Answer: the video, originally tweeted by @CindyScarbrou17, has been embedded in 1353 tweets from 1140 different accounts. Although none of the individual tweets got much attention, the video racked up a decent view count due to the the sheer number of tweets containing it.
These accounts are part of a Korean-language pornbot network consisting of (at least) 4291 accounts with repetitive naming schemes, created in batches between September 30th and November 18th, 2020. The older accounts host the original videos, and the newer ones embed them.
The accounts in this network all (allegedly) tweet via the Twitter Web App, but due to the sheer number of accounts and the repetitive nature of the content, we suspect they are automated rather than human-operated. All tweets containing text are in Korean.
Did we mention this botnet is quite repetitive? Although it has tweeted 101205 times, it has only shared 383 unique pieces of content (mostly video, with a few still images thrown in). The most frequently tweeted video was posted 3280 times on 2170 distinct accounts.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
Answer: a few recent @globaltimesnews tweets have been amplified by two distinct groups of bots. (It's possible that they are part of the same network, but we can't prove this, so we treated them as two separate botnets for the sake of this analysis.) #ATaleOfTwoBotnets
The smaller of the two botnets consists of 76 accounts created in October and November 2020, all (allegedly) tweeting via the Twitter Android App. In an apparent lapse of creativity on the part of the botnet operators, 36 of the accounts are named either "Barb" or "Barbara".
It turns out that when one reverse image searches a GAN-generated face pic, some of the results are other GAN-generated face pics. We used Yandex, as it was more effective than Google and is easier to automate. (This doesn't work with TinEye, which only finds exact matches.)
We generated 500 face pics using thispersondoesnotexist(dot)com, reverse searched them using Yandex, and filtered the results to Twitter profile pics, yielding 35 accounts (plus a few suspended ones). As usual, the major facial features are in the same place on each image.
We snagged the last 10 days worth of replies sent via Mobile Web (M2), and noticed a couple of interesting spikes in the creation dates of the accounts (on October 29th and November 1st, 2020). What's up with that? #MondayMotivation
Answer: the two spikes in creation dates appear to be an Arabic-language retweet/reply botnet, consisting of (at least) 149 accounts created in late October/early November 2020.
(We think there are actually more accounts, but we'll get to that later.)
The majority of this botnet's content is retweets of a variety of Arabic-langauge accounts. Based on Google's (potentially erroneous) translations of the most popular tweets, the majority of the content is discount codes for various products and services.
We took a look at the follower of popular right-wing Twitter account @ColumbiaBugle. The vast majority of its followers look like run-of-the-mill #MAGA accounts, but we found an interesting group of batch-created accounts lurking among its earliest followers.
We searched the followers of the other accounts followed by @ColumbiaBugle's early batch-created followers to see if we could find more, but came up empty handed. Interestingly, @ColumbiaBugle is the *only* account followed by all 154 accounts.
The accounts in this fake follower network were created in batches in late 2015 and early 2016. None have tweeted or liked a tweet. Several have names that are takeoffs on 2016 GOP presidential candidates (@MRubioooooo, @TedCruzzinn, @cruzin_teddy). All have default profile pics.
Answer: they're from a reply spam botnet we didn't know quite what to make of when we first saw it. It is now on a mission to promote forex trading/cryptocurrency content. ("Nicholas Shawn" appears to be a reference to the "Nick Shawn" Youtube channel.)
This botnet consists of 48 accounts, all created in September or October 2020. (We found 35 accounts when we first looked at it). Almost all tweets are replies sent via "Mobile Web (M2)".
This seems like an excellent day to look at a (mostly) Russian-language follower/retweet botnet that uses GAN-generated pics (presumably created using thispersondoesnotexist.com or a similar tool). #FridayShenanigans
This botnet consists of 53 accounts created between August 12th and August 16th, 2020. All have randomly generated usernames consisting of digits and lowercase letters and Cyrillic display names.
Here are the profile pics of all 53 accounts in the botnet, as well as the result of blending them together. The eyes align perfectly (as do the mouth and ears other than slight variations in angle and position), a trait common to all unmodified face pics generated with StyleGAN.