We found a network of 16 accounts tweeting links to latestdatabase(dot)com, all but two of which were created in 2020. These accounts tweet on extremely similar schedules and (allegedly) posted all of their recents tweets via the Twitter web app.
Although other sites turn up occasionally, the majority of the network's content is tweets linking latestdatabase(dot)com, a website that supposedly sells lists of people's email addresses and cell phone numbers. (As always, be wary of clicking links to unknown websites.)
This botnet is repetitive, with many tweets duplicated verbatim on multiple accounts. Most tweets contain hashtags of the form #<country>emaillist or #<country>phonenumberlist, and variants thereof.
Unsurprisingly most (and possibly all) of the accounts in this network use stolen profile pics. We found Google reverse image search superior to TinEye and Yandex for tracking down this particular network's profile pics.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
TFW you're a four-month old #MAGA Twitter account who "works around Intel specialist" and the Congressman you claimed was in FBI custody inconveniently tweets less than half an hour later.
The @MelaniasRhonda account has doubled down on its dubious claim that Adam Schiff has been arrested. This appears to be false, as Schiff continues to post on social media, but that hasn't stopped folks from running with the bogus narrative and causing Schiff's name to trend.
Several of the tweets claiming Adam Schiff was arrested include a screenshot from lacountyarrestrecords(dot)org, which is extremely unlikely to be accurate given that it also contains "LA county arrest records" for multiple former British prime ministers.
It's a great day to look at a botnet with GAN-generated profile pics that links several websites with "authors" that use the same GAN-generated pics. #HolidayShenaniGANs
Earlier today, Trump retweeted a @KMCRadio tweet that mostly demonstrates the author's poor understanding of differences in population density in various areas of the USA. This thread, however, is not about that tweet - the topic is @KMCRadio's fake followers.
Although @KMCRadio's recent followers mostly look like organic #MAGA accounts, its early followers are anything but. Sometime in mid-2012, it was followed en masse by thousands of accounts created between 2009 and 2011 that have never liked a tweet (among other similarities).
To find the remainder of this bulk follow network, we downloaded the followers of other accounts followed by @KMCRadio's early bogus followers, and repeated the process until we hit diminishing returns. (We didn't find many more - most of the network appears to follow @KMCRadio.)
This botnet consists of six accounts with GAN-generated profile pics, all created on August 11th, 2020. As is the case with all StyleGAN-generated face pics, the major facial features (particularly the eyes) line up when the images are blended/overlaid.
These six accounts tweet on nearly identical schedules and (allegedly) post all of their tweets via the Twitter Web App. Thus far, each accounts has sent exactly 10 tweets; with the exception of their first tweet, they always tweet within an hour of one another.
Answer: unsurprisingly, a botnet. We found 19 accounts that we believe are part of the network, created over the course of a little over an hour on December 7th, 2020. All their tweets thus far are replies sent via either "Mobile Web (M2)" or "Twitter Web Client".
The 19 accounts in this reply spam botnet operate on nearly identical schedules, and often send the same replies. Most replies are in Arabic, with the occasional English reply thrown in for good measure. (As always, take the Google translations with a grain of salt.)
In a bizarre coincidence, this hashtag-crammed @SorabNY tweet was retweeted by a bunch of accounts created in May 2014 with random-looking names. #FridayFeeling
These accounts are part of a 29-account retweet botnet created on May 25th, 2014. All the accounts have names consisting of 11 or 12 lowercase letters, beginning with a consonant and followed by alternating vowels and consonants. We suspect the names were generated randomly.
The accounts in this botnet have thus far posted all of their tweets (allegedly) via "Twitter Web App". Despite being created back in 2014, we found no evidence any of them tweeted prior to September 2020, with most accounts activating for the first time on December 9th, 2020.