It's Tuesday in May, and a blue-check verified Twitter account by the name of @JobySanchez (permanent ID 790029565) is on the market for the exciting and dynamic price of $2000.
The @JobySanchez account appears to have originally belonged to MMA fighter Joby Sanchez. Back in May 2020, it had far more tweets and fewer followers than it does now. The old tweets appear to have been purged - searches return nothing prior to April 18th, 2021.
About half of @JobySanchez's 4463 followers followed it recently (5/1/2021 or later), and we found an interesting difference (that we can't as of yet explain) between its old and new followers: @JobySanchez follows almost all of its recent followers but very few of the old ones.
(previous thread with more info on the selling of Twitter accounts on shady websites)
Meet @HodgesonMaria, @MarcusSabastian, and @AdelmoNowak, a trio of accounts using a similar lineup of automation apps. Their interests include adventure, travelling, incorrect use of capital letters, and stolen profile pics. Also, they have friends.
These accounts are part of a botnet that consists of 40 automated accounts. Most were created in October 2020 or March/April 2021. Ten of them were created back in 2009, but have no visible tweets prior to 2020.
All ten of the accounts with 2009 create dates underwent significant name changes at some point over the past year or so, making it reasonably likely that these accounts were hijacked or purchased.
The "Round Year Fun" family of malicious Twitter apps ("My Twitter Family", "My Twitter Crush", etc) began using a new domain name (roundyearfun(dot)me) as of May 1st, 2021. Here's a look at the activity since the switch, and once again: DO NOT USE THESE APPS!
Using any of the Round Year Fun apps will cause your account to follow and mute a specific set of accounts without your knowledge. If you've already attached one or more of these apps to your account, here are instructions on how to revoke access:
We downloaded all available tweets linking to the new Round Year Fun domain, roundyearfun(dot)me, yielding 145599 tweets from 117019 accounts posted via a whopping 870 distinct apps.
Here's a look at pro-Bolsonaro, pro-Trump follow train hashtag #Bolso22Trump24. (A "follow train" is a tweet listing a bunch of accounts to follow. Generally the listed accounts will follow back anyone who follows them and retweets the train.)
This hashtag is not the first incarnation of this follower growth operation. Similar follow trains (from many of the same accounts) were tweeted with the hashtag #BolsoTrump2021 until early March 2021, when it was abruptly replaced with #Bolso22Trump24.
We downloaded all available tweets containing #Bolso22Trump24, yielding 96310 tweets from 3920 accounts. Almost all (91148 tweets, 94.6%) are retweets, and the 4144 original tweets containing the hashtag originate with just 60 accounts.
This botnet consists of (at least) 1301 accounts created between November 2020 and May 2021. Although most have tweeted dozens of times, none has liked more than two tweets. Thus far, they have (allegedly) sent all of their tweets via the Twitter Web App.
All 1301 accounts in this botnet uses GAN-generated face images as their profile pics, similar to those generated by thispersondoesnotexist.com. Almost all of the bots' profile pics are female.
Peru's next president will be chosen in a runoff election on June 6th, and a network of recently-created accounts (many with stolen profile pics) is expressing its astroturfed preference for Keiko Fujimori over Pedro Castillo via TweetDeck. #FridayAstroturf
This network consists of 114 Spanish-language accounts created in batches between March 26th and April 30th, 2021. Thus far, these accounts have posted almost all of their content via TweetDeck (6989 of 7101 tweets, 98.4%).
These accounts tweet about the upcoming election, a mix of tweets promoting right-wing candidate Keiko Fujimori and tweets attacking left-wing candidate Pedro Castillo. They retweet each other's political content frequently, along with occasional retweets of large accounts.
This past Sunday (May 9th) was Mother's Day in multiple countries, and someone apparently chose to mark the occasion by creating a spam botnet to spread feel-good content related to #Xinjiang, China. #HolidayAstroturf
This botnet consists of 65 accounts with default profile pics created on May 9th, 2021. All have tweeted exactly three times, with the exception of @CaraLambrecht, which has only tweeted twice. All tweets thus far were (supposedly) sent via Twitter for Android.
Each account in this botnet has tweeted the same three tweets in the same order (again, with the exception of @CaraLambrecht, which skipped one). The most recent tweet from each account is a Xinhua YouTube video of children (allegedly in Xinjiang) saying "happy Mother's Day".