200+ “wpnewsreport” Spammers (Twitter)

March 8th, 2011

Over 200 shill accounts have recently been created on Twitter to link to fake news pages on a hijacked domain, wpnewsreport .com. Most of the tweets are sent as at-replies to random Twitter users, most stating something similar to “I assumed you’d be appreciative of this” or “I supposed that you’d be attracted to this,” while one account claimed to be sharing “Breaking News: Google Now Hiring People to Work from Home! You gotta see this..”. Many of the shill accounts follow several hundred users in an attempt to get other Twitter users to see these links. One account began tweeting links to the compromised site back on February 28th, but most accounts have only been active in the past 2-3 days.

Here are 156 shill accounts that Twitter had not suspended yet as of the time of this post:

https://twitter.com/Alainaog

https://twitter.com/Alfredia978

https://twitter.com/Alleensm

https://twitter.com/Allyn3238

https://twitter.com/Allynbet

https://twitter.com/Anitragnu

https://twitter.com/Anjelicaci

https://twitter.com/Arianna476

https://twitter.com/Aubreyrg

https://twitter.com/Audrea419

https://twitter.com/Autumnzsn

https://twitter.com/Belen907

https://twitter.com/Bernettaxe

https://twitter.com/Bethelfd

https://twitter.com/Billicj

https://twitter.com/Blanchtk

https://twitter.com/Brennatie

https://twitter.com/Briannegs

https://twitter.com/Brigettezp

https://twitter.com/Brigidbd

https://twitter.com/Brigidgp

https://twitter.com/Britni537

https://twitter.com/Carlottajc

https://twitter.com/Carolinhve

https://twitter.com/Cassondratgi

https://twitter.com/Catherynjx

https://twitter.com/Celestazx

https://twitter.com/Chanawcv

https://twitter.com/Charlestmw

https://twitter.com/Chia4952

https://twitter.com/Chongbyi

https://twitter.com/Christalpx

https://twitter.com/Cletatv

https://twitter.com/Coleenmmg

https://twitter.com/Coreen25

https://twitter.com/Curtisauo

https://twitter.com/Daineges

https://twitter.com/Danyellpm

https://twitter.com/Deannevo

https://twitter.com/Delfinajgp

https://twitter.com/Denaedix

https://twitter.com/Doreenxab

https://twitter.com/Dreamavax

https://twitter.com/Dwanarn

https://twitter.com/Ebonitnf

https://twitter.com/Eleanorekvk

https://twitter.com/Eufemiagm

https://twitter.com/Eveliahg

https://twitter.com/Eveloe

https://twitter.com/Fannywtn

https://twitter.com/Fidelacc

https://twitter.com/Gabrielaevd

https://twitter.com/Galehfg

https://twitter.com/Gaynellbw

https://twitter.com/Giselle0108

https://twitter.com/Gracie9631

https://twitter.com/Hangzyw

https://twitter.com/Harrietnvq

https://twitter.com/Heikecz

https://twitter.com/Ila9946

https://twitter.com/Ildalsf

https://twitter.com/Ingeborggm

https://twitter.com/Irmgardppk

https://twitter.com/Ivonnebuh

https://twitter.com/Janeengl

https://twitter.com/Janellahjv

https://twitter.com/Jaquelyn532

https://twitter.com/Jeninesam

https://twitter.com/Jenniemns

https://twitter.com/Ji977

https://twitter.com/Joellakb

https://twitter.com/Josieppw

https://twitter.com/Juanaouw

https://twitter.com/Kacieuaq

https://twitter.com/Kariewen

https://twitter.com/Karinefzf

https://twitter.com/Karry8693

https://twitter.com/Karry955

https://twitter.com/Kelsie1637

https://twitter.com/Kenyattacoo

https://twitter.com/Kumzw

https://twitter.com/Lainexni

https://twitter.com/Lanorafxq

https://twitter.com/Lanorajd

https://twitter.com/Latishawck

https://twitter.com/Latoyiash

https://twitter.com/Lavernawni

https://twitter.com/Lavernefst

https://twitter.com/Lavone53

https://twitter.com/Lawannays

https://twitter.com/Leighannwy

https://twitter.com/Letitialcw

https://twitter.com/Ligiafee

https://twitter.com/Lisettexgb

https://twitter.com/Loriezm

https://twitter.com/Lucieumf

https://twitter.com/Lucycep

https://twitter.com/Lurlinedwu

