Share this page!

Conspirador Norteño Profile picture
Twitter logo
6 Sep, 5 tweets, 3 min read
It's #LaborDay weekend, and a botnet with stolen profile pics is retweeting various giveaway tweets and pretending to be from Michigan.

cc: @ZellaQuixote
This botnet consists of 11 accounts created in early 2021. All follow far more accounts than they are followed by, and ll but one have their profile location set to somewhere in Michigan (@JacobMassengil's location is simply "USA").
Each account in this botnet tweets via its own custom app with a name consisting of 30 random letters and digits (e.g., @CarlaFreemly tweets via "LcOkMRRPjRblxHlQPo8OnwltoYXFWg"). Most also have older tweets sent via apps that were subsequently removed (the erased******* apps).
Almost all of this network's content is retweets (35116 of its most recent 35148 tweets, or 99.9%). The accounts retweeted are pretty much all cryptocurrency accounts, and the tweets amplified are mostly "retweet for a chance to win" giveaway tweets.
Belated NSFW warning if you look at any of these bots, as they occasionally retweet porn.

• • •

Missing some Tweet in this thread? You can try to force a refresh
　

Keep Current with Conspirador Norteño

Conspirador Norteño Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @conspirator0

Conspirador Norteño Profile picture
12 Sep
It's a great day for a look at the astroturf network that followed @ElectionWiz (ID 1290635110149169152, formerly named @Wizard_Predicts among other things) back at the beginning of its Twitter career (immediately after its first follower, @Barnes_Law).

cc: @ZellaQuixote
This network consists of (at least) 7991 accounts, most of which were created in the latter half of 2020 or the first half of 2021. The accounts in the network all follow at least 20 times as many accounts as they have followers of their own.
This astroturf network follows a variety of accounts. The most frequently followed accounts are @RanaSarkar, @AAldekhayel, and @thouse_opinions (the latter of which is marked "China state-affiliated media" by Twitter). @ElectionWiz is the 24th most-followed account.
Read 6 tweets
Conspirador Norteño Profile picture
4 Sep
Meet @jessica05181, a Twitter account with 32K followers that ostensibly belongs to a @Guardian reporter by the name of "Jessica Claire". As is often the case, things are not as they seem.

cc: @ZellaQuixote
A Google search of the Guardian's website for "Jessica Claire" turns up no articles written by anyone named "Jessica Claire", and although @jessica05181 has shared 111 @Guardian articles on Twitter, none of the authors have names remotely similar to "Jessica Claire".
As it turns out, @jessica05181 (permanent ID 1036130530666983425), wasn't always named @jessica05181. Previous names include @Adrian84474494 (which may be its original handle) and @thrawedmclag, and at least one early reply refers to it as "Adrian".
Read 7 tweets
Conspirador Norteño Profile picture
1 Sep
It's a great day for a thread on some interesting aspects of the tweets and followers of @Ravagiing (permanent ID 2191704602), the right-wing Twitter account featured in a recent @BuzzFeedNews investigation.

cc: @ZellaQuixote
buzzfeednews.com/article/kenben…
Although @Ravagiing is presently a right-wing Twitter account that tweets in English, it wasn't always so. Back in early 2014, it tweeted almost exclusively in Arabic. It appears to have gone silent in late April 2014 and woke back up in April 2018 as an English-language account.
Back in 2014 when it tweeted in Arabic, @Ravagiing was 100% automated, tweeting around the clock via a custom app. Most of the automated Arabic content looks like Quran verses.
Read 11 tweets
Conspirador Norteño Profile picture
29 Aug
Spam networks tweeting propaganda about Xinjiang have been a recurring thing for the past year or so. Here's one such network that appears to be trying to get specific bloggers and journalists to notice specific Xinjiang-related YouTube videos.

cc: @ZellaQuixote
This particular network consists of 354 accounts created between July 2019 and August 2021. Hilariously, the operators of the network on multiple occasions created multiple accounts in a row with the same name (e.g. @cumberland_ted and @ted_cumberland, created 4 minutes apart).
This network's content is repetitive, and mostly consists of articles and videos related to Xinjiang (both feel-good stories and denial of human rights abuses). Most of the repetitive tweets have at least two accounts tagged in them, generally bloggers and media accounts.
Read 6 tweets
Conspirador Norteño Profile picture
28 Aug
How did these six seemingly unrelated tweets end up with thousands of likes but few or no retweets? Are the likes coming from a large astroturf botnet created over the last month? (Spoiler: yup.) #FridayAstroturf

cc: @ZellaQuixote
This botnet consists of (at least) 13870 accounts with lowercase display names created between July 29th and August 26th, 2021. None has tweeted as of yet, but all follow dozens or hundreds of accounts and most have liked dozens or hundreds of tweets.
The bots in this network do two things: like tweets and follow accounts. The account whose tweets they've liked most frequently is @JuanOrlandoH, the President of Honduras. Many (not all) of the other accounts that received lots of likes from the botnet are cryptocurrency-themed.
Read 8 tweets
Conspirador Norteño Profile picture
24 Aug
This past Saturday (August 12th, 2021), a couple thousand accounts tweeted "This is the truth of this world" accompanied by a brief video containing the phrase "Corona virus fake" at more or less the same time. #AstroturfedBullcrap #Spam

cc: @ZellaQuixote
2882 tweets from 2875 accounts containing the "Corona virus fake" video and the text "This is the truth of this world" were posted over the span of 13 minutes. All but the first tweet end with a random 6 character code and were (allegedly) sent via "Twitter for iPhone".
Interestingly, the duplicated tweet was the first time 1754 of these 2875 accounts (61%) tweeted via iPhone (many are Android users). This suggests that some entity other than the account owners tweeted the iPhone video tweets from iPhones (or emulators) under their own control.
Read 7 tweets

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!

Follow Us on Twitter!

Like this author's thread?

Get emails when @conspirator0 has new unrolls!

Check out other threads from @conspirator0!

Read all threads by @conspirator0

:(