We found a total of 28 accounts with GAN-generated profile pics linking to ethereumcryptocurrency(dot)com. All were created in September or October 2020, and all tweet exclusively via automation service dlvr(dot)it.
As is the case with all face pics generated by StyleGAN (the neural network used by thispersondoesnotexist(dot)com and similar tools), the major facial features (particularly eyes) are in the same position on the profile pic of each account in this botnet.
Here's an animated visualization of the process of blending the 28 profile images, showing the similarity in facial feature placement. (This isn't the only fingerprint of GAN-generated face pics, but it's a pretty obvious one, at least if the pics haven't been rotated/shifted.)
This botnet is quite devoted to its apparent mission of promoting ethereumcryptocurrency(dot)com: 336 of 346 tweets (97.1%) are links to the site, with the remaining 10 being links to other cryptocurrency sites.
(Possibly related: here's a thread from two weeks ago on a very similar group of bots with GAN-generated profile pics linking a different cryptocurrency site, cointelegraph(dot)com.)
We've done a decent amount of research on the use of GAN-generated images over the last two years, mostly fake face "photos" such as those produced by thispersondoesnotexist(dot)com. Here are all of our related threads in one place.
GAN is an abbreviation for "generative adversarial network", the AI technique used to produce these images (and other things). Here's a "brief" description of how StyleGAN, the GAN behind thispersondoesnotexist(dot)com, works. machinelearningmastery.com/introduction-t…
Here's the first network we found in the wild using GAN-generated face pics (29 of 52 accounts, created in two batches). The profiles featured repetitive biographies mentioning family, friends, country, and weapons.
It's the day before Halloween, and a #MAGA account by the name of @PepeNewsNow has racked up over 16K followers in its 16 days of existence. We took a look at them, and found a couple of interesting anomalies. #FridayFeeling#AltWankers
For starters, a disproportionate number of @PepeNewsNow's followers (6182 of 16701, 37%) were created in March 2020 or later. We've seen this pattern before among #MAGA Twitter accounts, but have not seen the same phenomenon among left-leaning accounts.
Secondly, a lot of @PepeNewsNow's followers (2090 of 16701, 12.5%) have either never tweeted or have yet to tweet in 2020. Despite their apparent dormancy, they woke up in decent numbers to follow an account created in October 2020.
We took a closer look at this Arabic-language fake engagement botnet that we found promoting blue-check shady social media services vendor @sendthetrend. It consists of more accounts than we originally noticed (240 accounts rather than 188).
The 240 accounts in this botnet were created in batches between November 28th, 2016 and January 5th, 2017, with the majority created on January 5th, 2017. Almost all of their tweets are retweets (99.5%) and almost all were sent via Mobile Web (M2) (99.9%).
These accounts retweet a variety of Arabic-language accounts, with the most frequent flier being @dk_alsabah. Since we don't speak Arabic (and don't trust the accuracy of machine translation tools), we're unsure if there's a theme to the accounts/content amplified.
One of the accounts that this reply spam botnet we recently documented replied to (@oliverzok) began its Twitter life with an infusion of over 1000 batch-created bogus followers. We decided to explore the rest of the network. #SundaySpam
To find the rest of the network, we downloaded the followers of other accounts followed by the batch-created followers of @oliverzok, and repeated the process for the accounts they follow, and so on.
We found 1835 accounts that we believe to be part of this fake engagement network. All were created between January and March 2017, have been dormant since late 2017, and tweeted exclusively via the Twitter Android app back when they were active. All their tweets are retweets.
Move over, thispersondoesnotexist(dot)com, because deepfake face pics are so 2019. The good folks over on 4chan have made us aware of thiswaifudoesnotexist(dot)net, a site that serves up GAN-generated anime pics. #SaturdayShenaniGANs#ASeriesOfUn4chanateEvents.
The thiswaifudoesnotexist(dot)net website offers the real anime images used to train the GAN for download (we downloaded via Tor because opsec). We used this along with a set of images it produced to come up with a simple technique for detecting the GAN-generated anime pics.
The GAN-generated anime pics contain a variety of anomalies that aren't present in most of the real ones, but the most obvious (and the one we focused on) is the presence of blotches/very slight random variance in color in areas that would be solid colors on real anime pics.
This botnet consists of 35 accounts, all created on either October 19th or October 20th, 2020. Thus far all of this network's content is replies (no retweets or original tweets), almost all posted via "Mobile Web (M2)". Some of the account biographies are duplicates.
This botnet is very repetitive, with 77 replies sent at least twice and the most frequent reply ("Oh My God! Your tweet is really Enormous Graceful Frame") used seven times by seven different accounts. (Table includes all replies that were repeated at least three times.)