Discover and read the best of Twitter Threads about #SaturdaySpam

Most recents (18)

It's a new year, but some things remain the same, and one of those things is that one can still find pornbot networks. #SaturdaySpam

cc: @ZellaQuixote Image
This pornbot network consists of 690 accounts, created in batches between August 20th and November 16th, 2020. Thus far, all of their tweets have been (allegedly) sent via Twitter web app. Some (but not all) of the bots have liked tweets from porn accounts with large followings. ImageImageImageImage
The tweets posted by this pornbot network are extremely repetitive, with many tweets having been posted by hundreds of accounts. (The repeated tweets are sometimes accompanied by hashtagged US city names, which we removed for the sake of generating this table.) Image
Read 5 tweets
Are you looking for cleaning services in Riyadh? Don't worry, there's a botnet for that. #SaturdaySpam

cc: @ZellaQuixote
This botnet consists of 50 Arabic-language accounts, all created between December 18th, 2020 and January 1st, 2021. These accounts tend to all activate simultaneously and all (allegedly) tweet via the Twitter Web App.
The accounts in this botnet follow other members of the botnet, and most of them follow several. The follow relationships are somewhat structured by account creation date, with the December 22nd and 23rd batches having the most follows from other bots in the network.
Read 4 tweets
What's up with these identical replies to a @gabry1090 coupon code tweet? #SaturdaySpam

cc: @ZellaQuixote
Answer: unsurprisingly, a botnet. We found 19 accounts that we believe are part of the network, created over the course of a little over an hour on December 7th, 2020. All their tweets thus far are replies sent via either "Mobile Web (M2)" or "Twitter Web Client".
The 19 accounts in this reply spam botnet operate on nearly identical schedules, and often send the same replies. Most replies are in Arabic, with the occasional English reply thrown in for good measure. (As always, take the Google translations with a grain of salt.)
Read 4 tweets
What's up with these accounts retweeting giveaway tweets using apps with names like "Twitter for HUAWEI Y9a"? #SaturdaySpam

cc: @ZellaQuixote
Unsurprisingly, they're part of a botnet, consisting of (at least) 19 accounts that use custom apps with names of the form "Twitter for HUAWEI<xxxx>", and occasionally "Twitter for Android6" (not the real Twitter Android phone app). Most were created in June or October 2020.
The bots in this network do two things: retweet and reply. In both cases, the accounts they interact with are accounts selling access to proxy servers and botting software.
Read 4 tweets
What's with all of these repetitive replies mentioning the name "Nicholas Shawn"? #SaturdaySpam

cc: @ZellaQuixote
Answer: they're from a reply spam botnet we didn't know quite what to make of when we first saw it. It is now on a mission to promote forex trading/cryptocurrency content. ("Nicholas Shawn" appears to be a reference to the "Nick Shawn" Youtube channel.)
This botnet consists of 48 accounts, all created in September or October 2020. (We found 35 accounts when we first looked at it). Almost all tweets are replies sent via "Mobile Web (M2)".
Read 7 tweets
If you're looking for an automated military patriot mom who is sick of politics as usual and spams links to Gateway Pundit articles via IFTTT, @PatriotMomNDJ just might be the Twitter account for you. #SaturdaySpam

cc: @ZellaQuixote
All of @PatriotMomNDJ's recent tweets are sent via IFTTT, but this account has utilized other Twitter automation tools in the past, mainly SocialOomph. Almost all of its original tweets are automated (140161 of 140110, 99.96%), so this account is definitively a bot.
Similarly, @PatriotMomNDJ currently only links Gateway Pundit, but in the past it varied its spam lineup. Right-wing news site The Blaze was a frequent flier until late 2018, and commercial spam (Amazon, staged(dot)com, and others) was a major portion of its early content.
Read 4 tweets
For $800, you could be the proud new owner of @coisasqncompro (permanent ID 1221072227120156674), an automated account with 277K followers that mostly tweets pictures. As it turns out, this account is part of a botnet. #SaturdaySpam

