Conspirador Norteño Profile picture
Data Scientist/Musician/Participant in the General Confusion @trutherbotprop Resist autocracy and research/fight disinformation. I serve the realm.
Pensive™ 🇺🇸💯🔥🌹💚 Profile picture 🔔 ||| вєℓℓє ||| 🔔 Profile picture eDo Profile picture 🇬🇧DR.Renton🐸🇺🇸⭐⭐⭐PM-Elect✝️🇧🇷🇮🇹⌛️🥓🤣🐶 Profile picture Adam Smithee Profile picture 25 added to My Authors
13 Oct
Meet @AnthonyWill_BSC and @MrThomasKoning, a duo of supposed cryptocurrency experts and "Gem Hunters" with GAN-generated profile pics and over 180,000 followers between them.

cc: @ZellaQuixote
GAN = "generative adversarial network", the AI technique used by to generate fake faces such as those used by these two accounts. The major facial features are in the same position on both images, a fingerprint of unmodified GAN-generated face pics.
Both @AnthonyWill_BSC and @MrThomasKoning primarily tweet cryptocurrency/NFT promotions of varying sorts, with no apparent preference for any specific coin. The two accounts follow each other.
Read 8 tweets
12 Oct
You ever gonna admit you spread a total lie to your hundreds of thousands of followers, or is that just something you think is totally cool?
Here's where the fake story about General Dynamics workers quitting en masse over vaccine mandates started. I'm not holding my breath for @pnjaban or any of the other blue-check accounts who spread this lie to correct it, although they should.
Same thing with the "Southwest Airlines pilot's strike" rumor. The pilots' union, the FAA, and Southwest's CEO have all repeatedly refuted it, but the blue-check parrots of the right just keep on parroting, and I'll be shocked if any of them retract it.
Read 4 tweets
12 Oct
The bots described in this previous thread have been banned, but a new batch of accounts with GAN-generated face pics and screenshots of fake Elon Musk tweets has arisen to replace them.

cc: @ZellaQuixote Image
The new incarnation of the network consists of (at least) 128 accounts created between August 18th and October 10th 2020. All tweet exclusively via the Twitter Web App (allegedly), and all their tweets to date are either replies or retweets. ImageImageImageImage
The network's replies fall into three categories:

• replies containing screenshots fake Elon Musk tweets advertising watches and random text
• replies consisting entirely of random text
• repetitive replies containing images ImageImageImage
Read 10 tweets
10 Oct
Meet @DanielWilson_1, @PradipWebber, and @Sybil__Evans, a trio of interesting accounts that each got thousands of followers via the "Round Year Fun"/realactivefollowers(dot)com family of malicious Twitter apps ("My Twitter Family", "My Twitter Crush", etc).

cc: @ZellaQuixote
If you've used any of the "Round Year Fun" apps ("My Twitter Family", "My Twitter Crush", etc), your account has probably involuntarily followed one or more of the customers of a follower sales site. Here's how to revoke the apps' access to your account:
Massive infusions of involuntary followers from Round Year Fun is not the only thing @DanielWilson_1, @PradipWebber, and @Sybil__Evans have in common. Each has also quote tweeted pro-CCP/anti-Guo Wengui cartoons (in some cases, from accounts subsequently suspended by Twitter).
Read 6 tweets
3 Oct
Meet @kris_verma1984, a Twitter account that ostensibly belongs to a guest writer for the Sydney Morning Herald (@smh) by the name of "Kris Harrison" and resembles the now-suspended fake Guardian journalist account @jessica05181 in multiple interesting ways.

