It's a Saturday in May, and an armada of spamtastic pornbots is taking an interest in geometry.
cc: @ZellaQuixote
cc: @ZellaQuixote
This may be the largest pornbot network we've yet encountered; 12940 accounts have posted 539599 tweets since May 1st, almost exclusively via Mobile Web (M2). All usernames consist of a first name followed by an underscore and 5 digits, and display names are in block letters.
A significant majority of this network's traffic (90.5% of tweets since May 1st) is handled by the same datacenter, a potential indicator that the accounts are being run from the same location or internet connection.
The accounts in this botnet are mostly older, and we've been accumulating a dataset of older twitter accounts by iterating through ID numbers. Can we find additional dormant members of the network by searching the old accounts for others with the same naming conventions?
(more on the old accounts and how we've used this data)
By doing this, we found an additional 17281 accounts that appear to be part of the botnet, bringing the total size to 30221 accounts. There are almost certainly more, as our old accounts dataset only covers a span of roughly 26 months.
The Mobile Web (M2) porn spam from this network appears to have started in mid-2019, and thus far 17343 accounts have joined in, while the remaining 12878 have been dormant for years. Some of them (both slumbering and active) have older tweets, sent via a variety of apps.
The profile content of these accounts is extremely repetitive - only 246 unique first names are used across 30221 accounts. Profile photos and biographies are also prolifically reused, with many appearing on hundreds of accounts.
The tweet content posted by this botnet is repetitive, too - most tweets are sent verbatim by hundreds or thousands of accounts (the picture accompanying the text may vary, although the pictures repeat as well.)
