It's a great day to look at a botnet with GAN-generated profile pics that links several websites with "authors" that use the same GAN-generated pics. #HolidayShenaniGANs

(GAN = generative adversarial network, the AI technique used by thispersondoesnotexist.com)

cc: @ZellaQuixote
We found the first portion of this botnet a few days ago: six accounts that link timesofcasino(dot)com. As it turns out, the network is larger.
We found 60 accounts with GAN-generated pics made (mostly) in Aug 2020 that we think belong to the botnet:

• 42 accounts linking capitalbay(dot)news
• 6 accounts linking timesofcasino(dot)com
• 6 accounts linking coinnewsspan(dot)com
• 6 accounts linking namecoinnews(dot)com
All four of the websites promoted by these 60 bots have "authors" with the same names as some of the bots linking them. The "photographs" of these "authors" are the same GAN-generated images that the bots use as their Twitter profile pics.
Additionally, there are 5 accounts linking cryptonewsz(dot)com that we believe are also part of the botnet. These accounts are older, created in August and September 2019, but like the more recent creations, they have corresponding "authors" on the website they spam links to.
Here are the profile pics of all 65 accounts in the botnet, as well as the result of blending their images together. As is the case with all unmodified StyleGAN face pics, the major facial features (especially eyes) are in the same place on all 65 images.
All 65 accounts in this network (allegedly) sent all of their recent tweets via the Twitter website, although we suspect they're automated anyway. The older members of the network (the 5 accounts that link cryptonewsz(dot)com) have also used dlvr(dot)it.
What do these websites link? Mostly the five cryptocurrency and online gambling websites they promote (and are supposedly "authors" of), but there are occasional links to medium blogs and major cryptocurrency websites as well.
H/T @EJGibney, who found portions of the network featured in this thread.

• • •

Missing some Tweet in this thread? You can try to force a refresh
 

Keep Current with Conspirador Norteño

Conspirador Norteño Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @conspirator0

24 Dec
If you're looking for spammy Twitter accounts with stolen profile pics peddling #InsertCountryNameHerePhoneNumberLists and #Email #Lists, this botnet's for you.

cc: @ZellaQuixote Image
We found a network of 16 accounts tweeting links to latestdatabase(dot)com, all but two of which were created in 2020. These accounts tweet on extremely similar schedules and (allegedly) posted all of their recents tweets via the Twitter web app. ImageImageImage
Although other sites turn up occasionally, the majority of the network's content is tweets linking latestdatabase(dot)com, a website that supposedly sells lists of people's email addresses and cell phone numbers. (As always, be wary of clicking links to unknown websites.) ImageImageImageImage
Read 5 tweets
22 Dec
Earlier today, Trump retweeted a @KMCRadio tweet that mostly demonstrates the author's poor understanding of differences in population density in various areas of the USA. This thread, however, is not about that tweet - the topic is @KMCRadio's fake followers.

cc: @ZellaQuixote
Although @KMCRadio's recent followers mostly look like organic #MAGA accounts, its early followers are anything but. Sometime in mid-2012, it was followed en masse by thousands of accounts created between 2009 and 2011 that have never liked a tweet (among other similarities).
To find the remainder of this bulk follow network, we downloaded the followers of other accounts followed by @KMCRadio's early bogus followers, and repeated the process until we hit diminishing returns. (We didn't find many more - most of the network appears to follow @KMCRadio.)
Read 8 tweets
20 Dec
We took a quick look at a small online casino botnet that uses GAN-generated profile pics (similar to those produced by thispersondoesnotexist.com). #HolidayShenaninGANs

cc: @ZellaQuixote
This botnet consists of six accounts with GAN-generated profile pics, all created on August 11th, 2020. As is the case with all StyleGAN-generated face pics, the major facial features (particularly the eyes) line up when the images are blended/overlaid.
These six accounts tweet on nearly identical schedules and (allegedly) post all of their tweets via the Twitter Web App. Thus far, each accounts has sent exactly 10 tweets; with the exception of their first tweet, they always tweet within an hour of one another.
Read 6 tweets
20 Dec
What's up with these identical replies to a @gabry1090 coupon code tweet? #SaturdaySpam

cc: @ZellaQuixote
Answer: unsurprisingly, a botnet. We found 19 accounts that we believe are part of the network, created over the course of a little over an hour on December 7th, 2020. All their tweets thus far are replies sent via either "Mobile Web (M2)" or "Twitter Web Client".
The 19 accounts in this reply spam botnet operate on nearly identical schedules, and often send the same replies. Most replies are in Arabic, with the occasional English reply thrown in for good measure. (As always, take the Google translations with a grain of salt.)
Read 4 tweets
19 Dec
In a bizarre coincidence, this hashtag-crammed @SorabNY tweet was retweeted by a bunch of accounts created in May 2014 with random-looking names. #FridayFeeling

cc: @ZellaQuixote
These accounts are part of a 29-account retweet botnet created on May 25th, 2014. All the accounts have names consisting of 11 or 12 lowercase letters, beginning with a consonant and followed by alternating vowels and consonants. We suspect the names were generated randomly.
The accounts in this botnet have thus far posted all of their tweets (allegedly) via "Twitter Web App". Despite being created back in 2014, we found no evidence any of them tweeted prior to September 2020, with most accounts activating for the first time on December 9th, 2020.
Read 5 tweets
17 Dec
We've seen @justinsuntron turn up occasionally in our research on fake engagement networks, so we started perusing his followers to see what there is to see, and found an interesting little group of batch-created accounts.

cc: @ZellaQuixote
The botnet we found following @justinsuntron consists of 886 accounts created on September 24th and October 1st, 2020. Their initial wave of tweets was set via TweetDeck, and subsequent tweets were (allegedly) sent via the Twitter Web App. All have female names.
These accounts do four things:

• quote tweet cryptocurrency giveaway tweets (mostly from @justinsuntron)
• retweet cryptocurrency tweets
• reply "good" to a tweet from @OneSwap
• post original tweets composed of random nonsense
Read 6 tweets

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!

Follow Us on Twitter!