cc: @ZellaQuixote
A google search of the Sydney Morning Herald's website for "Kris Harrison" turns up no content written by anyone named "Kris Harrison", and @kris_verma1984 has never linked any Sydney Morning Herald content whatsoever.
As was the case with fake Guardian journalist @jessica05181, @kris_verma1984 (permanent ID 1074631446067843072) was renamed along the way. Internet Archive confirms that back in 2020 it was named @addiaeeprint and its display name was "Maria Pia" rather than "Kris Harrison".
Read 6 tweets
28 Sep
A 41 page document chock full of disinformation about COVID-19 (including claims that the vaccines may be mind control technology) written by someone using the pseudonym "Spartacus" has been making the rounds on Twitter the last few days. Here's how it spread.

cc: @ZellaQuixote
The "Spartacus" COVID disinfo document first appeared on docdroid(dot)com on Sept 24 2021. The first Twitter account to share it was a small Italian-language account, @number229401056. The second was @RWMaloneMD, whose tweet linking the letter was retweeted nearly 1000 times.
The so-called "Spartacus letter" was first posted to DocDroid, it was removed relatively quickly, resulting in subsequent reposting on a variety of sites. The copy of the document most frequently shared on Twitter is hosted by right-wing disinformation blog @zerohedge.
Read 5 tweets
25 Sep
Is @WaltWhiteCrypto getting retweets from a freshly-cooked batch of bots with GAN-generated profile pics? (Spoiler: Yes) #TheBotsWhoKnock

(GAN = "generative adversarial network", the AI technique used by etc to generate fake face pics)

cc: @ZellaQuixote
The botnet amplifying @WaltWhiteCrypto (and others) consists of 936 accounts created in August and September 2021. All have lowercase display names (first + last name) and follow zero accounts, and all have GAN-generated profile pics.
All 936 accounts in this network (allegedly) tweet via the Twitter Web App. The network is active round-the-clock, and all of its content is retweets. It mostly amplifies cryptocurrency accounts, although the most frequently retweeted account is a media account, @TheLevantNewsEN.
Read 6 tweets
21 Sep
Why do so many Journey fans have a goal of exactly 18K followers, and why are all of their biographies identical? #DontStopAstroturfin

cc: @ZellaQuixote Image
The weirdly identical Journey fan accounts are part of a network consisting of (at least) 28750 accounts created in Aug/Sept 2021. All have similar-looking random names, no tweets, few or no followers, follow similar numbers of accounts, and have liked similar numbers of tweets. ImageImage
No account in this network has a unique biography. The 28750 accounts use a total of 1054 distinct biographies (including an empty biography), each of which appears on at least 11 accounts. Image
Read 7 tweets
18 Sep
Another day, another evidence-free viral rumor. The claim that General Dynamics canceled their vaccine mandate appears to have originated with @AlexGiorgio6, a Twitter account that has no apparent connection to General Dynamics or any journalistic entity.

cc: @ZellaQuixote Image
The @AlexGiorgio6 account did eventually supply a "source" for their claim that General Dynamics was dropping its vaccine mandate, but that "source" is an obscure website quoting an unsourced tweet from another random Twitter account (@WillRock2424). ImageImageImage
At least four "news" sites have now amplified this bit of disinformation: beforeitsnews(dot)com, sgtreport(dot)com, investmentwatchblog(dot)com, and notmainstreamnews(dot)us. All four "articles" consist of tweets repeating the rumor accompanied by no actual information. ImageImageImageImage
Read 6 tweets
12 Sep
It's a great day for a look at the astroturf network that followed @ElectionWiz (ID 1290635110149169152, formerly named @Wizard_Predicts among other things) back at the beginning of its Twitter career (immediately after its first follower, @Barnes_Law).

cc: @ZellaQuixote
This network consists of (at least) 7991 accounts, most of which were created in the latter half of 2020 or the first half of 2021. The accounts in the network all follow at least 20 times as many accounts as they have followers of their own.
This astroturf network follows a variety of accounts. The most frequently followed accounts are @RanaSarkar, @AAldekhayel, and @thouse_opinions (the latter of which is marked "China state-affiliated media" by Twitter). @ElectionWiz is the 24th most-followed account.
Read 6 tweets
6 Sep
It's #LaborDay weekend, and a botnet with stolen profile pics is retweeting various giveaway tweets and pretending to be from Michigan.