cc: @ZellaQuixote ImageImage
We found a total of 27 accounts tweeting via "Twitter for me memso". Almost all were created in 2019 or 2020, and most have massive numbers of followers. This botnet recently switched automation tools - prior to Aug 10 2020 most tweets were sent via "Jeito". ImageImageImage
The automated tweets sent by this network are pretty much all images and videos, many of which (unsurprisingly given the large number of followers) receive large numbers of retweets and likes. Image
Read 6 tweets
Are 1000 "realistic looking followers" for the low, low price of $2 from @thou_followers and its associated website (thousandfollowers(dot)com) worth the price? Spoiler: probably not, and as always, don't click the link. #SaturdaySpam

cc: @ZellaQuixote
Conveniently, one need look no further than @thou_followers's own followers to study its inventory. 17957 of its 17963 followers were created in batches, have never liked a tweet, and followed @thou_followers in order of creation date.
As far as we can tell, these 17957 accounts comprise the entire botnet. They were created in batches starting in late May 2020 and continuing through the present day (most recent batch is from August 13, 2020), and have few or no tweets of their own.
Read 11 tweets
A gaggle of newly-made Turkish accounts with default profile pics are replying to Turkish tweets advertising adult services. What's up with that? #SaturdaySpam

cc: @ZellaQuixote Image
We found 25 accounts that appear to be part of the reply spam network. All were created on July 14th/15th 2020, have default profile pics, follow no accounts, and have no followers of their own. As always, take Google Translate's translations with a grain of salt. ImageImageImageImage
These 25 accounts theoretically tweet via the Twitter Web Client, but we suspect they are automated for two reasons:

• rapid tweeting (80-100 tweets per minute)
• "Twitter Web Client" is the source app name for the old Twitter website, which is no longer available to users Image
Read 5 tweets
We don't know Korean (and don't fully trust Google Translate) but it sure looks like this botnet is claiming to have a knack for picking winning lottery numbers. #SaturdaySpam

cc: @ZellaQuixote Image
This botnet consists of eight accounts, all created on May 9th 2015. At first glance, they look extremely low volume, with the most active account having tweeted only 135 times in 5 years. Image
In reality, these bots are much spammier, tweeting every 10-12 minutes, or 120-144 times per day (varies from bot to bot). They keep up the appearance of low volume by deleting the most recent tweet every time they post a new one (with occasional failures). #Lobsterfest
Read 4 tweets
We've seen some overzealous reactions to Twitter suspensions before, but spammy repetitive tweets implying that the banned accounts belonged to a literal deity is a new twist. #SaturdaySpam

cc: @ZellaQuixote
We downloaded all tweets tagging the now-suspended @davidroads and containing "Christian", "30 million", and "followers, yielding 1164 tweets from 845 accounts. The traffic doesn't appear automated based on software used.
The tweets are all variations on a few templates with different accounts tagged. Most frequently tagged accounts:

@jack - 1161 tweets (99.7%)
@FoxNews - 1137 tweets (97.7%)
@TwitterSupport - 784 tweets (67.4%)
@realDonaldTrump - 621 tweets (53.4%)
@ABC - 590 tweets (50.7%)
Read 7 tweets
What's up with all these IFTTT bots quoting Charlotte Brontë (and others)? #SaturdaySpam

cc: @ZellaQuixote
We found a botnet consisting of 21 accounts automated via IFTTT, all created on July 2nd, 2016, all with similar (and likely computer-generated) biographies, female profile pics, and links to one of two websites on their profiles.
This botnet draws its tweets from a repertoire of 1728 famous quotes, each tweeted at least once by every account in the network. We suspect the quotes aren't what these bots were deployed to promote, however. . .
Read 5 tweets
TFW you find a nearly six year old botnet proudly promoting a 23 year old website with no actual content. #SaturdaySpam

