To find spam networks, go where the spammers are
One can often map out networks of social media spam accounts by using information that the spammers themselves provide to advertise their services
How does one go about finding spam networks on social media platforms? Sometimes, the direct approach is best — simply go where spammers are advertising or discussing their services and start poking around. In this article, we’ll use a BlackHatWorld post advertising “X NFT Followers” as a starting point and follow the trail to a group of cryptocurrency-focused spam accounts operating on social media platform X (formerly Twitter).
The BlackHatWorld post offering “X NFT followers” includes a link to the website dmister.com, which offers a variety of illicit social media services. These services are mostly focused on X and include likes, mentions, reposts/retweets (both terms are used on the site), quote posts, comments (also known as replies), followers, and Spaces listeners, with a specific focus on amplifying cryptocurrency/NFT giveaway posts. The site also offers a few spamtastic services for Instagram and Discord, including likes, reactions, and followers.
The dmister.com website conveniently provides a Google spreadsheet containing a list of example spam accounts from the dmister.com network, presumably so that prospective customers can get an idea of what they’re buying before making a purchase. This list also provides an opportunity to study the network and search for more accounts based on the characteristics of the example accounts. There are multiple ways of going about this; for the purposes of this analysis, additional accounts were located by searching for other accounts posting exact duplicates of recent non-trivial posts from the example accounts. Accounts with multiple duplicate posts were considered potential members of the network, and obvious false positives were manually removed.
This process resulted in 496 potential spam accounts, which is likely only the tip of the iceberg given the inefficiency of exploring a network like this without a robust means of data collection such as the now-removed free X/Twitter API. The creation dates of these accounts range from 2009 to 2023, with the vast majority of the accounts having been created in 2022 or 2023. The accounts are small, with most having only a few dozen followers. Almost all of the accounts follow substantially more accounts than follow them; the average following:followers ratio for the spam accounts is 4:1 and the median ratio is 10:1.
The dmister.com site advertises the amplification of cryptocurrency/NFT giveaway posts as one of its primary services, and the spam accounts indeed amplify content of this sort frequently. Almost all of the accounts most frequently reposted by the network are crypto-themed, with the notable exception of SpaceX/Tesla CEO and X owner Elon Musk’s @elonmusk account. Whether the latter is a deliberate attempt to astroturf Musk’s posts or an effort to make the accounts blend in by sharing content from an already popular influencer is unclear from the available evidence.
These spam accounts do not solely repost content; they also post and reply. These posts and replies are highly repetitive, with many having been posted verbatim hundreds of times by dozens or hundreds of accounts. As with the reposts, the accounts’ repetitive posts and replies are pretty much all cryptocurrency themed (although some of the crypto tokens being offered, such as $TRUMP, have obvious political overtones).
Brings back memories of Alexander Nix and Cambridge Analytica saying they could get people to do things they wouldn’t ordinarily do. Same type of profiling FB did back in the day with their depression test threads to see if they could successfully make people depressed. I’d see Steve Bannon using these types of ops, as his partner Guo Wengui was able to extract more than a billion dollars from his networks that used some of the same tactics as Cambridge used with Brad Parscale. It leads one to ponder how reality can be bent/changed to manipulate low critical thinkers down rabbit holes with the thoughts that they actually had power, when all they really had was bots leading them there, and algorithms sinking them into a morass they couldn’t come back from.
Will you be moving to any other platform in the future?