Share this page!

Conspirador Norteño Profile picture
Twitter logo
14 Mar, 6 tweets, 4 min read
Daylight savings time has begun (in the USA, at least), and what better way to mark the occasion than by looking at a quote tweet astroturf botnet? #SundaySpam

cc: @ZellaQuixote
This network consists of 4399 accounts, created between January 23rd and January 25th 2021. The 4399 bots all follow the same 13 cryptocurrency/blockchain-themed accounts (or a subset thereof) and no other accounts.
The accounts in this network send all of their tweets via the Twitter Web App (allegedly). All of their content is either retweets or quote tweets - no original tweets or replies.
Who and what does this botnet quote tweet and retweet? It has amplified a total of 14 tweets from 12 cryptocurrency/blockchain accounts (the same accounts the bots follow, excluding @polkastarter), bestowing hundreds of quote tweets (and sometimes retweets) on each tweet.
This botnet reuses profile pics across accounts - 731 of 4399 accounts have the same profile pic as at least one other member of the network. (At least) 70 of the accounts use GAN-generate profile pics (similar to those generated by thispersondoesnotexist.com).
*generated

• • •

Missing some Tweet in this thread? You can try to force a refresh
　

Keep Current with Conspirador Norteño

Conspirador Norteño Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @conspirator0

Conspirador Norteño Profile picture
10 Mar
As it turns out, the @BlockchainCutie account amplified by the botnet described in this previous thread has a bunch of fake followers. We took a closer look at the largest network following it.

cc: @ZellaQuixote
3117 of @BlockchainCutie's followers are batch-created accounts created in late 2020 that we believe to be part of a single botnet. To find the rest of the botnet, we explored the followers of the other accounts these 3117 bots follow.
This botnet consists of 9640 accounts, created in batches between October 15th and December 18th 2020. All of these accounts tweet exclusively via the Twitter Web App - no tweets sent via Android or iPhone, which is itself anomalous.
Read 6 tweets
Conspirador Norteño Profile picture
8 Mar
Here's a look at a quote tweet astroturf network that thus far is quite single-mindedly fixated on a single tweet. #MondayMotivation

cc: @ZellaQuixote
This network consists of 165 accounts that were all created on January 1st, 2021. All of them have retweeted, quote-tweeted, and liked the same @BlockchainCutie tweet, and most have no other tweets or likes. All their tweets thus far were (allegedly) sent via the Twitter Web App.
All of this network's content is either retweets or quote tweets. The majority are the aforementioned interactions with @BlockchainCutie's tweet, but a few of them have amplified other cryptocurrency/blockchain-themed accounts as well.
Read 7 tweets
Conspirador Norteño Profile picture
6 Mar
It's a great day to look at a small botnet that retweets Spanish followback hashtag #SigueMeYTeSigo. #FridayFeeling

cc: @ZellaQuixote
This botnet consists of 13 accounts created between 2017 and 2020. Each account is active 24/7 and ends most of its tweets via a unique custom app, most of which have names like "dfghji876". Judging by their follower/following ratios, the bots don't actually follow back.
The vast majority of this botnet's content (99.4% of recent tweets) consists of retweets of tweets containing #SigueMeYTeSigo (or stylized variants such as #𝙎𝙞𝙜𝙪𝙚𝙢𝙚𝙔𝙏𝙚𝙎𝙞𝙜𝙤 and #𝕊𝕀𝔾𝕌𝔼𝕄𝔼𝕐𝕋𝔼𝕊𝕀𝔾𝕆) sent via the custom apps mentioned earlier in this thread.
Read 5 tweets
Conspirador Norteño Profile picture
5 Mar
We've looked at a variety of Twitter accounts being sold on dodgy sites, but @Online_agine holds the record for most followers with a whopping 712056.

(content warning: every single account described in this thread pretty much tweets nothing but porn videos)

cc: @ZellaQuixote
Although porn account @Online_agine has been around since December 2009, its massive follower growth does not appear to have started until September 2020. (A dataset we captured in March 2020 in which it showed up confirms that it only had 34 followers at that point.)
As it turns out, @Online_agine (permanent ID 97295448) wasn't always named @Online_agine. It appears to have been originally named @Allanymsantos, which was changed to @Mayaunmoor sometime prior to its massive follower growth, and then finally to its current name.
Read 10 tweets
Conspirador Norteño Profile picture
3 Mar
What's up with these identical tweets sent via TweetDeck?

(Note: duplicate tweets embedding YouTube videos are sometimes the result of the title of the YouTube video being copied into the tweet text, but that's not the case here.)

cc: @ZellaQuixote Image
Answer: the duplicate TweetDeck tweets are the work of a Spanish-language botnet, consisting of 10 accounts created in 11 minutes on August 22nd, 2020. All ten accounts have virtually identical schedules. ImageImage
At present, all of these accounts tweet exclusively via TweetDeck, although prior to mid-January they also used Twitter for Android. While they could be human-operated given the software used, we suspect automation due to the identical schedules (and repetition, as we'll see). Image
Read 5 tweets
Conspirador Norteño Profile picture
2 Mar
What's up with all these accounts created in May 2012 with "legit check" as their pinned tweet? #SeemsLegit

cc: @ZellaQuixote
Answer: they're part of a botnet that retweets and replies to giveaway tweets. This network consists of 271 accounts created on May 1st, 2012 that have no tweets prior to December 2020. (Not all have the "legit check" pinned tweet, but they have other things in common...)
At present, the 271 accounts in this network all (allegedly) tweet via the Twitter Web App. They've gone through a variety of custom apps, however, many of which seem to be named to give the incorrect impression that they are official Twitter products ("Tɯitter for Samsung" etc).
Read 7 tweets

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!

Follow Us on Twitter!

Like this author's thread?

Get emails when @conspirator0 has new unrolls!

Check out other threads from @conspirator0!

Read all threads by @conspirator0