Discover and read the best of Twitter Threads about #SaturdaySpam
Most recents (22)
Here's a look at a smallish astroturf network targeting @SafeguardDefend (a non-profit group that has released multiple reports on human rights abuses in China) with spammy duplicate tweets. #SaturdaySpam
cc: @ZellaQuixote
cc: @ZellaQuixote
This network consists of 25 Twitter accounts created in multiple batches in September and October 2022. Thus far, all their tweets were tweeted via the Twitter Web App, and they generally go silent for two days a week (Friday and Saturday in US Pacific Time).
The content tweeted by this network is repetitive, with many tweets duplicated verbatim numerous times across multiple accounts. The most frequently repeated tweets all begin with the hashtag #SafeguardDefenders, and are all attacks on the Safeguard Defenders group.
The accounts in the original "requesting faucet funds" botnet have all been suspended, but a fresh batch has arisen to take their place, and they've evolved (slightly). #SaturdaySpam
cc: @ZellaQuixote
cc: @ZellaQuixote
The current incarnation of the "faucet funds" network consists of 1436 accounts created between July 19th and July 22nd, 2021. All accounts have zero likes and zero followers, and have sent all their tweets thus far via the Twitter Web App (allegedly).
As with the previous version of the network, all 1436 accounts in the new botnet have sent exactly one "Requesting faucet funds" tweet. Unlike the previous version of the botnet, these tweets are not accompanied by links to a website.
Here's an interesting account: @VishalAParmar, created in May 2021. All but two of its 688 followers were also created in May 2021, over a period of less than 12 hours. #SaturdaySpam
cc: @ZellaQuixote
cc: @ZellaQuixote
These followers are part of a fake follower botnet created between April 30th and May 29th, 2021. This botnet consists of (at least) 20684 accounts, none of which has ever tweeted. The accounts have random-looking but more or less pronounceable names, usually in all lowercase.
Who does this botnet follow? There's a lot of variety, although most are promotional/commercial accounts of some type. Cryptocurrency/blockchain accounts are a bit of a theme.
Why did this @serdaribrahimke tweet objecting to Biden's acknowledgement of the #ArmenianGenocide mostly get retweeted by accounts created this month with names ending in 4 digits? #SaturdaySpam
cc: @ZellaQuixote
cc: @ZellaQuixote
Answer: a retweet botnet, consisting of 45 accounts made between April 22nd and April 24th, 2021. All have names ending in four digits, and all (allegedly) send most of their tweets via Twitter for iPad with occasional use of Twitter for Android.
This botnet has thus far posted no original content whatsoever. All of its 3016 tweets are retweets, almost all of which are of Turkish-language content.
It's a new year, but some things remain the same, and one of those things is that one can still find pornbot networks. #SaturdaySpam
cc: @ZellaQuixote
cc: @ZellaQuixote
This pornbot network consists of 690 accounts, created in batches between August 20th and November 16th, 2020. Thus far, all of their tweets have been (allegedly) sent via Twitter web app. Some (but not all) of the bots have liked tweets from porn accounts with large followings.
The tweets posted by this pornbot network are extremely repetitive, with many tweets having been posted by hundreds of accounts. (The repeated tweets are sometimes accompanied by hashtagged US city names, which we removed for the sake of generating this table.)
Are you looking for cleaning services in Riyadh? Don't worry, there's a botnet for that. #SaturdaySpam
cc: @ZellaQuixote
cc: @ZellaQuixote
This botnet consists of 50 Arabic-language accounts, all created between December 18th, 2020 and January 1st, 2021. These accounts tend to all activate simultaneously and all (allegedly) tweet via the Twitter Web App.
The accounts in this botnet follow other members of the botnet, and most of them follow several. The follow relationships are somewhat structured by account creation date, with the December 22nd and 23rd batches having the most follows from other bots in the network.
What's up with these identical replies to a @gabry1090 coupon code tweet? #SaturdaySpam
cc: @ZellaQuixote
cc: @ZellaQuixote
Answer: unsurprisingly, a botnet. We found 19 accounts that we believe are part of the network, created over the course of a little over an hour on December 7th, 2020. All their tweets thus far are replies sent via either "Mobile Web (M2)" or "Twitter Web Client".
The 19 accounts in this reply spam botnet operate on nearly identical schedules, and often send the same replies. Most replies are in Arabic, with the occasional English reply thrown in for good measure. (As always, take the Google translations with a grain of salt.)
What's up with these accounts retweeting giveaway tweets using apps with names like "Twitter for HUAWEI Y9a"? #SaturdaySpam
cc: @ZellaQuixote
cc: @ZellaQuixote
Unsurprisingly, they're part of a botnet, consisting of (at least) 19 accounts that use custom apps with names of the form "Twitter for HUAWEI<xxxx>", and occasionally "Twitter for Android6" (not the real Twitter Android phone app). Most were created in June or October 2020.
