Share this page!

Conspirador Norteño Profile picture
Twitter logo
27 Dec, 6 tweets, 4 min read
It's a day that ends in "Y", and a posse of pornbots is prolifically posting tweets advertising a group of websites, with the novel twist that the websites are included in images rather than linked directly from their tweets. #SundaySpam

cc: @ZellaQuixote
These bots were created in batches, and their image tweets contain hashtags and were (allegedly) sent via the Twitter Web App. We found 2147 batch-created accounts that fit this pattern, but how do we eliminate the ones without website names emblazoned on their image tweets?
Answer: we used OCR (optical character recognition), specifically the pytessaract library. It couldn't make much sense of the raw images, which use gray text on colored backgrounds, but tweaking the brightness/contrast on grayscale negatives resulted in machine-readable text.
Using the OCR technique, we determined that 21 of the accounts were false positives, leaving 2126 accounts that we believe are part of the network. These accounts post image tweets including the names of one of three websites (kunee(dot)me), kissme(dot)fun, and tusy69(dot)com).
These bots are repetitive, with many tweets repeated across over a hundred accounts (after removal of hashtags, which get varied between copies of any given tweet).
We weren't able to find out much about the websites these bots link, although we did visit one of them back in July 2020 when we posted about a predecessor of this botnet. Here's our previous thread:

• • •

Missing some Tweet in this thread? You can try to force a refresh
　

Keep Current with Conspirador Norteño

Conspirador Norteño Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @conspirator0

Conspirador Norteño Profile picture
27 Dec
In the aftermath of the Nashville bombing, a wide variety of rumors and conspiracy theories about motives/affiliation of the bomber(s) began circulating on Twitter. Trump supporters, antifa, and Dominion voting machines were some of the most common themes.

cc: @ZellaQuixote
The themes of the rumors varied somewhat over time. Antifa was a common topic shortly after the bombing, tweets about Dominion spiked twice after popular tweets, and Trump supporters were a common theme throughout, increasing slightly after CBS named a person of interest.
Here are some examples of tweets containing terms from each group. Some of the tweets fit into multiple groups - for example, some of the tweets about Dominion voting systems also reference the AT&T building.
Read 8 tweets
Conspirador Norteño Profile picture
25 Dec
TFW you're a four-month old #MAGA Twitter account who "works around Intel specialist" and the Congressman you claimed was in FBI custody inconveniently tweets less than half an hour later.

cc: @ZellaQuixote
The @MelaniasRhonda account has doubled down on its dubious claim that Adam Schiff has been arrested. This appears to be false, as Schiff continues to post on social media, but that hasn't stopped folks from running with the bogus narrative and causing Schiff's name to trend.
Several of the tweets claiming Adam Schiff was arrested include a screenshot from lacountyarrestrecords(dot)org, which is extremely unlikely to be accurate given that it also contains "LA county arrest records" for multiple former British prime ministers.
Read 4 tweets
Conspirador Norteño Profile picture
24 Dec
If you're looking for spammy Twitter accounts with stolen profile pics peddling #InsertCountryNameHerePhoneNumberLists and #Email #Lists, this botnet's for you.

cc: @ZellaQuixote
We found a network of 16 accounts tweeting links to latestdatabase(dot)com, all but two of which were created in 2020. These accounts tweet on extremely similar schedules and (allegedly) posted all of their recents tweets via the Twitter web app.
Although other sites turn up occasionally, the majority of the network's content is tweets linking latestdatabase(dot)com, a website that supposedly sells lists of people's email addresses and cell phone numbers. (As always, be wary of clicking links to unknown websites.)
Read 5 tweets
Conspirador Norteño Profile picture
24 Dec
It's a great day to look at a botnet with GAN-generated profile pics that links several websites with "authors" that use the same GAN-generated pics. #HolidayShenaniGANs

(GAN = generative adversarial network, the AI technique used by thispersondoesnotexist.com)

cc: @ZellaQuixote
We found the first portion of this botnet a few days ago: six accounts that link timesofcasino(dot)com. As it turns out, the network is larger.
We found 60 accounts with GAN-generated pics made (mostly) in Aug 2020 that we think belong to the botnet:

• 42 accounts linking capitalbay(dot)news
• 6 accounts linking timesofcasino(dot)com
• 6 accounts linking coinnewsspan(dot)com
• 6 accounts linking namecoinnews(dot)com
Read 9 tweets
Conspirador Norteño Profile picture
22 Dec
Earlier today, Trump retweeted a @KMCRadio tweet that mostly demonstrates the author's poor understanding of differences in population density in various areas of the USA. This thread, however, is not about that tweet - the topic is @KMCRadio's fake followers.

cc: @ZellaQuixote
Although @KMCRadio's recent followers mostly look like organic #MAGA accounts, its early followers are anything but. Sometime in mid-2012, it was followed en masse by thousands of accounts created between 2009 and 2011 that have never liked a tweet (among other similarities).
To find the remainder of this bulk follow network, we downloaded the followers of other accounts followed by @KMCRadio's early bogus followers, and repeated the process until we hit diminishing returns. (We didn't find many more - most of the network appears to follow @KMCRadio.)
Read 8 tweets
Conspirador Norteño Profile picture
20 Dec
We took a quick look at a small online casino botnet that uses GAN-generated profile pics (similar to those produced by thispersondoesnotexist.com). #HolidayShenaninGANs

cc: @ZellaQuixote
This botnet consists of six accounts with GAN-generated profile pics, all created on August 11th, 2020. As is the case with all StyleGAN-generated face pics, the major facial features (particularly the eyes) line up when the images are blended/overlaid.
These six accounts tweet on nearly identical schedules and (allegedly) post all of their tweets via the Twitter Web App. Thus far, each accounts has sent exactly 10 tweets; with the exception of their first tweet, they always tweet within an hour of one another.
Read 6 tweets

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!

Follow Us on Twitter!

Like this author's thread?

Get emails when @conspirator0 has new unrolls!

Check out other threads from @conspirator0!

Read all threads by @conspirator0