The super PAC presently known as TFM was initially founded on August 27th, 2026, three weeks after the @DemsForMike account was created. The super PAC was initially named “Democrats for Mike Rogers”, but was renamed to “Together for Michigan” and subsequently “TFM” following a September 8th notice from the FEC that the super PAC’s name may not contain a candidate’s name. All versions of the super PAC’s Statement of Organization list outgoing Michigan State Representative Karen Whitsett as both Custodian of Records and Treasurer. Whitsett, who announced she was leaving the Democratic Party back in March, has signed all TFM/”Democrats for Mike Rogers” FEC filings as of October 25th, 2026.

As of October 21st, 2026, the super PAC has spent $5,672,090.13 on the Michigan Senate race. This money has primarily been paid to a variety of consulting companies that offer various advertising services, including text messaging, online and TV ads, and canvassing. Several of the organization’s video ads, most of which feature the same small group of people who are allegedly voting for Mike Rogers, have racked up significant view counts on multiple platforms, including YouTube and X.

In early October 2026, the X account @america, associated with Elon Musk’s America PAC, posted one of the video ads produced by “Democrats for Mike Rogers”. It is presently unclear whether this came about due to coordination between the people behind “Democrats for Mike Rogers” and Musk’s super PAC, or was simply the result of America PAC personnel encountering the ad on their own and incorporating it into their existing efforts to promote Rogers’ candidacy.

FEC records show a total of $5,718,641.21 received thus far by TFM/”Democrats for Mike Rogers”, a statistically insignificant $780.48 of which (0.014%) is unitemized small-dollar individual contributions. Of the remaining $5,717,860.73, $5,538,000 (96.9%) is from a mix of conservative super PACs and individual donors whose history shows they primarily donate to Republican candidates. Despite the name, “Democrats for Mike Rogers” is almost entirely financed by Republicans. Of the nineteen named individual donors, only five have Michigan addresses; the remainder include three donors from Florida, three from Tennessee, two from New York, and one each from California, Colorado, Illinois, Kansas, Ohio, and Utah.

The largest donor to TFM/”Democrats for Mike Rogers” is another super PAC, GLCF (“Great Lakes Conservatives Fund”), which has contributed $4,100,000 to TFM as of October 14th, 2026. Although the name “Great Lakes Conservatives Fund” suggests that this super PAC might support a variety of Republican candidates in various states, almost all of GLCF’s spending thus far is related to the Michigan Senate race. At least some of GLCF’s funding comes from the Mike Rogers campaign itself; to date, Team Rogers has contributed $751,801 to GLCF, which means that the Rogers campaign is indirectly providing at least some of the money behind the “Democrats for Mike Rogers” effort.

As with their finances, GLCF’s social media presence is likewise focused almost exclusively on the Michigan Senate race. Their X account (@GreatLakes_HQ), which was created in July 2026 and frequently promotes Mike Rogers and attacks Abdul El-Sayed, has frequently reposted content from the @DemsForMike X account.

Political consultant Abby Ronson, whose firm Convergence Media has been paid over $4 million by the Mike Rogers campaign, appears to be involved in the “Democrats for Mike Rogers” project in multiple ways. Ronson is the creator of an August 20th Google doc announcing the "Democrats for Mike Rogers" effort, on which her Rogers campaign email address appears as both uploader and owner. Ronson is also a registered foreign agent, having lobbied for Brad Parscale’s public relations firm Clock Tower X on behalf of the State of Israel.

Ronson’s X account (@abbyronson) and the “Democrats for Mike Rogers” account (@DemsForMike) have repeatedly amplified each other’s content. Additionally, the two accounts have on multiple occasions posted the exact same screenshots at similar times, suggesting that Ronson may be involved in operating the @DemsForMike account. The identical images of a (misrepresented) mobile notification posted an hour apart are particularly interesting.

On a final note, the @DemsForMike X account recently posted an AI-generated flyer advertising a seven-hour “early vote rally” in Pontiac, MI, featuring free food, music, and a bouncy house. Despite the account’s repeated claims to represent thousands of Rogers-supporting Democratic voters, the actual rally consisted of a handful of people standing around in an otherwise empty parking lot. When combined with the rest of the available data points, this rally is just one more sign that “Democrats for Mike Rogers” is an astroturf campaign rather than a genuine movement.

