Tweet

Conspirador Norteño

19 Jul, 9 tweets, 5 min read

@El6YUlRJVNEFutr

Meet @El6YUlRJVNEFutr (permanent ID 1412134274762002436). Despite having been created just two weeks ago and having almost no content, it has somehow accumulated a large following consisting almost entirely of accounts that are at least seven years old.

cc: @ZellaQuixote

@El6YUlRJVNEFutr

Weirdly, almost all of @El6YUlRJVNEFutr's followers are older accounts, created in 2013 or earlier. The near-total absence of accounts that are even remotely new is a sign that this follower growth is extremely unlikely to be organic.

These accounts are part of a bulk follow network that followed a variety of accounts en masse over the last few weeks. (The followers from the network are highlighted in orange on the follow order by date range plots.)

@El6YUlRJVNEFutr

Here are the accounts most frequently followed by the accounts in the network. Almost all of the accounts followed by the network are Arabic-language accounts. Most (other than @El6YUlRJVNEFutr) are established accounts with at least some content.

The accounts in this network all follow hundreds of accounts but have few or no followers of their own. Almost have Arabic display names and "KSA" as their profile location. Most of the accounts between 2014 and 2021, when they suddenly woke up and kicked into high gear.

For many of these accounts, their recent reawakening was accompanied by a makeover. At least 9107 had their display names changed sometime between March 2020 (when we captured data on a bunch of older Twitter accounts) and July 2021 - in all cases, to Arabic text.

@justinsuntron

Almost all of this network's content since it woke back up (1996877 of 1997387 tweets, 99.97%) is retweets, mostly of the same content. The network primarily amplifies large Arabic-language accounts, although two of the top three are exceptions: @justinsuntron and @BitTorrent.

This network showed one previous spike of activity back in August 2012, when it posted thousands of tweets about "photos" accompanied by shortened links. The shortened links lead to pages hosted on narod(dot)ru that no longer exist.

@ARTEM_KLYUSHIN

How did we find this network? It bestowed a few hundred retweets each on a series of recent @ARTEM_KLYUSHIN tweets about a tanker fire in Dubai, all of which received substantially more retweets than likes as a result. This is a sign of potential astroturfing, so we dug deeper.

• • •

Missing some Tweet in this thread? You can try to force a refresh

This Thread may be Removed Anytime!

Twitter may remove this content at anytime! Save it as PDF for later use!

More from @conspirator0

Conspirador Norteño

@conspirator0

18 Jul

@OpenWebHQ

Rather ironically given its stated interest in "healthy conversations online" and "thriving engaged communities", @OpenWebHQ got many of its early followers from a duo of fake follower botnets. We've seen one of these botnets before; here's a look at the other.

cc: @ZellaQuixote

This fake follower botnet consists of 4075 accounts created in large batches in July 2014. All accounts have lowercase names containing underscores, and usually digits as well. All have been dormant since late 2015 but (allegedly) tweeted via "Twitter Web Client" when active.

Who does this fake follower botnet follow? Mostly commercial/promotional accounts belonging to a variety of businesses and entrepreneurs. Most of the accounts followed by the bots tweet primarily in English, although a few Arabic-language accounts turn up as well.

Read 8 tweets

Conspirador Norteño

@conspirator0

12 Jul

@aykacmis

Meet @aykacmis, @degismece, @anlamislar, @aykacti, @kayitlii, and @donmedim, a sextet of blue-check verified Twitter accounts created on June 16th, 2021. None has yet tweeted and all have roughly 1000 followers (and mostly the *same* followers).

cc: @ZellaQuixote

@kayitlii

Two of these six accounts (@kayitlii and @aykacti) have photographs of people as their profile pics. Despite the presence of the blue verification checkmark, neither image is likely to depict the account holder as both images appear to be stolen.

@verified

These six newly-created verified accounts have 977 followers in common. One is @verified (which follows all blue-check verified accounts). The other 976 were all created on June 19th or June 20th, 2021, and all follow the same 190 accounts. #Astroturf

Read 12 tweets

Conspirador Norteño

@conspirator0

10 Jul

@ZellaQuixote

It's #Caturday, so here's a freshly-made botnet tweeting cat videos because of course that's a thing.

cc: @ZellaQuixote

This botnet consists of 36 accounts created in July 2021. All 36 accounts have links to blogspot blogs on their profiles and GAN-generated profile pics. (GAN = "generative adversarial network", the AI technique used by thispersondoesnotexist.com to generate fake faces.)

The current generation of GAN-generated face pics (at least unmodified ones) always have the primary facial features (especially the eyes) in the same position on every image. This anomaly becomes visually obvious when the images are blended together.

Read 9 tweets

Conspirador Norteño

@conspirator0

8 Jul

@ZellaQuixote

It's a day ending in "y", and a swarm of accounts with GAN-generated face pics is spamming utter nonsense. #YouWontSeeThesePhrasesOnWheelOfFortune #DictionaryShenaniGANs

(GAN = "generative adversarial network", the AI technique used by thispersondoesnotexist.com)

cc @ZellaQuixote

This network consists of 99 accounts, created between January and May 2021. All have first + last name combinations as their display name, handles that match their display names, and all have GAN-generated face images as their profile pics.

As is the case with unmodified GAN-generated face pics (so far), the primary facial features (especially the eyes) are in the same location on all 99 images. This anomaly becomes obvious when one blends the images together.

Read 8 tweets

Conspirador Norteño

@conspirator0

6 Jul

@ElonMusk

TFW you go to sleep in 2015 tweeting in Spanish and wake up in 2021 as an "Elon" account, complete with @ElonMusk's current (as of July 6, 2021) profile pic. #RepurposedAccounts #LifeComesAtYouFast

cc: @ZellaQuixote

The recently awakened Elons are part of a larger network of 576 accounts created in May 2014. All accounts went dormant in late 2015, but some of them woke back up in 2021. Old tweets are almost all in Spanish, whereas new tweets are a mix of English, Indonesian, and Japanese.

The old Spanish tweets from these accounts are highly repetitive, with many tweets duplicated verbatim on dozens of accounts. Those of the accounts that are still dormant have similar names and tweet counts, and fewer than three likes (most have zero).

Read 9 tweets

Conspirador Norteño

@conspirator0

3 Jul

@SamyDindane

It's a Saturday, which is a great day to look at a long-dormant botnet following @SamyDindane, creator of the HypeFury Twitter automation software.

cc: @ZellaQuixote

https://twitter.com/conspirator0/status/1222697024786706437

@SamyDindane

We found 110 batch-created accounts (made in 2011) among @SamyDindane's early followers. To find the rest of the network, we downloaded the followers of other accounts followed by those 110 accounts and looked for additional batch-created accounts from the same time period.

The batches show up as horizontal streaks on follow order by creation date plots of the accounts they follow. This slideshow shows some examples, with the batch-created accounts highlighted in red.