Oh look, more pornbots. Some of the syntax and spelling is a bit off, but looks like they're fond of the metric system. #FridayFeeling #Spamtastic
cc: @ZellaQuixote
cc: @ZellaQuixote
By searching for other accounts tweeting the same tweets as the first few pornbots we ran across, and in turn searching for the tweets tweeted repeatedly by those accounts, we were able to flesh out the network to 1469 accounts, created over a span of less than 48 hours.
As we might've mentioned, these accounts repeat tweets. They appear to draw on a library of 399 unique tweets which they tweet accompanied by a photo. Some of the accounts also have one or two early tweets consisting of brief snippets of Bram Stoker's "Dracula".
These 1469 accounts tweet exclusively via the Twitter website. Although this is generally a sign that tweet activity is organic, the website can be automated, and the complete absence of ANY tweets sent via either iPhone or Android app is a sign that this activity is inauthentic.
Another pattern: nearly all of the tweets posted by this botnet were processed by the same Twitter datacenter, a possible indicator that they were sent from the same location/IP address range.
Just for fun, we analyzed the first names used by this botnet. It used 424 unique first names across 1469 accounts, with Jennifer, Jessica, Michelle, Melissa, and Lisa being the most popular choices.
Footnote: it's not unlikely that we've seen a previous incarnation (or several) of this botnet. . .
