For almost any given Reddit URL that displays a human-readable page, there is a corresponding JSON URL that returns the same information in JSON format. While there is some inconsistency in the specifics, the JSON URLs are generally formed by adding .json to the standard URL, along with optional parameters regarding the maximum number of results to retrieve and how to sort them.

Below is an example of how this works for listing the posts on a given subreddit (specifically, /r/ExtendedRangeGuitars) in most-recent-first order. The first URL is the standard URL used by human users of the Reddit website; the second returns the same list of posts in JSON form.

https://www.reddit.com/r/ExtendedRangeGuitars/new

https://www.reddit.com/r/ExtendedRangeGuitars/new.json?sort=new&raw_json=1&limit=100

This process can be easily automated using Python (or any other popular programming language, for that matter).

import json
import requests
import sys
import time


def retry (url, retries=10, backoff=1.8, pause=20, max_pause=900):
    print (url)
    while retries > 0:
        try:
            result = requests.get (url, headers={
                "User-Agent" : "placeholder"
            }, timeout=10).json ()
            if "error" not in result:
                return result
            else:
                print (result)
        except:
            pass
        retries = retries - 1
        if retries > 0:
            print ("error, sleeping " + str (pause) + " seconds...")
            time.sleep (pause)
            pause = min (max_pause, pause * backoff)
    return None

def get_subreddit_posts (subreddit):
    base_url = "https://www.reddit.com/r/" + subreddit \
             + "/new.json?sort=new&raw_json=1&limit=100"
    last_id = None
    rows = []
    while base_url is not None:
        url = base_url + "&after=" + last_id if last_id else base_url
        response = retry (url)
        data = response["data"]["children"]
        if len (data) == 0:
            base_url = None
        else:
            rows.extend (data)
            for item in data:
                new_id = item["data"]["name"]
                if last_id is None or new_id < last_id:
                    last_id = new_id
    return rows

def get_thread_detail (permalink):
    base_url = "https://www.reddit.com" + permalink
    if not base_url.endswith ("/"):
        base_url = base_url + ""
    base_url = base_url + ".json?raw_json=1"
    rows = retry (base_url)
    return rows

def get_subreddit_posts_and_detail (subreddit):
    posts = get_subreddit_posts (subreddit)
    for post in posts:
        post["detail"] = get_thread_detail (post["data"]["permalink"])
    return posts

def get_user_info (user):
    base_url = "https://www.reddit.com/user/" + user + \
            "/about.json"
    result = retry (base_url)
    return [] if len (result) == 0 else result["data"]

def get_subreddits_moderated (user):
    base_url = "https://www.reddit.com/user/" + user + \
            "/moderated_subreddits.json"
    result = retry (base_url)
    return [] if len (result) == 0 else result["data"]

if __name__ == "__main__":
    if sys.argv[1] == "subreddit":
        data = get_subreddit_posts_and_detail (sys.argv[2])
        with open (sys.argv[3], "w") as file:
            json.dump (data, file, indent=2)
    elif sys.argv[1] == "user":
        data = get_user_info (sys.argv[2])
        with open (sys.argv[3], "w") as file:
            json.dump (data, file, indent=2)
    elif sys.argv[1] == "moderated":
        data = get_subreddits_moderated (sys.argv[2])
        with open (sys.argv[3], "w") as file:
            json.dump (data, file, indent=2)

The above Python code contains functions for downloading the following four forms of Reddit data:

• a list of all recent posts in a given subreddit

• a hierarchical list of comments in a given thread

• profile information for a given user account

• a list of subreddits moderated by a given user account

This set of functions is far from comprehensive, but is sufficient to demonstrate the concept and can easily be adapted to call additional Reddit JSON endpoints. The JSON calls are rate limited, and in most cases require a pause after roughly 100 calls; this is handled automatically by the retry function in the above code.

As a brief test of the above Python code, I downloaded recent posts from the /r/redditrequest subreddit and took a look at the accounts posting there. For those who are unfamiliar, /r/redditrequest is a forum where Reddit users with accounts in good standing can request control of unmoderated or banned subreddits. While this process does serve a valuable purpose, it is unsurprisingly also abused from time to time by users who are simply seeking to take control of subreddits with desirable names and have no intention of moderating them in good faith.

Downloading recent posts from /r/redditrequest yielded 927 posts from 895 distinct accounts, four of which were suspended before the download process completed. The accounts posting in /r/redditrequest are disproportionately recent creations, with more accounts created in 2025 than in any prior year. This pattern is somewhat more interesting for accounts expressing interest in moderation than it would be for Reddit users as a whole, as the moderators of active subreddits are generally experienced users who have been on the platform for years.

Among the accounts posting to /r/redditrequest are multiple accounts created within the last six months that appear to be attempting to take over as many subreddits as possible. Accounts engaged in this activity generally focus on a specific theme; the above collage shows examples of accounts of this type that are aggressively acquiring Indian celebrity and NSFW subreddits.

This article is intended as a basic introduction to harvesting and examining Reddit data via the Reddit JSON interface. There is substantially more to study in deeper detail, both regarding /r/redditrequest and Reddit data in general, and future articles here will delve further into such topics.

Subscribe now

In recent weeks, a plethora of purported firefighters and home inspectors have used Facebook ads to spread sob stories regarding carbon monoxide, accompanied by claims that such tragedies can only be averted by purchasing a specific carbon monoxide detector from a four-month-old website, trydewlora(dot)com. There are, however, multiple problems, such as the fact that many of the pages running the ads are renamed accounts with AI-generated avatars. Additionally, the current Dewlora website is not the only short-lived website selling carbon monoxide detectors to be promoted by this set of accounts; Meta’s ad library indicates the network has promoted at least five other similar sites since the beginning of 2026.

The spam network promoting the Dewlora website consists of at least 21 Facebook accounts, slightly over half of which were created within the last three months. The accounts have a variety of alleged nations of origin, although certain patterns recur: six of the spam accounts are supposedly based in the Netherlands, and three others have operators spread across the same list of countries (the United States, Spain, and the United Arab Emirates). All of the accounts with the exception of the “official” Dewlora account and “The Firehouse Community” have names consisting of a given name and surname, and most claim to be firefighters, electricians, home inspectors, or other professionals whose work might conceivably involve carbon monoxide detectors.

Eleven of the 21 accounts in the spam network have been renamed at least once, and many have undergone multiple name changes. For example, the account presently named Brian Keller was previously Blake Contreras, the account presently named Amanda Shaw was previously Brian Shaw, and the account presently named Kelly Mexxy was previously Linda (no surname). The “official” Dewlora account has also experienced multiple makeovers, having cycled through the names Beanieluxe, TryNinoe, and Sayaru prior to the current incarnation.

The majority of the accounts in the spam network use AI-generated profile images. While these images are more convincingly photorealistic at first glance than AI-generated images from a few years ago, some of them still contain telltale glitches such as mangled text. Additionally, the AI-generated images used by these spam accounts all contain Google’s invisible SynthID watermark, indicating that they were created or modified using Google generative AI tools.

