Why did this @serdaribrahimke tweet objecting to Biden's acknowledgement of the #ArmenianGenocide mostly get retweeted by accounts created this month with names ending in 4 digits? #SaturdaySpam

cc: @ZellaQuixote
Answer: a retweet botnet, consisting of 45 accounts made between April 22nd and April 24th, 2021. All have names ending in four digits, and all (allegedly) send most of their tweets via Twitter for iPad with occasional use of Twitter for Android.
This botnet has thus far posted no original content whatsoever. All of its 3016 tweets are retweets, almost all of which are of Turkish-language content.
Who and what does this botnet retweet? It amplifies a variety of Turkish accounts, with content being a mix of political content (primarily objections to Biden's statement about the #ArmenianGenocide), sports, and promotional tweets.
Despite allegedly tweeting via the Twitter iPad app, we believe these accounts to be largely automated. Most of the network's retweets are meticulously synchronized, with the botnet's first and last retweet of any given tweet coming less than half a second apart.
Finally, who do the bots in this network follow? All 45 of them follow @imparator3438, whose tweets (mostly sports-themed) they have sometimes amplified. 40 of the 45 bots follow only this account; the other 5 appear to have followed accounts back here and there.

• • •

Missing some Tweet in this thread? You can try to force a refresh
 

Keep Current with Conspirador Norteño

Conspirador Norteño Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @conspirator0

23 Apr
It's a great day to look at a network of #SEO/#DigitalMarketing spam accounts with GAN-generated profile pics. #SEOShenaniGAN

(GAN = "generative adversarial network, the AI technique behind the fake faces generated by thispersondoesnotexist.com and similar tools)

cc: @ZellaQuixote
This network consists of 24 accounts created between May 2019 and December 2020. All have GAN-generated face images as their profile pics. Presently, all 24 (allegedly) tweet via the Twitter Web App.
The current generation of GAN-generated face pics have the anomaly that the major facial features (particularly the eyes) are in the same pixel position on each image. This trait becomes easy to see when we blend the images together, as in this video:
Read 6 tweets
19 Apr
Meet @JaredLCarter (permanent ID 150677979), a "Cyber Security PhD" with a GAN-generated profile pic and a blue verification checkmark.

(GAN = "generative adversarial network", the AI technology behind the fake face pics generated by thispersondoesnotexist.com)

cc: @ZellaQuixote
This video shows the process of blending @JaredLCarter's profile pic with 9 pictures generated by thispersondoesnotexist.com, demonstrating that the major facial features (particularly the eyes) are in the exact same place, a fingerprint of unmodified GAN-generated face pics.
(more threads on the use of GAN-generated images and how to detect them here: )
Read 7 tweets
17 Apr
One of the accounts that @DrunkAlexJones was forced to follow by the "Round Year Fun" app is @drago1171, an account created in 2009 with a GAN-generated face pic that follows several other old accounts with GAN-generated face pics. #SaturdayShenaniGANs

cc: @ZellaQuixote Image
By recursively exploring the followers/followees of these accounts, we found a network of 54 accounts created in 2009 or 2010 with GAN-generated faces. All were dormant from late 2012 until April 2021, when all 54 began tweeting via the Twitter Web App. ImageImageImageImage
Here's an animated visualization of blending all 54 profile pics together, showing the identical facial feature placement that is a fingerprint of GAN-generated pics such as those created by thispersondoesnotexist.com. (GAN = "generative adversarial network", the AI technique used.)
Read 6 tweets
17 Apr
PSA: These "fun" apps from roundyear(dot)fun ("My Twitter Family" etc) have a downside: they gain near-total control of your account and (at the very least) use it to follow other accounts without your knowledge. #FunAllYearRoundUntilYourAccountGetsCompromised

cc: @ZellaQuixote Image
We had @DrunkAlexJones test some of the Round Year Fun apps. The list of permissions the apps request is extensive and encompasses pretty much every action one could possibly take with one's Twitter account. The apps produced the expected "My Twitter Crush" etc tweets. ImageImage
Less expectedly, the Round Year Fun apps caused @DrunkAlexJones to follow six accounts:: @GeoRebekah, @ai3____, @zkerravala, @firefireband, @drago1171, and @MunaTaji. The apps also muted each of the accounts they followed. Image
Read 11 tweets
15 Apr
Meet @An_mal11, @An_mal12, @An_mal13, @An_mal14, @An_mal15, @An_mal16, @an_mal17, and @An_mal18. This collection of similarly-named tiny Twitter accounts could be yours for $71, but you should probably save your money.

cc: @ZellaQuixote
These eight accounts were all created on either February 18th or February 21st, 2021. Thus far, they have tweeted very little (only 58 tweets), and have sent all their tweets via the Twitter Android app. Two of them (@An_mal12 and @An_mal14) currently have identical biographies.
The majority of these accounts' tweets so far are extremely brief replies to each other (and sometimes replies to each other's replies to each other, and so on). They have also posted a few follower growth tweets, including retweets of a tweet that contains a likely malware link.
Read 7 tweets
13 Apr
Did a whole bunch of identical-looking people join Twitter back in 2016? (Spoiler: nope, it's yet another botnet.) #MondayMotivation

cc: @ZellaQuixote
This botnet is comprised of 4959 accounts created between January 7th and January 28th, 2016 (with a mid-month break). All of them follow between 35 and 40 accounts, and have never liked a tweet. Account names consist of English first names followed by four random letters.
This network only uses 23 unique profile pictures (22 photos and the default pic) across 4959 accounts, resulting in each non-default pic appearing on over 200 accounts. Reverse image searches indicate that the same images may have been used for spam networks on Facebook as well.
Read 5 tweets

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!

Follow Us on Twitter!