What's up with all these recently created accounts with identical biographies and a fondness for using UNNECESSARY CAPITAL LETTERS in their display names? #SundaySpam
Answer: they're part of a botnet, consisting of (at least) 568 accounts, all but three of which were created between October 2020 and April 2021. All have identical biographies and links to a telegram channel called "TRADING NATION" on their profiles.
All of this network's recent tweets were (allegedly) sent via the Twitter Web App. The three accounts that have older tweets have periods where they used IFTTT and Twitter Web Client (the old version of the Twitter website) as well.
Every tweet this network has posted since the beginning of 2021 is a retweet, and they only retweet one account: @TradingNation_, which has the same biography as the 568 bots that amplify it, and is itself automated via IFTTT. The network has amplified 61 of its tweets to date.
The bots in this network each follow a few other members of the network. Additionally, 452 of the 568 bots follow the @TradingNation_ account that they retweet.
One more interesting detail: the three retweet bots created prior to 2020, as well as the main @TradingNation_ account, were all renamed. The previous names and content of replies to their old tweets suggest electronic music was their previous focus.
@TradingNation_: previously @ElectroLifeMF (ID 972453637) @TradingNation6: previously @FactoriesBeats (ID 3009596267) @Crypto_Life02: previously @ElectroLifeEU (ID 1559554982) @Crypto_Life03: previously @ElectroLifeMEX (ID 621345335)
How does one find bot/sock networks? One technique that sometimes bears fruit is to gather a bunch of tweets with some common characteristic (in this example, Turkish tweet sent with TweetDeck), plot the account creation dates, and look for spikes.
Two of the creation date spikes (Jan 1 and Mar 15, 2021) are batches of accounts that are part of the same botnet: a 32-account porn network whose members tweet at the same times each day via TweetDeck and occasionally via the Twitter Web App. Most were created in 2020 or 2021.
The botnet also contains three accounts created in 2009. It is possible that these were purchased/hacked/otherwise repurposed, as all three have changed their display name significantly and one has changed its @-name as well.
Are these spammy replies from accounts with cat avatars some mysterious form of feline communication? Nope, it's another botnet, and the cats are fake (GAN-generated, similar to those produced by thiscatdoesnotexist.com).
The reply spammers with the GAN-generated cat pics follow a bunch of other accounts with GAN-generated cat avatars, as well as GAN-generated human face pics and anime pics (and some other things), all with similar follow stats and all created in April 2021.
By recursively exploring the follow relationships of the initial group of accounts, we found 5007 accounts that we believe to be part of the botnet, created in batches between April 2nd and April 27th, 2021.
This botnet consists of 99 accounts created between 2010 and 2015 (mostly 2013). All have some variant of "p o r n" as their display name, and all were mostly dormant until mid-April 2021.
This pornbot network tweets prolifically via TweetDeck (223566 tweets from 99 accounts over the span of just two weeks). The majority of the accounts tweet round-the-clock, with some ceasing operation after a few hours or days of activity.
Why did this @serdaribrahimke tweet objecting to Biden's acknowledgement of the #ArmenianGenocide mostly get retweeted by accounts created this month with names ending in 4 digits? #SaturdaySpam
Answer: a retweet botnet, consisting of 45 accounts made between April 22nd and April 24th, 2021. All have names ending in four digits, and all (allegedly) send most of their tweets via Twitter for iPad with occasional use of Twitter for Android.
This botnet has thus far posted no original content whatsoever. All of its 3016 tweets are retweets, almost all of which are of Turkish-language content.
This network consists of 24 accounts created between May 2019 and December 2020. All have GAN-generated face images as their profile pics. Presently, all 24 (allegedly) tweet via the Twitter Web App.
The current generation of GAN-generated face pics have the anomaly that the major facial features (particularly the eyes) are in the same pixel position on each image. This trait becomes easy to see when we blend the images together, as in this video:
This video shows the process of blending @JaredLCarter's profile pic with 9 pictures generated by thispersondoesnotexist.com, demonstrating that the major facial features (particularly the eyes) are in the exact same place, a fingerprint of unmodified GAN-generated face pics.
(more threads on the use of GAN-generated images and how to detect them here: