Meet @coshdisme10853 (and its thirty thousand automated siblings). Back in 2015 and 2016, this account was tweeting in Spanish, but it went to sleep for a few years and recently woke up and started retweeting English cryptocurrency tweets. #SundaySpam
cc: @ZellaQuixote
cc: @ZellaQuixote
The @coshdisme10853 account is part of a botnet consisting of 31014 accounts created back in May 2014. Accounts were created in batches and followed the big accounts they follow en masse. (Each bot follows 20-30 or so of the other bots in the network).
Who does this botnet follow? Primarily Spanish-language accounts (mostly Mexican public figures and brand accounts), with @Chertorivski, @MaruchanRamenMx and @MaruchanMx at the top of the list. (We believe that this is the first botnet we've found following a ramen company.)
This botnet began its life mostly tweeting in Spanish via the Twitter Web Client. It then went mostly silent from late 2017 until the tail end of 2020, when 1566 of the 31014 accounts started tweeting again, via a variety of software in both English and Indonesian.
This botnet posts both original tweets and retweets. Many of its original tweets are repeated across accounts. The tweets from 2015/2016 are mostly headlines in Spanish, whereas the new content is a mix of English cryptocurrency tweets and Indonesian political tweets.
The accounts the botnet retweeted back in 2015/2016 were mostly Spanish-language accounts (although a different set of accounts than it follows). The accounts it has amplified recently are a mix of Indonesian accounts and English cryptocurrency accounts.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
