What's up with the spike in recently-created accounts that use automation service twittbot(dot)net to tweet? #TuesdayThoughts
cc: @ZellaQuixote
Answer: a botnet, unsurprisingly. We found 1824 extremely similar accounts created between June 3rd and July 17th, 2020, all with randomized 13-character names, zero likes, and few or no followers or followees. All 1824 tweet primarily in Japanese.
This botnet operates 24/7, and has been steadily ramping up activity as additional accounts are created (with a brief gap in early July). At present the network is churning out over 2000 tweets per hour, almost all via automation service twittbot(dot)net.
What does this botnet tweet? Neither of us read Japanese, but the content seems to be a mix of porn and work-from-home spam. Notably, every tweet contains a QR code for adding some unspecified party (presumably associated with the botnet) as a friend on the LINE chat app.
We've seen this behavior pattern before, also from a now-suspended Japanese botnet that may well be a predecessor of this one.
Share this Scrolly Tale with your friends.
A Scrolly Tale is a new way to read Twitter threads with a more visually immersive experience.
Discover more beautiful Scrolly Tales like this.