The bots in this network do two things: retweet and reply. In both cases, the accounts they interact with are accounts selling access to proxy servers and botting software.
What's with all of these repetitive replies mentioning the name "Nicholas Shawn"? #SaturdaySpam
cc: @ZellaQuixote
cc: @ZellaQuixote
Answer: they're from a reply spam botnet we didn't know quite what to make of when we first saw it. It is now on a mission to promote forex trading/cryptocurrency content. ("Nicholas Shawn" appears to be a reference to the "Nick Shawn" Youtube channel.)
This botnet consists of 48 accounts, all created in September or October 2020. (We found 35 accounts when we first looked at it). Almost all tweets are replies sent via "Mobile Web (M2)".
If you're looking for an automated military patriot mom who is sick of politics as usual and spams links to Gateway Pundit articles via IFTTT, @PatriotMomNDJ just might be the Twitter account for you. #SaturdaySpam
cc: @ZellaQuixote
cc: @ZellaQuixote
All of @PatriotMomNDJ's recent tweets are sent via IFTTT, but this account has utilized other Twitter automation tools in the past, mainly SocialOomph. Almost all of its original tweets are automated (140161 of 140110, 99.96%), so this account is definitively a bot.
Similarly, @PatriotMomNDJ currently only links Gateway Pundit, but in the past it varied its spam lineup. Right-wing news site The Blaze was a frequent flier until late 2018, and commercial spam (Amazon, staged(dot)com, and others) was a major portion of its early content.
For $800, you could be the proud new owner of @coisasqncompro (permanent ID 1221072227120156674), an automated account with 277K followers that mostly tweets pictures. As it turns out, this account is part of a botnet. #SaturdaySpam
cc: @ZellaQuixote
cc: @ZellaQuixote
We found a total of 27 accounts tweeting via "Twitter for me memso". Almost all were created in 2019 or 2020, and most have massive numbers of followers. This botnet recently switched automation tools - prior to Aug 10 2020 most tweets were sent via "Jeito".
The automated tweets sent by this network are pretty much all images and videos, many of which (unsurprisingly given the large number of followers) receive large numbers of retweets and likes.
Are 1000 "realistic looking followers" for the low, low price of $2 from @thou_followers and its associated website (thousandfollowers(dot)com) worth the price? Spoiler: probably not, and as always, don't click the link. #SaturdaySpam
cc: @ZellaQuixote
cc: @ZellaQuixote
Conveniently, one need look no further than @thou_followers's own followers to study its inventory. 17957 of its 17963 followers were created in batches, have never liked a tweet, and followed @thou_followers in order of creation date.
As far as we can tell, these 17957 accounts comprise the entire botnet. They were created in batches starting in late May 2020 and continuing through the present day (most recent batch is from August 13, 2020), and have few or no tweets of their own.
A gaggle of newly-made Turkish accounts with default profile pics are replying to Turkish tweets advertising adult services. What's up with that? #SaturdaySpam
cc: @ZellaQuixote
cc: @ZellaQuixote
We found 25 accounts that appear to be part of the reply spam network. All were created on July 14th/15th 2020, have default profile pics, follow no accounts, and have no followers of their own. As always, take Google Translate's translations with a grain of salt.
These 25 accounts theoretically tweet via the Twitter Web Client, but we suspect they are automated for two reasons:
• rapid tweeting (80-100 tweets per minute)
• "Twitter Web Client" is the source app name for the old Twitter website, which is no longer available to users
• rapid tweeting (80-100 tweets per minute)
• "Twitter Web Client" is the source app name for the old Twitter website, which is no longer available to users
We don't know Korean (and don't fully trust Google Translate) but it sure looks like this botnet is claiming to have a knack for picking winning lottery numbers. #SaturdaySpam
cc: @ZellaQuixote
cc: @ZellaQuixote
This botnet consists of eight accounts, all created on May 9th 2015. At first glance, they look extremely low volume, with the most active account having tweeted only 135 times in 5 years.
In reality, these bots are much spammier, tweeting every 10-12 minutes, or 120-144 times per day (varies from bot to bot). They keep up the appearance of low volume by deleting the most recent tweet every time they post a new one (with occasional failures). #Lobsterfest
We've seen some overzealous reactions to Twitter suspensions before, but spammy repetitive tweets implying that the banned accounts belonged to a literal deity is a new twist. #SaturdaySpam
cc: @ZellaQuixote
cc: @ZellaQuixote
We downloaded all tweets tagging the now-suspended @davidroads and containing "Christian", "30 million", and "followers, yielding 1164 tweets from 845 accounts. The traffic doesn't appear automated based on software used.
