What's up with all these accounts with July 2020 creation dates and stated locations in the US retweeting @ARTEM_KLYUSHIN's tweets (in Russian) about the 2020 US election? #Spamtastic
We found 95 accounts that we believe to be part of a retweet network amplifying @ARTEM_KLYUSHIN (and others), all created in July 2020. Many list a US state on their profile, usually in all lowercase, and none has ever liked a tweet.
All of the accounts in this network theoretically tweet via the Twitter website ("Twitter Web App"). Although this hypothetically indicates the tweets are human-posted, there are multiple ways of automating websites so the accounts could well be automated.
The accounts in this network do three things:
• retweet accounts, primarily @ARTEM_KLYUSHIN and cryptocurrency accounts
• reply to cryptocurrency accounts
• tweet short phrases/aphorisms
The accounts in this network follow each other profusely (and notably follow very few other accounts), with each account following an average of 23 other members of the network.
As is the case more often than not with bot/sockpuppet networks on Twitter, these accounts use stolen pics. We had better luck with Google than TinEye or Yandex this time around.
(semi-related thread about a much larger, albeit dormant, botnet following @ARTEM_KLYUSHIN)
We took another look at @ARTEM_KLYUSHIN's account, and noticed several recent tweets with almost no retweets but lots of extremely generic-looking English replies from accounts that look suspiciously like those in the network described in this thread.
By exploring the follower networks of the repliers, we found a total of 225 accounts that we believe to be part of the network (including the 95 July 2020 creations we originally found). All but the oldest were created in batches, with the recent batches being larger.
All 225 accounts (allegedly) tweet via Twitter web products, with the earliest traffic being via "Twitter Web Client", followed by "Mobile Web (M2)", followed by "Twitter Web App". Volume has increase substantially over the last couple months.
Who do these accounts reply to? As with the accounts they retweet, it's mostly cryptocurrency accounts and @ARTEM_KLYUSHIN. We'll keep an eye on this network here and there and update this thread further if we notice anything else interesting.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
It's New Year's Eve, and a bunch of politics enthusiasts with GAN-generated faces are enthusiastically replying to a variety of posts with similarly-worded replies. #NewYearShenaniGANs
cc: @ZellaQuixote
The politics enthusiasts are part of a spam network consisting of (at least) 575 accounts created between May and December 2023 with GAN-generated faces. Many of their handles, such as @Maairiuieinaaa and @eJooeiaAoneueer, contain long strings of vowels.
@Maairiuieinaaa @eJooeiaAoneueer All 575 of these accounts use StyleGAN-generated faces as profile images. Some of these, such as @MauMoiagaia's profile image, contain a tiny "StyleGAN 2 (Karras et al.)" watermark in the lower right corner.
It's a great day to look at a network of inauthentic accounts that post identical AI art images (with a side of good old fashioned T-shirt spam).
cc: @ZellaQuixote
This network consists of 24 X accounts. 12 of these accounts were created in the latter half of 2023 and have female avatars, while the other 12 were created in 2013 or earlier and have male avatars.
The 12 accounts with female avatars and 2023 creation dates regularly post AI-generated art images, and these image posts are quickly reposted by other accounts in the network (both female and male). The AI-generated images are often duplicated across accounts.
Meet @ImJamesMiller (permanent ID 1371651462153994242), an account with a GAN-generated face, 172K followers, and no tweets prior to two days ago. What's up with that?
cc: @ZellaQuixote
As it turns out, @ImJamesMiller wasn't always named @ImJamesMiller. In June, the account was named @/IamJimCaviezel in an apparent attempt to impersonate Sound of Freedom actor Jim Caviezel.
@ImJamesMiller Multiple prominent users appear to have accepted the fake Jim Caviezel account as legitimate, including Texas Congressman Brian Babin, right-wing influencer/ex-Game of Thrones blogger Jack Posobiec, and recently indicted ex-Assistant Attorney General Jeff Clark.
It's a great day to look at a network of Bluesky spam accounts with randomized names. #SundaySpam
cc: @ZellaQuixote
This spam network consists of (at least) 401 accounts, all of which were created (or added to the Bluesky app view) in August 2023. These accounts do not follow each other; rather, each one follows a small number of popular Bluesky accounts.
The accounts in this network cycle rhythmically between posting three types of content:
• reposts
• posts containing links to news articles
• posts containing links to news articles accompanied by images
Meet @thisisorange, a Twitter account created in February 2022 with a gold "verified organization" badge, thousands of batch-created fake followers, and a couple other interesting traits.
Verified organizations on Twitter can verify affiliated accounts (employees, teams, brand names, etc), which receive blue checkmarks as well as an organization badge (help.twitter.com/en/using-twitt…). The @thisisorange account has thousands of affiliates, mostly cryptocurrency accounts.
How did this come about? The website linked on @thisisorange's profile (orange dot associates) apparently allows one to become an affiliate simply by providing a Twitter account and a cryptocurrency wallet.