Subscribe now

Within two days of Abdul El-Sayed’s victory in the 2026 Michigan Democratic Senate primary, a blue-check account with the handle @DemsForMike and the display name "Democrats for Mike Rogers" popped up on X (formerly Twitter). While this account claims to be run by Democrats who support Republican Senate candidate Mike Rogers over Democrat El-Sayed, almost all of the account’s engagement is coming from conservative X users. Additionally, the account’s initial follower growth appears to have been driven primarily by amplification from prominent Republicans, including the official Michigan GOP account.

I analyzed the reposts of the most recent 100 @DemsForMike X posts with at least 3 visible reposts as of the morning of September 29th, 2026. Of the 20 most prolific reposters, 19 are right-wing accounts, most of which have extensive histories of enthusiastically posting in support of Republican candidates. The sole alleged Democrat among the top 20 accounts, @khit242 (“Anti Communist Democrat”) is an extremely new blue-check account that seems to be focused almost exclusively on the Michigan Senate race.

Overall, 94.5% of the 328 X accounts that reposted @DemsForMike five or more times during the period studied are right-wing accounts, based on profile information, post content, and the accounts they regularly amplify. While some of these accounts are (or claim to be) run by Michigan residents, many are not, and a few are demonstrably run from outside of the United States and therefore rather unlikely to be operated by Michigan voters.

As of the time of this writing, the @DemsForMike X account has roughly 11 thousand followers. Almost all of these followers were gained during the first few days of the account’s existence, with growth tapering off heavily by the time the account was a week old. Rather than representing Democratic enthusiasm for the account or Mike Rogers, the initial burst of follower growth appears to be the result of boosts from prominent conservatives, including Laura Loomer, Mark Levin, and the official Michigan GOP X account.

Some of the relatively small number of alleged Democratic accounts that boost @DemsForMike show signs of being less than entirely legitimate. Several are blue-check accounts that were created, or in the case of @TheDemCentrist, renamed, within the last few months. These accounts have generic display names such as “Anti Communist Democrat”, “DSAarenotDemocrats”, and “Democratic Centrist”, and their content primarily consists of attacks on progressive Democratic candidates, with occasional Islamophobic posts thrown in.

On October 3rd, 2026, right-wing news site The Gateway Pundit published an article containing the claim that former Abdul El-Sayed campaign staffer Jordan Domingue runs the @DemsForMike X account. Domingue disputed this on X, saying that The Gateway Pundit was incorrect, and that an earlier post he had made claiming to be the account owner was a joke. He has, however, declined to request a retraction. For the moment, the identity of the account owner remains unknown, although Domingue’s refusal to ask the Gateway Pundit to correct their assertion makes it difficult to rule him out entirely. (Interestingly, the Gateway Pundit reporter who wrote the article has repeatedly tagged the @DemsForMike account on X.)

As a final note, I was blocked on X by the @DemsForMike account at some point within the last 24 hours, despite not having posted on the platform for over a year. I did post a short thread on Bluesky on October 2nd containing some of the same information as I included in this article; the block indicates that, despite the absence of a corresponding DemsForMike Bluesky account, the operator of the @DemsForMike X account is nonetheless monitoring Bluesky (and observing discussion of the account in general).

Subscribe now

Can the process of identifying these contradictions be automated? It turns out that it can be, to some extent, although manual review to filter out false positives is still necessary. By using Jev to estimate the likelihood that pairs of autobiographical posts contradict one another, it is possible to quickly find at least some of the contradictions in a social media account’s back story without performing extensive manual searches of the account’s posts. (Jev is an AI model that takes a chunk of JSON data and natural language questions about that data as input, accompanied with the data type that should be returned in response to each question.)

