We reached into the IFTTT cookie jar in search of botnets, and did not return empty handed. To start out, we grabbed the most recent 100K tweets without links sent via IFTTT. #SundaySpam
Search used:
source:IFTTT -filter:links exclude:retweets
cc: @ZellaQuixote
Search used:
source:IFTTT -filter:links exclude:retweets
cc: @ZellaQuixote
@ZellaQuixote Next, we looked at the creation dates of the 17479 accounts that sent the tweets in question. We analyzed the three largest spikes in new account creations:
1) April 26th - 27th 2017
2) September 9th - 21st 2017
3) January 23rd - 28th 2019
1) April 26th - 27th 2017
2) September 9th - 21st 2017
3) January 23rd - 28th 2019
@ZellaQuixote The first spike (April 2017) is a network of 52 Korean-language IFTTT bots. All 52 operate on identical scheduls and have names consisting of 4 digits, followed by 4 letters, followed by 4 digits, followed by 2 letters, and finally followed by a "1". 50 of 52 have female avatars.
@ZellaQuixote Although these 52 bots do not repeat tweets verbatim, they are incredibly repetitive: tweets are assembled from Korean text that is reused repeatedly with an English date/timestamp thrown in to the middle of the tweet.
@ZellaQuixote The third spike (January 2019) consists of 147 IFTTT bots. Like the group created in April 2017, they tweet in Korean, but unlike those accounts they all have identical profile pics, which appear to be the logo for a cryptocurrency website called CME88(dot)com.
@ZellaQuixote These 147 IFTTT bots bear a couple of additional similarities to the first group of Korean-language bots: same schedule and they likewise use English timestamps. Every one of the most recent 3200ish tweets from these 147 bots (473257 tweets total) contains the text "CME88com".
@ZellaQuixote Last but far from least, we have the second spike, consisting of 1138 IFTTT bots created (mostly) in September 2017. These bots spammishly tweet the hashtags #RewardsPoints, #MembersGetIt, and #FindYourRoute (among others) and clone-retweet @MariottRewards/@MariottBonvoy.
@ZellaQuixote Unlike the Korean accounts, this network does repeat tweets verbatim frequently, both within and across accounts. The most common tweet, tweeted (at least) 275359 times by (at least) 424 accounts, is simply "#MembersGetIt #RewardsPoints #FindYourRoute #MRpoints".
@ZellaQuixote Why thank you for cloning that tweet, @Anthony32121 who is also Jim!
(This one uses an app called "Basic Application - Network" rather than IFTTT, which is why it didn't show up as part of the #RewardsPoints botnet.)
(This one uses an app called "Basic Application - Network" rather than IFTTT, which is why it didn't show up as part of the #RewardsPoints botnet.)
