The network described in this thread has grown and evolved somewhat in the 25 days since we posted it, and has amplified @ARTEM_KLYUSHIN's latest batch of tweets, including one containing #QAnon slogan "ENJOY THE SHOW" accompanied by Trump in a Guy Fawkes mask.
We found 145 accounts that retweeted or replied to @ARTEM_KLYUSHIN's recent tweets that appear to be part of the network. Most accounts have their profile location set to somewhere in the USA or UAE.
By exploring the follow relationships of the 145 accounts that interacted with @ARTEM_KLYUSHIN's tweets, we found 445 accounts that we believe to be part of this bot/sock network. Accounts are grouped into (mostly) distinct clusters of accounts that all follow each other.
The 445 accounts in this network all tweet with the same software (currently "Twitter Web App") although they have switched platforms a couple of times over their history. The accounts are mostly July or August 2020 creations. Tweets are mostly in English, followed by Arabic.
The behavior of this bot/sock network has evolved over time. Almost all content prior to April 2020 was retweets, at which point the focus switched to replies. Since the beginning of July, the network has diversified and now combines retweets, replies, and original tweets.
As was the case a month ago, this bot/sock network retweets @ARTEM_KLYUSHIN alongside various cryptocurrency and promotional accounts. It also retweets @realDonaldTrump far more frequently than it previously did, and has added @BarackObama to its retweet repertoire.
Who does this network reply to and what do the replies say? It replies to @ARTEM_KLYUSHIN as well as various promotional accounts, and the replies are repetitive, with many repeated verbatim across dozens of accounts. Most replies are in English.
The original tweets produced by this network are also repetitive, but unlike the repetitive replies, these tweets are mostly in Arabic. We've provided Google Translate's English versions of the most frequent tweets, with the caveat that the translations may be way off.
As before, this bot/sock network uses stolen profile pics. We don't have anything new to say on this aspect, so here's the relevant portion of our previous thread on an earlier phase of this network's activity.
It's New Year's Eve, and a bunch of politics enthusiasts with GAN-generated faces are enthusiastically replying to a variety of posts with similarly-worded replies. #NewYearShenaniGANs
cc: @ZellaQuixote
The politics enthusiasts are part of a spam network consisting of (at least) 575 accounts created between May and December 2023 with GAN-generated faces. Many of their handles, such as @Maairiuieinaaa and @eJooeiaAoneueer, contain long strings of vowels.
@Maairiuieinaaa @eJooeiaAoneueer All 575 of these accounts use StyleGAN-generated faces as profile images. Some of these, such as @MauMoiagaia's profile image, contain a tiny "StyleGAN 2 (Karras et al.)" watermark in the lower right corner.
It's a great day to look at a network of inauthentic accounts that post identical AI art images (with a side of good old fashioned T-shirt spam).
cc: @ZellaQuixote
This network consists of 24 X accounts. 12 of these accounts were created in the latter half of 2023 and have female avatars, while the other 12 were created in 2013 or earlier and have male avatars.
The 12 accounts with female avatars and 2023 creation dates regularly post AI-generated art images, and these image posts are quickly reposted by other accounts in the network (both female and male). The AI-generated images are often duplicated across accounts.
Meet @ImJamesMiller (permanent ID 1371651462153994242), an account with a GAN-generated face, 172K followers, and no tweets prior to two days ago. What's up with that?
cc: @ZellaQuixote
As it turns out, @ImJamesMiller wasn't always named @ImJamesMiller. In June, the account was named @/IamJimCaviezel in an apparent attempt to impersonate Sound of Freedom actor Jim Caviezel.
@ImJamesMiller Multiple prominent users appear to have accepted the fake Jim Caviezel account as legitimate, including Texas Congressman Brian Babin, right-wing influencer/ex-Game of Thrones blogger Jack Posobiec, and recently indicted ex-Assistant Attorney General Jeff Clark.
It's a great day to look at a network of Bluesky spam accounts with randomized names. #SundaySpam
cc: @ZellaQuixote
This spam network consists of (at least) 401 accounts, all of which were created (or added to the Bluesky app view) in August 2023. These accounts do not follow each other; rather, each one follows a small number of popular Bluesky accounts.
The accounts in this network cycle rhythmically between posting three types of content:
• reposts
• posts containing links to news articles
• posts containing links to news articles accompanied by images
Meet @thisisorange, a Twitter account created in February 2022 with a gold "verified organization" badge, thousands of batch-created fake followers, and a couple other interesting traits.
Verified organizations on Twitter can verify affiliated accounts (employees, teams, brand names, etc), which receive blue checkmarks as well as an organization badge (help.twitter.com/en/using-twitt…). The @thisisorange account has thousands of affiliates, mostly cryptocurrency accounts.
How did this come about? The website linked on @thisisorange's profile (orange dot associates) apparently allows one to become an affiliate simply by providing a Twitter account and a cryptocurrency wallet.