This botnet consists of (at least) 1301 accounts created between November 2020 and May 2021. Although most have tweeted dozens of times, none has liked more than two tweets. Thus far, they have (allegedly) sent all of their tweets via the Twitter Web App.
All 1301 accounts in this botnet uses GAN-generated face images as their profile pics, similar to those generated by thispersondoesnotexist.com. Almost all of the bots' profile pics are female.
Unmodified GAN-generated face pics have the fingerprint that the major facial features (especially eyes) are always in the same pixel position on each image. This becomes apparent when one blends the images together.
Despite the fact that one can generate GAN face pics to one's heart's content, the operators of this botnet reused them across accounts. 216 of the 1301 accounts bear the same AI-generated face as other accounts in the network.
What does this botnet actually tweet? The vast majority of its content is retweets (183391 of 183925 tweets, 99.7%). The few non-retweets are mostly "thank you for following me tweets" accompanied by promotion of assorted musicians and bands.
Who/what does this botnet retweet? Music-related accounts and tweets about bands/musicians/instuments/etc. Cymbals are a frequent theme of the most-retweeted tweets. Since these bots almost never like tweets, many of the tweets it amplifies end up with more retweets than likes.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
Peru's next president will be chosen in a runoff election on June 6th, and a network of recently-created accounts (many with stolen profile pics) is expressing its astroturfed preference for Keiko Fujimori over Pedro Castillo via TweetDeck. #FridayAstroturf
This network consists of 114 Spanish-language accounts created in batches between March 26th and April 30th, 2021. Thus far, these accounts have posted almost all of their content via TweetDeck (6989 of 7101 tweets, 98.4%).
These accounts tweet about the upcoming election, a mix of tweets promoting right-wing candidate Keiko Fujimori and tweets attacking left-wing candidate Pedro Castillo. They retweet each other's political content frequently, along with occasional retweets of large accounts.
This past Sunday (May 9th) was Mother's Day in multiple countries, and someone apparently chose to mark the occasion by creating a spam botnet to spread feel-good content related to #Xinjiang, China. #HolidayAstroturf
This botnet consists of 65 accounts with default profile pics created on May 9th, 2021. All have tweeted exactly three times, with the exception of @CaraLambrecht, which has only tweeted twice. All tweets thus far were (supposedly) sent via Twitter for Android.
Each account in this botnet has tweeted the same three tweets in the same order (again, with the exception of @CaraLambrecht, which skipped one). The most recent tweet from each account is a Xinhua YouTube video of children (allegedly in Xinjiang) saying "happy Mother's Day".
Here's an interesting account: @Right_n_Aware. Almost all of this account's tweets (177 of 193) have the curious property that they are duplicated verbatim on other accounts. #SpamTastic
We found a total of 78 accounts (including @Right_n_Aware) that frequently tweet the same tweets verbatim. Almost all were created in 2020 or 2021, and almost all have more tweets than likes. They post the majority of their tweets via "Twitter for Android".
This network's duplicate tweets are almost all political in nature, with criticism of the governments of China and Pakistan as the primary themes. Most of the duplicated tweets were tweeted first by either @Right_n_Aware or @ProwessSilent.
A May 3rd 2021 tweet from @SpokespersonCHN about a boy with serious arm injuries being flown to Xinjiang for medical treatment attracted a flurry of retweets and repetitive replies in multiple languages from accounts with default profile pics.
These replies are from a network of 479 accounts created in batches between January and April 2021. All accounts have English first and last names (first names are almost all female). These accounts have thus far posted all of their tweets via the Twitter Web App (allegedly).
This network's content is (mostly) a mix of replies and retweets. The replies are repeated verbatim across multiple accounts. Despite all of the accounts having English-looking names, the accounts are quite multilingual, having replied in 37 different languages thus far.
All twelve of these accounts have the same anomalous pattern in their followers: long spans of time post-2019 where nearly all their new followers are accounts created prior to mid-November 2018. What's up with that? #WednesdayWisdom
The twelve accounts don't have the same anomalous followers, however, and the anomalous followers in question by and large don't look like batch-created accounts or obvious bots. The twelve accounts do have something in common, however. . .
All twelve accounts are being promoted in Twitter's "who to follow" section. We're not precisely sure why, but there appears to be a correlation between this form of Twitter promotion and accounts mostly gaining followers created before November 2018.
Each of the five accounts in this botnet tweets via its own custom automation app, all of which have names beginning with "test" or "testing" and ending in long strings of digits.
The vast majority (90.9%) of this botnet's content is retweets, with replies rounding out the remainder. It mostly retweets and replies to giveaway tweets, generally from cryptocurrency or gaming accounts.