These eight accounts were all created on either February 18th or February 21st, 2021. Thus far, they have tweeted very little (only 58 tweets), and have sent all their tweets via the Twitter Android app. Two of them (@An_mal12 and @An_mal14) currently have identical biographies.
The majority of these accounts' tweets so far are extremely brief replies to each other (and sometimes replies to each other's replies to each other, and so on). They have also posted a few follower growth tweets, including retweets of a tweet that contains a likely malware link.
Each of the eight accounts in this network follows all seven of the others (in many cases, the accounts are each other's earliest followers). This diagram shows both the follow and reply relationships between the accounts in the network.
How did these accounts build their following? They appear to be fishing for followbacks from small accounts in a variety of languages (chiefly Japanese, English, and Hindi). These accounts mostly don't look automated, but do tweet a lot of followback spam.
(old thread on the malware link that this network amplified and associated spam)
PSA: These "fun" apps from roundyear(dot)fun ("My Twitter Family" etc) have a downside: they gain near-total control of your account and (at the very least) use it to follow other accounts without your knowledge. #FunAllYearRoundUntilYourAccountGetsCompromised
We had @DrunkAlexJones test some of the Round Year Fun apps. The list of permissions the apps request is extensive and encompasses pretty much every action one could possibly take with one's Twitter account. The apps produced the expected "My Twitter Crush" etc tweets.
This botnet is comprised of 4959 accounts created between January 7th and January 28th, 2016 (with a mid-month break). All of them follow between 35 and 40 accounts, and have never liked a tweet. Account names consist of English first names followed by four random letters.
This network only uses 23 unique profile pictures (22 photos and the default pic) across 4959 accounts, resulting in each non-default pic appearing on over 200 accounts. Reverse image searches indicate that the same images may have been used for spam networks on Facebook as well.
None of these cats exist. All are GAN-generated images obtained from thiscatdoesnotexist.com. Can we come up with a way to detect GAN-generated cat pics? #CaturdayShenaniGANs
(GAN = "generative adversarial network", the AI technique used to create the images)
For this project, we used the following datasets (all images 512x512):
• 2000 GAN-generated cats from thiscatdoesnotexist.com
• 1195 real cat faces, cropped from images at kaggle.com/crawford/cat-d…
• a test set of 1000 GAN-generated and 1000 real cats (same sources as above)
Unlike the GAN-generated human face pics provided by thispersondoesnotexist.com etc, the placement of the major facial features on the GAN-generated cat pics from thiscatdoesnotexist.com varies from image to image. There are other anomalies in the fake cat pics, however. . .
Do you want to pay complete strangers on the Internet (whose qualifications and skills you know nothing about) to do your homework for you? There's a spam network for that. #FridayFeeling
By searching for the repeated "Hire us to do your <list of homework topics>" tweets shown in the previous collage and exploring the networks of the resulting accounts, we found 300 accounts posting repetitive tweets offering homework/essay writing services for hire.
The accounts in the network (allegedly) send the majority of their tweets via the Twitter Android app, although a number of other apps show up as well. Most tweets are either original tweets or replies (very few retweets or quote tweets).
Is astroturfing with HootSuite still a thing in April 2021? It sure looks that way - we found a network (or possibly two networks) using HootSuite for synchronized retweets, which the accounts then undo after a few hours. #Lobsterfest
First, here's a thread with some background on tweetdecking, the form of astroturfing this network engages in, which involves groups of accounts that retweet the same tweets at the same time, and then undo their retweets after the tweets go viral.
We found 28 accounts that appear to be using the Hootsuite app for astroturfing. We found two separate groups (each amplifying its own lineup of tweets), one consisting of 18 accounts and one consisting of 10 accounts. The larger group appears to undo their retweets more quickly.
Meet @BlancaMatos13, a four-week old Twitter account with a penchant for using stolen photos and a distaste for Ecuadorian presidential candidate Andrés Arauz. Unsurprisingly, this account is not a solo act.
The @BlancaMatos13 account is part of a network of (at least) 63 accounts created in batches in March 2021 that all tweet almost exclusively via TweetDeck and have Ecuador as their profile location. Most operate on very similar schedules.
This network is likely using TweetDeck's scheduling feature, which disproportionately posts its tweets during the first second of the minute for which they are scheduled. (It's also possible that TweetDeck is being automated using other software with similar scheduling behavior).