Thread by @conspirator0

We've seen @justinsuntron turn up occasionally in our research on fake engagement networks, so we started perusing his followers to see what there is to see, and found an interesting little group of batch-created accounts.

cc: @ZellaQuixote

The botnet we found following @justinsuntron consists of 886 accounts created on September 24th and October 1st, 2020. Their initial wave of tweets was set via TweetDeck, and subsequent tweets were (allegedly) sent via the Twitter Web App. All have female names.

These accounts do four things:

• quote tweet cryptocurrency giveaway tweets (mostly from @justinsuntron)
• retweet cryptocurrency tweets
• reply "good" to a tweet from @OneSwap
• post original tweets composed of random nonsense

Here are the accounts most frequently amplified by this botnet, and the type of interaction (quote tweet, retweet, or reply). Quote tweets of @justinsuntron are by far the most frequent interaction, and the only action that every single bot in the network has taken.

As is quite often the case with spammy botnets, these accounts use stolen profile pics. We found Google and Yandex reverse image search to be more effective than TinEye. Many of the images appear to be cropped, which may be confusing the image search algorithms.

One last amusing detail: the majority of these accounts use sentence fragments from Bram Stoker's Dracula as profile biographies. We've seen this behavior before, albeit from a porn rather than cryptocurrency-themed botnet.

https://twitter.com/conspirator0/status/1281396606957498368