Thread by @mikefarb1

#unhackthevote

The Jane Austen Russian Pornbot

I see I got your attention

Time to take down another one.

This one is interesting

Everyone please Retweet and Report

Thanks to @GwendolynIRL for sending us some additional info

Thread

A few days ago we noticed an interesting response in the comments on a thread. A tattooed woman tweeted "points of blood and". Points of blood and?

We had a closer look at Tara Charlson. We noticed a few interesting things about this account.
1. Her account description makes about as much sense as her tweets
2. Although the account has been active since 2014, she only has 18 followers.

3. She prefers the "barely there" look when it comes to clothing.
4. Her Twitter handle - @luisman81849303 - ends in eight digits and has no resemblance to user name.
5. The link in her description is unusual looking. Twichick[.]info? Never heard of that.

Going back further in her timeline we notice something interesting. In 2014 she was tweeting in Portuguese. Then for over four years there were no tweets, until very recently.

This is a hallmark of a repurposed account - possibly one that has been hacked and sold on the blackmarket. These accounts can look well-established because they apparently joined Twitter years ago.

Since both the account name and the twitter handle itself can be changed, it can be very difficult to track the origins of these accounts.

Here is a similar account. Compare the user name (Emma Oliver) to the twitter handle (@hongpiao). Note that the account was apparently created in 2012. Then scroll back in the tweets. Hmmmm…

What about the odd tweets? Where do those come from? Let's look at one of the more distinctive tweets. "Devonshire.--Edward turned hastily towards her,"

We did a Google search for that tweet and other similarly distinctive ones. Looks like Tara Charlson is quoting Jane Austen!

Then we did a Twitter search for the same sentence. Apparently Tara Charlson has some sisters with a similar love of English literature. twitter.com/search?f=tweet…

In just a few minutes we uncovered dozens of related accounts with very similar patterns. Here is a partial list:

twitter.com/luisman81849303
twitter.com/hongpiao
twitter.com/KarinaRiehl1
twitter.com/thahey1
twitter.com/Jhoon_alan
twitter.com/SwaggThiskid

What is the purpose of this botnet? Let's have a look at the urls used in these accounts profiles. For instance twichick[.]info. As always, it's a bad idea to click on links in iffy Twitter profiles, so we investigated this domain using the online tool VirusTotal.

And what did we find? A Russian server. Looks like it's hosting all the domains of Tara Charlson and her sister pornbots. virustotal.com/#/ip-address/2…

This is why we NEVER click on a link in a suspicious Twitter account. The server is apparently hosting some kind of malware. virustotal.com/#/url/19d3bc8b…

Once again - without too much effort - we have stumbled on a botnet. This time it's a dangerous one. In fact, Twitter is already aware that these domains are malicious. Try tweeting or DMing twichick[.]info without the brackets. Twitter will not allow you to.

What should you do when you spot suspicious activity like this?

First, again, NEVER click on a link in a suspcious account's timeline.
Second, it's always a good idea to double-check your suspicions before reporting an account. One way to do that is by asking a question and seeing if you get a human sounding response.

Once you are sure the account is a bot, Report. You can find the "report" option by going to the user's profile clicking the three small dots to the right of the page.

Since a bot is an automated account trying to pretend it's a human, the correct selection for reporting is that the account is "pretending to be me or someone else".

Twiitter limits the amount of URL's posted I. a thread. So we are going to upload and update the active bots from this thread on our website. Please visit unhackthevote.com/our-research/t…

These bots are being created as we speak. We will try to stay up to date on our website.

We are no longer recommending Blocking these Bots as Twitter has been negligent and we may need you to report again.

Lets get this one suspended. Se haver much more to publish.

Thank you for all of your help