Share this page!

Maybe Scrolly?
Conspirador Norteño Profile picture
Twitter logo
29 Jun, 5 tweets, 3 min read
It's a Tuesday in June, and a whole ducking lot of newly-made Twitter accounts are "requesting faucet funds on the #Goerli #Ethereum test network" in a spammy repetitive fashion. #TuesdayAstroturf

cc: @ZellaQuixote
These tweets are from a network of (at least) 1281 accounts created between June 22 and June 29, 2021. Each account has tweeted exactly once, and all tweets are identical other that the cryptocurrency wallet address. All tweets were (allegedly) sent via the Twitter Web App.
Each account in the network posted its one and only tweet shortly after being created, with an average of 74 seconds and median of 68 seconds between account creation and tweet time. The longest gap between creation and tweet was slightly over ten minutes.
These tweets appear to be an attempt to game a cryptocurrency giveaway hosted at faucet(dot)goerli(dot)mudit(dot)blog. (As always, caution is recommended when visiting unknown websites linked by spammy accounts.)
The accounts in this network use photographs of people as their profile pics, but the pics are stolen, as tends to be the case with spammy botnets. Google and TinEye were more effective than Yandex for finding previous uses of these images on the Internet.

• • •

Missing some Tweet in this thread? You can try to force a refresh
　

Keep Current with Conspirador Norteño

Conspirador Norteño Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @conspirator0

Conspirador Norteño Profile picture
26 Jun
Follow order by creation date scatter plots can be a useful diagnostic tool for finding anomalies in the followers of Twitter accounts. Here's Python source code for generating such a plot based on a follower list in CSV format.

cc: @ZellaQuixote
pastebin.com/KqsTs7yZ
One sign of inauthentic followers is groups of batch-created accounts that followed en masse. These groups manifest as horizontal streaks on the scatter plot, as seen here with @TWReloaded's followers. (This plot is June 2020 and @TWReloaded's fake followers are now suspended.)
(June 2020 thread on the @TWReloaded fake follower network)
Read 8 tweets
Conspirador Norteño Profile picture
24 Jun
In what is quite possibly one of the least necessary crossovers ever, here's a botnet that mostly spams propaganda about #Xinjiang but very occasionally tweets porn too .

cc: @ZellaQuixote
This botnet consists of 183 accounts created between December 2020 and March 2021, mostly in batches. Nearly all of their tweets contain random four letter codes, which we've also seen in a previous Xinjiang propaganda botnet (now suspended):
The accounts in this botnet post almost all of their tweets via Twitter Web App, with very occasional tweets posted via Twitter for Advertisers. All of the Twitter for Advertisers tweets are Arabic-language porn tweets.
Read 8 tweets
Conspirador Norteño Profile picture
20 Jun
Meet @Fernandozi2u, @Itzel2xqry, @Jenniferypvw, @Jensen3eigi, @Maximpxh, and @Raelynq1uo, six accounts with GAN-generated profile pics and identical biographies created in May 2021. #SundayShenaniGANs

cc: @ZellaQuixote
The aforementioned six accounts are part of an astroturf botnet consisting of 2841 similarly-named Twitter accounts with repetitive biographies created in May 2021. These accounts (allegedly) send all of their tweets via Twitter for iPhone.
All 2841 accounts in this network use GAN-generated face pics as their profile images.

(GAN = "generative adversarial network", the AI technique used by thispersondoesnotexist.com and similar tools to generate fake face pics.)
Read 10 tweets
Conspirador Norteño Profile picture
18 Jun
How does one find astroturf networks? One method is to choose a word or phrase, plot a histogram of the creation dates of accounts tweeting that word/phrase, and look for spikes. Several such spikes show up among accounts with recent tweets containing "casino".

cc: @ZellaQuixote
If the spikes in creation dates are the result of someone creating making en masse, batches of similar-looking accounts will show up when one looks at the accounts created during the spikes. Here are some examples from the casino dataset, with possible batches highlighted in red.
The late February and early March batches from the casino dataset all use the same naming scheme, tweet using the same app ("Twitter Web App"), retweet many of the same tweets, and tweet identical tweets on multiple accounts, so these accounts are likely a single operation.
Read 7 tweets
Conspirador Norteño Profile picture
15 Jun
Pro-Bolsonaro accounts are spamming follow trains under a variety of hashtags. Here's a quick look at the network (or network of networks, rather). #PlatformManipulationMonday

cc: @ZellaQuixote
To map out Bolsonaro trains, we began with one train hashtag (#ArqueirosPatriotas) and explored the networks of accounts using it to find more. We wound up with 12 hashtags (often used in combination), 16969 trains, and 229795 retweets of trains between April 1 and June 13 2021.
We considered any non-reply tweet containing at least one of the follow train hashtags, at least 10 tags of other accounts, and no substantive additional text content to be train tweets. Over half of the volume (56.1%) is trains listing at least 20 accounts or retweets thereof.
Read 5 tweets
Conspirador Norteño Profile picture
14 Jun
If you woke up this morning hoping that somewhere in the world there was a Twitter botnet advertising multiplayer games by replying to tweets (many of them several years old) that have nothing to do with video games, this spam network's for you. #SundaySpam

cc: @ZellaQuixote
This network consists of 45 accounts created between February and June 2020. Almost all of their content (23574 of 24125 tweets, 97.7%) is repetitive replies promoting video games, most of which link to gameexp(dot)com.
At least 23 (probably 25) of the accounts in this network use GAN-generated profile pics. (GAN = "generative adversarial network", the AI technique behind the fake faces produced by thispersondoesnotexist.com etc.) Many have had their colors edited, and 10 have been resized/cropped.
Read 7 tweets

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!

Follow Us on Twitter!

Like this author's thread?

Get emails when @conspirator0 has new unrolls!

Check out other threads from @conspirator0!

Read all threads by @conspirator0

:(