This botnet consists of 99 accounts created between 2010 and 2015 (mostly 2013). All have some variant of "p o r n" as their display name, and all were mostly dormant until mid-April 2021.
This pornbot network tweets prolifically via TweetDeck (223566 tweets from 99 accounts over the span of just two weeks). The majority of the accounts tweet round-the-clock, with some ceasing operation after a few hours or days of activity.
Is this botnet using TweetDeck's scheduling feature to accomplish its 24/7 presence? Almost all scheduled TweetDeck tweets are posted within the first second of the minute for which they are scheduled, which isn't true of this botnet's tweets.
The botnet's tweets do have a timing anomaly, however. It began by posting its tweets shortly before the start of each minute, but it is slowly falling behind: on 4/20, it was tweeting ~10 seconds into each minute, and today (4/25) it is tweeting ~23 seconds into each minute.
What would explain this behavior? A likely explanation is that the botnet operators wrote their own scheduling software that fails to account for some form of latency, and thus slowly falls behind schedule when run for a long period of time.
What does this botnet actually tweet? The tweets are extremely repetitive and consist of single words such as "XXX" or "video" followed by four tags of one of two porn accounts (@/porn_sex_linkkk and @/sex_porn_linkk), followed by a random number.
The two tagged porn accounts in turn have what appear to be blogspot links that actually redirect to endless signup pages for an obscure "dating site" in multiple languages. The site is likely unsafe and we recommend neither visiting it nor providing it any information.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
It's New Year's Eve, and a bunch of politics enthusiasts with GAN-generated faces are enthusiastically replying to a variety of posts with similarly-worded replies. #NewYearShenaniGANs
cc: @ZellaQuixote
The politics enthusiasts are part of a spam network consisting of (at least) 575 accounts created between May and December 2023 with GAN-generated faces. Many of their handles, such as @Maairiuieinaaa and @eJooeiaAoneueer, contain long strings of vowels.
@Maairiuieinaaa @eJooeiaAoneueer All 575 of these accounts use StyleGAN-generated faces as profile images. Some of these, such as @MauMoiagaia's profile image, contain a tiny "StyleGAN 2 (Karras et al.)" watermark in the lower right corner.
It's a great day to look at a network of inauthentic accounts that post identical AI art images (with a side of good old fashioned T-shirt spam).
cc: @ZellaQuixote
This network consists of 24 X accounts. 12 of these accounts were created in the latter half of 2023 and have female avatars, while the other 12 were created in 2013 or earlier and have male avatars.
The 12 accounts with female avatars and 2023 creation dates regularly post AI-generated art images, and these image posts are quickly reposted by other accounts in the network (both female and male). The AI-generated images are often duplicated across accounts.
Meet @ImJamesMiller (permanent ID 1371651462153994242), an account with a GAN-generated face, 172K followers, and no tweets prior to two days ago. What's up with that?
cc: @ZellaQuixote
As it turns out, @ImJamesMiller wasn't always named @ImJamesMiller. In June, the account was named @/IamJimCaviezel in an apparent attempt to impersonate Sound of Freedom actor Jim Caviezel.
@ImJamesMiller Multiple prominent users appear to have accepted the fake Jim Caviezel account as legitimate, including Texas Congressman Brian Babin, right-wing influencer/ex-Game of Thrones blogger Jack Posobiec, and recently indicted ex-Assistant Attorney General Jeff Clark.
It's a great day to look at a network of Bluesky spam accounts with randomized names. #SundaySpam
cc: @ZellaQuixote
This spam network consists of (at least) 401 accounts, all of which were created (or added to the Bluesky app view) in August 2023. These accounts do not follow each other; rather, each one follows a small number of popular Bluesky accounts.
The accounts in this network cycle rhythmically between posting three types of content:
• reposts
• posts containing links to news articles
• posts containing links to news articles accompanied by images
Meet @thisisorange, a Twitter account created in February 2022 with a gold "verified organization" badge, thousands of batch-created fake followers, and a couple other interesting traits.
Verified organizations on Twitter can verify affiliated accounts (employees, teams, brand names, etc), which receive blue checkmarks as well as an organization badge (help.twitter.com/en/using-twitt…). The @thisisorange account has thousands of affiliates, mostly cryptocurrency accounts.
How did this come about? The website linked on @thisisorange's profile (orange dot associates) apparently allows one to become an affiliate simply by providing a Twitter account and a cryptocurrency wallet.