The Dewlora website, trydewlora(dot)com, also makes use of AI-generated images. These include images of the alleged product and associated packaging, with mangled text such as “Qes & CO Detector” rather than “Gas & CO Detector” visible on the detector itself. The chemical formula C₁H₁ on the packaging is also written incorrectly (should be simply CH), and the associated chemical (methylidyne) is additionally highly unstable under normal conditions and would not persist long enough in the air to be detected or pose a threat.

On a final note, the Dewlora website is far from the only fly-by-night carbon monoxide detector website promoted by this spam network. Others include truesafety(dot)com, swirlasbrand(dot)com, truststeadfast(dot)com, bysecurenest(dot)com, and airshield(dot)store. The websites all look relatively similar, and the tragic tales used to advertise them are sometimes duplicated verbatim to advertise different sites.

While spammy activity of this sort is hardly new, the use of generative AI makes it substantially easier to conduct campaigns of this nature. AI-generated avatars are now of sufficient quality to effectively reinforce the illusion that the (likely fictional) sob stories in the ads are coming from a real person with a real life, and the replies to the ads from regular users generally indicate that people are buying the stories. Given the level of duplication involved in the text content and the obvious similarities between the accounts, it would be trivial for Meta to identify this activity as spam and shut it down, and it is thus curious that they have not as of yet done so.

Subscribe now

In two articles in late 2025, I analyzed a network of TikTok spam accounts posting extremely similar AI-generated videos of nonexistent Black people, interspersed with occasional commercial spam. Although the majority of the accounts in this network ceased posting around the end of the year, many have subsequently resumed (and a few never stopped). As of March 28th, 2026, roughly half of the accounts in this network have been recently active, and their content has evolved further.

40 of the 76 known accounts in the network have posted at some point in 2026, and all of them have pivoted in some fashion from their initial content lineup. Unlike the videos from fall 2025, which featured the same three hashtags in the description of every video, most of the new posts from the network contain no hashtags whatsoever, and generally lack text captions as well. The recent posts are all very similar and fall into one of two broad categories: dating-themed AI-generated videos, and advertising in multiple languages. Thus far, no account has posted content from both categories.

In recent weeks, many of the accounts in this spam network have posted three different variations on repetitive AI-generated videos asking male viewers whether they would date a woman of a given race. The three types of videos include, with varied wording:

• video of a woman seated in a car, asking “would you date a Black woman?”

• video of a group of women outdoors, asking “would you kiss a Black woman outside?”

• video of a woman standing in front of a neutral background, asking “I’ve heard men in the U.S. don’t like Brazilian women, but what about you?”

As can be seen in the montage above, the quality of the video and audio is inconsistent from post to post, with some videos showing obvious signs of their artificial origin and others being far more realistic. The AI-generated videos set in vehicles are, in general, more obviously inauthentic than the other two variants.

The remaining accounts in the spam network have largely changed focus to various forms of advertising. Most of the advertising posts are of one of two types: photorealistic English-language videos showcasing clothing, accompanied by background music, and cartoonish Spanish-language videos advertising various dietary supplements. Both types of video bear signs of being synthetically generated, and some include watermarks from popular AI video generation tools. Unlike the dating-themed videos, some of the advertising videos include hashtags.

Although many of the accounts have deleted all of their older content, a handful have not, making the sudden change in focus obvious when scrolling through their post histories. In most cases, there is a gap of weeks or months between the older videos and the current material. In several cases, the account operator also appears to have forgotten to update the avatar after changing an account’s focus, as a handful of the accounts have avatars that do not look like the AI-generated people in the videos currently posted by the account, but do resemble previous rounds of spam.

The fact that a significant portion of the network has at this point pivoted to commercial spam strongly suggests that this spam is the primary goal of the network. That being said, there are still unanswered questions; while it is possible the AI-generated videos about dating are simply a method to grow the accounts’ audience, the discoverability of these videos is somewhat undermined by the lack of hashtags and textual descriptions, and it is possible the operators of the network have other goals as well. Time, and further observation, may well reveal more.

Subscribe now

TikTok, like all popular social media platforms, has attracted the attention of the operators of various shady services that sell bogus social media engagement. Simply searching TikTok itself for phrases such as “buy followers” turns up numerous accounts purporting to offer services of this nature. One example is @buyfollowersinstant, a Tiktok account with zero videos posted or reposted, a link to an SMM (social media management) panel in its profile, and over four thousand eerily similar looking followers.

A quick stroll through @buyfollowersinstant’s 4328 visible followers reveals a streak of 4210 followers in a row with the same naming scheme. (The account’s most recent followers appear to be authentic.) Each of these accounts has the same handle as display name, and each name consists entirely of lowercase letters, digits, periods, and underscores — no capital letters whatsoever. Since authentic TikTok users employ a variety of naming schemes, and often use a different display name than handle, this anomaly is a clear indicator of bulk account creation and bulk follow activity orchestrated by a single entity.

The TikTok accounts in the fake follower network following @buyfollowersinstant have other traits in common beyond the telltale naming scheme. Each account has relatively few followers of its own but follows dozens or hundreds (and in some cases, thousands) of other accounts. The vast majority also have never posted; those which have generally have a handful of generic videos that do not in any way depict the account operator. The network is likely larger than the 4210 accounts following @buyfollowersinstant, but due to the lack of an easily accessible public API for retrieving TikTok data, the present analysis is limited to this set of fake accounts.

The accounts in this fake follower network utilize a variety of profile images, including several dozen with default avatars. Among the fake accounts are several with StyleGAN-generated faces, which remain perennially popular among spammers despite the availability of far more sophisticated AI image generation tools. The accounts in this spam network also reuse profile images, with the same (plagiarized) profile photos sometimes being used by multiple accounts.

The @buyfollowersinstant TikTok account’s profile contains a link to smmseven(dot)com, an SMM (social media marketing) panel that sells followers, likes, views, reposts, and other various forms of artificial amplification for a variety of social media platforms, including but not limited to TikTok. The maximum order size of one million followers is an additional data point suggesting that the network of fake TikTok accounts associated with the site is far larger than the 4210 fake accounts following @buyfollowersinstant. Like many SMM panels, smmseven(dot)com offers an API, allowing customers to automate orders.

The set of accounts followed by the spam network is widely varied, encompassing everything from personal accounts to business accounts to accounts advertising other spammy social media services. Many of these accounts appear to have few or no genuine users following them whatsoever.

This network is far from the only one of its kind presently active on TikTok; as mentioned earlier, finding additional examples of follower sales operations requires nothing more than searching TikTok itself for “buy followers”. It will be interesting to monitor how this situation evolves (or devolves) with the recent change in ownership of TikTok’s U.S. operations.

Subscribe now

Meet “Tech News World”, a Facebook page that recently pivoted from spamming the platform with AI-generated movie posters to spamming the platform with AI-generated fake videos of warfare in the Middle East. The page in question has been repurposed multiple times over its three years of existence, as is common with engagement farming efforts; prior themes include puppies and Gal Gadot. Unsurprisingly, “Tech News World” is not the only spammy content farm that has elected to exploit the current war for clicks and views, and the phenomenon is not limited to Facebook.

The majority of the recent videos posted by “Tech News World” purport to show scenes of destruction from the war currently taking place in the Middle East, and generally feature AI-generated versions of locations in Iran and Israel. There are multiple problems with these videos; for example, explosions are unrealistically colorful and crisp, and frequently leave no damage to structures behind in their wake. Some videos also include nonexistent military technology, such as the “massive, glowing blue directed-energy beam” mentioned in the middle post in the above collage.

