More from @conspirator0

Conspirador Norteño

@conspirator0

1 Apr

@BlancaMatos13

Meet @BlancaMatos13, a four-week old Twitter account with a penchant for using stolen photos and a distaste for Ecuadorian presidential candidate Andrés Arauz. Unsurprisingly, this account is not a solo act.

cc: @ZellaQuixote

@BlancaMatos13

The @BlancaMatos13 account is part of a network of (at least) 63 accounts created in batches in March 2021 that all tweet almost exclusively via TweetDeck and have Ecuador as their profile location. Most operate on very similar schedules.

This network is likely using TweetDeck's scheduling feature, which disproportionately posts its tweets during the first second of the minute for which they are scheduled. (It's also possible that TweetDeck is being automated using other software with similar scheduling behavior).

Read 5 tweets

Conspirador Norteño

@conspirator0

28 Mar

@coshdisme10853

Meet @coshdisme10853 (and its thirty thousand automated siblings). Back in 2015 and 2016, this account was tweeting in Spanish, but it went to sleep for a few years and recently woke up and started retweeting English cryptocurrency tweets. #SundaySpam

cc: @ZellaQuixote

@coshdisme10853

The @coshdisme10853 account is part of a botnet consisting of 31014 accounts created back in May 2014. Accounts were created in batches and followed the big accounts they follow en masse. (Each bot follows 20-30 or so of the other bots in the network).

@Chertorivski

Who does this botnet follow? Primarily Spanish-language accounts (mostly Mexican public figures and brand accounts), with @Chertorivski, @MaruchanRamenMx and @MaruchanMx at the top of the list. (We believe that this is the first botnet we've found following a ramen company.)

Read 6 tweets

Conspirador Norteño

@conspirator0

26 Mar

@ZellaQuixote

By reverse image searching a GAN-generated face pic (i.e. the "faces" produced by thispersondoesnotexist.com), one can often find Twitter accounts with GAN-generated profile pics. Today's search led to a massive botnet with a bit of everything. #ThursdayShenaniGANs

cc @ZellaQuixote

This botnet consists of 16512 accounts, created in batches between February 18th and March 21st, 2021. All either follow or are followed by dozens or hundreds of other members of the botnet (and by very few accounts that are not part of the botnet).

The bots in this network are grouped into clusters of a few hundred accounts each that follow or are followed by many other accounts within their cluster. The accounts mostly don't follow accounts in other clusters, but do reply to them.

Read 8 tweets

Conspirador Norteño

@conspirator0

24 Mar

@ZellaQuixote

In the aftermath of the Boulder shooting, a variety of speculation about the attack made the rounds on Twitter. We categorized the tweets based on keywords used. The most common categories:

• apprehended + white
• Muslim, Syria(n), or ISIS
• Boebert

cc: @ZellaQuixote

The themes of the tweets changed over time. Tweets mentioning vaccines were common early on, but were quickly eclipsed by the apprehended+white and Boebert categories. The Muslim/Syria and Washington Post/anti-Trump categories took off after the shooter's name was released.

Retweet network for tweets prior to the announcement of the shooter's name containing "Boulder" or "Table Mesa" and one or more of the keywords we analyzed. It's almost all left-wing accounts, mostly focused on the apprehended+white and assault rifle ban/overturn categories.

Read 5 tweets

Conspirador Norteño

@conspirator0

22 Mar

@Heritage

It's either the second day of spring or fall (depending on where you are), so here's a look at a botnet following the official Twitter account of right wing think tank @Heritage Foundation. #SundaySpam

cc: @ZellaQuixote

This botnet consists of 28971 accounts, created Nov 2013 - Jan 2014. All their tweets were sent via "Twitter Web Client", and none has tweeted since 2014. None has liked a tweet, and all have the same display name as @-name (including lack of space between first and last name).

@Citibank

Who does this botnet follow? The majority of the beneficiaries of its bogus follows are the official accounts of businesses (including some fairly large companies such as @Citibank and @WhiteCastle). The @Heritage Foundation (followed by 2845 of the bots) is a notable outlier.

Read 5 tweets