Share this page!

Conspirador Norteño Profile picture
Twitter logo
14 Jan, 5 tweets, 3 min read
This botnet would like you to know that online casino affiliates make big profits and earn continuous income, and has therefore said so hundreds of times. #TwinkleTwinkleLittleCasinoSpambots

cc: @ZellaQuixote
This online casino spambot network consists of 15 accounts, all made in 2020 or 2021. Each account sends the majority of its tweets via a unique custom app with a numerical name. Most of the accounts tweet on very similar schedules.
This botnet sends both original tweets and retweets. The retweets, which comprise the lion's share of the volume, are sent via the numerically-named custom apps, while the original tweets are sent via automation service SocialDog.
This botnet's original tweets are repetitive, and mostly contain links to a variety of online casino websites. Almost all content is in Japanese. (English translations from Google are included in the table with the caveat that machine translation sometimes gets things wrong.)
Who do the bots in this network retweet? Mostly each other, with each bot having retweeted others in the network thousands of times. (The exception is the newest account, @Surrend53074013, which doesn't seem to have gotten around to retweeting the others yet.)

• • •

Missing some Tweet in this thread? You can try to force a refresh
　

Keep Current with Conspirador Norteño

Conspirador Norteño Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @conspirator0

Conspirador Norteño Profile picture
13 Jan
If you woke up this morning wondering if someone had made a cryptocurrency astroturf botnet that falls in love all over again every time it sees Sean Hannity, you're in luck.

cc: @ZellaQuixote Image
This botnet consists of 266 accounts created on December 7th and December 8th 2020. All the accounts in this network have (allegedly) sent all of their tweets via the Twitter Web App. ImageImageImage
What do the bots in this network do? They primarily amplify cryptocurrency giveaway/promotion tweets via retweets by retweeting, replying to, and quote-tweeting them. They primarily amplify a group of twelve accounts (although one, @Latestairdrop3, is suspended). Image
Read 6 tweets
Conspirador Norteño Profile picture
11 Jan
We took a look at GOP Congressman @DrPaulGosar's followers, and discovered that on two occasions he received surges in followers that tweet in languages other than English: first Chinese, and later Portuguese.

cc: @ZellaQuixote
When did @DrPaulGosar pick up these followers? The Chinese-language accounts mostly followed him in late March and early April 2020, with the Portuguese-language accounts showing up in mid-November 2020 (shortly after the U.S. presidential election).
The Chinese-language accounts following @DrPaulGosar link a variety of right-wing news sources, including Steve Bannon/Gui Wengui project GNews, Fox News, Epoch Times, and ZeroHedge.
Read 6 tweets
Conspirador Norteño Profile picture
10 Jan
We created a @DrunkAlexJones Parler account (parler.com/profile/DrunkA…) back in June 2020. Despite the fact that he has only followed 40 accounts and posted a grand total of twice, he has racked up 1756 followers (43 times as many accounts as he follows).

cc: @ZellaQuixote
Most of DrunkAlexJones' Parler followers joined Parler at one of three points in time:

• shortly after Twitter first added a disclaimer to one of Trump's tweets
• in the week following the Nov 3, 2020 US presidential election
• shortly after Twitter banned @realDonaldTrump
188 of DrunkAlexJones' 1756 Parler followers (10.7%) have never posted, and 992 (56.5%) have posted fewer than 10 times. The empty accounts were disproportionately created during the post-election surge.
Read 4 tweets
Conspirador Norteño Profile picture
10 Jan
The Vatican experienced a blackout last night, and QAnon believers have responded in typical fashion by baking a conspiracy casserole involving the Pope being arrested for child trafficking and something about Dominion voting machines (of course).

cc: @ZellaQuixote
Retweet network for tweets containing "Vatican" or "The Pope" for the evening of January 9th and morning of January 10th, 2020 (PST). Former QAnon congressional candidate @theangiestanton and a newborn "news" account named @WorldWireNews1 turn up prominently.
The @WorldWireNews1 account was created during the attack on the U.S. Capitol, at 1:49 PM on January 6th, 2020. It appears to be the successor to the now-suspended @WW_NEWS_ (@WorldWireNews1's "F" tweet is a reply to a now-removed tweet commenting on @WW_NEWS_'s ban).
Read 5 tweets
Conspirador Norteño Profile picture
10 Jan
It's a new year, but some things remain the same, and one of those things is that one can still find pornbot networks. #SaturdaySpam

cc: @ZellaQuixote Image
This pornbot network consists of 690 accounts, created in batches between August 20th and November 16th, 2020. Thus far, all of their tweets have been (allegedly) sent via Twitter web app. Some (but not all) of the bots have liked tweets from porn accounts with large followings. ImageImageImageImage
The tweets posted by this pornbot network are extremely repetitive, with many tweets having been posted by hundreds of accounts. (The repeated tweets are sometimes accompanied by hashtagged US city names, which we removed for the sake of generating this table.) Image
Read 5 tweets
Conspirador Norteño Profile picture
4 Jan
This botnet would like to give you a manual and support and help you to install and run "EA FX ROBOT", which is (allegedly) not difficult. #SpamTastic #WeHeardYouLikeBotsSoWePutABotInYourBot

cc: @ZellaQuixote Image
We found a network of 23 accounts promoting something called "EA FX ROBOT", created between October 2016 and March 2017. These accounts are automated, sending all of their tweets via a scheduling app called "Dynamic Tweets". Most of them operate on very similar schedules. ImageImageImage
Hopefully you didn't get your hopes up about installing and running "EA FX ROBOT", because the associated website (eafxrobot(dot)com, the only site linked by the botnet) is no longer online and has been replaced with a generic landing page. The botnet soldiers on, though. ImageImageImage
Read 5 tweets

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!

Follow Us on Twitter!

Like this author's thread?

Get emails when @conspirator0 has new unrolls!

Check out other threads from @conspirator0!

Read all threads by @conspirator0