Discover and read the best of Twitter Threads about #Coronagrift
Most recents (5)
Meet @pzf, an account with 235K followers that is currently covering the coronavirus from around the world and breaking the news before the news, per its profile and pinned tweet. What does this entail?
cc: @ZellaQuixote
cc: @ZellaQuixote
Apparently, it breaks the news before the news by tweeting a mix of (usually accurate) "BREAKING NEWS" tweets with no links to sources and quote tweets hawking sales of masks, hand sanitizer, toilet paper, and other things from @PzDeals. #coronagrift
The #coronavirus theme is a new twist, but @pzf has been pairing BREAKING NEWS tweets with @PzDeals sales spam since early 2016. Prior to that, @pzf's mission appears to have been to promote an associated website/wordpress blog, pzfeed(dot)com.
It's a Friday, and a coterie of bots is bombarding folks' mentions with repetitive solicitations to buy masks from some random Twitter account. With a website named "bigsales-amazon(dot)com" (NOT the real Amazon), what could possibly go wrong? #coronagrift
cc: @ZellaQuixote
cc: @ZellaQuixote
We found 17 accounts operating on identical schedules and spamming repetitive replies directing folks to purchase masks from @Shop_Mask_USA's website. Although they (seemingly) only began tweeting in May 2020, the accounts are all several years old.
Additionally, almost all of the tweets posted by these 17 accounts were processed by the same Twitter datacenter, suggesting they were sent via the same internet connection. (Tweet IDs contain information on which datacenter processed them, details here: )
We found 448 tweets from 448 accounts linking fastsalesproduct(dot)com, which in turn redirects to masks2020(dot)us. All 448 tweets were supposedly sent via the Twitter website, which is unusual - normal Twitter traffic consists of a mix of the website and the smartphone apps.
The masks2020(dot)us site itself supposedly sells face masks and respirators, although we refrained from placing an order. Interestingly, despite using a .us domain, the website is registered in Singapore.
If you're looking for #coronavirus profiteers that will also load up your account with useless followers, this is the botnet for you. #SundaySpam #coronagrift
cc: @ZellaQuixote
cc: @ZellaQuixote
This network consists of three mixed English/Japanese accounts (@MoreOker, @MoreThanBetter4, and @MostOkest) with various #Followback hashtags on their profiles. They tweet 24/7 via "Botbird Tweets", with (possibly) organic tweets via Twitter Web App thrown in.
The bulk of this network's tweets occurred during one of two spikes in activity. The first was a barrage of #followback tweets sent around the new year via Twitter Web App, and the second (late Feb-March) is round-the-clock automated tweets hawking face masks and hand sanitizer.
For the second time, we captured 24 hours' worth of tweets containing coronavirus/COVID-19 (and variations.) Traffic has more than quadrupled relative to two weeks ago to 1477082 tweets, a whopping 206297 of which (14%) are automated.
cc: @ZellaQuixote
cc: @ZellaQuixote
(previous #coronavirus thread from February 29th with some observations on automation)
The presence of automation is particularly notable among the most prolific accounts. 157 accounts tweeted about #coronavirus at least 100 times during the 24 hour period in question, 126 of which (80.3%) are automated.