Prior to the recent glut of fake war footage, the operator(s) of “Tech News World” made various attempts at garnering engagement with other types of repetitive content. The earliest posts still visible feature photos of dogs, generally engaged in cute dog behaviors; these photos are all plagiarized from other social media accounts and websites. In late 2024, the account pivoted from stolen dog photos to AI-generated movie posters, some of which contain obvious glitches such as incorrectly rendered titles. The final batch of movie posters to date was posted on March 2nd, 2026; all content since has been AI-generated material related to the war in Middle East.

As mentioned earlier, “Tech News World” is far from the only Facebook page posting AI-generated fake war footage. At present, AI-generated videos of the war in the Middle East are frequently served up by Facebook’s recommendation algorithms, particularly in the “Reels” section. Incongruously, despite allegedly taking place in countries where English is not the primary language, many of the AI-generated war videos feature bystanders speaking fluent English, generally with common US accents.

As with “Tech News World”, many (not all) of the other Facebook pages posting AI-generated videos of warfare have been repeatedly renamed and repurposed. This is a common pattern with content farm accounts, in some cases due to an account changing hands, and in others as the result of the page operator’s desire to try new engagement farming tactics. New accounts created in 2026 also turn up somewhat frequently among the pages posting bogus war footage.

Similar AI-generated war videos, and in some cases the exact same clips, can be found on other social media platforms as well. The above collage includes a few examples from X (formerly Twitter); the same type of content also turns up on Instagram, TikTok, YouTube, and elsewhere. Unfortunately, as long as such material is rewarded with clicks and views, the trend of content farmers exploiting war and other tragedies for social media engagement will likely continue to evolve with available technology.

Subscribe now

Over on Facebook, a page by the name of “Beautiful USA” has been making its way into people’s feeds by posting an endless stream of United States-themed posts featuring exaggerated patriotic imagery. The page’s posts primarily consist of surreal AI-generated images laden with contextually inappropriate US flags, although plagiarized photos of iconic US locations also turn up here and there. Despite the page’s self-stated claim to be based in Los Angeles, Facebook’s Page Transparency feature indicates that it is actually operated from Romania.

The “Beautiful USA” page follows several other large United States-themed content farm pages that post similar, and in some cases identical, material. Recursively mapping the accounts followed by the pages in question yields a set of 20 US-themed content farm/spam pages run from a variety of countries. (Several of the US-themed pages also follow similar pages focused on individual US cities; these pages are excluded from the present analysis.)

The 20 US-themed content farm pages have administrators in a variety of countries, including Sri Lanka, Greece, Pakistan, Finland, Australia, Bangladesh, Estonia, Ireland, Romania, Sweden, and the United States, per Facebook’s Page Transparency feature. Only four of the 20 pages (20%) have a US-based administrator, and one of these (“USA America Facts”), also has three administrators in Bangladesh. Several of the page names are reused, with “Explore USA” being particularly popular. In one case (“Amazing America”), the page administrator’s country of origin has been hidden.

Much of the material posted by these spam pages features AI-generated patriotic imagery, frequently involving gratuitous and unrealistic displays of the US flag, such as the Old Glory-encrusted locomotive belching red, white, and blue smoke seen in the leftmost post in the above collage. Trucks, trains, and other vehicles are a recurring theme of this artificially generated content. Other types of AI-generated images, including scenery and memes, turn up as well, as do plagiarized photographs of major US cities and landmarks.

As mentioned earlier, the same posts sometimes end up being posted by more than one of the spam accounts. In most cases, the duplicate posts are pilfered photographs or AI-generated images, but there are exceptions. For example, at least three of the pages have posted visually similar posts with links to a low-effort listicle with the title “Americans Are Leaving These 11 States Faster Than Ever”.

Most of the US-themed content farm pages make prolific use of hashtags, frequently cramming five or more into each post. In some cases, the spam pages have managed to flood specific hashtags with unrelated content; for example, a significant portion of the search results for #CaliforniaRealEstate at the time of this writing are posts from “Beautiful USA” that have nothing whatsoever to do with California real estate. This hashtag flooding is likely an attempt to artificially increase engagement by piggybacking on popular hashtags.

Several of the spam pages periodically post political content, and this political content is biased in a rightward direction. Posts praising deceased Turning Point USA founder Charlie Kirk and his widow Erika turn up repeatedly, including a surreal AI-generated image of Kirk, Jesus Christ, and a US flag worn as a garment. Other political posts include anti-immigrant material, such as a racist meme insinuating that multiple elected U.S. Representatives should be ineligible for public office based on their countries of origin. The presence of this political content, and the consistency of the political stances therein, suggests that pushing conservative political views, rather than simply serving up image spam, may be the primary goal of these pages.

Subscribe now

For the last few years, Tanya Shpachuk, the operator of a guitar repair business in Kyiv, Ukraine, has posted various videos of guitar restoration and repair on multiple social media platforms, primarily YouTube and TikTok. A series of videos documenting the process of restoring a Les Paul damaged by a Russian drone strike went particularly viral, and was featured in a recent article on guitarplayer.com. Not all of the social media accounts allegedly associated with Shpachuk or her business are legitimate, however; over on Facebook, the most popular “Tanya Shpachuk” page appears be a fake account operated from Cambodia.

A quick look at the Page Transparency info for the most popular “Tanya Shpachuk” page on Facebook, which has 37K followers as of the time of this writing, reveals that the page was created on January 1st, 2024, and is managed from Cambodia and the United States. This is odd for a page allegedly belonging to someone in Kyiv, Ukraine, which is located nowhere in the vicinity of either of these two countries, and makes the absence of an administrator in Ukraine particularly notable. Unlike the YouTube and TikTok accounts, this Facebook page is not linked from Shpachuk’s official website.

Although the majority of the content posted by the fake “Tanya Shpachuk” Facebook page consists of guitar repair videos lifted from the real Shpachuk’s YouTube and TikTok accounts, additional problems crop up as one scrolls through the account’s photos. Back in December 2025, the account posted an AI-generated image of a house previously posted on an AI house spam page (“Log Cabin Vibes”), accompanied by a portion of the text from the original post. One possible explanation is that the operator of the fake Shpachuk page operates one or more AI image spam pages as well, and posted this image to the wrong account.

The fake “Tanya Shpachuk” Facebook account also occasionally plagiarizes guitar-related content from sources other than the real Shpachuk’s social media accounts. Over a six hour period on February 20th, 2026, the account posted three different photographs of guitars plagiarized from elsewhere on the Internet. At least two were copied from Instagram, and contain some or all of the text from the original Instagram posts. This behavior is similar to that of another fake Facebook account, “Maya Jordan”, which prolifically posts guitar photographs pilfered from Reddit.

On a final note, a January 2026 post from what appears to be Shpachuk’s genuine Facebook account includes a screenshot of the fake page, accompanied by a request that users report the fake to Facebook. Unlike the fake page, the Shpachuk page posting the warning is run by someone based in Ukraine (per Facebook’s Page Transparency feature), and is linked from other social media accounts associated with Shpachuk’s guitar repair work. Taken together, these pieces of evidence strongly indicate that the Cambodia-based “Tanya Shpachuk” page is inauthentic, and it is unclear why Facebook has not removed it after a month and a half of reports.

