Random number radio stations.
A numbers station (or number station) is a type of shortwave radio station
characterized by their unusual broadcasts, which consist of spoken words,
but mostly numbers, often created by artificially generated voices reading
streams of numbers, words, letters, tunes or Morse code.
It is certainly not by accident that the lat/lngs change on each Tweet. If I had the time as an experiment, I'd probably try and find patterns between the lng/lats to see if the decimal equivalent means anything? How hilariously awesome would it be if when mapped on a globe, it builds up a large picture. (Fair warning.. this runs WebGL and will most likely nuke your browser for a few seconds http://data-arts.appspot.com/globe-search/ )
Just listen to the buzzing sound clip... Sends chills down my spine. Then after years of 24/7/365 buzzing, a Russian voice reads a bizarre encoded message. Spooky.
'Priyom' is Russian for copy/over.
I think it is less spooky: My bet is on it being an iPhone app from years ago, maybe long pulled from the store. Its dev was using the Twitter account as a logging system. Maybe for something silly as highscores from around the world. "_dev" and "_prod" seem far too innocent names for an account that is trying to fly under the radar.
EDIT: Perhaps it is used for indexation benchmarks? Deploy a tweet with a unique string and location, and check how long it takes before it shows up in the index or notification inbox?
(Requires Java plugin)
These tweets appear to originate from Russia.
Now, common uses of 16bit (and 32bit) encryption keys are for WEP keys, traditionally used in router password protection, which can be provided either in a full ASCII spectrum or in merely hexadecimal format.
Taking these points together I can conclude that these could possibly be the encrypted WEP keys of a Russian router.
Or I could be totally wrong, but I really wasn't given much to work with :)
The maximum is 200, but you can move down the line by using since_id or max_id optional parameters.
'xml' can be replaced with 'json' or 'rss' if you'd prefer a different format.
Looking over the data briefly reveals the additonal fact that the 'source' field is populated with a link to Google. That, combined with the other accounts including one that outright says it's associated with google on its profile. So this is either google maybe doing some sort of recruiting thing, or somebody that wants us to think it's google for whatever reason. One guess is that the account name could mean Google User Notification Service.
Additionally, the tweets are published at a (more or less, this is the web) regular interval. Always around the HH:M9:30, HH:M0:00, and HH:M4:30 and HH:M5:00 marks. As stbullard speculated (https://news.ycombinator.com/item?id=4697813), there could be two instances of whatever this is running, publishing every 5 minutes independently, with one instance having the code baf200000000 associated with it and another having the id of 2350000000. Note that the length of these two are different- the former is 12 while the latter is 10. This could mean a variety of things regarding the format in which the data is published, or variance in the data itself.
It might be worth looking at the unique parts of the 235 ones as color.
If anyone can pull these tweets down into a single file and share them that would be amazing.
I wonder if it does some sort of transform on the number to get an IP addr? perhaps its part of a IPv6 Addr?
Perhaps its a distributed brute-force on a password or checksum being carried out by a botnet?
Its interesting distributed this is, too bad we dont have IP addrs associated with the posts
Each client has his/her own UUID(the tweet) and the geolocation is where the client is located.
It seems as though the googuns_staging was the trial, all fake/useless location and googun_prod(as the name suggests) is the actual "in-the-wild" run of locating all of its clients
Also interesting is at the moment there are many tweets ending in either a350000000 or baf200000000 but that may just be coincidence based on some counter thats incrementing
17 73 f2 7b a0 00 00 00
23 115 242 123 160 00 00 00
On staging, all posts end in ba0000000. On prod, all posts end in 200000000 or 350000000. Since these sequences are repeated, it seems likely they could be disregarded.
hex:10 37 ba f2 00 00 00 00
dec:16 55 186 242 0 0 0 0
they do indeed look like IP addresses. The extra number is the port(maybe). what's weird is that it's sometimes zero.
IRC traffic is commonly blocked, but HTTP traffic directed to Twitter is generic enough to get through most locked down networks. I doubt whoever is behind this cares if it's public data and that people see what's being posted. Public access just means any newly compromised computer can access it without anything more than a single HTTP request.
If we had access to the IP(s) posting the tweets, it'd be pretty easy to get an idea if they were malicious or not. But where's the fun in that
Also there is an (inactive) GooGuns_Staging: https://twitter.com/googuns_staging
As a note, the last nine digits just alternate between 200000000 and 350000000. On staging they're simply ba0000000.
Yeah, I'm looking at you DonnyV.
"created_at":"Tue May 05 19:13:53 +0000 2009"
"created_at":"Thu Sep 24 19:21:47 +0000 2009"
"created_at":"Tue Jul 28 22:48:11 +0000 2009"
"created_at":"Tue Jul 28 22:49:22 +0000 2009"
<a href="http://www.google.com/ rel="nofollow">Google</a>
each shot is defined by one unique hash and a geo location.. waiting to see a tweet about "hit" or perhaps "miss" but those wouldnt need to be ACKed
Here is a chart of the 00s (plotted against tweet number):
and of the 50s:
It's rather strange that the data isn't perfectly monotonic.
I'll look into the tweet coordinates next.
I would guess googuns_prod is the output from two of whatever googuns_staging is, running at a 1-minute offset, with each thing identifying itself with the last nine digits: 200000000 and 350000000 for the production thing, ba0000000 for the staging thing.
Maybe it's just announcing a continuous deploy script saying that a particular build made it to prod/staging?
<meta name="keywords" content="googun googun googun googun googun googun googun googun gay gay gay gay gay gay gay gay seattle seattle seattle seattle hot hot hot hot hot hot hot hot hot Tshirts t shirt t shirt t shirt t shirt t-shirt t-shirt t-shirt coffee coffee coffee coffee coffee">
Left one for the data ending with "f200000000", right one with "50000000". For these I just assumed the numbers were 64-bit little endian integers.