What's up with these accounts retweeting giveaway tweets using apps with names like "Twitter for HUAWEI Y9a"? #SaturdaySpam

cc: @ZellaQuixote
Unsurprisingly, they're part of a botnet, consisting of (at least) 19 accounts that use custom apps with names of the form "Twitter for HUAWEI<xxxx>", and occasionally "Twitter for Android6" (not the real Twitter Android phone app). Most were created in June or October 2020.
The bots in this network do two things: retweet and reply. In both cases, the accounts they interact with are accounts selling access to proxy servers and botting software.
The content the botnet interacts with is mostly giveaway tweets where winners are selected from the retweeters/repliers. The replies consist of the @-names of other accounts in the botnet, likely because many of the tweets retweeted ask folks who retweet to "tag a friend".

• • •

Missing some Tweet in this thread? You can try to force a refresh
 

Keep Current with Conspirador Norteño

Conspirador Norteño Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @conspirator0

5 Dec
Here's an interesting duo: @POLICEFORTRUMPI and @SidneyPowell_ (not the real Sidney Powell). Both were created in Apr 2016 but silent until Dec 2020, both are demanding RETWEETS and FOLLOWS, and both started out by following large Arabic-language accounts.

cc: @ZellaQuixote
The RETWEETS and FOLLOWS verbiage on this pair of accounts is reminiscent of this recently-suspended network of fake #MAGA accounts, so they may be the same operation, but we don't have enough information to be 100% sure on that yet.
Yet another similar looking fake #MAGA account (@atensnut__, impersonating @atensnut) has emerged and is begging for RETWEETS and FOLLOWS. (Despite the claims of the impostor, the real @atensnut is still active and still has a full complement of followers.)
Read 5 tweets
4 Dec
Oh look, more pornbots. At least the naming scheme is straightforward this time. #FridayFeeling #Spamtastic

cc: @ZellaQuixote
This pornbot network consists of 653 accounts with names beginning with "porn_click_" and ending with numbers, mostly created in batches at various points in 2020. They (allegedly) all tweeted via the Twitter website until mid-September 2020, when they swapped to TweetDeck.
The "videos" in these pornbots' tweets aren't actually videos. They're redirected links to obscure porn websites disguised as videos through the use of thumbnail images with fake "play" buttons. We suspect the links are unsafe and do not recommend clicking them.
Read 4 tweets
2 Dec
Attorney @SidneyPowell1, known for representing Michael Flynn, filing multifarious election-related lawsuits, and overuse of the word "Kraken", has accumulated an impressive 1139718 Twitter followers, more than half of them since election day. We took a look.

cc: @ZellaQuixote ImageImage
At first glance, @SidneyPowell1's followers appear to be largely run-of-the-mill #MAGA and #QAnon accounts, and the hashtags used in their profiles corroborate this. Looking deeper, however, we ran across some interesting anomalies. . . Image
First off, @SidneyPowell1's Twitter account began its life with an infusion of fake followers from a fake engagement botnet we've previously encountered. (647 of her earliest followers are part of this network.)
ImageImageImage
Read 10 tweets
29 Nov
Meet @DianaWi59797083, a newly-created pro-Trump account that can't seem to decide whether its name is Blake or Diana. It probably doesn't matter, since it's using a plagiarized profile pic that's been floating around the internet for years. #YouHadOneJob

cc: @ZellaQuixote
Compounding the hilarity, the first account to retweet @DianaWi59797083 is @JasonMAGA4ever, an account created a couple weeks ago. In what is doubtless a total coincidence, @JasonMAGA4ever is also using a stolen profile photo.
We weren't able to retrieve the early retweets of @JasonMAGA4ever's tweets, so the saga ends there for now, but we wouldn't be surprised if its Twitter career was bootstrapped with the aid of additional bogus #MAGA accounts with stolen pics.
Read 7 tweets
29 Nov
What's with all these similarly-named accounts retweeting this @globaltimesnews tweet? #SundaySpam

cc: @ZellaQuixote
Answer: a few recent @globaltimesnews tweets have been amplified by two distinct groups of bots. (It's possible that they are part of the same network, but we can't prove this, so we treated them as two separate botnets for the sake of this analysis.) #ATaleOfTwoBotnets
The smaller of the two botnets consists of 76 accounts created in October and November 2020, all (allegedly) tweeting via the Twitter Android App. In an apparent lapse of creativity on the part of the botnet operators, 36 of the accounts are named either "Barb" or "Barbara".
Read 9 tweets
28 Nov
How did this video get 8.5K views despite the tweets having no retweets or likes and the accounts having no followers?

cc: @ZellaQuixote
Answer: the video, originally tweeted by @CindyScarbrou17, has been embedded in 1353 tweets from 1140 different accounts. Although none of the individual tweets got much attention, the video racked up a decent view count due to the the sheer number of tweets containing it.
These accounts are part of a Korean-language pornbot network consisting of (at least) 4291 accounts with repetitive naming schemes, created in batches between September 30th and November 18th, 2020. The older accounts host the original videos, and the newer ones embed them.
Read 5 tweets

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!

Follow Us on Twitter!