Share this page!

Conspirador Norteño Profile picture
Twitter logo
11 Nov, 5 tweets, 3 min read
If what's missing from your Wednesday is a group of newly-minted automated accounts that link randomly named NFL and NBA-themed tumblr pages, this is the botnet for you. (We're as confused as you as to what 1990s NASCAR drivers have to do with the Lakers.)

cc: @ZellaQuixote
We found 29 accounts, all created between November 8th and November 11th 2020. These accounts post all of their tweets via automation service dlvr(dot)it.
Most of this botnet's tweets contain links to tumblr pages of the form nfl*****(dot)tumblr(dot)com or lakers*****(dot)tumblr(dot)com. The tumblr pages are empty other than a "RELOAD NEWS" button that redirects to zeezhop(dot)com. (As always, be wary of links to unknown sites.)
The 29 accounts in this botnet use female profile pics (with the exception of a couple of pics that contain multiple people). The pics appear to be stolen from posts on quora(dot)com, although it's possible there are earlier uses that we didn't find.
This is likely the second incarnation of this particular botnet that we've encountered. Back in June 2020 we found a similar but glitchier group of bots linking sports-themed tumblr pages. If it's run by the same folks, they seem to have fixed some bugs.

• • •

Missing some Tweet in this thread? You can try to force a refresh
　

Keep Current with Conspirador Norteño

Conspirador Norteño Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @conspirator0

Conspirador Norteño Profile picture
12 Nov
We've analyzed a variety of bot/sock networks using coordinated retweeting to make content look more popular than it actually is (astroturfing). For a change of pace, here's a look at a network from 2018 that used quote tweets for artificial amplification.

cc: @ZellaQuixote Image
This June 2018 tweet from @origonetworks received more than 3 times as many quote tweets as retweets (quote tweet/retweet ratio of ~0.05 appears to be average). Furthermore, the accounts that quote tweeted it were disproportionately created in June/July 2018. What happened? Image
To explore further, we looked at other tweets with lopsided quote tweet/retweet ratios quote tweeted by the bulk-created accounts that quote tweeted the @origonetworks tweet, and indeed found more accounts created in June/July 2018 that quote tweeted a lot of the same tweets.
Read 8 tweets
Conspirador Norteño Profile picture
10 Nov
How did this duo of newly-created IFTTT bots get so many retweets on their tweets with embedded ISIS videos despite having almost no followers? #TuesdayThoughts

(Some of the accounts mentioned in this thread got suspended while we were doing the research.)

cc: @ZellaQuixote ImageImage
We downloaded the retweets of the video tweets from the two IFTTT ISIS bots (@3J2IEgC35AMih8R and @Id1kveiZWhI013x), and it turns out that most of the retweets are also automated: 250 of 257 retweets (97.3%) were sent via one of 101 different automation apps. Image
The accounts retweeting the two IFTTT ISIS bots didn't only automate their retweets of these two accounts: 89 of 122 accounts (72.9%) automated at least half of their tweets, and 65 of 122 (53.3%) are at least 80% automated. These accounts were mostly created in 2020. ImageImageImageImage
Read 6 tweets
Conspirador Norteño Profile picture
9 Nov
Meet @Wizard_Predicts, a self-anointed Election Wizard with 106K followers and a taste for dubious tweets about voter fraud. It takes pride in being followed by @DanScavino, @MattGaetz, @DLoesch, and many more. (We'll get back to the "many more" part shortly).

cc: @ZellaQuixote
The first unusual thing we noticed about @Wizard_Predicts: despite it being an English-language pro-Trump account, many of the "Who To Follow" suggestions that come up when viewing its timeline are non-English accounts.
Although @Wizard_Predicts's followers mostly look like English-language #MAGA accounts, things get a weirder when we look at the first 10K or so: the 2009 spike in account creations we usually see is largely absent. (Its first follower is right-wing Twitter pundit @Barnes_Law.)
Read 8 tweets
Conspirador Norteño Profile picture
8 Nov
We explored the follower networks of the 311 dormant bots we found following @keichri, and indeed found a much larger group of old automated accounts.

cc: @ZellaQuixote
We found 25574 automated accounts that we believe to be part of this botnet. All were created in batches between 2012 and 2014, and they use repetitive naming schemes. (This is probably not the whole network, we stopped searching when the pace of finding more accounts slowed.)
These accounts are mostly dormant, but back when they were active they tweeted via a wide variety of automation apps (883 apps total). Almost all of their content is in Russian.
Read 5 tweets
Conspirador Norteño Profile picture
7 Nov
If you've been wanting to meet an automated Reagan conservative who worries about our future by spamming Twitter with links to poorly-source articles about "voter fraud" on a website you've never heard of, @keichri is the account for you. #FridayFeeling

cc: @ZellaQuixote
Almost all (98.5%) of @keichri's recent tweets are automated via dlvr(dot)it. This account has apparently dabbled in automation before, although at least two of the apps it was using have subsequently been shut down (erased7812941 and erased13330229).
The primary mission of @keichri appears to be to promote various right-wing websites, usually obscure ones. Almost all of its tweets since March 2020 link to speakingaboutnews(dot)com, with a previous three and a half year binge of spamming links to conservativeread(dot)com.
Read 7 tweets
Conspirador Norteño Profile picture
6 Nov
It's a Thursday, which is an excellent time to look at a recently created fake follower/retweet botnet that uses GAN-generated profile pics (similar to those produced by thispersondoesnotexist.com). #ThursdayShenaniGANs

cc: @ZellaQuixote
This botnet consists of 164 accounts created between October 9th and October 13th, 2020. All of them either have never tweeted or post all of their tweets (nearly all of which are retweets) via "Twitter Web App".
Here are the profile pics of all 164 accounts in this botnet, as well as the result of blending them together. Like all unmodified pics produced by StyleGAN (the neural network used by thispersondoesnotexist.com), the eyes, nose, and mouth are in the same location on every image.
Read 7 tweets

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!

Follow Us on Twitter!

Like this author's thread?

Get email notifications when new thread is out from this Author!

Check out other threads from this Author!

Read all threads by @conspirator0