If you're looking for a payday loan in multiple languages from a dysfunctional website, this botnet might be your thing. #SaturdaySpam #DigitalLoanSharkFail
cc: @ZellaQuixote
cc: @ZellaQuixote
@ZellaQuixote This botnet consists of three accounts: @AfanasevaErmina, @OlgaKir37407272, and @AfanasevaErmina. All three tweet hashtag-drenched solicitations for short-term loans in multiple languages targeting multiple countries round-the-clock.
@ZellaQuixote @AfanasevaErmina @OlgaKir37407272 The website linked by the bots (teletype(dot)in/@nadezhdabekreneva1) no longer loads, but we found a cached copy on Google. Needless to say, it doesn't exactly look like a reputable financial institution. It contains links to another site, paydayloan(dot)date. . .
@ZellaQuixote @AfanasevaErmina @OlgaKir37407272 We attempted to load paydayloan(dot)date via Tor, but were unsuccessful. We did manage to determine that the site is/was hosted by a Russian web hosting company, vdsina(dot)ru.
@ZellaQuixote @AfanasevaErmina @OlgaKir37407272 In addition to the payday loan spam, the three bots in this network have occasionally retweeted other spammy accounts. One of them, @simchacollecti1, gets a surprising number of retweets for its 198 followers. What's going on?
@ZellaQuixote @AfanasevaErmina @OlgaKir37407272 @simchacollecti1 We looked at accounts that retweeted @simchacollecti1 more than once, and found 245. Almost all are recent creations. 28 supposedly tweet via "Twitter Web Client" but are obvious bots due to round-the-clock activity; the remainder are relatively low-volume.
@ZellaQuixote @AfanasevaErmina @OlgaKir37407272 @simchacollecti1 This network retweets a variety of accounts, but the common denominator seems to be commercial/promotional spam - it retweets links to various goods and services on platforms such as fiverr and etsy, as well as blogs and amateur porn sites.
@ZellaQuixote @AfanasevaErmina @OlgaKir37407272 @simchacollecti1 *correction: list should be @AfanasevaErmina, @katenar2, and @OlgaKir37407272.