Subscribe now

Over the last three months, 27 Bluesky accounts belonging to prominent technology reporters and news organizations experienced a rapid uptick in follows from newly-created accounts with little or no content. While it is not unusual for new Bluesky users to follow well-known journalists and media outlets, this sudden large increase in follow activity from new accounts is notable and anomalous. The shift in follower growth pattern corresponds to the journalists and news outlets being added to a starter pack created in October 2025 by an obscure account that has yet to post anything whatsoever.

As it turns out, there is a Bluesky starter pack comprised of the exact set of 27 tech media accounts that experienced the October 2025 shift in follower growth patterns. This starter pack, with the name “Tech News”, was created on October 1st, 2025, by @bskystarterpack.bsky.social, a Bluesky account with a default profile image and zero posts. While every single account added to this pack is already listed in dozens or hundreds of other starter packs, only this one appears to have been accompanied by a corresponding influx of low quality followers.

The “Tech News” starter pack is far from the only starter pack created by @bskystarterpack.bsky.social. As of the time of this writing, the account has created 24 themed starter packs, with titles ranging from “Economics” to “Bluesky Comedians” to “Animals & Wildlife”, and everything in between. There is some overlap between the starter packs; for instance, Wired’s official Bluesky account has been added to both the “Tech News” and “Major News Outlets” packs.

19 of the 24 starter packs created by @bskystarterpack.bsky.social were created over the span of exactly an hour on October 1st, 2025, with the remaining five created between October 2nd, 2025, and January 24th, 2026. While most users that create starter packs also post links to them, the operator of the @bskystarterpack.bsky.social account has yet to promote any of their starter packs, or indeed post anything at all. The majority of these starter packs have also never been shared on Bluesky by any other user.

The effect of these starter packs on the follower growth patterns of the accounts listed in the packs is significant. In the case of all but two of the @bskystarterpack.bsky.social starter packs (“Writers & Authors” and “Major News Outlets”), addition to the starter packs was accompanied by drastic increases in back-to-back follows from new accounts and accounts created within an hour of one another. In many cases, these new followers have few or no posts, either presently or at the time of their creation.

As often happens with spammy social media operations, some of the low quality followers associated with the shady starter packs use plagiarized profile photos. Many of these images have repeatedly been used for fake accounts on a variety of websites, and some are even inventoried on sites that maintain lists of photographs frequently used for scams. Depending on the image, both Google and TinEye were occasionally useful in tracking down other occurrences of the photos used by the accounts.

Although many of the followers associated with the starter packs have no posts at all, some have posted, and some of their posts contain additional evidence of spam and inauthenticity. Account sales operations are a recurring theme, with available merchandise ranging from social media and email accounts to verified accounts with payment processing platforms such as Paypal and Cashapp; aged Gmail accounts seem to be a particularly common piece of merchandise. In some cases, these account sales services are advertised using the same graphics by multiple accounts.

The post-starter pack followers also contain several clusters of link spam accounts: groups of similar-looking accounts which post little or no original content and instead simply spam Bluesky with links to obscure websites, posted in the same order by each account. The above collage of posts linking to wealthhg(dot)com is representative of the phenomenon; similar posting patterns revolving around other websites turn up as well.

Obvious scams also turn up among the posts from the low quality followers summoned by the starter packs. These scams include a variety of posts inviting the reader to comment on what they would do if they suddenly received a large sum of money, presumably for the purpose of luring potential marks into providing financial account information. Anecdotal evidence from users indicates that similar scam attempts are also being made via direct message.

The presence of a variety of different types of spam suggests that, rather than all belonging to a single network operated by a single individual, the various low quality accounts following the major accounts listed in the starter packs include a variety of spam networks, potentially operated by a variety of entities.

Subscribe now

As Bluesky continues to grow in popularity, automated posting features from services such as dlvr.it have seen a corresponding increase in adoption. Tools of this sort are often used to create automated news feeds, frequently aggregated from multiple news sources and media websites, and have long been utilized for this purpose on older platforms such as X (formerly Twitter). While some of these automated feeds are operated by news organizations themselves, others are run and curated by random individuals. Among these is one of the most prolific sources of links to low quality right-wing news sites on Bluesky, an account that recently changed names from “Ian Hansen” to “BS Favourite AI Bot”.

A search performed on January 8th, 2026 for the most recent 50000 Bluesky posts containing dlvr.it links yielded posts from 960 distinct accounts, with the most prolific having posted hundreds of times via dlvr.it during that time period. The most frequent dlvr.it posters include accounts based in a variety of countries posting news and updates on a variety of topics, with the most active account being a UK-based flood alert feed. The second most frequent user of dlvr.it is a bit more interesting, however…

With 832 dlvr.it posts over the course of four days, the account @bsrussianbot.bsky.social (“BS Favourite AI Bot”) is one of the highest-volume users of dlvr.it on Bluesky. Almost all of this account’s posts are automated via dlvr.it, and almost all of the automated posts are links to right-wing media sites such as Gateway Pundit and Newsmax. Despite the high posting volume, most of the content gets very little engagement, and the account has thus far only accumulated a few hundred followers.

The “bot” portion of the @bsrussianbot.bsky.social account’s name is highly accurate, as almost all of the account’s posts are in fact automated. 95077 of 95658 posts to date (99.4%) were posted automatically via dlvr.it, with almost all of the automated posts being links to various conservative media sites. At peak times, the account exceeded 300 posts per day; the posting level generally fell off somewhat on weekends due to the underlying news sites publishing less content on Saturdays and Sundays.

The websites most frequently linked by the @bsrussianbot.bsky.social account are Breitbart, Newsmax, and Red State, with a smorgasbord of right-wing media sites filling out the remainder of the list. This account is among the most abundant sharers of English-language right-wing media on Bluesky, with tens of thousands of links to the most frequently linked sites. Note that these posts do not presently come up in Bluesky searches for the sites’ own domain names; instead, they appear under searches for “domain:dlvr.it”.

As mentioned earlier, the Bluesky account currently named @bsrussianbot.bsky.social (“BS Favourite AI Bot”) was recently renamed. Prior to January 8th, 2026, the account had the handle @ianhansen.bsky.social and the display name “Ian Hansen” (per contemporaneous screenshots). It is unclear whether this name has anything to do with the account operator, but given that the account’s content has been almost entirely automated all along, revising the name to include “bot” is a (perhaps unintentional) increase in honesty.

Subscribe now

Movies and TV shows are full of fictional scenes where characters use computers to “enhance” images and videos, magically filling in details that are in no form present in the originals. With the rise of AI image and video generators in recent years, social media users have been attempting to use these tools to perform such enhancements on real photographs and footage of major news events, such as the recent killings of Minneapolis residents Renée Good and Alex Pretti by federal immigration agents. This technique does not work, however, as the additional details in the “enhanced” images and videos are fabricated based on the AI models’ training data, and are often provably at odds with reality.