cc: @ZellaQuixote
This botnet consists of 11 accounts created in early 2021. All follow far more accounts than they are followed by, and ll but one have their profile location set to somewhere in Michigan (@JacobMassengil's location is simply "USA").
Each account in this botnet tweets via its own custom app with a name consisting of 30 random letters and digits (e.g., @CarlaFreemly tweets via "LcOkMRRPjRblxHlQPo8OnwltoYXFWg"). Most also have older tweets sent via apps that were subsequently removed (the erased******* apps).
Read 5 tweets
4 Sep
Meet @jessica05181, a Twitter account with 32K followers that ostensibly belongs to a @Guardian reporter by the name of "Jessica Claire". As is often the case, things are not as they seem.

cc: @ZellaQuixote
A Google search of the Guardian's website for "Jessica Claire" turns up no articles written by anyone named "Jessica Claire", and although @jessica05181 has shared 111 @Guardian articles on Twitter, none of the authors have names remotely similar to "Jessica Claire".
As it turns out, @jessica05181 (permanent ID 1036130530666983425), wasn't always named @jessica05181. Previous names include @Adrian84474494 (which may be its original handle) and @thrawedmclag, and at least one early reply refers to it as "Adrian".
Read 7 tweets
1 Sep
It's a great day for a thread on some interesting aspects of the tweets and followers of @Ravagiing (permanent ID 2191704602), the right-wing Twitter account featured in a recent @BuzzFeedNews investigation.

cc: @ZellaQuixote…
Although @Ravagiing is presently a right-wing Twitter account that tweets in English, it wasn't always so. Back in early 2014, it tweeted almost exclusively in Arabic. It appears to have gone silent in late April 2014 and woke back up in April 2018 as an English-language account.
Back in 2014 when it tweeted in Arabic, @Ravagiing was 100% automated, tweeting around the clock via a custom app. Most of the automated Arabic content looks like Quran verses.
Read 11 tweets
29 Aug
Spam networks tweeting propaganda about Xinjiang have been a recurring thing for the past year or so. Here's one such network that appears to be trying to get specific bloggers and journalists to notice specific Xinjiang-related YouTube videos.

cc: @ZellaQuixote
This particular network consists of 354 accounts created between July 2019 and August 2021. Hilariously, the operators of the network on multiple occasions created multiple accounts in a row with the same name (e.g. @cumberland_ted and @ted_cumberland, created 4 minutes apart).
This network's content is repetitive, and mostly consists of articles and videos related to Xinjiang (both feel-good stories and denial of human rights abuses). Most of the repetitive tweets have at least two accounts tagged in them, generally bloggers and media accounts.
Read 6 tweets
28 Aug
How did these six seemingly unrelated tweets end up with thousands of likes but few or no retweets? Are the likes coming from a large astroturf botnet created over the last month? (Spoiler: yup.) #FridayAstroturf

cc: @ZellaQuixote
This botnet consists of (at least) 13870 accounts with lowercase display names created between July 29th and August 26th, 2021. None has tweeted as of yet, but all follow dozens or hundreds of accounts and most have liked dozens or hundreds of tweets.
The bots in this network do two things: like tweets and follow accounts. The account whose tweets they've liked most frequently is @JuanOrlandoH, the President of Honduras. Many (not all) of the other accounts that received lots of likes from the botnet are cryptocurrency-themed.
Read 8 tweets
24 Aug
This past Saturday (August 12th, 2021), a couple thousand accounts tweeted "This is the truth of this world" accompanied by a brief video containing the phrase "Corona virus fake" at more or less the same time. #AstroturfedBullcrap #Spam

