This follower sales website, cryptolikez(dot)com, has an associated Twitter account by the name of @cryptolikez (permanent 1494042375529938946). Almost all of @cryptolikez's 41K followers are accounts created between March and June 2022 that followed @cryptolikez en masse.
The batch-created accounts following @cryptolikez are part of an astroturf botnet consisting of (at least) 243586 accounts created between January and July 2022. All of the tweets posted by this botnet were (allegedly) tweeted via the Twitter Web App.
Who do the accounts in this botnet follow? A mix of English and Chinese-language cryptocurrency/NFT accounts, many of which gained tens of thousands of followers from the botnet and appear to have few or no real followers.
The followers from the botnet show up as horizontal streaks (highlighted in red) on follow order by creation date plots of the accounts they follow.
The accounts in this botnet tweet, retweet, and quote tweet. Their tweets/quote tweets are highly repetitive, with the same text duplicated verbatim by hundreds or thousands of accounts. As with the accounts they follow, the accounts they retweet are mostly crypto/NFT accounts.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
First up, we have @DrAdamAneevit, an antivax account with 38K followers and a GAN-generated face. Although this account's bio states that it is a "pArOdY", plenty of people are eating up its misleading tweets about COVID and vaccines.
As it turns out, @DrAdamAneevit (permanent ID 949263131800424449) wasn't always called @DrAdamAneevit. Wayback machine archives reveal that this account was previously a "news" account named @/ForFactsSake101.
These accounts are part of a network consisting of (at least) 408 accounts created between February and July 2022 (mostly in July). These accounts all have single-letter display names (usually "Q"), and (allegedly) send all their tweets via Twitter for Android.
The accounts in this network use the same profile pics over and over, with only 7 distinct images (including the default) pic across 408 accounts. We were unable to find the sources of any of the images using TinEye or Google reverse image search.
What do Michigan GOP congressional candidate @Seely4Congress and New Hampshire GOP state senate candidate @LougNH have in common? Both were recently followed by swarms of recently-created accounts with random-looking names. #KeepOnAstroturfin
The recently-created accounts that followed the two GOP candidates en masse are part of an astroturf botnet consisting of (at least) 25762 accounts created in June and July 2022 with display names consisting of random lowercase letters.
Here are follow order by creation date plots for @Seely4Congress and @LougNH. The followers from the botnet show up as horizontal streaks (highlighted in red).
How do we know that @JonasMattheww's profile image is GAN-generated? There are several signs, such as nonsensical clothing that melts into the neck and background.
GAN-generated faces (at least the commonly-available ones) have the telltale trait that the primary facial features (especially eyes) are in the same location on each image. This becomes obvious when multiple GAN-generated faces are blended together.
What do these nine cryptocurrency/NFT accounts have in common? Several things: all were created in 2010, all have been renamed at least once, and all appear to have gained their followers from the same illegitimate sources.
These nine accounts were all created between April and August 2010. A few of the accounts tweeted via a variety of apps back in 2010, but all of them fell silent for over a decade until they woke up in 2022 tweeting about NFT/crypto stuff via the Twitter Web App.
All nine of these recently-awakened crypto accounts were renamed sometime between May 2020 and the present day. (The source for the previous names is a dataset of older account profiles we downloaded in spring 2020, discussed here:
Meet @ItsJustMeRED and @JordanFun2, a pair of MAGA accounts with plagiarized profile photos who celebrated the 4th of July by tweeting additional plagiarized photos.
These accounts are part of a network of eight MAGA accounts that retweet, reply to, quote tweet, and follow each other. Most have stolen profile photos (although @imp1ss3d0ff appears to be a cropped GAN-generated face). As we'll see, they also frequently tweet plagiarized photos.
All of the accounts in this network with the exception of @goldisez profusely post plagiarized photographs of random women, often falsely implying that the image depicts the operator of one of the accounts. Many of these photos are duplicated by multiple accounts in the network.