How do we know that @JonasMattheww's profile image is GAN-generated? There are several signs, such as nonsensical clothing that melts into the neck and background.
GAN-generated faces (at least the commonly-available ones) have the telltale trait that the primary facial features (especially eyes) are in the same location on each image. This becomes obvious when multiple GAN-generated faces are blended together.
More on GAN-generated pics and their use on Twitter (and elsewhere) in this thread:
When one retrieves retweets via Twitter's free API, the text of these tweets is tagged with the name the account being retweeted had at the time of the retweet. Applying this technique to @JonasMattheww reveals that the account was named @/Zeplin20 prior to July 3, 2022.
Looking at old Wayback Machine archives corroborates this finding: the account presently named @JonasMattheww (permanent ID 2494218428) was previously named @/Zeplin20.
In additional to changing handles, @JonasMattheww (permanent ID 2494218428) also deleted all tweets prior to April 30, 2022. The deleted content (under the name @/Zeplin20) was in a mix of English and Turkish.
More on detecting renamed Twitter accounts in this thread:
What do these nine cryptocurrency/NFT accounts have in common? Several things: all were created in 2010, all have been renamed at least once, and all appear to have gained their followers from the same illegitimate sources.
These nine accounts were all created between April and August 2010. A few of the accounts tweeted via a variety of apps back in 2010, but all of them fell silent for over a decade until they woke up in 2022 tweeting about NFT/crypto stuff via the Twitter Web App.
All nine of these recently-awakened crypto accounts were renamed sometime between May 2020 and the present day. (The source for the previous names is a dataset of older account profiles we downloaded in spring 2020, discussed here:
Meet @ItsJustMeRED and @JordanFun2, a pair of MAGA accounts with plagiarized profile photos who celebrated the 4th of July by tweeting additional plagiarized photos.
These accounts are part of a network of eight MAGA accounts that retweet, reply to, quote tweet, and follow each other. Most have stolen profile photos (although @imp1ss3d0ff appears to be a cropped GAN-generated face). As we'll see, they also frequently tweet plagiarized photos.
All of the accounts in this network with the exception of @goldisez profusely post plagiarized photographs of random women, often falsely implying that the image depicts the operator of one of the accounts. Many of these photos are duplicated by multiple accounts in the network.
When you're a bogus Twitter account named @APPLE01903644 pretending to have participated in protests in Washington DC, sometimes you screw up and post a stolen photo from a protest in an entirely different city, such as Boston. It's what you do.
In a not-so-surprising development, @APPLE01903644's profile pic is stolen, as are a few of the "good morning"/"good evening" photos the account has posted.
The @APPLE01903644 account has repeatedly posted pet photos (both cats and dogs), but as with the account's profile photo, these photos are stolen.
Meet @na_intel, an account with a GAN-generated face that provides "open source intelligence" about the Russian invasion of Ukraine, which apparently involves plagiarizing photos from official Ukrainian military Facebook pages.
How can we tell that @na_intel's profile pic is GAN-generated? In this case, it's extremely easy, because the same "face" can be found on the website generated.photos, which maintains a curated collection of synthetically generated face images.
These four accounts are part of a much larger retweet botnet consisting of 63096 accounts created from January to May 2022. All of them (allegedly) post all their tweets via the Twitter Web App, and 100% of their content to date is retweets.
What do the accounts in this botnet retweet? Mostly cryptocurrency/NFT content, but recently defeated Colombian presidential candidate @ingrodolfohdez turns up prominently as well. The tweets retweeted by the botnet tend to wind up with far more retweets than likes.
Meet @KCRATySteele and @TomVacarKTVU, a duo of verified Twitter accounts tweeting NFT spam. Both accounts allegedly belong to journalists, but all is not as it seems.
As it turns out, the original @KCRATySteele (ID 130148626) and the new one (ID 3170517168) are different accounts. The spammy blue-check @KCRATySteele was created in April 2015, while the original was created in April 2010 and appears to have been renamed to @TySteeleNews.