cc: @ZellaQuixote
2882 tweets from 2875 accounts containing the "Corona virus fake" video and the text "This is the truth of this world" were posted over the span of 13 minutes. All but the first tweet end with a random 6 character code and were (allegedly) sent via "Twitter for iPhone".
Interestingly, the duplicated tweet was the first time 1754 of these 2875 accounts (61%) tweeted via iPhone (many are Android users). This suggests that some entity other than the account owners tweeted the iPhone video tweets from iPhones (or emulators) under their own control.
Read 7 tweets
22 Aug
In one of the least surprising developments ever, 4chan/alt-right trolls are still creating fake left-wing Twitter accounts with GAN-generated faces as profile pics, such as @BlueVotedJenn (ID 1386808499414441984). #AltWankers #ASeriesOfUn4chanateEvents

cc: @ZellaQuixote
The @BlueVotedJenn account established itself as "liberal" via early tweets denouncing climate change and the GOP (and praising CNN), and subsequntly pivoted to alt-right trolling (multiple forms of bigotry, attacks on Fauci, etc).
Although the operator of the @BlueVotedJenn account cropped its profile image so that the facial features no longer have the telltale positioning seen in GAN-generated face pics, other artifacts remain (nonsense earring and hair in the lower right corner, for example).
Read 4 tweets
18 Aug
Who follows @GettrOfficial, the Twitter account of nascent far-right social media platform GETTR? Weirdly, even though @GettrOfficial tweets solely in English, most of its first 4000 followers (and 22% of its followers overall) are Chinese-language accounts.

cc: @ZellaQuixote
The presence of Chinese-language accounts is even more apparently among @GettrOfficial's retweeters. Almost two-thirds of its amplification (66.1%) comes from accounts that primarily tweet in Chinese.
What websites do these Chinese-language accounts link? GETTR is the most frequently shared site, followed by GNews (created by Steve Bannon and Guo Wengui, YouTube, and GTV (another Bannon/Guo production), and a variety of Western far-right media sites.
Read 5 tweets
16 Aug
Meet @cryptoaover1111, @cryptodover1111, @cryptofover1111, @cryptoiover1111, @cryptopover1111, @cryptosover1111, @cryptogover1111, and @cryptolover1111, an octet of similarly-named Twitter accounts that you probably don't want to purchase.

cc: @ZellaQuixote
In addition to the eight accounts presently up for sale, we found two others with the same naming scheme: @cryptotover1111 and @cryptouover1111. All ten accounts were created in 2021 and have tweeted/retweeted a small amount of cryptocurrency content via Twitter for Android.
(BTW, buying/selling Twitter accounts is against TOS, and websites offering such services should be regarded as potentially unsafe and one should take precautions when visiting then, such as using Tor.)
Read 10 tweets
15 Aug
Here's a thread about bots: what bots are and (some of) what bots do, and also things that aren't bots but frequently get mistaken for them.

cc: @ZellaQuixote
First, what is a bot? The Oxford English Dictionary defines "bot" as "an autonomous program on the internet... that can interact with systems or users". A Twitter bot is simply an automated Twitter account (operated by a piece of computer software rather than a human). Image
Although much public discussion of "bots" centers on malicious or spammy accounts, there are plenty of legitimate uses of automation. Many news outlets use automation tools to automatically share their articles and videos on Twitter, for example. ImageImageImageImage
Read 22 tweets
8 Aug
The repetitive biographies that frequently mention beavers may be silly, but the fact that you can pay to have thousands of these accounts retweet, reply to, or follow you is even sillier. #SundaySpam #BeaverAstroturf

cc: @ZellaQuixote
These accounts are part of an astroturf network consisting of (at least) 11599 accounts created (mostly) in 2021. Each account has a two word biography composed of a capitalized adjective followed by a lowercase noun, drawn from a pool of 36 adjectives and 36 nouns.
The accounts in this network follow a variety of accounts, with cryptocurrency as a recurring theme. The account followed by the largest swath of the network is @PRm4u_official, the "official" account of prm4u(dot)com, a website selling SMM ("social media management") services.
Read 9 tweets