The nine thousand dollar botnet

A network of over a thousand spammy X accounts with blue checkmarks is flooding selected posts with waves of extremely similar replies

the payload fairing separation has inspired some spammy enthusiasm

Although the proposition has been repeatedly put forth that X’s paid verification program will help reduce spam, the comment sections of particular posts tell a very different story. One need look no further than the replies to certain recent @SpaceX posts to find a swarm of verified accounts replying with dozens of mildly rephrased versions of the same response. As it turns out, these accounts are part of a network of over a thousand “verified” spam accounts that frequently reply en masse to popular X accounts as well as to one another.

almost all of the spam accounts are older accounts

This spam network consists of at least 1152 X accounts, almost all of which are old accounts that were dormant for several years prior to December 2023/January 2024. This lengthy digital nap, along with the fact that their old content is far more varied and organic-looking than the recent wave of spam, suggests that the accounts were hijacked or purchased and are no longer under the control of their original owners. As of the time the data was gathered for this analysis, all 1152 of these accounts had blue verification checkmarks. Assuming that the accounts in this network are using the $8/month X Premium subscription, the cost of operating this network is at least $9216 per month in X subscription fees alone.

at moments of peak activity, this botnet replies thousands of times per hour

Almost all of the recent content posted by this network is replies (258131 of 263965 posts posted in January 2024, 97.8%). The remaining 2.2% is posts that appear to exist for the sole purpose of giving the other accounts in the network material to reply to in order to create the illusion of genuine interaction. These posts were the primary indicator used to map the network for this analysis, as they generally receive dozens of extremely similar replies from other spam accounts, but few or no likes, making them easy to discern from organic X posts. Replies to these posts constitute 34.2% of the network’s content; most of the remaining replies are to popular accounts. This spam network almost never replies just once; if one account from the network replies to a post, dozens of others join in with extremely similar replies. (Note that the dataset used is likely incomplete due to the lack of affordable access for researchers to the X API.)

many of the legitimate accounts replied to by the spam network are large meme accounts

Outside of replying to one another, the accounts in this spam network most frequently reply to two large meme accounts: @PicturesFoIder and @historyinmemes. Other interesting accounts spammed by the network include right-wing media personality @CollinRugg, tech entrepreneur @elonmusk, and the aforementioned @SpaceX.

the blue checkmark: not as helpful at preventing spam as one might imagine

The network’s replies are generally riffs on the posts being replied to: the spam replies to @SpaceX’s “payload fairing separation confirmed” post all express enthusiasm about the payload fairing separation, replies to a pun about an exploding cheese factory make repeated mention of a “cheesy situation”, replies to a post about the moon and the tides all express fascination with the fact that the moon controls the tides, and so on. Although the spam accounts do vary their phrasing, many of the replies end up being repeated verbatim anyway, due to the sheer volume of replies and the network’s apparently limited repertoire.

the network’s replies often vary in phrasing, but some content is duplicated verbatim

Although a handful of the accounts in the network were either suspended or had their verification checkmarks revoked by X during the two days it took to complete this analysis, the vast majority have managed to spam away throughout the month of January 2024. The existence of a spam network of this size composed of accounts with paid verification checkmarks casts significant doubt on the value of monetary barriers in disrupting coordinated efforts to manipulate social media platforms.

Supplemental links:

permanent IDs of the 1152 accounts in the network

archives of 50 randomly selected posts from the network