The aforementioned six accounts are part of an astroturf botnet consisting of 2841 similarly-named Twitter accounts with repetitive biographies created in May 2021. These accounts (allegedly) send all of their tweets via Twitter for iPhone.
All 2841 accounts in this network use GAN-generated face pics as their profile images.
(GAN = "generative adversarial network", the AI technique used by thispersondoesnotexist.com and similar tools to generate fake face pics.)
The facial features on GAN-generated face pics always appear in the same pixel position on the images. In an interesting twist, the pics used by this botnet have been shifted down and to the right, but since all were shifted by the same amount, the facial features line up anyway.
Here's an animated visualization of the process of blending the 2841 GAN-generated pics, demonstrating the identical facial feature placement (particularly the eyes).
As is often to be the case with network consisting of large numbers of GAN-generated profile pics, some rather glitchy images have made their way into the dataset. These are some of the more entertaining examples.
What does this botnet actually do? It mostly amplifies large cryptocurrency/blockchain accounts, via both retweets and quote tweets, with some retweets of news and sports tweets (and occasional other things) thrown in for good measure.
In addition to retweeting large cryptocurrency accounts, this botnet also follows them en masse: 16 of the accounts the network amplifies are also followed by at least 90% of the bots in the network.
How does one find astroturf networks? One method is to choose a word or phrase, plot a histogram of the creation dates of accounts tweeting that word/phrase, and look for spikes. Several such spikes show up among accounts with recent tweets containing "casino".
If the spikes in creation dates are the result of someone creating making en masse, batches of similar-looking accounts will show up when one looks at the accounts created during the spikes. Here are some examples from the casino dataset, with possible batches highlighted in red.
The late February and early March batches from the casino dataset all use the same naming scheme, tweet using the same app ("Twitter Web App"), retweet many of the same tweets, and tweet identical tweets on multiple accounts, so these accounts are likely a single operation.
Pro-Bolsonaro accounts are spamming follow trains under a variety of hashtags. Here's a quick look at the network (or network of networks, rather). #PlatformManipulationMonday
To map out Bolsonaro trains, we began with one train hashtag (#ArqueirosPatriotas) and explored the networks of accounts using it to find more. We wound up with 12 hashtags (often used in combination), 16969 trains, and 229795 retweets of trains between April 1 and June 13 2021.
We considered any non-reply tweet containing at least one of the follow train hashtags, at least 10 tags of other accounts, and no substantive additional text content to be train tweets. Over half of the volume (56.1%) is trains listing at least 20 accounts or retweets thereof.
If you woke up this morning hoping that somewhere in the world there was a Twitter botnet advertising multiplayer games by replying to tweets (many of them several years old) that have nothing to do with video games, this spam network's for you. #SundaySpam
This network consists of 45 accounts created between February and June 2020. Almost all of their content (23574 of 24125 tweets, 97.7%) is repetitive replies promoting video games, most of which link to gameexp(dot)com.
At least 23 (probably 25) of the accounts in this network use GAN-generated profile pics. (GAN = "generative adversarial network", the AI technique behind the fake faces produced by thispersondoesnotexist.com etc.) Many have had their colors edited, and 10 have been resized/cropped.
We found 1311 Instagram accounts with GAN-generated face pics, account names beginning with "alex-", and biographies containing "GET +10000 FOLLOWERS NOW" accompanied by random emoji. (Due to Instagram's lack of a public API, this was done via the website's search future.)
As is the case with unmodified GAN-generated face pics (so far), the major facial features (especially the eyes) are in the same position on each of the 1311 images. This anomaly becomes visually apparent when the images are blended.
A new pro-Bolsonaro, pro-Trump follow train hashtag has emerged: #BolsoTrumpTeam. It's being pushed by pretty much the same set of accounts that previously posted #Bolso22Trump24 follow trains, although some have renamed themselves. #PlatformManipulation
#BolsoTrumpTeam is (at least) the third Bolsonaro/Trump follow train hashtag pushed by this group of accounts. The accounts all switched to the new hashtag at pretty much the same time, with almost no use of #Bolso22Trump24 after June 1st, 2021.
This table shows the most prolific posters of #BolsoTrumpTeam follow trains. Nine of them have changed their account name since the #Bolso22Trump24 days.
Meet @ChargoisCodie, whose profile pic is the cover of Codie Chargois's 2021 album "Tentatively Muttering", available on Amazon, iHeartRadio, and YouTube. One might infer that this is Codie Chargois's official Twitter account, but things are not as they seem.
The Codie Chargois tracks on YouTube are all covers that have been given different names than the original songs. Two are identical - "Just Around the Way" () and "3h AM" () are the same version of "Ring of Fire". One more thing...
All of the songs allegedly recorded by "Codie Chargois" appear to have actually been recorded by 39 WEST, an Ohio country band (reverbnation.com/39west). Perhaps "Tentatively Plagiarizing" would've been a better album title than "Tentatively Muttering".