The tweets are all variations on a few templates with different accounts tagged. Most frequently tagged accounts:
@jack - 1161 tweets (99.7%)
@FoxNews - 1137 tweets (97.7%)
@TwitterSupport - 784 tweets (67.4%)
@realDonaldTrump - 621 tweets (53.4%)
@ABC - 590 tweets (50.7%)
@jack - 1161 tweets (99.7%)
@FoxNews - 1137 tweets (97.7%)
@TwitterSupport - 784 tweets (67.4%)
@realDonaldTrump - 621 tweets (53.4%)
@ABC - 590 tweets (50.7%)
What's up with all these IFTTT bots quoting Charlotte Brontë (and others)? #SaturdaySpam
cc: @ZellaQuixote
cc: @ZellaQuixote
We found a botnet consisting of 21 accounts automated via IFTTT, all created on July 2nd, 2016, all with similar (and likely computer-generated) biographies, female profile pics, and links to one of two websites on their profiles.
This botnet draws its tweets from a repertoire of 1728 famous quotes, each tweeted at least once by every account in the network. We suspect the quotes aren't what these bots were deployed to promote, however. . .
TFW you find a nearly six year old botnet proudly promoting a 23 year old website with no actual content. #SaturdaySpam
cc: @ZellaQuixote
cc: @ZellaQuixote
We found 24 accounts with vip174(dot)ru (and various subdomains) linked on their profiles. All are (presently) automated via dlvr(dot)it and were created on July 27th, 2014. (@Pabooli0A is an anomaly - although it has supposedly tweeted 85364 times, we only found 6744 tweets.)
This botnet briefly used a few other automation tools early in its life before switching to dlvr(dot)it at the beginning of 2016. The majority of the tweet content consists of images with captions in Russian.
We found a network of 20 automated accounts, all spamming Korean hashtags with an embedded phone number via twittbot(dot)net. All but two were created in 2019, with the network first tweeting in August 2019 and slowly scaling up output.
Oh look, more pornbots. This network hypothetically tweets via Mobile Web (M2) (an older version of the Twitter website for mobile phones) and uses link redirection service rebrand(dot)ly to shorten/disguise its links. #SundaySpam
cc: @ZellaQuixote
cc: @ZellaQuixote
@ZellaQuixote We found a total of 91 accounts tweeting shortened porn links via Mobile Web (M2). The entire group activated shortly after midnight PST on 2/9, and all were created in the 2 hours immediately prior. The botnet has generated an average of 69 tweets per minute since coming online.
@ZellaQuixote So far, every single tweet posted by these 91 accounts contains a rebrand(dot)ly short link that redirects to the actual porn site being peddled, zavmosse(dot)pw. As always, be wary of clicking links from dodgy botnets.
Many of the accounts in the Turkish botnet described here have large numbers of followers. Are there other networks lurking among them? (Spoiler: yes, at least one.) #SaturdaySpam
cc: @ZellaQuixote
cc: @ZellaQuixote
@ZellaQuixote We took a look at the followers of one of the bots in the network, @agresifprofil. The anomaly circled in red on the plot indicates it was followed by a group of accounts created at roughly the same time, a potential sign that they were created en masse by a single entity.
@ZellaQuixote @agresifprofil The anomaly in @agresifprofil's followers contains 252 Tuskish accounts with similar histories: high volume via SocialOomph in 2015, lower volume via TweetDeck in 2016, and even lower in 2019 via the Twitter website. Based on this, we found 262 more accounts, for a total of 514.
If you're looking for a payday loan in multiple languages from a dysfunctional website, this botnet might be your thing. #SaturdaySpam #DigitalLoanSharkFail
cc: @ZellaQuixote
cc: @ZellaQuixote
@ZellaQuixote This botnet consists of three accounts: @AfanasevaErmina, @OlgaKir37407272, and @AfanasevaErmina. All three tweet hashtag-drenched solicitations for short-term loans in multiple languages targeting multiple countries round-the-clock.
@ZellaQuixote @AfanasevaErmina @OlgaKir37407272 The website linked by the bots (teletype(dot)in/@nadezhdabekreneva1) no longer loads, but we found a cached copy on Google. Needless to say, it doesn't exactly look like a reputable financial institution. It contains links to another site, paydayloan(dot)date. . .
It’s a Saturday, and once again pornbots are busily attaching themselves to trending hashtags such as #BravoMasha. We found 22 accounts that appear to be part of this botnet (screenshots of content omitted for obvious reasons.) #SaturdaySpam.
cc: @ZellaQuixote
cc: @ZellaQuixote
@ZellaQuixote Although the bots in question have been around for years, none show significant volume prior to today. Although the tweets appear to be sent via the Twitter website, we suspect the accounts are automated due to the spamminess of their tweets.
@ZellaQuixote The purpose of the bots appears to be to promote the video4me(dot)xyz website. Even if you’re looking for porn, caution is advised before clicking links from spammy botnets as malware is not unlikely.
