It turns out that when one reverse image searches a GAN-generated face pic, some of the results are other GAN-generated face pics. We used Yandex, as it was more effective than Google and is easier to automate. (This doesn't work with TinEye, which only finds exact matches.)
We generated 500 face pics using thispersondoesnotexist(dot)com, reverse searched them using Yandex, and filtered the results to Twitter profile pics, yielding 35 accounts (plus a few suspended ones). As usual, the major facial features are in the same place on each image.
Although most of the accounts using GAN-generated face pics we found via reverse image search appear to be solo acts, we did find a small botnet. This botnet consists of 7 Russian-language accounts tweeting via Tweetdeck on identical schedules.
These bots do two things:
• Tweet links to a variety of websites (these appear to be small sites selling various things, with the caveat that we don't speak Russian)
• Tweet sentence fragments, often repeated across accounts
We searched for the origin of the repeated sentence fragment tweets, and they appear to be from a book called "Английская классическая эпиграмма" ("English Classical Epigrams", per Google Translate) that contains Russian translations of text from famous English authors.
(Some other threads on GAN-generated profile pics and their use on Twitter, for those interested in further reading material)
Answer: the video, originally tweeted by @CindyScarbrou17, has been embedded in 1353 tweets from 1140 different accounts. Although none of the individual tweets got much attention, the video racked up a decent view count due to the the sheer number of tweets containing it.
These accounts are part of a Korean-language pornbot network consisting of (at least) 4291 accounts with repetitive naming schemes, created in batches between September 30th and November 18th, 2020. The older accounts host the original videos, and the newer ones embed them.
We snagged the last 10 days worth of replies sent via Mobile Web (M2), and noticed a couple of interesting spikes in the creation dates of the accounts (on October 29th and November 1st, 2020). What's up with that? #MondayMotivation
Answer: the two spikes in creation dates appear to be an Arabic-language retweet/reply botnet, consisting of (at least) 149 accounts created in late October/early November 2020.
(We think there are actually more accounts, but we'll get to that later.)
The majority of this botnet's content is retweets of a variety of Arabic-langauge accounts. Based on Google's (potentially erroneous) translations of the most popular tweets, the majority of the content is discount codes for various products and services.
We took a look at the follower of popular right-wing Twitter account @ColumbiaBugle. The vast majority of its followers look like run-of-the-mill #MAGA accounts, but we found an interesting group of batch-created accounts lurking among its earliest followers.
We searched the followers of the other accounts followed by @ColumbiaBugle's early batch-created followers to see if we could find more, but came up empty handed. Interestingly, @ColumbiaBugle is the *only* account followed by all 154 accounts.
The accounts in this fake follower network were created in batches in late 2015 and early 2016. None have tweeted or liked a tweet. Several have names that are takeoffs on 2016 GOP presidential candidates (@MRubioooooo, @TedCruzzinn, @cruzin_teddy). All have default profile pics.
Answer: they're from a reply spam botnet we didn't know quite what to make of when we first saw it. It is now on a mission to promote forex trading/cryptocurrency content. ("Nicholas Shawn" appears to be a reference to the "Nick Shawn" Youtube channel.)
This botnet consists of 48 accounts, all created in September or October 2020. (We found 35 accounts when we first looked at it). Almost all tweets are replies sent via "Mobile Web (M2)".
This seems like an excellent day to look at a (mostly) Russian-language follower/retweet botnet that uses GAN-generated pics (presumably created using thispersondoesnotexist.com or a similar tool). #FridayShenanigans
This botnet consists of 53 accounts created between August 12th and August 16th, 2020. All have randomly generated usernames consisting of digits and lowercase letters and Cyrillic display names.
Here are the profile pics of all 53 accounts in the botnet, as well as the result of blending them together. The eyes align perfectly (as do the mouth and ears other than slight variations in angle and position), a trait common to all unmodified face pics generated with StyleGAN.
Oh hey, it's a post on blackhatworld(dot)com offering 50 free Twitter followers to whomever replies. Let's see what they look like. #SeemsLegit#ThursdayThoughts
We downloaded the followers of six of the accounts that replied to the blackhatworld(dot)com post offering free followers, and indeed each has a streak of batch-created followers from summer 2020, most of which have never liked a tweet.
These batch-created followers are part of a fake engagement botnet consisting of 96 accounts, all created between June and August 2020. They supposedly tweet via the Twitter website, but due to frequent 24/7 activity (among other things), we believe them to be automated.