We explored the followers of the accounts followed by @JaMaalBuster's batch-created followers to see if we could find more accounts that were part of the same botnet, and did not return empty-handed. #TuesdayThoughts
We found a total of 36698 accounts, all created in July or August 2013. None of these accounts has ever tweeted or liked a tweet, and the first name and last name in their display names do not match their @-names (@Gerlach_Dianna9 is "Estella Fritsch", for example).
Who do the accounts in this botnet follow? As is often the case with bulk follow botnets, there's a lot of variety. One account, @Wolfvee11, is followed by all 200 of the accounts in our sample (and 36510 of 36698 of the bots in the network, 99.5%).
Hilariously, @Wolfvee11 (the account followed by nearly every account in this botnet) has a bunch of tweets accusing Twitter of banning its followers based on political stance. Somehow, we're skeptical that the claimed reason for the bans is accurate.
This botnet reuses profile pics prolifically, with only 1266 distinct images (including the default) between 36698 accounts. The most-frequently used non-default pic shows up on 61 different accounts.
Per Google search, the images used by this botnet have also been used repeatedly on other social media sites. Due to the frequency with which the pics appear, we're not sure where they originated, but they are presumably stolen.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
Oh hey, it's a post on blackhatworld(dot)com offering 50 free Twitter followers to whomever replies. Let's see what they look like. #SeemsLegit#ThursdayThoughts
We downloaded the followers of six of the accounts that replied to the blackhatworld(dot)com post offering free followers, and indeed each has a streak of batch-created followers from summer 2020, most of which have never liked a tweet.
These batch-created followers are part of a fake engagement botnet consisting of 96 accounts, all created between June and August 2020. They supposedly tweet via the Twitter website, but due to frequent 24/7 activity (among other things), we believe them to be automated.
Cryptocurrency content is an ever-popular target for spammy Twitter botnets. Here's a look at a group of accounts that all quote tweet the same cryptocurrency tweets. #WednesdayWisdom
This cryptocurrency network consists of 34 accounts, all created on March 3rd, 2019. Despite cramming their profiles with abundant #followback hashtags, they haven't had much success in gaining followers.
These 34 accounts all operate on very similar schedules (which isn't surprising as they all amplify the same tweets), and allegedly tweet via the Twitter website ("Twitter Web App"), although we have our doubts that the tweets are actually organic.
What's up with all these accounts who are getting divorced and moving to <insert place name here> following the revelation that their wives voted for Joe Biden? (Spoiler: they're not bots.)
We downloaded tweets (excluding retweets) containing "my wife told me", "she voted for Joe Biden", and "divorced", yielding 1119 tweets from 604 accounts. A grand total of 2 of those accounts (@CrapAmericaSays and @tsbcomng) appear to be automated, so bots aren't the story here.
Here are the first 15 accounts to tweet "my wife told me (that) she voted for Joe Biden" and mentioning getting divorced. Almost all of them, including the first account (@wernerstarCEO) are UK football fan accounts rather than politically-themed accounts.
In an interesting coincidence, this tweet linking what appears to be an unauthorized livestream of a sporting event was retweeted by a bunch of similarly-named accounts created in May 2013. #SundaySpam
These accounts are part of a botnet promoting what we believe to be pirated livestreams of a variety of sporting events. (Among other things, many of the accounts have had tweets removed for copyright violations.
This botnet consists of two types of accounts: 206 accounts that link the pirated streams in their tweets, and 16 accounts that retweet them.
If you're looking for tweets discussing half of a wanderer or spider and don't mind the utter absence of coherent sentences, this botnet will be right up your alley. #SundaySentenceFragments
This botnet consists of 25 accounts, all created in October or November 2020. All of their biographies are lengthy resumes of seemingly random occupations, and all tweet exclusively via "Twitter Web Client" (the old and hypothetically unavailable version of the Twitter website).
Each account in this botnet has thus far activated exactly once, firing off 4-6 tweets over the span of a minute or two, and then going silent. The tweets themselves are (likely randomly generated) mashups of words, phrases, and sentence fragments rather than complete sentences.
Meet @SRRRJ, @Srm1n, @DemiLovatoTH, @banci__, and @gdibarry, a quintet of automated accounts that tweet CNN articles accompanied by partial headlines and tag @null (a suspended account) in each tweet.
These five accounts presently send all of their tweets via automation service twittbot(dot)net. There are two distinct schedule patterns, so it's possible this is two separate botnets, but since the accounts are otherwise similar we analyzed them as a single network.
What does this botnet tweet? It's quite single-minded: all recent tweets (the last ~3200 from each account) contain links to CNN, accompanied by the beginning of the title of whatever article/video is being linked.