cc: @ZellaQuixote
We found 24 accounts with vip174(dot)ru (and various subdomains) linked on their profiles. All are (presently) automated via dlvr(dot)it and were created on July 27th, 2014. (@Pabooli0A is an anomaly - although it has supposedly tweeted 85364 times, we only found 6744 tweets.)
This botnet briefly used a few other automation tools early in its life before switching to dlvr(dot)it at the beginning of 2016. The majority of the tweet content consists of images with captions in Russian.
Read 5 tweets
Are these spambots? Survey says yes! #SaturdaySpam

cc: @ZellaQuixote
We found a network of 20 automated accounts, all spamming Korean hashtags with an embedded phone number via twittbot(dot)net. All but two were created in 2019, with the network first tweeting in August 2019 and slowly scaling up output.
These accounts are incredibly repetitive, with each account having a specific tweet that it tweets over and over, varying only the final portion consisting of random-looking letters and numbers. Tables of @q33soc and @vbvaldo's repeated tweets are provided as examples.
Read 4 tweets
Oh look, more pornbots. This network hypothetically tweets via Mobile Web (M2) (an older version of the Twitter website for mobile phones) and uses link redirection service rebrand(dot)ly to shorten/disguise its links. #SundaySpam

cc: @ZellaQuixote
@ZellaQuixote We found a total of 91 accounts tweeting shortened porn links via Mobile Web (M2). The entire group activated shortly after midnight PST on 2/9, and all were created in the 2 hours immediately prior. The botnet has generated an average of 69 tweets per minute since coming online.
@ZellaQuixote So far, every single tweet posted by these 91 accounts contains a rebrand(dot)ly short link that redirects to the actual porn site being peddled, zavmosse(dot)pw. As always, be wary of clicking links from dodgy botnets.
Read 17 tweets
Many of the accounts in the Turkish botnet described here have large numbers of followers. Are there other networks lurking among them? (Spoiler: yes, at least one.) #SaturdaySpam

cc: @ZellaQuixote
@ZellaQuixote We took a look at the followers of one of the bots in the network, @agresifprofil. The anomaly circled in red on the plot indicates it was followed by a group of accounts created at roughly the same time, a potential sign that they were created en masse by a single entity.
@ZellaQuixote @agresifprofil The anomaly in @agresifprofil's followers contains 252 Tuskish accounts with similar histories: high volume via SocialOomph in 2015, lower volume via TweetDeck in 2016, and even lower in 2019 via the Twitter website. Based on this, we found 262 more accounts, for a total of 514.
Read 12 tweets
If you're looking for a payday loan in multiple languages from a dysfunctional website, this botnet might be your thing. #SaturdaySpam #DigitalLoanSharkFail

cc: @ZellaQuixote
@ZellaQuixote This botnet consists of three accounts: @AfanasevaErmina, @OlgaKir37407272, and @AfanasevaErmina. All three tweet hashtag-drenched solicitations for short-term loans in multiple languages targeting multiple countries round-the-clock.
@ZellaQuixote @AfanasevaErmina @OlgaKir37407272 The website linked by the bots (teletype(dot)in/@nadezhdabekreneva1) no longer loads, but we found a cached copy on Google. Needless to say, it doesn't exactly look like a reputable financial institution. It contains links to another site, paydayloan(dot)date. . .
Read 8 tweets
It’s a Saturday, and once again pornbots are busily attaching themselves to trending hashtags such as #BravoMasha. We found 22 accounts that appear to be part of this botnet (screenshots of content omitted for obvious reasons.) #SaturdaySpam.

cc: @ZellaQuixote
@ZellaQuixote Although the bots in question have been around for years, none show significant volume prior to today. Although the tweets appear to be sent via the Twitter website, we suspect the accounts are automated due to the spamminess of their tweets.
@ZellaQuixote The purpose of the bots appears to be to promote the video4me(dot)xyz website. Even if you’re looking for porn, caution is advised before clicking links from spammy botnets as malware is not unlikely.
Read 3 tweets

Related hashtags

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3.00/month or $30.00/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!