Meet @DianaWi59797083, a newly-created pro-Trump account that can't seem to decide whether its name is Blake or Diana. It probably doesn't matter, since it's using a plagiarized profile pic that's been floating around the internet for years. #YouHadOneJob
Compounding the hilarity, the first account to retweet @DianaWi59797083 is @JasonMAGA4ever, an account created a couple weeks ago. In what is doubtless a total coincidence, @JasonMAGA4ever is also using a stolen profile photo.
We weren't able to retrieve the early retweets of @JasonMAGA4ever's tweets, so the saga ends there for now, but we wouldn't be surprised if its Twitter career was bootstrapped with the aid of additional bogus #MAGA accounts with stolen pics.
Another interesting detail: @JasonMAGA4ever is retweeting Mike Pence and Kayleigh McEnany "parody" accounts that are hawking unofficial Trump 2020 T-shirts.
Instead of stolen photos, @Concerned4us_ and @TeddyRobMAGA use GAN-generated profile pics (note that eyes, nose, and mouth line up perfectly when the images are blended). Both were created in November 2020 and have similar pinned tweets to the other accounts in the network.
(animated visualization of blending @Concerned4us_ and @TeddyRobMAGA's profile pics, demonstrating the telltale positioning of major facial features common to face pics generated by StyleGAN/thispersondoesnotexist)
• • •
Missing some Tweet in this thread? You can try to
force a refresh
Answer: a few recent @globaltimesnews tweets have been amplified by two distinct groups of bots. (It's possible that they are part of the same network, but we can't prove this, so we treated them as two separate botnets for the sake of this analysis.) #ATaleOfTwoBotnets
The smaller of the two botnets consists of 76 accounts created in October and November 2020, all (allegedly) tweeting via the Twitter Android App. In an apparent lapse of creativity on the part of the botnet operators, 36 of the accounts are named either "Barb" or "Barbara".
Answer: the video, originally tweeted by @CindyScarbrou17, has been embedded in 1353 tweets from 1140 different accounts. Although none of the individual tweets got much attention, the video racked up a decent view count due to the the sheer number of tweets containing it.
These accounts are part of a Korean-language pornbot network consisting of (at least) 4291 accounts with repetitive naming schemes, created in batches between September 30th and November 18th, 2020. The older accounts host the original videos, and the newer ones embed them.
It turns out that when one reverse image searches a GAN-generated face pic, some of the results are other GAN-generated face pics. We used Yandex, as it was more effective than Google and is easier to automate. (This doesn't work with TinEye, which only finds exact matches.)
We generated 500 face pics using thispersondoesnotexist(dot)com, reverse searched them using Yandex, and filtered the results to Twitter profile pics, yielding 35 accounts (plus a few suspended ones). As usual, the major facial features are in the same place on each image.
We snagged the last 10 days worth of replies sent via Mobile Web (M2), and noticed a couple of interesting spikes in the creation dates of the accounts (on October 29th and November 1st, 2020). What's up with that? #MondayMotivation
Answer: the two spikes in creation dates appear to be an Arabic-language retweet/reply botnet, consisting of (at least) 149 accounts created in late October/early November 2020.
(We think there are actually more accounts, but we'll get to that later.)
The majority of this botnet's content is retweets of a variety of Arabic-langauge accounts. Based on Google's (potentially erroneous) translations of the most popular tweets, the majority of the content is discount codes for various products and services.
We took a look at the follower of popular right-wing Twitter account @ColumbiaBugle. The vast majority of its followers look like run-of-the-mill #MAGA accounts, but we found an interesting group of batch-created accounts lurking among its earliest followers.
We searched the followers of the other accounts followed by @ColumbiaBugle's early batch-created followers to see if we could find more, but came up empty handed. Interestingly, @ColumbiaBugle is the *only* account followed by all 154 accounts.
The accounts in this fake follower network were created in batches in late 2015 and early 2016. None have tweeted or liked a tweet. Several have names that are takeoffs on 2016 GOP presidential candidates (@MRubioooooo, @TedCruzzinn, @cruzin_teddy). All have default profile pics.
Answer: they're from a reply spam botnet we didn't know quite what to make of when we first saw it. It is now on a mission to promote forex trading/cryptocurrency content. ("Nicholas Shawn" appears to be a reference to the "Nick Shawn" Youtube channel.)
This botnet consists of 48 accounts, all created in September or October 2020. (We found 35 accounts when we first looked at it). Almost all tweets are replies sent via "Mobile Web (M2)".