Discover and read the best of Twitter Threads about #spamtastic

Most recents (16)

If you're looking for fake followers that cannot get there until five thirty, this botnet's for you. #Spamtastic

cc: @ZellaQuixote collage of six Twitter accounts with the biography "dct
This fake follower botnet consists of 23965 accounts created between August 3rd and August 7th, 2022. None of these accounts has ever tweeted or liked a tweet. All use the same naming scheme and most have repetitive biographies. histogram of creation dates/time, showing that the accounts table of 27 example accounts
In addition to the aforementioned repetitive biographies, this fake follower botnet also uses the same profile pics on multiple accounts. collage of profile photos for a bunch of the accounts in the
Read 6 tweets
When you're a spammer with something to share, you share it simultaneously on ten Twitter accounts that were created on the same day and tag the same people in every tweet. It's what you do. #Spamtastic #Propagandalicious

cc: @ZellaQuixote
These accounts are part of a network of (at least) 42 accounts created over a span of eight hours on July 10th, 2021. All have female names and profile pics, zero friends/followers, and have thus far tweeted exclusively via Twitter for Android.
The accounts in this network do three things: post repetitive tweets, retweet tweets, and like tweets. The repetitive tweets all contain links to articles/videos (mostly Xinjiang-related content from Chinese media/government sites), and most of them tag exactly two accounts.
Read 5 tweets
It's a Monday afternoon, which is the perfect time to look at a pornbot network with a penchant attaching random emoji to its repetitive tweets. Also, it spam-followed a rather odd lineup of accounts. #MondayMotivation #Spamtastic

cc: @ZellaQuixote Image
This network consists of (at least) 27745 Japanese-language accounts, created in batches between June 1st and July 25th, 2010. All tweets posted by these accounts so far were (allegedly) sent via the Twitter Web App. None has ever liked a tweet. ImageImageImageImage
The accounts in this network are extremely repetitive, with the same tweets frequently duplicated verbatim (other than emoji) by dozens of accounts. The accounts' biographies generally include an invitation to chat with unknown parties on the LINE messaging app. ImageImage
Read 6 tweets
Here's an interesting account: @Right_n_Aware. Almost all of this account's tweets (177 of 193) have the curious property that they are duplicated verbatim on other accounts. #SpamTastic

cc: @ZellaQuixote
We found a total of 78 accounts (including @Right_n_Aware) that frequently tweet the same tweets verbatim. Almost all were created in 2020 or 2021, and almost all have more tweets than likes. They post the majority of their tweets via "Twitter for Android".
This network's duplicate tweets are almost all political in nature, with criticism of the governments of China and Pakistan as the primary themes. Most of the duplicated tweets were tweeted first by either @Right_n_Aware or @ProwessSilent.
Read 5 tweets
What's up with all these extremely similar-looking job listing tweets, many of which are cut off mid-word? #Spamtastic

cc: @ZellaQuixote
Answer: a botnet, consisting of 103 accounts with names indicating that they offer jobs in a certain city (i.e, @HendersonJobs1) or a certain line of work (@EngineerJobs3). They all link to the same website, e-physician(dot)info.
All of the recent "job listings" tweets from these bots link to e-physician(dot)info, which appears to be scraping real job listings from ZipRecruiter and slapping its own ads on them. Despite the website name, most of the "jobs" being offered are not in the healthcare field.
Read 4 tweets
This botnet would like to give you a manual and support and help you to install and run "EA FX ROBOT", which is (allegedly) not difficult. #SpamTastic #WeHeardYouLikeBotsSoWePutABotInYourBot

cc: @ZellaQuixote Image
We found a network of 23 accounts promoting something called "EA FX ROBOT", created between October 2016 and March 2017. These accounts are automated, sending all of their tweets via a scheduling app called "Dynamic Tweets". Most of them operate on very similar schedules. ImageImageImage
Hopefully you didn't get your hopes up about installing and running "EA FX ROBOT", because the associated website (eafxrobot(dot)com, the only site linked by the botnet) is no longer online and has been replaced with a generic landing page. The botnet soldiers on, though. ImageImageImage
Read 5 tweets
What's up with these accounts with German biographies retweeting "election fraud" conspiracy theories from Trump and his supporting cast? #Spamtastic

cc: @ZellaQuixote
Answer: they're part of a botnet, consisting of 12 accounts automated via a custom app called "TweetFoxx". Although they do have occasional organic tweets, the vast majority of their content (19802 of 20233 tweets since September 1st, 2020, or 97.9%) is automated.
The majority of accounts in this botnet operate on very similar schedules. The exception is @TaioSchmid , which is active for fewer hours a day and skips out on retweeting some of the tweets amplified by its compatriots.
Read 6 tweets
Oh look, more pornbots. At least the naming scheme is straightforward this time. #FridayFeeling #Spamtastic

cc: @ZellaQuixote
This pornbot network consists of 653 accounts with names beginning with "porn_click_" and ending with numbers, mostly created in batches at various points in 2020. They (allegedly) all tweeted via the Twitter website until mid-September 2020, when they swapped to TweetDeck.
The "videos" in these pornbots' tweets aren't actually videos. They're redirected links to obscure porn websites disguised as videos through the use of thumbnail images with fake "play" buttons. We suspect the links are unsafe and do not recommend clicking them.
Read 4 tweets
Check out all the love and blessings from Miami, Florida, also known as Ohio and Texas. #YouHadOneJob #Spamtastic

