All the news that's fit to spam
All the news that's fit to spam
The tale of a network of oddly similar "news" accounts on Bluesky that repost and follow one another
As the Bluesky social media platform’s population grows, so too does the platform’s value as a target for various types of spam, manipulation, and shenanigans. One interesting example that has popped up in the opening months of 2024 is a network of hundreds of eerily similar-looking “news” accounts, allegedly covering myriad scintillating topics ranging from “Ecology News” and “Building News” to “Poison News” and “Assassination News”. These accounts follow each other and regularly repost one another’s content, which consists almost exclusively of links to videos and news articles, and features no original reporting.
A quick peek at the Following tab of any of these accounts reveals a multitude of additional obscure “news” accounts, which provides a convenient way to locate more accounts and map out the network. In the case of this particular network, excluding false positives is straightforward as, unlike real users who sign up for social media platforms to disseminate or read news, these accounts do not follow media organizations, journalists, podcasters, social media influencers, or friends. Instead, they all follow more or less the same list of hundreds of accounts — the other members of the network. The display names of most of the accounts contain the word “News”, frequently parenthesized.
Recursively exploring the set of accounts followed by an initial seed account (“TRUMP (News)”, trumpnews.bsky.social) yields 387 accounts. Each account follows an average of 317 of the other accounts in the network, and on average 99.7% of the accounts followed by any given member of the network are other accounts in the network. (Their followers are another story, as some of the accounts in the network have picked up real followers here and there, possibly due to the network’s posts appearing in search results.)
The network’s activity is a mix of posts and reposts, with reposts comprising 78.6% of the content to date. While some of the accounts in the network exclusively post or exclusively repost, most do both. With a few early exceptions, the posting activity began in late January 2024, and the reposts kicked into high gear in late February. Prior to February 6th, Bluesky was invitation-only, so at least some of the accounts in the network were created with invitation codes rather than via public signups.
As mentioned earlier, almost all of the content reposted by the network is from other accounts in the network. When combined with the fact that the network reposts more than three times as often as it posts, the result of this behavior is that the accounts appear to be more popular than they actually are, as each post generally has at least a few reposts. The spam accounts also frequently like each other’s posts.
The network’s posts almost all contain links to news articles and videos, with the most frequently linked sites being YouTube (youtube.com/youtu.be), BeLoud (beloud.com), Bloomberg (bloomberg.com), The Sun (the-sun.com), and Associated Press (apnews.com). These posts generally include multiple hashtags, some of which are loosely related to the theme of the account or the article or video being shared, while others are more general hashtags such as #breaking. This may be an attempt to flood search results for the hashtags in question with content from the spam network, especially since hashtags on Bluesky are now clickable.
Data used in this analysis was gathered via the atproto Python module. Previous articles on this blog include some potentially useful code samples, although they may be based on earlier versions of the module.