Discover and read the best of Twitter Threads about #Spamtastic
Most recents (16)
If you're looking for fake followers that cannot get there until five thirty, this botnet's for you. #Spamtastic
cc: @ZellaQuixote
cc: @ZellaQuixote
This fake follower botnet consists of 23965 accounts created between August 3rd and August 7th, 2022. None of these accounts has ever tweeted or liked a tweet. All use the same naming scheme and most have repetitive biographies.
In addition to the aforementioned repetitive biographies, this fake follower botnet also uses the same profile pics on multiple accounts.
When you're a spammer with something to share, you share it simultaneously on ten Twitter accounts that were created on the same day and tag the same people in every tweet. It's what you do. #Spamtastic #Propagandalicious
cc: @ZellaQuixote
cc: @ZellaQuixote
These accounts are part of a network of (at least) 42 accounts created over a span of eight hours on July 10th, 2021. All have female names and profile pics, zero friends/followers, and have thus far tweeted exclusively via Twitter for Android.
The accounts in this network do three things: post repetitive tweets, retweet tweets, and like tweets. The repetitive tweets all contain links to articles/videos (mostly Xinjiang-related content from Chinese media/government sites), and most of them tag exactly two accounts.
It's a Monday afternoon, which is the perfect time to look at a pornbot network with a penchant attaching random emoji to its repetitive tweets. Also, it spam-followed a rather odd lineup of accounts. #MondayMotivation #Spamtastic
cc: @ZellaQuixote
cc: @ZellaQuixote
This network consists of (at least) 27745 Japanese-language accounts, created in batches between June 1st and July 25th, 2010. All tweets posted by these accounts so far were (allegedly) sent via the Twitter Web App. None has ever liked a tweet.
The accounts in this network are extremely repetitive, with the same tweets frequently duplicated verbatim (other than emoji) by dozens of accounts. The accounts' biographies generally include an invitation to chat with unknown parties on the LINE messaging app.
Here's an interesting account: @Right_n_Aware. Almost all of this account's tweets (177 of 193) have the curious property that they are duplicated verbatim on other accounts. #SpamTastic
cc: @ZellaQuixote
cc: @ZellaQuixote
We found a total of 78 accounts (including @Right_n_Aware) that frequently tweet the same tweets verbatim. Almost all were created in 2020 or 2021, and almost all have more tweets than likes. They post the majority of their tweets via "Twitter for Android".
This network's duplicate tweets are almost all political in nature, with criticism of the governments of China and Pakistan as the primary themes. Most of the duplicated tweets were tweeted first by either @Right_n_Aware or @ProwessSilent.
What's up with all these extremely similar-looking job listing tweets, many of which are cut off mid-word? #Spamtastic
cc: @ZellaQuixote
cc: @ZellaQuixote
Answer: a botnet, consisting of 103 accounts with names indicating that they offer jobs in a certain city (i.e, @HendersonJobs1) or a certain line of work (@EngineerJobs3). They all link to the same website, e-physician(dot)info.
All of the recent "job listings" tweets from these bots link to e-physician(dot)info, which appears to be scraping real job listings from ZipRecruiter and slapping its own ads on them. Despite the website name, most of the "jobs" being offered are not in the healthcare field.
This botnet would like to give you a manual and support and help you to install and run "EA FX ROBOT", which is (allegedly) not difficult. #SpamTastic #WeHeardYouLikeBotsSoWePutABotInYourBot
cc: @ZellaQuixote
cc: @ZellaQuixote
We found a network of 23 accounts promoting something called "EA FX ROBOT", created between October 2016 and March 2017. These accounts are automated, sending all of their tweets via a scheduling app called "Dynamic Tweets". Most of them operate on very similar schedules.
Hopefully you didn't get your hopes up about installing and running "EA FX ROBOT", because the associated website (eafxrobot(dot)com, the only site linked by the botnet) is no longer online and has been replaced with a generic landing page. The botnet soldiers on, though.
What's up with these accounts with German biographies retweeting "election fraud" conspiracy theories from Trump and his supporting cast? #Spamtastic
cc: @ZellaQuixote
cc: @ZellaQuixote
Answer: they're part of a botnet, consisting of 12 accounts automated via a custom app called "TweetFoxx". Although they do have occasional organic tweets, the vast majority of their content (19802 of 20233 tweets since September 1st, 2020, or 97.9%) is automated.
The majority of accounts in this botnet operate on very similar schedules. The exception is @TaioSchmid , which is active for fewer hours a day and skips out on retweeting some of the tweets amplified by its compatriots.
Oh look, more pornbots. At least the naming scheme is straightforward this time. #FridayFeeling #Spamtastic
cc: @ZellaQuixote
cc: @ZellaQuixote
This pornbot network consists of 653 accounts with names beginning with "porn_click_" and ending with numbers, mostly created in batches at various points in 2020. They (allegedly) all tweeted via the Twitter website until mid-September 2020, when they swapped to TweetDeck.
The "videos" in these pornbots' tweets aren't actually videos. They're redirected links to obscure porn websites disguised as videos through the use of thumbnail images with fake "play" buttons. We suspect the links are unsafe and do not recommend clicking them.
Check out all the love and blessings from Miami, Florida, also known as Ohio and Texas. #YouHadOneJob #Spamtastic
cc: @ZellaQuixote
cc: @ZellaQuixote
The duplicate "blessings from Miami, Florida" tweets came from a network of ten accounts created on Sept 4 2020. These accounts tweet on nearly identical schedules, and almost all of their tweets (96.3%) are replies. Tweets are (allegedly) sent via various Twitter web products.
These ten accounts have sent a multitude of repeated tweets in their two weeks on Twitter. The repeated tweets are a mix of generic pleasantries, praise for various cryptocurrency accounts, and attacks on a Massachusetts social worker.
These particular duplicate tweets (and others) were posted by @SunnQuest123, @GodMgga, @barbwire975, and @Sunnquest123W, a quartet of accounts who in a total coincidence all follow each other (and each account's first followers are the previously created members of the network).
The accounts in this network frequently duplicate both tweets and memes within and across accounts, with the text color/formatting on the memes occasionally changing. Three of four accounts are presently using variants on the same meme about voting as their pinned tweet.
What's with all these accounts linking the same boat parade YouTube video at the exact same time? #Spamtastic #FridayFeeling?
cc: @ZellaQuixote
cc: @ZellaQuixote
Answer: a botnet, consisting of 12 accounts with nearly identical tweet schedules linking YouTube videos via Plume for Android. This botnet has shared 640 different YouTube videos since June 1st 2020, all but one of which was tweeted by all 12 accounts.
Did we mention that these 12 accounts are tweeting on nearly identical schedules? On average, all 12 accounts tweet each YouTube video over a span of 5 seconds (tables show the most recent examples as of the time we pulled data).
What's up with all these accounts with July 2020 creation dates and stated locations in the US retweeting @ARTEM_KLYUSHIN's tweets (in Russian) about the 2020 US election? #Spamtastic
cc: @ZellaQuixote
cc: @ZellaQuixote
We found 95 accounts that we believe to be part of a retweet network amplifying @ARTEM_KLYUSHIN (and others), all created in July 2020. Many list a US state on their profile, usually in all lowercase, and none has ever liked a tweet.
All of the accounts in this network theoretically tweet via the Twitter website ("Twitter Web App"). Although this hypothetically indicates the tweets are human-posted, there are multiple ways of automating websites so the accounts could well be automated.
It's a Wednesday in July, and a multitude of cryptocurrency/forex trading accounts have been posting identical tweets (with some variance in the hashtags they attempt to hijack). #Spamtastic
cc: @ZellaQuixote
cc: @ZellaQuixote
This network of cryptocurrency spammers appears to be centered on @Liam_steve1 and @James_bitcoin1, both of whom are Stock Market Experts, social workers, forex traders at Bitinvests Organization, and per time (sic) brokers at CCCBOT Organization.
We found 34 additional accounts that copied some of @Liam_steve1 and @James_bitcoin1's bitcoin/forex trading tweets verbatim, bringing the total size of the network to 36. Most tweet primarily via Android. With one exception, tweet schedules don’t clearly indicate automation.
Oh look, supplements. Also bots. Bots promoting supplements, even. (No, this is not a thread about Alex Jones.) #MondayMotivation #Spamtastic
cc: @ZellaQuixote
cc: @ZellaQuixote
We found 63 IFTTT bots tweeting Arabic coupon spam, mostly for discounts on nutritional supplements on iherb(dot)com. Almost all were created in batches of accounts with similar names, and userpics are reused across accounts.
As tends to be the case with spam, these bots are repetitive, with many tweets having been repeated verbatim thousands of times. No tweet thus far has been tweeted by all 63 accounts, however.
Oh look, more pornbots. Some of the syntax and spelling is a bit off, but looks like they're fond of the metric system. #FridayFeeling #Spamtastic
cc: @ZellaQuixote
cc: @ZellaQuixote
By searching for other accounts tweeting the same tweets as the first few pornbots we ran across, and in turn searching for the tweets tweeted repeatedly by those accounts, we were able to flesh out the network to 1469 accounts, created over a span of less than 48 hours.
As we might've mentioned, these accounts repeat tweets. They appear to draw on a library of 399 unique tweets which they tweet accompanied by a photo. Some of the accounts also have one or two early tweets consisting of brief snippets of Bram Stoker's "Dracula".
We found 44 still-active accounts tweeting the text "Donald Trump teases 'big announcement' in Iowa" accompanied by a link of some sort. Hilariously, a couple of them tweeted it in September 2017, over a year late to the party.
Of those 44 accounts, 20 were flagged as bots based on 90+% of tweets being posted via automation services, 24/7 activity, or both. 5 of those were the official accounts of radio/TV stations, but the other 15 are interesting. . .
