Meet @YannickJongene1, @JitzeKnoppers, @HeijnenJuninho, @DorlandFadil, and @BonneHendrickx, a quintet of accounts created in April 2021 with GAN-generated profile pics. Their interests include being automated and retweeting pretty much the same set of tweets.

cc: @ZellaQuixote
Each of the five accounts in this botnet tweets via its own custom automation app, all of which have names beginning with "test" or "testing" and ending in long strings of digits.
The vast majority (90.9%) of this botnet's content is retweets, with replies rounding out the remainder. It mostly retweets and replies to giveaway tweets, generally from cryptocurrency or gaming accounts.
Almost all of the botnet's replies tag other accounts (this is one of the conditions of entering some of the giveaways). It has tagged 31 different accounts to date, with cryptocurrency, game streaming, and sports being the main themes.
The five accounts in this network use GAN-generated profile pics, but there's a twist: the pics have been cropped so that the major facial features no longer align when blended.

(GAN = "generative adversarial network", the AI technique used by thispersondoesnotexist.com etc)
Shifting the images so that the left eyes line up causes the other facial features to align as well, however. We also found an additional piece of evidence corroborating our belief that these images are GAN-generated. . .
As it turns out, the uncropped versions of all five accounts' profile pics are available from generated.photos, which hosts a library of over 2 million GAN-generated faces. (The site's "anonymize" feature also functions as a reverse image search of its image library.)
Update: all of these accounts have deactivated. Here are their permanent IDs in case they resurface:

@YannickJongene1 1382779056366686213
@JitzeKnoppers 1382414380105621505
@HeijnenJuninho 1382407339903488003
@DorlandFadil 1382740754691407875
@BonneHendrickx 1382425168706990088

• • •

Missing some Tweet in this thread? You can try to force a refresh
 

Keep Current with Conspirador Norteño

Conspirador Norteño Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @conspirator0

3 May
It's not often that the majority of the tweets containing a given hashtag turn out to have been posted with TweetDeck, but so it goes with #UnSoloPaís. 627 of 667 tweets (94%) posted over the last week containing this hashtag were sent via TweetDeck.

cc: @ZellaQuixote Image
Most of these tweets came from a network of 107 Spanish-language accounts that tweet almost exclusively via TweetDeck. These accounts were created between August 2020 and April 2021, mostly in batches of multiple accounts. ImageImageImageImage
These accounts tweet a variety of hashtags, with #UnSoloPais (the unaccented form of #UnSoloPaís) being the most frequent, and various hashtags supporting President-elect of Ecuador Guillermo Lasso and attacking his opponent Andrés Arauz turning up frequently. ImageImage
Read 7 tweets
1 May
What's up with all these recently created accounts with identical biographies and a fondness for using UNNECESSARY CAPITAL LETTERS in their display names? #SundaySpam

cc: @ZellaQuixote
Answer: they're part of a botnet, consisting of (at least) 568 accounts, all but three of which were created between October 2020 and April 2021. All have identical biographies and links to a telegram channel called "TRADING NATION" on their profiles.
All of this network's recent tweets were (allegedly) sent via the Twitter Web App. The three accounts that have older tweets have periods where they used IFTTT and Twitter Web Client (the old version of the Twitter website) as well.
Read 8 tweets
30 Apr
How does one find bot/sock networks? One technique that sometimes bears fruit is to gather a bunch of tweets with some common characteristic (in this example, Turkish tweet sent with TweetDeck), plot the account creation dates, and look for spikes.

cc: @ZellaQuixote
Two of the creation date spikes (Jan 1 and Mar 15, 2021) are batches of accounts that are part of the same botnet: a 32-account porn network whose members tweet at the same times each day via TweetDeck and occasionally via the Twitter Web App. Most were created in 2020 or 2021.
The botnet also contains three accounts created in 2009. It is possible that these were purchased/hacked/otherwise repurposed, as all three have changed their display name significantly and one has changed its @-name as well.
Read 8 tweets
29 Apr
Are these spammy replies from accounts with cat avatars some mysterious form of feline communication? Nope, it's another botnet, and the cats are fake (GAN-generated, similar to those produced by thiscatdoesnotexist.com).

cc: @ZellaQuixote
The reply spammers with the GAN-generated cat pics follow a bunch of other accounts with GAN-generated cat avatars, as well as GAN-generated human face pics and anime pics (and some other things), all with similar follow stats and all created in April 2021.
By recursively exploring the follow relationships of the initial group of accounts, we found 5007 accounts that we believe to be part of the botnet, created in batches between April 2nd and April 27th, 2021.
Read 10 tweets
25 Apr
It's a great day to look at an incredibly repetitive pornbot network that tags its tweets with random numbers. #SundaySpam

cc: @ZellaQuixote
This botnet consists of 99 accounts created between 2010 and 2015 (mostly 2013). All have some variant of "p o r n" as their display name, and all were mostly dormant until mid-April 2021.
This pornbot network tweets prolifically via TweetDeck (223566 tweets from 99 accounts over the span of just two weeks). The majority of the accounts tweet round-the-clock, with some ceasing operation after a few hours or days of activity.
Read 8 tweets
24 Apr
Why did this @serdaribrahimke tweet objecting to Biden's acknowledgement of the #ArmenianGenocide mostly get retweeted by accounts created this month with names ending in 4 digits? #SaturdaySpam

cc: @ZellaQuixote
Answer: a retweet botnet, consisting of 45 accounts made between April 22nd and April 24th, 2021. All have names ending in four digits, and all (allegedly) send most of their tweets via Twitter for iPad with occasional use of Twitter for Android.
This botnet has thus far posted no original content whatsoever. All of its 3016 tweets are retweets, almost all of which are of Turkish-language content.
Read 6 tweets

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!

Follow Us on Twitter!