import pandas as pd
import sys
from typesafe_sdk import TypeSafeClient, Noul 


in_file = sys.argv[1]
out_file_auto = sys.argv[2]
out_file_contradict = sys.argv[3]
api_key = sys.argv[4]

with TypeSafeClient(api_key=api_key) as client:
    # test anything 100 chars or longer for autobiographical content
    df = pd.read_csv (in_file)
    df = df[df["text"].fillna ("").str.len () >= 100]
    results = []
    for text in df["text"]:
        response = client.system_one (
            state={"text" : text},
            questions={
                "autobiographical": Noul (
                    instructions="does the text contain an autobiographical claim?"
                 )
            }
        );
        results.append (response.nouls["autobiographical"].noul)
    df["autobiographical"] = results
    df.to_csv (out_file_auto, index=False)
    df = df[df["autobiographical"] >= 0.9]

    # test pairs of posts for potential contradictions
    results = []
    texts = list (df["text"])
    for i in range (len (texts) - 1):
        text1 = texts[i]
        for j in range (i + 1, len (texts)):
            text2 = texts[j]
            response = client.system_one (
                state = {
                    "text1" : text1,
                    "text2" : text2
                },
                questions={
                "contradiction": Noul (
                    instructions="does anything in text1 contradict anything in text2?"
                 )
            }
            );
            results.append ({
                "text1"         : text1,
                "text2"         : text2,
                "contradiction" : response.nouls["contradiction"].noul
            })
    df = pd.DataFrame (results).sort_values ("contradiction", ascending=False)
    df.to_csv (out_file_contradict, index=False)

The code above reads a user’s social media posts from a CSV file, discarding any post shorter than 100 characters to prevent false positives from short general statements (i.e. “I’m in a good mood”) that superficially “contradict” portions of longer, more complex posts. Jev is then used to provide a probability that each post contains autobiographical content, using the question “does the text contain an autobiographical claim?”; posts with a probability lower than 90% of being autobiographical are discarded. Jev is then used to check each possible pair of remaining posts for contradictions, using the question “does anything in text1 contradict anything in text2?”.

To test this process, I downloaded all original posts from the Bluesky account @rsouissivibes.bsky.social, and ran them through the Python script featured earlier in this article. This account was selected as a test since there were already several known contradictions present in the account’s autobiographical posts, such as the inconsistency regarding marriage duration in the collage above. (The account in question also has other suspicious characteristics, such as extensive use of plagiarized photos.)

The table above contains the posts that were rated as having the highest probability of containing autobiographical content, and each post indeed qualifies. The question “does the text contain an autobiographical claim?” appears to have been a reasonably effective method of causing Jev to identify posts containing autobiographical claims. The subject matter of the posts includes (among other things) alleged family history, alleged military service, alleged facial hair, and alleged participation in past elections.

The contradiction test was somewhat more error-prone than the test for autobiographical content, but still sufficiently effective at detecting genuine contradictions to be useful. For the example account, roughly half of the pairs of posts scored as having a high probability of containing contradictions turned out to be genuine contradictions after manual review. Despite the need to manually screen for false positives, this technique was nonetheless reasonably effective at flagging inconsistencies in this particular Bluesky account’s back story.

What kind of contradictions turned up? In addition to the aforementioned inconsistency regarding marriage duration, the operator of the @rsouissivibes.bsky.social account simultaneously has good knees and bad knees, worked for USAID for 10 years, which is also 15 years, and left his job at USAID in 2022, which is also 2024. There are numerous other contradictions related to the account operator’s alleged military service record, including inconsistency in overall duration, inconsistency in the set of countries allegedly visited, and inconsistency in the amount of time allegedly spent in or near Gaza specifically.

Removing the minimum post length requirement turns up several additional contradictions, including variation in the number of dogs allegedly living with the account operator, and inconsistency regarding whether the account operator uses Facebook. This also results in a higher false positive rate, however.

While this method of finding autobiographical contradictions is not perfect, and still requires some degree of manual review to remove false positives, it was effective at identifying multiple contradictions in the test account’s back story without the need to perform numerous keyword searches. This experiment was relatively simple, and it is likely that the technique can be improved significantly. One obvious spot for improvement is the step that determines whether a given pair of posts are contradictory; bringing down the false positive rate without meaningfully worsening the true positive rate would make the technique more effective. Other enhancements are likely possible as well.