On January 7th, 2026, in the immediate aftermath of the shooting death of Renée Good by the ICE agent eventually identified as Jonathan Ross, numerous social media users made attempts to use generative AI tools to remove the face mask from photographs of the shooter. This process resulted in a variety of images that neither show the actual killer nor even depict the same imaginary person, making the output quite useless for the purpose of identifying the shooter. This outcome is not surprising, as image generation models have no way of “knowing” what the face behind the mask actually looks like, and are simply filling in the masked area with details mathematically interpolated from images in their training data.

A quick experiment with Grok highlights another obvious issue with using AI models to “enhance” images: the output is inevitably guided by the prompt used to generate it. In the case of this photograph, Grok complied with requests to add specific features such as facial hair and tattoos to the unmasked image. The ability to trivially influence the resulting image in a given direction is one more reason why using generative AI to enhance images is not a suitable technique for identifying unknown individuals.

A bit over two weeks later, Alex Pretti was deliberately shot and killed by as-yet-unidentified federal agents, and, as with the shooting of Renée Good, social media users made various efforts to use generative AI tools to enhance photographs and videos of the shooting. One popular “enhancement” includes several frames where the gun removed from Pretti by an agent appears to fire at the ground while in the agent’s hand. This is entirely an act of digital fiction, however; no such discharge occurs in the real video. Additionally, the gunshot depicted in the “enhanced” video is unrealistic in multiple ways; no recoil is evident, and the blast includes a jet of flame more reminiscent of a flamethrower than a typical firearm.

Other images circulated after Pretti’s killing include numerous attempts to use AI to increase the resolution of individual frames from various videos of the shooting. As with the previous “enhancements” described in this article, this technique simply does not work, as the AI models are filling in the missing detail with information derived from their training data rather than anything to do with the actual incident depicted. Unfortunately, based on the degree of engagement garnered by inaccurately “enhanced” images and videos of the recent Minneapolis shootings, we can expect major news events to be accompanied by similarly misleading AI-enhanced depictions for the foreseeable future.

Subscribe now

As Bluesky continues to grow in popularity, various providers of illicit social media marketing services have made use of the platform to advertise their offerings with increasing frequency. These services, known as “SMM panels” (social media marketing panels), sell followers, likes, reposts, and other forms of engagement for a variety of social media platforms, despite this being a violation of most sites’ terms of service. Over the course of the last year, dozens of accounts promoting these panels and their services have popped up on Bluesky.

Many of the Bluesky accounts promoting SMM panels follow each other and repost one another’s content. This amplification, along with the fact that some of the accounts promote the exact same websites, strongly indicates that at least some of the SMM panel accounts are operated by the same entity. Similarities between the various SMM panel websites suggest that the sites themselves also may share operators or developers.

In addition to selling followers, likes, reposts, and other forms of engagement directly through their own websites or Telegram channels, many SMM panels also offer APIs (application programming interfaces). This allows customers to automate the process of purchasing the panels’ services, reducing the amount of human effort required to procure spammy amplification on an ongoing basis, and allowing engagement from banned accounts to be easily replaced. The APIs offered by the various SMM panels are all extremely similar, which further indicates that at least some of the panels are run by the same individuals or groups.

Among the more unusual efforts to promote an SMM Panel on Bluesky is an apparently abandoned network of dozens of empty accounts with duplicate biographies. Each of these accounts has the biography “Bluesky SMM Panel t.me / ibbepanelbot”, a default profile image, and no posts whatsoever. The link in the repeated biography leads to a Telegram bot allegedly associated with an SMM panel, but as of the time of this writing the bot does not appear to be operational, making it difficult to evaluate the panel’s offerings.

The network promoting this SMM panel consists of 136 Bluesky accounts created over the course of roughly six hours in June 2025. Thus far, none of these 136 accounts has actually posted anything and, as mentioned earlier, the Telegram-based ordering system for this particular SMM panel appears to be offline. This does not, however, mean that this set of accounts is irrelevant or permanently inactive; it is not uncommon for swarms of dormant spam accounts to be suddenly reactivated and repurposed, and it would not be surprising to see these accounts reused for additional astroturfing at some point in the future.

Subscribe now

In a fascinating coincidence that isn’t a coincidence at all, Bluesky users “Haven Tallmadge” and “Yara Rochelle” both allegedly just saw the same T-shirts hit the clearance section, and made identical posts promoting the shirts in question. In reality, the T-shirts are being sold via a website rather than physical stores, and whoever made the posts in question is highly unlikely to have encountered them in any sort of clearance section. There are some additional anomalies: the accounts that made the identical posts are new and have posted no other content of their own, and their T-shirt posts have been amplified by numerous new accounts with duplicate profile images.

The two accounts that posted the duplicate T-shirt advertisements, along with at least 29 of the accounts amplifying them, are part of a spam network consisting of at least 31 Bluesky accounts created between January 14th and January 16th, 2026. All 31 accounts use traditionally female English-language names and have a first name/last name pair as their display name. Based on the number of accounts each follows, the spam accounts appear to be following other Bluesky users in batches of 500. None of the accounts in the network are hosted on Bluesky’s own personal data servers or utilize the associated bsky(dot)social domain; all 31 accounts use myatproto(dot)social instead.

Overall, the accounts in the spam network primarily follow random liberal and left-wing Bluesky accounts, some of which they also amplify periodically. The account followed by the largest share of the spam network, however, is @annaguns.bsky.social (“Anna Guns”), an account with a default profile image and a distinct lack of authentic followers. The “Anna Guns” account’s sole post to date is a reply advertising the same T-shirt site promoted by the spam network.

With the exception of the two accounts that posted the original T-shirt advertisements, every single account in the network uses one of two photographs as a profile image. The photographs are sometimes cropped differently from account to account; for example, the image used by “Elaine Walton” is a zoomed version of the same image used by “Brenda Waldron”. It is unclear why the operators of this network chose to use images of the same two people over and over rather than employing a wider variety of photographs, as the latter approach would have made the accounts less obviously inauthentic.

As is often the case with spam networks that utilize the same images again and again, the profile photos used by this spam network are plagiarized. The two photographs repeatedly used by the spam accounts have also appeared on multiple X accounts, according to Google image search results. The repeated use of the same photos by the Bluesky network is on its own sufficient evidence of astroturfing, and the presence of the same images on other platforms further corroborates the inauthenticity of the accounts and the network to which they belong.

Subscribe now

With a sizable population of residents of Middle Eastern descent and the largest Muslim population per capita of any city in the United States, Dearborn, Michigan has been frequently subject to racist and Islamophobic scapegoating on social media. Attacks over the years have ranged from insinuations that the city is home to terrorist sleeper cells to complaints about an on-duty police officer wearing a hijab.

As seen in the graph of X posts above, the volume of this activity is not consistent; posts regarding Dearborn tend to occur in waves, and these waves are often triggered by major events that do not directly involve Dearborn. While these patterns of activity have historically been driven primarily by right-wing influencers, liberal participation increased significantly during the 2024 election season.

Right-wing Twitter (now X) influencers have been posting Islamophobic content about Dearborn for many, many years. Themes of these posts include fearmongering about sharia law, complaints about Muslims marching peacefully in public, and low-effort whining about a photo of a hijab-wearing cop standing next to a police vehicle. Occasional posts attacking Dearborn can be found throughout much of X’s history.

