COVID-19 Vaccine Development

TL;DR

This study analyzes Twitter's sharing of malicious and low credibility URLs during the AstraZeneca COVID-19 vaccine development halt, revealing coordinated promotion and tactics to evade detection, highlighting the need for monitoring systems.

Contribution

It uncovers the prevalence and tactics of malicious URL sharing on Twitter during a health crisis, emphasizing the importance of monitoring systems for misinformation.

Findings

Malicious URLs often in shortened forms are shared on Twitter.

Content delivery networks and cloud hosting are used to evade detection.

Signs of coordination in promoting low credibility URLs are observed.

Abstract

We investigate the link sharing behavior of Twitter users following the temporary halt of AstraZeneca COVID-19 vaccine development in September 2020. During this period, we show the presence of malicious and low credibility information sources shared on Twitter messages in multiple languages. The malicious URLs, often in shortened forms, are increasingly hosted in content delivery networks and shared cloud hosting infrastructures not only to improve reach but also to avoid being detected and blocked. There are potential signs of coordination to promote both malicious and low credibility URLs on Twitter. Our findings suggest the need to develop a system that monitors the low-quality URLs shared in times of crisis.