,
11 tweets,
8 min read
Read on Twitter
Meet @elcopcota, a Twitter account with a stolen profile pic whose one and only original tweet contains a link to a (possible unsafe) porn site. #IndependeceDay
cc: @ZellaQuixote
cc: @ZellaQuixote
Is @elcopta a solo act or part of a network? Searching Twitter for tweets linking the site it promotes (flirtcontact(dot)com) turns up very little, as the site isn't linked directly in the tweet - it contains a bitly link to a blogspot page that redirects to the actual site.
We can, however, work around this by searching for tweets that A) link both bitly and blogspot and B) contain key terms (sex/sexy + various words for chatting) and filtering out false positives.
We found 2338 accounts that are likely part of the network. All have exactly one tweet that isn't a retweet, with the following traits:
- redirected porn site link
- is one of account's first 10 tweets
- contains sex/sexy + talk/talking/chat/chatting/write/writing + emoji
- redirected porn site link
- is one of account's first 10 tweets
- contains sex/sexy + talk/talking/chat/chatting/write/writing + emoji
All but the first account in the network (@klaspeswadu) were created in batches - a couple smaller ones in early April, with a larger set created in mid-June. Although the individual accounts have gaps in activity, the operation as a whole runs 24/7.
The 2338 accounts have very self-similar names and profiles. Account names appear randomly generated but are largely pronounceable and the letter distribution is consistent with English, as shown by the correlation to Scrabble point values. Account bios consist of single emoji.
Like the names, the tweets posted by the accounts appear randomly generated (and the same goes for the names of the blogspot blogs used for redirection to the porn site.) All could have been plausibly generated via Markov chains, although other techniques would work too.
Other than the single tweet linking the dodgy site, the 2338 accounts in this network do nothing but retweet. These bots mostly retweet tweets that have received very little attention, and don't focus on specific accounts - they've RT'd 353474 tweets from 325639 accounts.
A couple final notes about myflirtcontacts(dot)com. (Use protection - VPN/proxy/Tor - when visiting dodgy sites like this, btw.)
- site is registered in the Seychelles
- when visiting from some (not all) Tor exit nodes, the links redirect to Wikipedia instead of the porn site
- site is registered in the Seychelles
- when visiting from some (not all) Tor exit nodes, the links redirect to Wikipedia instead of the porn site
(previous threads on similar botnets)
*correct account name: @elcopcota
