The holiday season may have drawn to a close, but these trend-hijacking pornbots seem to have missed the memo. #ReleaseTheMemo #ThursdayThoughts
cc: @ZellaQuixote
cc: @ZellaQuixote
@ZellaQuixote By searching for the repeated phrases used by the pornbots, we found 19 accounts. All supposedly tweet via the "Twitter Web Client" (the old version of the Twitter website), but due to repetition of content and frequently inhuman sleep schedules, we believe them to be automated.
@ZellaQuixote Here are the 40 trends that this botnet most frequently grafts onto its tweets. Holidays, sports, and recent political/news topics make up the bulk of the list. All appear to be U.S. trends (or have at least trended recently in the U.S.). These bots drop the "#" from hashtags.
@ZellaQuixote These 19 pornbots are extremely repetitive - once one removes the hijacked trends from their tweets, they have a library of a grand total of 23 tweets that they repeat over. . . and over. . . and over.
@ZellaQuixote Do these bots use stolen pics? They sure do - we were able to find previous uses of the majority of the photos via TinEye or Yandex reverse image searches (Google did not perform well on this set of accounts.)
@ZellaQuixote One final detail: the domain name of the website linked by these pornbots, myjuicypussy(dot)fun (yes, really) is registered in Russia. (Note that this doesn't necessarily mean that the operators are physically located in said country, however.)
@ZellaQuixote Actually, make that (at least) 27 accounts.
@ZellaQuixote Update: 37 bots. Some of the "new" ones were likely either search-banned or restricted when we did our original analysis yesterday, so we wouldn't be surprised if there are still more of them out there.
