Oh hey, it's a post on blackhatworld(dot)com offering 50 free Twitter followers to whomever replies. Let's see what they look like. #SeemsLegit #ThursdayThoughts

cc: #ZellaQuixote
We downloaded the followers of six of the accounts that replied to the blackhatworld(dot)com post offering free followers, and indeed each has a streak of batch-created followers from summer 2020, most of which have never liked a tweet.
These batch-created followers are part of a fake engagement botnet consisting of 96 accounts, all created between June and August 2020. They supposedly tweet via the Twitter website, but due to frequent 24/7 activity (among other things), we believe them to be automated.
Almost all of this botnet's tweets are retweets (41067 of 41252, 99.5%). Cryptocurrency/blockchain and soccer are the most common themes. The bots follow a wide variety of smaller accounts, mostly not the same accounts they retweet.
As is common with spammy botnets, these accounts use stolen profile pics. There's a twist: most of the pics have been cropped substantially, possibly to disrupt attempts to discover the plagiarism via reverse image search. (If so, it didn't work.)

• • •

Missing some Tweet in this thread? You can try to force a refresh

Keep Current with Conspirador Norteño

Conspirador Norteño Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!


Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @conspirator0

20 Nov
This seems like an excellent day to look at a (mostly) Russian-language follower/retweet botnet that uses GAN-generated pics (presumably created using thispersondoesnotexist.com or a similar tool). #FridayShenanigans

cc: @ZellaQuixote
This botnet consists of 53 accounts created between August 12th and August 16th, 2020. All have randomly generated usernames consisting of digits and lowercase letters and Cyrillic display names. ImageImage
Here are the profile pics of all 53 accounts in the botnet, as well as the result of blending them together. The eyes align perfectly (as do the mouth and ears other than slight variations in angle and position), a trait common to all unmodified face pics generated with StyleGAN. Image
Read 6 tweets
18 Nov
Cryptocurrency content is an ever-popular target for spammy Twitter botnets. Here's a look at a group of accounts that all quote tweet the same cryptocurrency tweets. #WednesdayWisdom

cc: @ZellaQuixote
This cryptocurrency network consists of 34 accounts, all created on March 3rd, 2019. Despite cramming their profiles with abundant #followback hashtags, they haven't had much success in gaining followers.
These 34 accounts all operate on very similar schedules (which isn't surprising as they all amplify the same tweets), and allegedly tweet via the Twitter website ("Twitter Web App"), although we have our doubts that the tweets are actually organic.
Read 5 tweets
18 Nov
We explored the followers of the accounts followed by @JaMaalBuster's batch-created followers to see if we could find more accounts that were part of the same botnet, and did not return empty-handed. #TuesdayThoughts

cc: @ZellaQuixote
We found a total of 36698 accounts, all created in July or August 2013. None of these accounts has ever tweeted or liked a tweet, and the first name and last name in their display names do not match their @-names (@Gerlach_Dianna9 is "Estella Fritsch", for example).
Who do the accounts in this botnet follow? As is often the case with bulk follow botnets, there's a lot of variety. One account, @Wolfvee11, is followed by all 200 of the accounts in our sample (and 36510 of 36698 of the bots in the network, 99.5%).
Read 6 tweets
16 Nov
What's up with all these accounts who are getting divorced and moving to <insert place name here> following the revelation that their wives voted for Joe Biden? (Spoiler: they're not bots.)

cc: @ZellaQuixote
We downloaded tweets (excluding retweets) containing "my wife told me", "she voted for Joe Biden", and "divorced", yielding 1119 tweets from 604 accounts. A grand total of 2 of those accounts (@CrapAmericaSays and @tsbcomng) appear to be automated, so bots aren't the story here.
Here are the first 15 accounts to tweet "my wife told me (that) she voted for Joe Biden" and mentioning getting divorced. Almost all of them, including the first account (@wernerstarCEO) are UK football fan accounts rather than politically-themed accounts.
Read 5 tweets
16 Nov
In an interesting coincidence, this tweet linking what appears to be an unauthorized livestream of a sporting event was retweeted by a bunch of similarly-named accounts created in May 2013. #SundaySpam

cc: @ZellaQuixote
These accounts are part of a botnet promoting what we believe to be pirated livestreams of a variety of sporting events. (Among other things, many of the accounts have had tweets removed for copyright violations.
This botnet consists of two types of accounts: 206 accounts that link the pirated streams in their tweets, and 16 accounts that retweet them.
Read 9 tweets
15 Nov
If you're looking for tweets discussing half of a wanderer or spider and don't mind the utter absence of coherent sentences, this botnet will be right up your alley. #SundaySentenceFragments

cc: @ZellaQuixote
This botnet consists of 25 accounts, all created in October or November 2020. All of their biographies are lengthy resumes of seemingly random occupations, and all tweet exclusively via "Twitter Web Client" (the old and hypothetically unavailable version of the Twitter website).
Each account in this botnet has thus far activated exactly once, firing off 4-6 tweets over the span of a minute or two, and then going silent. The tweets themselves are (likely randomly generated) mashups of words, phrases, and sentence fragments rather than complete sentences.
Read 5 tweets

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!

Follow Us on Twitter!