Missing Twitter User

I try to follow the hacking scene also on Twitter. Example sources: Cyber War News (or CWN), E Hacking News and The Hacker News. Recently I noticed a Twitter user called @1923Turkz posting information about fake hacks. After my feedback, this user (and some others) got upset and posted some angry feedback and DMs.

But suddenly @1923Turkz was gone or to be more precise, apparently changed the Twitter screen name to “@IBH_CREW”:

@laurahuu It seems @1923turkz is now @ibh_crew – go figure twitter.com/JanneFI/status…

— Janne Ahlberg (@JanneFI) May 25, 2013

@1923Turkz  – from Turkey according to the profile – was now suddenly pointing to completely different account. According to the profile, @IBH_CREW was from Iran, with zero tweets but over 23K of followers.  The account favorites-list suggested that only the account name was changed.

No magic tricks or l33t Twitter hacks – just a simple screen name change. But this morning IBH_CREW was gone and I could not find any tweets or users that would resemble the original @1923Turkz. Google search to the rescue! Search site:twitter.com @1923turkz – on page 2 I found a working link:

But when I followed the link, there was yet another screen name: @TheEvil3st (from Russia…):

Note that the URL still had the original screen name “1923Turkz”.

Luckily there is an easier way to keep track of Twitter accounts: the user ID. A quick look at the API revealed that it is possible to get both the user ID and the screen name using the “status” number (293156809957572610 in this case). Twitter API tells us that the tweet was posted by user nr #1043660580, currently using screen name @PakCyberEaglez (likely to change).

There is also an API for checking the User ID from screen name which in this case confirms that the ID is the same.

it seems Twitter mobile is updated a bit slower so I was able to pull out the tweet with current user information:

Update 3

CWN has done some further investigations. The current screen name of @1923turkz is @kwgdeface, pretending to be a hacker group from Kosovo who also commented the issue:

Here is some hard proof from the real Kosova Warriors Group about @kwgdeface twitter.com/Cyber_War_News…

— CWN (@Cyber_War_News) May 27, 2013

The related Cyber War New posts are now tagged as “Fakers”.

According to other sources, one earlier name of this account was @officialHmei7:

@ehackernews @jannefi @kwgdeface This -> twitter.com/tehMystical/st…

— Mordecai(@tehMystical) May 27, 2013

Update 4 : yet another screen name change, now it is @ReZK2LL 

Update 5 : now the user ID resolves to @ChinaBlueArmy

Lesson learned? If you want to hide your Twitter account for some reason like identity crisis, it is better to delete the current account and create a new one. Screen name can be changed, but that has no affect on the user ID. Also, Twitter API is a nice tool.

The thing about lying is, it is quite exhausting – you have to remember a lot. – Rupert Everett