Oh look, more pornbots, tweeting in Korean this time. Despite the reassuring presence of four heart emoji in each tweet, we don't recommend clicking their obfuscated links. #SundaySpam
cc: @ZellaQuixote
cc: @ZellaQuixote
We found a total of 1342 accounts that appear to be part of this botnet. Most were created in April or May 2020, although a few are older. None have liked more than 2 tweets, and all theoretically tweet via the old version of the Twitter website ("Twitter Web Client.")
The links in these pornbots' tweets are redirected via the tinyurl(dot)com link shortening service, followed by several other redirectors before arriving at newkitchen(dot)co(dot)kr, a Korean website than unsurprisingly seems more focused on nudity than actual kitchens.
This pornbot network generally activates once a day, cycling between accounts over a period of several hours. Each account contributes a single tweet, with the end result being hundreds of spammy tweets promoting the newkitchen porn website each day.
(examples of the tweet schedules of individual accounts in this network)
As is pretty much always the case with porn spam networks we've analyzed, these bots use stolen profile pics. (We had more luck finding the black-and-white than full-color pics in this set via reverse search for some reason, not sure why.)