In a sudden reversal, numerous right-wing influencers pivoted temporarily to praising Dearborn in fall 2022 during efforts to ban various books with LGBTQ themes from public school libraries. Some of these posts specifically praise Muslim residents of Dearborn for participating in the efforts to remove the books in question, despite some of the posters having issued Islamophobic attacks against Dearborn on other occasions.

In the wake of the October 7th, 2023 Hamas attacks in Israel, X posts from right-wing influencers targeting Dearborn surged in volume. These posts are laden with unfounded allegations of a significant terrorist presence or “sleeper cell” in the Michigan city, along with claims that Dearborn is “one of the top ISIS recruitment locations in the U.S.” Many of these posts originated with blue -check “verified” accounts, indicating that the influencers who posted them may have been paid by X for the engagement the posts received.

The 2024 U.S. election season brought the first wave of anti-Dearborn X posts driven significantly by liberal and anti-Trump accounts. These posts initially emerged in response to uncommitted votes during the primary, when former President Joe Biden was still running for re-election, but morphed into scapegoating over the general election outcome following Kamala Harris’s November 2024 loss. (Blaming Dearborn for the outcome is not based in mathematical reality, as even if every single eligible voter in Dearborn had voted for Harris, Trump would still have won the state of Michigan and the accompanying electoral votes.)

The tail end of 2025 saw a massive explosion in anti-Dearborn posts from right-wing X influencers. These posts include a mix of Islamophobic and general anti-immigrant rhetoric, and frequently equate immigration with invasion and conquest. Purveyors of recent anti-Dearborn material include U.S. Representative Randy Fine (R-Florida) and YouTube livestreamer Nick Shirley, better known for a recent misleading viral video alleging fraud in Minnesota daycare centers.

In 2025, anti-Dearborn traffic from liberal X users died down again, in part due to many liberals leaving the platform following the 2024 U.S. general election. Some of this rhetoric subsequently emerged elsewhere as these users became active on other platforms. On Bluesky, posts inaccurately blaming the relatively small city for Donald Trump’s electoral victory have become a periodic staple of liberal discourse, and have sometimes garnered significant engagement.

While the anti-Dearborn rhetoric originated as (and largely remains) a right-wing phenomenon, this particular Islamophobic dog whistle has unfortunately lodged itself to some extent into liberal narratives regarding the 2024 election as well. Unfortunately, susceptibility to bigotry and misleading rhetoric is a cross-ideological problem.

Subscribe now

Meet Maya Jordan, a Facebook user who has posted hundreds of photographs of various types of guitars in recent weeks, along with claims to own the numerous instruments in question. In one recent post, Maya Jordan described the process of creating a particularly eye-catching guitar body from wood and acrylic. As is often the case on social media, however, all is not as it seems; both the photo of the guitar and the brief description of the build process are copied verbatim from a five year old Reddit post. Additionally, there are several other problems with the Maya Jordan Facebook account, including a stolen profile photo and a lengthy history of account name changes.

Every recent post from the Maya Jordan Facebook account consists of a photograph of one or more guitars, generally accompanied by text describing the origins of the instrument(s) in the photograph. None of this content is original, however; in each case, the photograph and the accompanying text have previously been posted on Reddit (and sometimes other platforms as well) by users not named “Maya Jordan”. The text and images are duplicated verbatim, although in cases where the original Reddit post contains multiple images, the Facebook copy includes only one.

The content posted by the Maya Jordan Facebook account is harvested from at least thirteen distinct subreddits, based on the most recent 100 posts as of December 31st, 2025 at 11 AM CST. The subreddits are a mix of general guitar-themed subreddits and brand-specific subreddits focused on prominent manufacturers such as Gibson and Ibanez. The most frequent source of material is the /r/guitarporn subreddit, accounting for a quarter of recent Maya Jordan posts, followed by /r/Guitar, /r/gibson, and /r/Luthier.

In addition to the plagiarized content, there are multiple problems with the Maya Jordan account itself. As with the guitar images, the account’s current profile image is not original, and has in fact been used repeatedly on a variety of platforms, including Facebook and LinkedIn. There is also an inconsistency between the account’s proclaimed location of Los Angeles, CA, and the use of phone number with a 484 area code, which is one of several area codes serving southeastern Pennsylvania.

Unsurprisingly, the Maya Jordan Facebook account wasn’t always named "Maya Jordan”. Facebook’s Page Transparency feature reveals that the account was originally named “Harry Harro” back when it was created in November 2023, and has been renamed multiple times since. Other names the account has cycled through include “Brandon Anna”, “Crochet Tutorial and Patterns”, and finally “Guitar Haven” prior to swapping to the current “Maya Jordan” appellation in October 2025. All content posted under prior names has been purged from the account other than a handful of screenshots of textual Reddit threads posted near the end of the time period in which the account was named “Guitar Haven”. (These posts are, confusingly, not about guitars.)

The repeated name changes, along with the stolen profile image, the inconsistencies in the account’s self-proclaimed location, and the prolific use of plagiarized content all indicate that this account is far from authentic. While it is impossible to be certain of the operator’s ultimate goal, building an audience for eventual sale is a distinct possibility.

Subscribe now

Do you want to join the Resistance team and help protect the National Park Service? If so, a recent Facebook ad for park-themed clothing sold by a website by the name of Dearscloth would, at least at first glance, appear to be right up your alley. There are, however, a few problems; the Dearscloth website contains dubious and unsupported claims of affiliation with the U.S. National Park Service, and the site is just one of several oddly similar websites hawking the same merchandise. Additionally, despite the focus on products with themes related to U.S. politics, evidence indicates that the site and its compatriots are in fact based in China.

The Dearscloth website, along with the merchandise sold there, is festooned with references to “protecting” or “saving” U.S. national parks. The site also outlandishly claims to have raised “over $183 million in assistance to the National Parks”, and to be a “Proud Partner of the National Park Service”; neither claim is accompanied by supporting evidence, however, and the U.S. National Park Service website contains no mention whatsoever of Dearscloth as of December 26th, 2025.

In addition to advertising the Dearscloth website, the Dearscloth Facebook account also posts a variety of political content directed at U.S. audiences, such as photographs from various protests and rallies. These photos are plagiarized, however, generally from content posted by the “Alt National Park Service” family of influencer/engagement farming accounts. Despite the reuse of these images, the Dearscloth website has no apparent connection to the Alt National Park Service accounts.

As it turns out, Facebook is not the only platform on which Dearscloth advertises, and Dearscloth is not the only alleged business selling this particular lineup of products. The exact same text (“Join the Resistance team and help protect the National Park Service…”) appears repeatedly on multiple Meta platforms (Facebook, Instagram, and Threads), as well as Pinterest. The posts are from accounts promoting six different alleged businesses: Dearscloth, Terrific Feminist, WeaveHot, Stonesock, Tojoy, and Exclusive Couple.

Each of the six businesses has an affiliated website, or at least an affiliated domain name — two of the six sites, stonesock(dot)com and tojoy(dot)online, are presently nonfunctional, despite being advertised on multiple social media platforms. The remaining four sites all offer similar lineups of clothing items, many of which, including the “National Park Service” items, have political themes.

