Meet @HodgesonMaria, @MarcusSabastian, and @AdelmoNowak, a trio of accounts using a similar lineup of automation apps. Their interests include adventure, travelling, incorrect use of capital letters, and stolen profile pics. Also, they have friends.
cc: @ZellaQuixote
cc: @ZellaQuixote
These accounts are part of a botnet that consists of 40 automated accounts. Most were created in October 2020 or March/April 2021. Ten of them were created back in 2009, but have no visible tweets prior to 2020.
All ten of the accounts with 2009 create dates underwent significant name changes at some point over the past year or so, making it reasonably likely that these accounts were hijacked or purchased.
The majority of this botnet's content (41245 of 50975 tweets, 80.9%) is sent via automation service dlvr(dot)it. Most of the rest of the content is sent via custom apps with lowercase names. A few tweets sent via other automation services and the Twitter Web App turn up as well.
The dlvr(dot) tweets are all links to websites, mostly news outlets and YouTube, with the New Delhi Times at the top of the list. Much (not all) of the news content is related to India. Lakers42342(dot)tumblr(dot)com is a weird outlier - it appears to be an empty Tumblr page.
We've seen botnets linking similar empty tumblr pages with sports-themed names before, although those networks only linked the tumblr pages and didn't share actual news. It's possible this botnet is a successor to these earlier networks.
https://twitter.com/conspirator0/status/1326623427634061312
The rest of the botnet's content is almost all retweets, most frequently of @NewDelhiTimes. Retweets are posted via 20 different custom apps. Each bot has also quote-tweeted @NewDelhiTimes or @HamaraHind via Ryzely at least once (some of the quote tweets are broken).
• • •
Missing some Tweet in this thread? You can try to
force a refresh