cc: @ZellaQuixote Image
The duplicate "blessings from Miami, Florida" tweets came from a network of ten accounts created on Sept 4 2020. These accounts tweet on nearly identical schedules, and almost all of their tweets (96.3%) are replies. Tweets are (allegedly) sent via various Twitter web products. ImageImageImageImage
These ten accounts have sent a multitude of repeated tweets in their two weeks on Twitter. The repeated tweets are a mix of generic pleasantries, praise for various cryptocurrency accounts, and attacks on a Massachusetts social worker. Image
Read 5 tweets
Oh look, a bunch of duplicate tweets. What's up with that? #Spamtastic

cc: @ZellaQuixote Image
These particular duplicate tweets (and others) were posted by @SunnQuest123, @GodMgga, @barbwire975, and @Sunnquest123W, a quartet of accounts who in a total coincidence all follow each other (and each account's first followers are the previously created members of the network). ImageImageImage
The accounts in this network frequently duplicate both tweets and memes within and across accounts, with the text color/formatting on the memes occasionally changing. Three of four accounts are presently using variants on the same meme about voting as their pinned tweet. ImageImageImage
Read 5 tweets
What's with all these accounts linking the same boat parade YouTube video at the exact same time? #Spamtastic #FridayFeeling?

cc: @ZellaQuixote Image
Answer: a botnet, consisting of 12 accounts with nearly identical tweet schedules linking YouTube videos via Plume for Android. This botnet has shared 640 different YouTube videos since June 1st 2020, all but one of which was tweeted by all 12 accounts. ImageImageImage
Did we mention that these 12 accounts are tweeting on nearly identical schedules? On average, all 12 accounts tweet each YouTube video over a span of 5 seconds (tables show the most recent examples as of the time we pulled data). ImageImageImageImage
Read 6 tweets
What's up with all these accounts with July 2020 creation dates and stated locations in the US retweeting @ARTEM_KLYUSHIN's tweets (in Russian) about the 2020 US election? #Spamtastic

cc: @ZellaQuixote ImageImage
We found 95 accounts that we believe to be part of a retweet network amplifying @ARTEM_KLYUSHIN (and others), all created in July 2020. Many list a US state on their profile, usually in all lowercase, and none has ever liked a tweet. ImageImageImage
All of the accounts in this network theoretically tweet via the Twitter website ("Twitter Web App"). Although this hypothetically indicates the tweets are human-posted, there are multiple ways of automating websites so the accounts could well be automated. ImageImage
Read 11 tweets
It's a Wednesday in July, and a multitude of cryptocurrency/forex trading accounts have been posting identical tweets (with some variance in the hashtags they attempt to hijack). #Spamtastic

cc: @ZellaQuixote Image
This network of cryptocurrency spammers appears to be centered on @Liam_steve1 and @James_bitcoin1, both of whom are Stock Market Experts, social workers, forex traders at Bitinvests Organization, and per time (sic) brokers at CCCBOT Organization. Image
We found 34 additional accounts that copied some of @Liam_steve1 and @James_bitcoin1's bitcoin/forex trading tweets verbatim, bringing the total size of the network to 36. Most tweet primarily via Android. With one exception, tweet schedules don’t clearly indicate automation. ImageImage
Read 6 tweets
Oh look, supplements. Also bots. Bots promoting supplements, even. (No, this is not a thread about Alex Jones.) #MondayMotivation #Spamtastic

cc: @ZellaQuixote
We found 63 IFTTT bots tweeting Arabic coupon spam, mostly for discounts on nutritional supplements on iherb(dot)com. Almost all were created in batches of accounts with similar names, and userpics are reused across accounts.
As tends to be the case with spam, these bots are repetitive, with many tweets having been repeated verbatim thousands of times. No tweet thus far has been tweeted by all 63 accounts, however.
Read 5 tweets
Oh look, more pornbots. Some of the syntax and spelling is a bit off, but looks like they're fond of the metric system. #FridayFeeling #Spamtastic

cc: @ZellaQuixote
By searching for other accounts tweeting the same tweets as the first few pornbots we ran across, and in turn searching for the tweets tweeted repeatedly by those accounts, we were able to flesh out the network to 1469 accounts, created over a span of less than 48 hours.
As we might've mentioned, these accounts repeat tweets. They appear to draw on a library of 399 unique tweets which they tweet accompanied by a photo. Some of the accounts also have one or two early tweets consisting of brief snippets of Bram Stoker's "Dracula".
Read 7 tweets
Thanks @zedster. We took a quick look at the ones that are still live.

cc: @ZellaQuixote
We found 44 still-active accounts tweeting the text "Donald Trump teases 'big announcement' in Iowa" accompanied by a link of some sort. Hilariously, a couple of them tweeted it in September 2017, over a year late to the party.
Of those 44 accounts, 20 were flagged as bots based on 90+% of tweets being posted via automation services, 24/7 activity, or both. 5 of those were the official accounts of radio/TV stations, but the other 15 are interesting. . .
Read 4 tweets

Related hashtags

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3.00/month or $30.00/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!