A new day, a new porn botnet, or rather the reincarnation of a banned porn botnet to be precise. It's bigger and has evolved a bit, but the mission is the same: get naive people to click the link on the accounts' profiles to formynudes(dot)site. #DontBeNaive
cc: @ZellaQuixote
cc: @ZellaQuixote
This botnet consists of (at least) 347 accounts, created in several batches in June and July 2020. These accounts post most of their tweets via the Twitter Web App (allegedly), and have ramped up volume considerably in the last five days.
Although the use of the Twitter Web App generally indicates organic tweets, the repetitiveness of the accounts and 24/7 activity strongly suggests automation. Note that many of the repeated tweets encourage the reader to visit the website promoted in the accounts' profiles.
Tweets are not the only thing accounts in this network repeat: they also disproportionately use certain first names, with a fifth of them being named Tiffany, Stephanie, Tammy, or Tina. Someone should really send the botnet operators a book of suggested baby names or something.
Do these bots use stolen pics? Oh yes they do, and in at least one case used the *same* stolen photo that was used in a May 2020 incarnation of what is likely the same botnet (subsequently suspended).
As with the previous incarnations of this botnet we've encountered, many of the accounts have a quote or sentence fragment from Bram Stoker's Dracula as their 1st tweet. This time, though, they've replaced the spaces with plus signs in most of the tweets.
