It's a Saturday, which is a great day to look at a long-dormant botnet following @SamyDindane, creator of the HypeFury Twitter automation software.

cc: @ZellaQuixote
We found 110 batch-created accounts (made in 2011) among @SamyDindane's early followers. To find the rest of the network, we downloaded the followers of other accounts followed by those 110 accounts and looked for additional batch-created accounts from the same time period.
The batches show up as horizontal streaks on follow order by creation date plots of the accounts they follow. This slideshow shows some examples, with the batch-created accounts highlighted in red.
We wound up with exactly 300 accounts that appear to be part of the network, created in April and May 2011. All have been dormant since 2013 but tweeted exclusively via "Twitter Web Client" when active, all follow similar numbers of accounts, and none have ever liked a tweet.
This network's content is mostly in French, with English as the second most frequent language, and is extremely repetitive. Most tweets appear to be ads for various tech products and services.
Along with the repetitive tweets, this network also reuses profile pics across accounts. Profile pics are a mix of cartoon drawings of people and graphics that look like logos.
Who does this network actually follow? Mostly smaller French-language accounts, although a few larger French accounts such as @paramountfr turn up as well. Many but not all appear to be accounts with a focus on technology.
(more info on the follow order by creation date plots used in this thread + source code)

• • •

Missing some Tweet in this thread? You can try to force a refresh
 

Keep Current with Conspirador Norteño

Conspirador Norteño Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @conspirator0

1 Jul
OK, time to create a @DrunkAlexJones account on yet another MAGA social media site and stuff. This feature to "import copies of your Twitter" content looks interesting, will definitely test that out.

cc: @ZellaQuixote
Suggested follows include NewsMax (which somehow has 905K followers on a platform that just started?) and the verification checkmark appears to be red because of course.
So far it looks like a pretty literal clone of Twitter's user interface (much more similar than Gab or Parler).
Read 13 tweets
29 Jun
It's a Tuesday in June, and a whole ducking lot of newly-made Twitter accounts are "requesting faucet funds on the #Goerli #Ethereum test network" in a spammy repetitive fashion. #TuesdayAstroturf

cc: @ZellaQuixote
These tweets are from a network of (at least) 1281 accounts created between June 22 and June 29, 2021. Each account has tweeted exactly once, and all tweets are identical other that the cryptocurrency wallet address. All tweets were (allegedly) sent via the Twitter Web App.
Each account in the network posted its one and only tweet shortly after being created, with an average of 74 seconds and median of 68 seconds between account creation and tweet time. The longest gap between creation and tweet was slightly over ten minutes.
Read 5 tweets
26 Jun
Follow order by creation date scatter plots can be a useful diagnostic tool for finding anomalies in the followers of Twitter accounts. Here's Python source code for generating such a plot based on a follower list in CSV format.

cc: @ZellaQuixote
pastebin.com/KqsTs7yZ
One sign of inauthentic followers is groups of batch-created accounts that followed en masse. These groups manifest as horizontal streaks on the scatter plot, as seen here with @TWReloaded's followers. (This plot is June 2020 and @TWReloaded's fake followers are now suspended.)
(June 2020 thread on the @TWReloaded fake follower network)
Read 8 tweets
24 Jun
In what is quite possibly one of the least necessary crossovers ever, here's a botnet that mostly spams propaganda about #Xinjiang but very occasionally tweets porn too .

cc: @ZellaQuixote
This botnet consists of 183 accounts created between December 2020 and March 2021, mostly in batches. Nearly all of their tweets contain random four letter codes, which we've also seen in a previous Xinjiang propaganda botnet (now suspended):
The accounts in this botnet post almost all of their tweets via Twitter Web App, with very occasional tweets posted via Twitter for Advertisers. All of the Twitter for Advertisers tweets are Arabic-language porn tweets.
Read 8 tweets
20 Jun
Meet @Fernandozi2u, @Itzel2xqry, @Jenniferypvw, @Jensen3eigi, @Maximpxh, and @Raelynq1uo, six accounts with GAN-generated profile pics and identical biographies created in May 2021. #SundayShenaniGANs

cc: @ZellaQuixote
The aforementioned six accounts are part of an astroturf botnet consisting of 2841 similarly-named Twitter accounts with repetitive biographies created in May 2021. These accounts (allegedly) send all of their tweets via Twitter for iPhone.
All 2841 accounts in this network use GAN-generated face pics as their profile images.

(GAN = "generative adversarial network", the AI technique used by thispersondoesnotexist.com and similar tools to generate fake face pics.)
Read 10 tweets
18 Jun
How does one find astroturf networks? One method is to choose a word or phrase, plot a histogram of the creation dates of accounts tweeting that word/phrase, and look for spikes. Several such spikes show up among accounts with recent tweets containing "casino".

cc: @ZellaQuixote
If the spikes in creation dates are the result of someone creating making en masse, batches of similar-looking accounts will show up when one looks at the accounts created during the spikes. Here are some examples from the casino dataset, with possible batches highlighted in red.
The late February and early March batches from the casino dataset all use the same naming scheme, tweet using the same app ("Twitter Web App"), retweet many of the same tweets, and tweet identical tweets on multiple accounts, so these accounts are likely a single operation.
Read 7 tweets

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!

Follow Us on Twitter!

:(