Thread by @benimmo

Thread: The funniest thing about that network of blue-haired pornbots which has been going around for a while?

The way they quote Jane Austen.

#BotSpot

medium.com/dfrlab/botspot…

This is the first one I found. Oddly, it was being followed by @StoppingWW3, which was Ian56789's backup account at the time.

Reverse search the profile picture, and see how many more accounts use the same one.

Talk about mass production...

It's obviously a botnet: identical profile pics, style of bio, content.

What's interesting is the creation dates, and the way the screen names are different from the handles (e.g. @ermolaeva_olya / "Gladys Flatcher").

These look like hijacked accounts.

This is part of a much bigger network, with different profile pics but the same style.

And between the porn posts, they share random phrases from "Sense and Sensibility."

Compare the tweet with Google books.

Looks like someone set up the network to scrape and post random excerpts from "Sense and Sensibility", to insert more variety in the tweets, and thereby escape the Twitter algorithm.

At least they chose a good book to scrape from.

They also posted authored tweets, but with typos.

We love typos. They make for unique searches.

Scanning mentions of these typos using @sysomos, and deleting all duplicate results, returned a list of over 35,000 unique names.

Other phrases they used returned over 75,000 accounts, but the phrases were less unique.

Even the lower number makes a big botnet.

These bots posted low volumes of retweets, likes and follows. The main common feature was the linkage to porn sites.

One of those sites had an open WhoIs registration, in St Petersburg, Russia. Others gave less detail, but were also Russian registered.

Unclear whether the main purpose of the botnet was to sell likes and retweets, or advertise the porn sites, or both.

What's striking is how big it is, and the tricks it used to evade detection. Twitter has upped its game. So have the bot herders. / Thread ends.