Share this page!

Conspirador Norteño Profile picture
Twitter logo
29 Dec, 4 tweets, 4 min read
It's a great day to look at a network of old fake follower bots with randomly generated biographies. #MondayMotivation

cc: @ZellaQuixote Image
This botnet is made up of 241 accounts, created in batches between February 28th and March 3rd, 2011. All have names consisting of a first and last name followed by 2 or 4 digits, follow similar numbers of accounts, and have never liked a tweet. ImageImageImageImage
The accounts in this botnet don't just follow similar numbers of accounts - they follow a lot of the same accounts, with 543 accounts followed by all 241 members of the network. The accounts they follow are mostly promotional accounts, many of which followed the bots back. ImageImageImage
The accounts in this botnet have been dormant since 2011, but when active they sent their tweets via "Twitter Web Client". Most of their tweets are commercial spam containing now-defunct bitly short links. The tweets frequently appear on multiple accounts. ImageImageImage

• • •

Missing some Tweet in this thread? You can try to force a refresh
　

Keep Current with Conspirador Norteño

Conspirador Norteño Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @conspirator0

Conspirador Norteño Profile picture
30 Dec
If you're looking for a "news feed" account whose website consists entirely of news stories harvested from other websites (many of them less than reliable themselves), then @1BUV_News just might be right up your alley.

cc: @ZellaQuixote Image
Where does the content on 1buv(dot)com, the website promoted by @1BUV_News come from? The present lineup includes 20 different websites, the most common being Sputnik, Breitbart, and ZeroHedge. Antivax/conspiracy site Natural News is another interesting inclusion. Image
The majority of @1BUV_News's content is automated, posted round-the-clock by a custom app with no name. (We've seen a few bots that post via nameless apps before, but without a visible name, it's hard to tell if they're the *same* no-name automation app.) Image
Read 4 tweets
Conspirador Norteño Profile picture
29 Dec
GAN-generated profile pics (such as those produced by thispersondoesnotexist.com) have become quite popular among botnets promoting cryptocurrency blogs/websites. Here's a look at one such botnet that was mostly made just before Christmas. #HolidayShenaniGANs

cc: @ZellaQuixote
We found a group of 12 accounts with GAN-generated profile pics linking cryptocurrency-themed websites and blog posts. All but one of these accounts was created between December 22nd and 25th, 2020. Image
Here are the profile pics of all 12 bots in the network. When overlaid, one can see that the major facial features (particularly the eyes) are in the same location on each image. The images contain other artifacts too: the metallic droplet on @SwiftAlene's forehead, for example. Image
Read 7 tweets
Conspirador Norteño Profile picture
27 Dec
It's a day that ends in "Y", and a posse of pornbots is prolifically posting tweets advertising a group of websites, with the novel twist that the websites are included in images rather than linked directly from their tweets. #SundaySpam

cc: @ZellaQuixote
These bots were created in batches, and their image tweets contain hashtags and were (allegedly) sent via the Twitter Web App. We found 2147 batch-created accounts that fit this pattern, but how do we eliminate the ones without website names emblazoned on their image tweets?
Answer: we used OCR (optical character recognition), specifically the pytessaract library. It couldn't make much sense of the raw images, which use gray text on colored backgrounds, but tweaking the brightness/contrast on grayscale negatives resulted in machine-readable text.
Read 6 tweets
Conspirador Norteño Profile picture
27 Dec
In the aftermath of the Nashville bombing, a wide variety of rumors and conspiracy theories about motives/affiliation of the bomber(s) began circulating on Twitter. Trump supporters, antifa, and Dominion voting machines were some of the most common themes.

cc: @ZellaQuixote
The themes of the rumors varied somewhat over time. Antifa was a common topic shortly after the bombing, tweets about Dominion spiked twice after popular tweets, and Trump supporters were a common theme throughout, increasing slightly after CBS named a person of interest.
Here are some examples of tweets containing terms from each group. Some of the tweets fit into multiple groups - for example, some of the tweets about Dominion voting systems also reference the AT&T building.
Read 8 tweets
Conspirador Norteño Profile picture
25 Dec
TFW you're a four-month old #MAGA Twitter account who "works around Intel specialist" and the Congressman you claimed was in FBI custody inconveniently tweets less than half an hour later.

cc: @ZellaQuixote
The @MelaniasRhonda account has doubled down on its dubious claim that Adam Schiff has been arrested. This appears to be false, as Schiff continues to post on social media, but that hasn't stopped folks from running with the bogus narrative and causing Schiff's name to trend.
Several of the tweets claiming Adam Schiff was arrested include a screenshot from lacountyarrestrecords(dot)org, which is extremely unlikely to be accurate given that it also contains "LA county arrest records" for multiple former British prime ministers.
Read 4 tweets
Conspirador Norteño Profile picture
24 Dec
If you're looking for spammy Twitter accounts with stolen profile pics peddling #InsertCountryNameHerePhoneNumberLists and #Email #Lists, this botnet's for you.

cc: @ZellaQuixote
We found a network of 16 accounts tweeting links to latestdatabase(dot)com, all but two of which were created in 2020. These accounts tweet on extremely similar schedules and (allegedly) posted all of their recents tweets via the Twitter web app.
Although other sites turn up occasionally, the majority of the network's content is tweets linking latestdatabase(dot)com, a website that supposedly sells lists of people's email addresses and cell phone numbers. (As always, be wary of clicking links to unknown websites.)
Read 5 tweets

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!

Follow Us on Twitter!

Like this author's thread?

Get emails when @conspirator0 has new unrolls!

Check out other threads from @conspirator0!

Read all threads by @conspirator0