Here’s what at first glance appears to be a relatively small botnet: 13 accounts, all created near the end of October 2019, and all devoted to spamming links to akroncantonjoycegroup(dot)us (as always, be wary of clicking links.)
cc: @ZellaQuixote
cc: @ZellaQuixote
@ZellaQuixote As with many botnets, these bots repeat tweets, both on individual accounts and across multiple accounts. Curiously, we found a copy of one of the tweets used by this botnet on an account spamming links to a different site, mysillk(dot)us.
@ZellaQuixote Much like akroncantonjoycegroup(dot)us, mysillk(dot)us has a Twitter botnet devoted to promoting it. This one consists of at least 18 accounts, all created in October or November 2019. Are there other groups like this promoting other sites?
@ZellaQuixote A curious feature of some of the tweets posted by the bots in question - invisible spaces in tweets (actually Unicode character 8203.) This results in human-readable tweets that are difficult to search due to the invisible spaces breaking apart the words.
@ZellaQuixote The invisible spaces make it difficult to find additional groups of accounts by searching for repeated tweets, but does open the door to an alternate technique: download a bunch of recent tweets containing links and look for the invisible space character.
@ZellaQuixote Using this technique, we found 22 sites being promoted by a network of 458 accounts, all created October 2019 or later and likely automated despite appearing to tweet via the Twitter website. The sites themselves are (possibly malicious) redirectors to more well-known sites.
@ZellaQuixote Here’s the network after filtering out the invisible spaces (two accounts are connected if they have tweeted the same tweet at least once.) The networks for each site are largely separate, with occasional connections where the same text is accompanied by links to different sites.
@ZellaQuixote H/T @ushadrons for the lead.
