It's a Friday, and a coterie of bots is bombarding folks' mentions with repetitive solicitations to buy masks from some random Twitter account. With a website named "bigsales-amazon(dot)com" (NOT the real Amazon), what could possibly go wrong? #coronagrift
cc: @ZellaQuixote
cc: @ZellaQuixote
We found 17 accounts operating on identical schedules and spamming repetitive replies directing folks to purchase masks from @Shop_Mask_USA's website. Although they (seemingly) only began tweeting in May 2020, the accounts are all several years old.
Additionally, almost all of the tweets posted by these 17 accounts were processed by the same Twitter datacenter, suggesting they were sent via the same internet connection. (Tweet IDs contain information on which datacenter processed them, details here: )
The site supposedly selling the masks, bigsales-amazon(dot)dom, redirects to e-medicaltools(dot)com. Both domains were registered May 6, 2020. Despite being only 2 days old, the site features tons of supposed reviews from happy customers with names like "Prof Derek Botsford III."
Who do the face mask spambots reply to? Mostly major US-focused media and political accounts, hailing from both ends of the political spectrum (with occasional celebrity accounts mixed in.) Each of the 17 accounts has placed exactly one ad on Twitter; all are images of masks.
As mentioned earlier, these accounts have been around far longer than the few days they've been tweeting face mask spam. Currently, they have no tweets prior to May 2020, but a few quick searches reveal a multitude of replies to now-deleted tweets from the accounts in the botnet.
Fortuitously, we've been assembling a dataset of older Twitter accounts and as a result have data on what five of these bots looked like prior to the mask spam. Based on the hashtags used, they were Indonesian TweetDeck pornbots in a past life. #WeKnowWhatYourBotnetDidLastWinter
(some other ways we've used the dataset of old accounts to find botnets)
