More from @conspirator0

Conspirador Norteño

@conspirator0

31 Mar

@ZellaQuixote

What's with all these recently-created accounts with variations on "Selected Items. Deals. Product Information. Daily Updated. (eBay Links)" in their profiles?

cc: @ZellaQuixote

Answer: these accounts are part of a spam botnet consisting of 73 accounts created between October 2020 and March 2021 (most of them in February or March 2021). All the accounts in this botnet are named after various products (automotive supplies are a frequent theme).

The bots in this network do all of their tweeting via automation service dlvr(dot)it, with most of the accounts being active round-the-clock. The network has tweeted 123037 times thus far, with almost all of the volume in February and March 2020.

Read 4 tweets

Conspirador Norteño

@conspirator0

28 Mar

@coshdisme10853

Meet @coshdisme10853 (and its thirty thousand automated siblings). Back in 2015 and 2016, this account was tweeting in Spanish, but it went to sleep for a few years and recently woke up and started retweeting English cryptocurrency tweets. #SundaySpam

cc: @ZellaQuixote

@coshdisme10853

The @coshdisme10853 account is part of a botnet consisting of 31014 accounts created back in May 2014. Accounts were created in batches and followed the big accounts they follow en masse. (Each bot follows 20-30 or so of the other bots in the network).

@Chertorivski

Who does this botnet follow? Primarily Spanish-language accounts (mostly Mexican public figures and brand accounts), with @Chertorivski, @MaruchanRamenMx and @MaruchanMx at the top of the list. (We believe that this is the first botnet we've found following a ramen company.)

Read 6 tweets

Conspirador Norteño

@conspirator0

26 Mar

@ZellaQuixote

By reverse image searching a GAN-generated face pic (i.e. the "faces" produced by thispersondoesnotexist.com), one can often find Twitter accounts with GAN-generated profile pics. Today's search led to a massive botnet with a bit of everything. #ThursdayShenaniGANs

cc @ZellaQuixote

This botnet consists of 16512 accounts, created in batches between February 18th and March 21st, 2021. All either follow or are followed by dozens or hundreds of other members of the botnet (and by very few accounts that are not part of the botnet).

The bots in this network are grouped into clusters of a few hundred accounts each that follow or are followed by many other accounts within their cluster. The accounts mostly don't follow accounts in other clusters, but do reply to them.

Read 8 tweets

Conspirador Norteño

@conspirator0

24 Mar

@ZellaQuixote

In the aftermath of the Boulder shooting, a variety of speculation about the attack made the rounds on Twitter. We categorized the tweets based on keywords used. The most common categories:

• apprehended + white
• Muslim, Syria(n), or ISIS
• Boebert

cc: @ZellaQuixote

The themes of the tweets changed over time. Tweets mentioning vaccines were common early on, but were quickly eclipsed by the apprehended+white and Boebert categories. The Muslim/Syria and Washington Post/anti-Trump categories took off after the shooter's name was released.

Retweet network for tweets prior to the announcement of the shooter's name containing "Boulder" or "Table Mesa" and one or more of the keywords we analyzed. It's almost all left-wing accounts, mostly focused on the apprehended+white and assault rifle ban/overturn categories.

Read 5 tweets

Conspirador Norteño

@conspirator0

22 Mar

@Heritage

It's either the second day of spring or fall (depending on where you are), so here's a look at a botnet following the official Twitter account of right wing think tank @Heritage Foundation. #SundaySpam

cc: @ZellaQuixote

This botnet consists of 28971 accounts, created Nov 2013 - Jan 2014. All their tweets were sent via "Twitter Web Client", and none has tweeted since 2014. None has liked a tweet, and all have the same display name as @-name (including lack of space between first and last name).

@Citibank

Who does this botnet follow? The majority of the beneficiaries of its bogus follows are the official accounts of businesses (including some fairly large companies such as @Citibank and @WhiteCastle). The @Heritage Foundation (followed by 2845 of the bots) is a notable outlier.

Read 5 tweets