Despite the focus on U.S. political issues in general, and on the U.S. National Park Service in particular, the six websites do not appear to be operated from within the United States. WHOIS information indicates that all six domains have registrars based in either China (country code 86) or Hong Kong (country code 852). This is further corroborated by a reference to the GMT+8 time zone buried in the shipping policy published on the Dearscloth website. This time zone includes the special administrative region of Hong Kong as well as a significant portion of mainland China, and in combination with the domain registration, indicates that this particular spammy garment sales operation is almost certainly based in China rather than the United States, regardless of the content.

Subscribe now

On December 15th, 2025, a Bluesky account by the name of “Mansa Agents Craft” (@agentscraft.bsky.social) posted a video advertising an “enterprise-grade Web3 platform”, which was rapidly reposted by a large number of spam accounts. The accounts that amplified the Mansa Agents Craft post are part of a spam network consisting of thousands of accounts that also amplified a handful of other Bluesky posts around the same time, including both cryptocurrency and music-related content. In the days since, both the Mansa Agents Craft account and the majority of the spam accounts promoting it have been suspended, although some of the other posts amplified by the network are still online.

As with the accounts amplifying Mansa Agents Craft, the majority of the account‘s followers are (or were) spam accounts, all created on December 15th or 16th, 2025. Most have interacted with no accounts other than Mansa Agents Craft, although a significant minority have also amplified a handful of posts from a specific set of cryptocurrency and music-themed accounts. The Mansa Agents Craft account itself claims to be an “Ultimate AI Agent Creator” in its biography, and its profile contains a link to an associated website, mansa(dot)world.

In addition to reposting and following the Mansa Agents Craft account, the spam accounts also liked, replied to, and quote posted it with a similar degree of spammy enthusiasm. Many of the replies are brief phrases such as “Good project”, “Let’s go”, and “To the moon”, and are reminiscent of similar spam that has regularly appeared in the reply sections of cryptocurrency posts on X (formerly Twitter) over the last several years. Between the accounts that reposted, followed, liked, replied to, and quoted Mansa Agents Craft, the spam network consists (or consisted) of at least 2512 accounts.

The website linked from Mansa Agents Craft’s profile, mansa(dot)world, purports to provide “…one platform to create AI agents and generate all AI content”. The types of AI-generated content allegedly available include chatbots, images, voiceovers, articles, and more. The fine print on the website reveals that using the site’s services requires paying with an obscure cryptocurrency token, $MUSA, and most screens on the site have a prominent “Connect Wallet” button displayed in the upper right corner.

The graph above shows a fourteen-hour snapshot of the spam network’s posting activity. The majority of the posts are reposts (1444 of 2147 posts, 67.3%), followed by replies (405 of 2147, 18.9%), followed by quote posts (298 of 2147, 13.9%). The account most frequently amplified during this period was Mansa Agents Craft, although a handful of other accounts (some themselves now suspended) turned up as well. At its peak, the network posted over 100 times in the course of ten minutes.

During the period in which the spam network was amplifying Mansa Agents Craft, it also reposted at least four other posts from four distinct Bluesky accounts. Two of these posts contain links to songs on various streaming services and are still online. The other two posts are from suspended accounts, @kajlabs.bsky.social and @jkasr.bsky.social, both of which appear to have been cryptocurrency-themed accounts. The fact that the spam accounts amplified content from a variety of accounts with different themes suggests that the spam network is some type of general spam-for-hire network, as opposed to something specifically created to amplify Mansa Agents Craft.

Subscribe now

This spam network consists of at least 76 TikTok accounts as of December 13th, 2025. The full size of the network is likely larger, as this only includes accounts that appeared in search results for #OneHumanRace or #RespectAll from December 11th through December 13th, 2025. Each account in the network has at some point posted a series of highly repetitive AI-generated videos, although a handful of the accounts have subsequently deleted them. 43 of the 76 accounts (56.6%) have posted other types of spam as well.

As tends to happen when a spam network posts a sufficiently large volume of AI-generated media, some of the videos posted by the accounts contain glitches indicative of their artificial origin. In one particularly bizarre case, an AI-generated person’s AI-generated shirt changes color from pink to gold over the course of a ten second video. The post in question also contains additional anomalies, such as a person in the background hovering in front of a car door in the early frames.

While the initial round of videos was largely focused on friendship (“I don’t know which of y’all white people need to hear this today, but I love y’all; if you don’t got a problem with my skin, please hit that follow, we need to be friends”), some of the newer content has gone in a more romantic direction. One new type of recurring video depicts a couple (specifically, a white woman and a Black man) in identical U.S. flag shirts holding two babies. Most of the accounts posting videos of this style also have older unrelated spam posts.

In a similar vein, a few of the accounts have started posting videos asking the viewer about dating or marriage. The video above, featuring the question “Hey white guys, I have one question: why is it so hard for an Asian woman to meet an older white guy?”, is representative of the genre.

Emergency personnel are another theme of the recent wave of videos from the spam accounts. AI-generated footage of doctors, nurses, and other medical staff, police officers, and firefighters have been posted repeatedly by several of the accounts in the network in recent days. The videos generally include somewhat appropriate backgrounds: medical scenes take place in hospitals or pharmacies, cops are shown in police cars, and firefighters with a fire truck or fire station in the background.

As mentioned earlier, 43 of the 76 accounts in the network have switched to other forms of spam, much of it commercial messaging in both English and Spanish. Unlike the #OneHumanRace videos, these videos are accompanied by “Paid Partnership” labels from TikTok. The merchandise promoted in the videos varies, but dietary supplements are the most frequent theme, followed by Christmas items and clothing. This switch suggests that commercial spam was the purpose of the network all along, and that the earlier videos were a form of engagement farming for the purpose of growing the accounts prior to attempting to profit off of them.

Subscribe now

Social media platform Bluesky has continued to grow in popularity, and that growth has unsurprisingly been accompanied by increased interest in the platform from purveyors of various spam-for-hire services. While websites selling Bluesky followers, reposts, and likes were somewhat rare during the platform’s invitation-only period, they have proliferated significantly over the last couple of years. Many of these sites look oddly similar to one another, suggesting that some may share an operator, or be based on the same underlying tools and infrastructure.

Finding websites that allegedly sell Bluesky followers is relatively straightforward, and requires nothing more than typing “buy bluesky followers” into a major search engine. The first few pages of Google search results for the aforementioned query include at least a dozen different English-language sites offering Bluesky followers, reposts, and likes for sale in various quantities. Most of the sites in question are not specific to Bluesky and also offer similar services for other prominent social media platforms. The majority of the sites are presently using IP addresses associated with Cloudflare or Amazon, although there are some exceptions.

Despite theoretically being distinct businesses, many of the websites selling infusions of fake Bluesky followers look very, very similar to one another. A few of the sites even have identical “Can I help you? Start Smm Helper” chat widgets in the lower right, and the overall layout and flow is extremely similar across the majority of the sites. Most of the chat widgets appear to be backed by large language models rather than actual humans, judging by the nature of the responses provided.

Although the majority of the Bluesky follower sales sites were unresponsive to requests to see examples of the followers on offer, one site, Morelike(dot)net, contains screenshots of the merchandise. It is unclear when the screenshots were taken, as the accounts shown in them are now suspended, but the majority have biographies of the form “<X> based, interested in <Y>”; examples include “Iran based, interested in music”, “New Zealand based, interested in technology”, and “Brazil based, interested in gaming”.

