Tweet

Conspirador Norteño

12 May, 8 tweets, 6 min read

@ZellaQuixote

This past Sunday (May 9th) was Mother's Day in multiple countries, and someone apparently chose to mark the occasion by creating a spam botnet to spread feel-good content related to #Xinjiang, China. #HolidayAstroturf

cc: @ZellaQuixote

@CaraLambrecht

This botnet consists of 65 accounts with default profile pics created on May 9th, 2021. All have tweeted exactly three times, with the exception of @CaraLambrecht, which has only tweeted twice. All tweets thus far were (supposedly) sent via Twitter for Android.

@CaraLambrecht

Each account in this botnet has tweeted the same three tweets in the same order (again, with the exception of @CaraLambrecht, which skipped one). The most recent tweet from each account is a Xinhua YouTube video of children (allegedly in Xinjiang) saying "happy Mother's Day".

We found a second astroturf network pushing the same "#Mother's Day Greetings from #Xinjiang" YouTube video. This network consists of 94 accounts with default profile pics created over a two-week period in May 2020. This network tweets via the Twitter Web App.

This network's tweets are repetitive, with tweets disputing reports of human rights abuses in Xinjiang and tweets about terrorism and separatism in Xinjiang as recurring themes. A few tweets countering US right-wing claims that China caused the COVID-19 pandemic turn up as well.

This network has a recurring glitch: many of its tweets contain links that don't work due to the lack of a space between the links and the tweet text. These glitchy tweets are generally duplicated across multiple accounts in the network.

@nytimes

Finally, who does this network follow? Mostly big accounts with millions or tens of millions of followers, so a small botnet doesn't really do much to inflate their follower counts. @nytimes is the only account followed by all 94 bots in the network.

https://twitter.com/conspirator0/status/1391175028708892673

This is not the first time we've encountered astroturf networks focused on Xinjiang. Some previous examples:

https://twitter.com/conspirator0/status/1391175028708892673

https://twitter.com/conspirator0/status/1372007492276916224

https://twitter.com/conspirator0/status/1352408453143269378

• • •

Missing some Tweet in this thread? You can try to force a refresh

This Thread may be Removed Anytime!

Twitter may remove this content at anytime! Save it as PDF for later use!

More from @conspirator0

Conspirador Norteño

@conspirator0

11 May

@Right_n_Aware

Here's an interesting account: @Right_n_Aware. Almost all of this account's tweets (177 of 193) have the curious property that they are duplicated verbatim on other accounts. #SpamTastic

cc: @ZellaQuixote

@Right_n_Aware

We found a total of 78 accounts (including @Right_n_Aware) that frequently tweet the same tweets verbatim. Almost all were created in 2020 or 2021, and almost all have more tweets than likes. They post the majority of their tweets via "Twitter for Android".

@Right_n_Aware

This network's duplicate tweets are almost all political in nature, with criticism of the governments of China and Pakistan as the primary themes. Most of the duplicated tweets were tweeted first by either @Right_n_Aware or @ProwessSilent.

Read 5 tweets

Conspirador Norteño

@conspirator0

8 May

@SpokespersonCHN

A May 3rd 2021 tweet from @SpokespersonCHN about a boy with serious arm injuries being flown to Xinjiang for medical treatment attracted a flurry of retweets and repetitive replies in multiple languages from accounts with default profile pics.

cc: @ZellaQuixote

These replies are from a network of 479 accounts created in batches between January and April 2021. All accounts have English first and last names (first names are almost all female). These accounts have thus far posted all of their tweets via the Twitter Web App (allegedly).

This network's content is (mostly) a mix of replies and retweets. The replies are repeated verbatim across multiple accounts. Despite all of the accounts having English-looking names, the accounts are quite multilingual, having replied in 37 different languages thus far.

Read 4 tweets

Conspirador Norteño

@conspirator0

8 May

@ZellaQuixote

All twelve of these accounts have the same anomalous pattern in their followers: long spans of time post-2019 where nearly all their new followers are accounts created prior to mid-November 2018. What's up with that? #WednesdayWisdom

cc: @ZellaQuixote

The twelve accounts don't have the same anomalous followers, however, and the anomalous followers in question by and large don't look like batch-created accounts or obvious bots. The twelve accounts do have something in common, however. . .

All twelve accounts are being promoted in Twitter's "who to follow" section. We're not precisely sure why, but there appears to be a correlation between this form of Twitter promotion and accounts mostly gaining followers created before November 2018.

Read 4 tweets

Conspirador Norteño

@conspirator0

4 May

@YannickJongene1

Meet @YannickJongene1, @JitzeKnoppers, @HeijnenJuninho, @DorlandFadil, and @BonneHendrickx, a quintet of accounts created in April 2021 with GAN-generated profile pics. Their interests include being automated and retweeting pretty much the same set of tweets.

cc: @ZellaQuixote

Each of the five accounts in this botnet tweets via its own custom automation app, all of which have names beginning with "test" or "testing" and ending in long strings of digits.

The vast majority (90.9%) of this botnet's content is retweets, with replies rounding out the remainder. It mostly retweets and replies to giveaway tweets, generally from cryptocurrency or gaming accounts.

Read 8 tweets

Conspirador Norteño

@conspirator0

3 May

@ZellaQuixote

It's not often that the majority of the tweets containing a given hashtag turn out to have been posted with TweetDeck, but so it goes with #UnSoloPaís. 627 of 667 tweets (94%) posted over the last week containing this hashtag were sent via TweetDeck.

cc: @ZellaQuixote

Most of these tweets came from a network of 107 Spanish-language accounts that tweet almost exclusively via TweetDeck. These accounts were created between August 2020 and April 2021, mostly in batches of multiple accounts.

These accounts tweet a variety of hashtags, with #UnSoloPais (the unaccented form of #UnSoloPaís) being the most frequent, and various hashtags supporting President-elect of Ecuador Guillermo Lasso and attacking his opponent Andrés Arauz turning up frequently.

Read 7 tweets

Conspirador Norteño

@conspirator0

1 May

@ZellaQuixote

What's up with all these recently created accounts with identical biographies and a fondness for using UNNECESSARY CAPITAL LETTERS in their display names? #SundaySpam

cc: @ZellaQuixote

Answer: they're part of a botnet, consisting of (at least) 568 accounts, all but three of which were created between October 2020 and April 2021. All have identical biographies and links to a telegram channel called "TRADING NATION" on their profiles.

All of this network's recent tweets were (allegedly) sent via the Twitter Web App. The three accounts that have older tweets have periods where they used IFTTT and Twitter Web Client (the old version of the Twitter website) as well.

Read 8 tweets

Support us! We are indie developers!

This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!

Share this page!

Conspirador Norteño

Try unrolling a thread yourself!

More from @conspirator0

Conspirador Norteño

Conspirador Norteño

Conspirador Norteño

Conspirador Norteño

Conspirador Norteño

Conspirador Norteño

Did Thread Reader help you today?

Like this author's thread?