What do 2022 Congressional candidates @BlakeHarbinGA (R), @DavidGiglioCA (R), and @RajiRab2020 (D) have in common? All three have recently been followed by thousands of newly-created accounts with lowercase display names and zero tweets.

cc: @ZellaQuixote
The new followers of the three Congressional candidates are part of a botnet consisting of (at least) 38105 accounts with random-looking names created in December 2021/January 2022. None of the accounts has ever tweeted, though most have liked dozens or hundreds of tweets.
The accounts in this botnet have extremely repetitive biographies, using only 1085 unique biographies across 38105 accounts.

What do these accounts actually do?
The accounts in the botnet do two things: like and follow. The accounts whose tweets the bots like are mostly cryptocurrency accounts, although @JuanOrlandoH, the President of Honduras, turns up prominently.
The botnet also mostly follows cryptocurrency accounts. As mentioned earlier, three 2022 US House candidates have followers from this botnet:

@BlakeHarbinGA (GA Republican, 7855 followers)
@DavidGiglioCA (CA Republican, 8563 followers)
@RajiRab2020 (CA Democrat, 10835 followers)
Here's a slideshow of follow order by creation date plots for various accounts that have a lot of followers from the botnet. The mass-created bot followers from the network show up as horizontal streaks (colorfully highlighted).
This botnet shares multiple characteristics (random names, no tweets, lots of likes, repeated biographies) with a couple of botnets we found in fall 2021, and may be a new incarnation of the same operation.

• • •

Missing some Tweet in this thread? You can try to force a refresh

Keep Current with Conspirador Norteño

Conspirador Norteño Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!


Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @conspirator0

12 Jan
In one of the sillier developments in recent history, the adherents of this flawed "vetting guide" are now issuing "alerts" about my account because (gasp!) a small number of the 41K accounts following me look suspicious. Image
Since I'm now being targeted, I'm going to be blunt. The principal author of this "vetting guide", @EnseySherwood, blatantly makes shit about about bot detection, such as this false claim that servers have a setting that Twitter could use to eliminate all bots in 10 minutes. Image
If you have been relying on this person or the "vetting guide" for advice on bots and suspicious accounts, you've been fooled, and you should probably also give some thought as to why certain "vetting experts" constantly lock their accounts and refuse to engage with critics.
Read 4 tweets
6 Jan
It's possible to automate this technique and download most or all of an account's tweets archived on Wayback Machine/Internet Archive. Here's how to write a basic Python program to download the tweets and store them as a CSV file.

(Pastebin link to source code at end of thread)
Step 1: read the list of all the Wayback Machine archives of the account in question. The URL used is the same call the Wayback Machine website uses, but the maximum number of results has been bumped to 1 million.(Wayback Machine defaults to 10K max results.)
Step 2: filter the results to archives of individual tweets or replies (throwing away things like archives of someone's profile etc). Tweets from before Twitter switched to using Snowflake IDs (November 2011 blog.twitter.com/engineering/en…) are also discarded.
Read 6 tweets
3 Jan
The hashtag #Hero trended in the USA yesterday (January 2nd, 2022) with a truly massive volume of tweets. In an interesting twist, the vast majority of the tweets are in Farsi despite "hero" being an English word.

cc: @ZellaQuixote Image
The #Hero trend appears to be the result of a preplanned tweetstorm commemorating General Qasim Soleimani on the second anniversary of his assassination in January 2020. Tweet activity (mostly in Farsi) using this hashtag has been building since mid-December 2021. ImageImage
Over 1.6 million tweets containing #Hero were tweeted by 50872 accounts on Jan 2, 2022. Very little of the traffic appears to be automated. An exception is @Ra_Shojaei, which tweets pro-Soleimani tweets 24/7 via a custom app called "TwèétDeck" (not to be confused with TweetDeck). ImageImageImage
Read 5 tweets
26 Dec 21
Here's a proposal for @TwitterSafety: modify the "Account suspended" screen to include a brief description of which rule/rules the banned account violated, and have "Learn more" link to the related section of the Twitter Rules.

(Images are mockups with made-up account names.) mockup of a message that an account was suspended for spammockup of a message that an account was suspended for COVID-mockup of a message that an account was suspended for threatmockup of a message that an account was suspended for multip
Why make this change? Currently, when an account with any degree of notoriety gets suspended, conspiracy theories about why it was removed quickly take root. In the absence of information about the reason for the suspension, the conspiracy theories are often accepted as fact.
Often, the dominant narrative(s) for why a given account got banned are established by the account operator(s) themselves, either on other platforms or via friends/alts on Twitter. Unsurprisingly, these narratives tend to cast the suspension as unfair, regardless of the facts.
Read 4 tweets
24 Dec 21
how it started / how it's going ImageImage
The saga continues. . . Image
A second participant has arrived. Image
Read 4 tweets
23 Dec 21
Oh look, a bunch of accounts named George with GAN-generated profile pics are tweeting identical tweets. #HolidayShenaniGANs

(GAN = "generative adversarial network", the technique used by thispersondoesnotexist.com to generate fake face pics)

cc: @ZellaQuixote Image
The spammy Georges are part of a larger network of 2500 newly-created accounts promoting cryptocurrency launchpad site @CeloLaunch. Between them, these 2250 accounts have just 25 unique first names and 50 unique last names. All have zero likes, zero followers, and 1 or 2 tweets. ImageImageImage
Most of these accounts have tweeted exactly twice: a duplicated tweet promoting @CeloLaunch, and a retweet of a December 12th @CeloLaunch tweet (a few missed either the duplicate tweet or the retweet). All tweets were sent (allegedly) via the Twitter web app. ImageImageImageImage
Read 8 tweets

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!


0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy


3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us on Twitter!