Oh look, more pornbots. This network hypothetically tweets via Mobile Web (M2) (an older version of the Twitter website for mobile phones) and uses link redirection service rebrand(dot)ly to shorten/disguise its links. #SundaySpam
cc: @ZellaQuixote
cc: @ZellaQuixote
@ZellaQuixote We found a total of 91 accounts tweeting shortened porn links via Mobile Web (M2). The entire group activated shortly after midnight PST on 2/9, and all were created in the 2 hours immediately prior. The botnet has generated an average of 69 tweets per minute since coming online.
@ZellaQuixote So far, every single tweet posted by these 91 accounts contains a rebrand(dot)ly short link that redirects to the actual porn site being peddled, zavmosse(dot)pw. As always, be wary of clicking links from dodgy botnets.
@ZellaQuixote In an utterly unsurprising development, this botnet uses stolen profile photos. Yandex reverse image search found 89 of the 91 accounts' profile pics on sites other than Twitter (and usually more than one.)
@ZellaQuixote In an interesting turn of events, the original 91 pornbots described in this thread stopped tweeting as of ~9:30 PM PST. They have been replaced with 105 new ones, all created within the span of two hours earlier today (Feb 9, 2020.)
@ZellaQuixote Most of the accounts in the first two waves of this porn botnet have been suspended by Twitter, but a new set has been created, and the operators seem to be scaling up - (at least) 216 accounts in the current wave, more than double the size of either of the previous iterations.
@ZellaQuixote Another day, and 75 additional accounts have been added to this pornbot network (although some of yesterday's crop have been suspended.) #WednesdayWisdom
@ZellaQuixote The accounts in this pornbot network continue to get suspended and replaced on a daily basis. The latest batch of 71 was created yesterday morning (Feb 12) and started spamming yesterday evening around 9 PM PST.
#ThursdayThoughts
#ThursdayThoughts
@ZellaQuixote Apparently #ValentinesDay2020 merits an extra-large batch of pornbots. 213 new accounts came online shortly before midnight, thrice the size of the previous wave.
@ZellaQuixote 203 additional accounts have been added to this botnet. Although the majority of the previous day's wave of pornbots has thus far eluded suspension, the old accounts have gone silent anyway - this morning's traffic is all from the new batch.
@ZellaQuixote It's Monday, and this pornbot network has kicked off the week with 179 new accounts. Once again, most of the previous wave of bots has been suspended, but even those that are still online have stopped tweeting. #MondayMotivation
@ZellaQuixote 249 accounts in the most recent batch, making it the largest batch we've seen so far since we started monitoring this pornbot network. The volume of tweets produced continues to be high; presently ~150 per minute.
@ZellaQuixote Today's batch of "Mobile Web (M2)" pornbots is smaller - 110 accounts. Once more, accounts from previous waves have gone silent even if not suspended. #WednesdayWisdom
@ZellaQuixote 125 new accounts have been added in the latest wave of this pornbot network. In an interesting twist, all the surviving accounts from previous waves have now been suspended. #FridayFeeling
@ZellaQuixote Today's installment of the Mobile Web (M2) pornbot network consists of an impressive 2190 accounts, more than eight times the size of any previous wave. All but 21 of the accounts from previous waves have been removed by Twitter. #SaturdaySpam
@ZellaQuixote The escalation in volume continues with the 13th batch of Mobile Web (M2) pornbots, consisting of 2278 accounts generating an average of 150-300 tweets per minute across the network.
@ZellaQuixote The latest batch of pornbots in this network is smaller than the last two; "only" 478 accounts. Interestingly, they dialed back their tweet volume substantially at ~2 AM PST, possibly in an attempt to be less visible to Twitter's spam filters.