https://twitter.com/Lynwd

https://twitter.com/Maisiebyo

https://twitter.com/Majorie8847

https://twitter.com/Maniewl

https://twitter.com/Maragaretdx

https://twitter.com/Margarettanut

https://twitter.com/Margeryzcv

https://twitter.com/Margobbu

https://twitter.com/Margrettyik

https://twitter.com/Marikozbp

https://twitter.com/Marquettaqm

https://twitter.com/Maureenwkk

https://twitter.com/Mechelleys

https://twitter.com/Melisaunh

https://twitter.com/Minhgz

https://twitter.com/Minhpia

https://twitter.com/Monserrategb

https://twitter.com/Netafiv

https://twitter.com/Nieveslz

https://twitter.com/Oleneitz

https://twitter.com/Paulinaelx

https://twitter.com/Pennyezl

https://twitter.com/Phyliss14

https://twitter.com/Renaevpa

https://twitter.com/Renna2344

https://twitter.com/Rivka48

https://twitter.com/Rosariohbj

https://twitter.com/Rosettawgw

https://twitter.com/Sarah7560

https://twitter.com/scottfj

https://twitter.com/Selinabz

https://twitter.com/Selmaldo

https://twitter.com/Setsukovv

https://twitter.com/Shalonan

https://twitter.com/Shantelleoi

https://twitter.com/Shantellezc

https://twitter.com/Sharleensaj

https://twitter.com/Shelleynm

https://twitter.com/Sherrieur

https://twitter.com/Stasiapkl

https://twitter.com/Stephinegez

https://twitter.com/Suzanect

https://twitter.com/Svetlanajq

https://twitter.com/Sydneyduy

https://twitter.com/Tabitha497

https://twitter.com/Tamara492

https://twitter.com/Tarenfii

https://twitter.com/Teresejia

https://twitter.com/Teresianbq

https://twitter.com/Tijuanaza

https://twitter.com/Tonawro

https://twitter.com/Tristan251

https://twitter.com/Valariezb

https://twitter.com/Vickeyvse

https://twitter.com/Wan174

https://twitter.com/Yaelzb

https://twitter.com/Yuonneflg

https://twitter.com/Zelma337

Twitter has already suspended at least  63 accounts affiliated with this spam campaign including Arlena4542, Beryl286, Carlena84, Cathi128, Christeen014, Clotilde996, Cyndi772, Danika46, Dann445, Dawne017, Debrah586, Deegvz, Delois113, Denyse164, Devora592, Diedra929, Edra52, Elisha991, Elli115, Elmira131, Erin740, Erlinda743, Felipa869, Franchesca356, Gayewik, Gaynelle24, Gerda643, Grazyna790, Hyo325, Isela928, Jacquelin016, Jani006, Jannette607, Jeni065, Jennieaib, Johnetta342, Kacie776, Kristel076, Lacresha657, Leisha470, Leoma061, Leontine919, Lianne990, Lilla516, Manie770, Marisawng, Micaela325, Minerva379, Pamula59, Paz177, Robyn629, Roselyn40, Samella643, Shaquana069, Shonta656, Stefanie818, Stephenyv, Tamela52, Tereasa976, Tressa245, Waneta717, Winnifred69, and Winona1742.

Here’s the Web of Trust report for the hijacked domain to which these accounts have linked:

https://www.mywot.com/en/scorecard/wpnewsreport.com

Thanks to Andrew Tokuda for bringing this spam campaign to our attention.

On an interesting side note, AnubisNetworks recently launched a site called TweetSpike for tracking Twitter spam campaigns in real time. Hopefully the anti-spam team at Twitter will take advantage of this new site to help combat spam campaigns:

http://www.tweetspike.org/

Filed under Twitter | Comment (0)

Multiple #MM spammers (Twitter)

November 22nd, 2010

UPDATE: Twitter suspended all of these accounts on the same day as this post. Thanks, Twitter!

Numerous accounts are mass-mentioning random users on Twitter.  The exact purpose of this spam is unclear; the tweets and the accounts tweeting them don’t link to any Web pages, although the first 5 accounts mentioned in every tweet are @DJJohnDigweed, @skrillex, @Avicii, @Deadmau5, and @djafrojack.  Although it’s possible that the spammers intend to advertise those user accounts, it’s probably more likely that the tweets only contain those users in order to make the tweets appear credible; the #MM hashtag usually means “Music Monday” and those accounts appear to be related to people in the music industry.