This repetitive biography format previously surfaced in April 2025, when a network of over twelve thousand accounts with such biographies popped into existence in the span of a few hours. Back then, most of the spam accounts were empty and followed no other accounts at all, making their purpose difficult to discern at the time. The screenshots on the Morelikes(dot)net follower sales website make things clearer; the now-suspended network created back in April was almost certainly a batch of fake followers intended to be sold via Morelikes, and possibly other similar sites.

Subscribe now

Previous articles on this blog have covered the ongoing phenomenon of AI-generated house spam on Facebook, originating from pages that post endless images of nonexistent barndominiums and log cabins. Many (but not all) of the Facebook pages posting this type of repetitive content are run by a single business entity, Vacarino LLC, allegedly based out of Oklahoma City, OK. A bit of digging, however, reveals that the founder of the LLC and likely operator of the spammy Facebook pages in question is in fact a software developer based in Kosovo, thousands of miles from Oklahoma City.

Vacarino LLC operates at least 30 Facebook pages (and likely more), with follower counts ranging from 34 thousand to over a million as of November 21st, 2025. Each of these Facebook pages churns out AI-generated images of alleged farmhouses, barndominiums, log cabins, tiny homes, and other domiciles around the clock. Eleven of the pages have their locations set to various U.S. cities, although none match the alleged location of Vacarino LLC itself, Oklahoma City. Most of the pages have been renamed at least once.

Some of the Facebook pages operated by Vacarino LLC link to one of four websites, lotsofcabin(dot)com, vacarino(dot)com, cablog(dot)us, and tinyhomevibes(dot)com. Unlike the Facebook pages, which almost exclusively post AI-generated imagery, at least some of the images on the websites are real photographs. Interestingly, the Vacarino website itself seems to be focused on food rather than images of rural houses.

As mentioned earlier, most of the Facebook pages operated by Vacarino LLC have been renamed at least once. While some of these name changes are uninteresting swaps between similar names like “Dream Houses” and “Forest Cabins”, others show significant changes of theme, such as pages that were originally religious in nature abruptly pivoting to AI-generated house spam. While it’s possible that some of these changes are simply a content farm operator swapping from one type of clickbait to another, the sudden shifts in content accompanied by name changes are a potential indicator that some of the pages have been hijacked.

At least one of the pages, currently named “Log Cabins”, is quite obviously stolen and repurposed. This page, which was created under the name “MCHS” back in April 2010, appears to have originally belonged to Monroe Comprehensive High School in Albany, GA. Although old content has been purged from the page, the original name is still visible in the Page Transparency section, and the Tagged Photos section includes several pieces of evidence confirming that the page was once affiliated with a school.

Although Vacarino LLC, the operator of this network of Facebook spam pages, is allegedly based in Oklahoma City, OK, the registration documents for the LLC in question tell quite a different story. The name on the LLC’s articles of organization, Durim Dermaku, matches that of a Kosovo-based web designer who recently modified the location of his own Facebook page to Oklahoma City, but continues to post photos of himself cycling in Kosovo, which is inconveniently located on an entirely different continent. Despite the allegedly Oklahoma-based LLC and the numerous Facebook pages claiming to be based in major U.S. cities, this spam operation likely has no actual U.S. presence whatsoever.

Subscribe now

In recent days and weeks, unusually similar AI-generated videos depicting nonexistent Black people accompanied by captions such as “dear white people” and “hit follow if you want peace” have proliferated on TikTok. These videos are invariably accompanied by the same set of hashtags, and posted by accounts that appear to post no content other than the repetitive AI-generated videos in question and occasional random spam. Most of the videos rack up a few thousand views, although a handful have garnered substantially higher engagement and been more widely recommended to users.

Over the period from November 11th to November 16th, 2025, at least 45 TikTok accounts posted one or more AI-generated #OneHumanRace videos. 19 of the 45 accounts have handles that are variations on the name “Holly”, frequently with additional O’s. Multiple accounts named Clara, Doris, and Yuki also turn up, the latter with variable numbers of U’s. Some, but not all, of the accounts deleted the AI-generated #OneHumanRace videos between the time they were first observed and November 16th, 2025.

The video above, featuring an AI-generated outdoor scene of a group of younger Black people and the audio “I don’t know which of y’all white people need to hear this today, but I love y’all; if you don’t have a problem with my skin, please hit that follow, we need to be friends” is representative of the content posted by the spam network. The majority of the spam accounts have posted dozens of such videos, with slight variations on the same theme and message, generally ending with a suggestion to follow the spam account. Some of the videos feature indoor settings such as kitchens, grocery stores, and libraries as opposed to street scenes.

The majority of the accounts in the network use still images from the AI-generated videos as profile images, sometimes with added pixellation or blurring reminiscent of an analog television. A few of the accounts use other AI-generated face shots, plagiarized photographs, or drawings as avatars instead. In the case of at least one account, @hooolly90, the profile image has been swapped from an AI-generated image to a graphic of a bottle, accompanied by the deletion of the AI-generated videos formerly hosted by the account.

Each of the AI-generated videos posted by this network is accompanied by the same three hashtags: #OneHumanRace, #RespectAll, and #LetLoveLead. Of these three tags, only #LetLoveLead appears to have a significant amount of authentic content associated with it; the other two hashtags show up almost exclusively alongside the spam network’s synthetic videos. The more popular hashtag is presumably included in order to make the content more algorithm-friendly and increase the odds of the videos being seen by genuine TikTok users.

At least twelve of the accounts in the network have since moved on from posting AI-generated videos of nonexistent Black people to other forms of repetitive content. Much of the new material is obvious commercial spam hawking various forms of merchandise, often Christmas-themed. Other types of new content turn up as well, including at least two accounts that have started posting extremely similar videos about tinnitus in Spanish.

A handful of the accounts in the network also have older repetitive posts unrelated to the AI-generated video spam. The older spam consists largely of videos of landscapes and other outdoor scenes with the caption “so you are living your big dream and this song plays in your mind”. Some of the accounts also have early travel-related videos, depicting scenes from airplanes, hotels, and resorts.

As mentioned earlier, the AI-generated videos posted by the network are extremely repetitive, with variations on the same handful of scenes appearing over and over: small groups of people walking down streets, women cooking, and women walking past bookshelves in a library are recurring themes. The videos in each category are basically all the same, with minor variations in wording, clothing, and background imagery, such as the library scenes in the collage above. This suggests that the operators of the spam network used the same prompts over and over to generate these videos, rather than crafting individual prompts for each.

Many of the network’s videos contain obvious indicators of their artificial origin. In some cases, watermarks from OpenAI’s Sora are still present on the videos, confirming not only that the videos are AI-generated but identifying the specific AI model used to produce them. Other videos, while lacking watermarks, include artifacts that demonstrate their inauthenticity, such as shopping carts that melt together, and grocery stores with nonsensically numbered aisles.

Although the origins and goals of this spam network remain unclear, the repetitive nature of the content and the pivots between different types of spam suggest that the #OneHumanRace videos are a form of engagement farming rather than sincere messaging. The fact that the most recent spam from many of the accounts involves blatant product promotion underscores this, and indicates that, rather than being sincere, the #OneHumanRace videos are simply an effort to build an audience for the accounts for future advertising purposes.

Subscribe now