Every one of the accounts below is an obvious shill; they’re all following 0 users, and they’re all tweeting the same thing repeatedly and nothing else. Some of these accounts even share the same profile pictures.

Block Now:

Also, here’s an unrelated spammer claiming to be giving away an Apple iPhone 4 to multiple random Twitter users:

Block Now:

Filed under Suspended, Twitter | Comment (0)

VirgilStengel (Twitter)

November 13th, 2010

Spamming a plethora of Twitter users (over 990 so far) with @ messages saying “Is that one of the Fat Slag’s **** it’s tattooed on?” with a link that redirects to a site (which incidentally claims to offer you money to send advertisements). The page to which unsuspecting clickers are redirected says “LADIES…NOT ONLY IS HE TATTOOED AND HOT, BUT HE HAS A GREAT VOICE AND PRESENCE SO GO CHECK IT OUT AND FOLLOW ON TWITTER @corduroyatl”.

Although the Twitter username is VirgilStengel, the account’s real name is listed as “Hiram Kyte.” Apparently, like AndrewLafounta (see the previous post), this spammer is also experiencing an identity crisis.

Block Now:

See also the Web of Trust reports for the domains involved with the spam message:

Filed under Twitter | Comment (1)

AndrewLafounta (Twitter)

November 13th, 2010

Spamming a plethora of Twitter users (over 850 so far) with @ messages saying “Is that one of the Fat Slag’s **** it’s tattooed on?” with a link that redirects to a site (which incidentally claims to offer you money to send advertisements).  The page to which unsuspecting clickers are redirected says “LADIES…NOT ONLY IS HE TATTOOED AND HOT, BUT HE HAS A GREAT VOICE AND PRESENCE SO GO CHECK IT OUT AND FOLLOW ON TWITTER @corduroyatl”.

By the way, even though the Twitter username is AndrewLafounta, the account’s real name is listed as “Santina Dreyer.” Identity crisis, perhaps? ;)

Block Now:

See also the Web of Trust reports for the domains involved with the spam message:

UPDATE: Another spam account (VirgilStengel) has also been found tweeting the same nonsense; see this follow-up post.

Filed under Twitter | Comment (1)

KarlaVenez14707 and other spammers (Twitter)

October 26th, 2010

These are a number of old spam accounts (created between June 2009 and June 2010) that Twitter has never cleaned up.

Block Now:

Filed under Twitter | Comment (0)

101computers (Twitter)

September 20th, 2010

Shill account for rogue registry cleaner applications.  The sites linked to by this account are rated “red” in multiple categories (Spam, Phishing or other scams, Malicious content or viruses, Spyware or adware, etc.) by a significant volume of users on Web of Trust.  Both sites are listed on hpHosts as “Fraudulent software and websites, Severity: High Risk.”

Block Now:

See also the Web of Trust reports for the domains being spammed:

Filed under Twitter | Comment (0)

hanskalin (Twitter)

September 16th, 2010

Spamming users who have recently tweeted about virtualization with fake replies that are actually out of context; purely spam.

Block Now:

See also the Web of Trust report for the domain being spammed:

Filed under Twitter | Comment (0)

isitbangus (Twitter)

September 15th, 2010

Spamming a plethora of Twitter users with @ messages saying “check out your party profile”.

Block Now:

Filed under Twitter | Comment (0)

twevelopeos (Twitter)

September 7th, 2010

This account is a bot that’s spewing nonsense and linking to random tech blogs (possibly as a proof-of-concept test in preparation for future spam attacks).

Block Now:

Filed under Twitter | Comment (0)

“Test and Keep the new iPad/Macbook” Spam (Twitter)

September 6th, 2010

Several Twitter shill accounts are claiming you can “Test and Keep the new Macbook” or “Test and Keep the new iPad” (with each tweet sent as an @ reply to a single recipient).  These are obvious scams; clearly the spammers aren’t going to send out multiple thousands of dollars’ worth of iPads and MacBooks for free to anyone who clicks their links.

Block Now:

If you use Web of Trust, be sure to rate the affiliated spam sites to warn others about this scam:

Filed under Twitter | Comment (0)
« Previous Entries