Subscribe now

For over a year, an unknown entity has been hijacking Bluesky accounts and incorporating them into a spam network that aggressively follows real users while serving up a mix of political posts, news links, and plagiarized photographs. While these accounts generally get suspended sooner or later, the operators of the network continue to replace them with new batches, making minor tweaks to the network’s behavior along the way. In the past, the spam accounts’ posts rarely received much engagement; however, the latest batch of accounts have had more success, with multiple posts going somewhat viral in August and September 2026.

This spam network consists of at least 24 Bluesky accounts, and is most likely substantially larger. The set of accounts studied was obtained by starting with the accounts @bilautaly.bsky.social, @calista747.bsky.social, and @savannahleea.bsky.social, and scanning the followers of major accounts they follow for additional accounts meeting the criteria below:

• account follows at least 10,000 accounts

• account follows at least 3 times as many accounts as it has followers

• account has fewer than 100 posts

• gap in activity of at least six months (if account is sufficiently old)

• account has a stolen profile photo or has posted multiple stolen photos

• account is not cryptocurrency or porn-themed

Most, but not all, of the accounts in the network also have a mismatch between their handles and display names; for example, @eduardoegomes.bsky.social has the display name “Lily”. The display names are a mix of random first names, political phrases such as “ProgressiveBloom”, and fruit/vegetable emoji.

Two of the accounts in the network, @celine2017.bsky.social and @edenwhisper.bsky.social, originally posted in Portuguese but switched to English following a gap in activity of almost two years. This, along with the fact that nearly every account in the network has a similar gap in activity, and the fact that most have display names that are unrelated to their handles, strongly suggests that the network consists mostly or entirely of hijacked accounts.

The accounts in this spam network frequently post photographs of various aspects of their alleged lives, including but not limited to their alleged meals, scenes from alleged walks around cities in California, and alleged dogs belonging to their alleged neighbors. Reverse image searches confirm, however, that most (and likely all) of these photographs are plagiarized, and many have been in circulation for years on various parts of the Internet. The majority of the images appear to have been pilfered from other social media platforms, generally TikTok, Instagram, or Facebook.

The majority of the accounts in this network use photos of animals, people, or landscapes as avatars, and as with the photographs in their posts, these images are plagiarized. Most were previously posted or used as avatars on other social media sites; some can also be found on stock photo sites. Google image search outperformed TinEye for tracking down other uses of these particular images.

As mentioned earlier, this is not the first incarnation of this particular Bluesky spam network (several earlier versions were covered previously on this blog). The latest batch of accounts has, however, been markedly more successful at getting real users to pay attention to its content. In the last two months, many of the accounts in the network have racked up significant numbers of reposts, likes, and replies on their political and news posts, with little indication that any of the users engaging with this material are aware that they are interacting with fake accounts.

How are these accounts getting traction? While their main method for growing their audiences appears to be simply to follow as many accounts as possible with the hope of being followed back, some of their growth can also be attributed to Bluesky’s starter pack feature. Most of the accounts in the network are in multiple starter packs, generally politically-themed packs created by liberal users. Some of the accounts are also listed on so-called “follow train” posts, which consist of a list of accounts to follow, presented with the understanding that the accounts on the list will follow back.

The accounts in this network have a handful of other unusual behaviors that, while not present on every account, do occur frequently enough to constitute a pattern. For example, roughly half of the accounts have put up posts that reference specific news stories or headlines, but link to the news outlet’s home page rather than to the article or video under discussion. While it is possible that this is the result of human error, it is more likely a glitch resulting from some type of automation malfunctioning.

There are indications that these spam accounts are attempting to send direct messages to other Bluesky users. Several of the accounts in the network have asked other users publicly why they are unable to message the user they are replying to; the answer, in each case I reviewed, is simply that the person the spammer attempted to message does not have their direct messages open to accounts they do not follow. It is presently unclear what, exactly, the spam accounts are attempting to send to legitimate users via DM.

While this spam network has been around in various forms for some time, its behavior has evolved slightly with each new group of repurposed accounts. If the goal of the network is to build an audience of legitimate users, the effort appears to be succeeding for the moment, as many of the spam accounts have grown sizable followings, and garnered noticeable engagement on their posts. While the viral posts thus far have been largely benign, the spam network’s increasing ability to get real users who post about U.S. politics to amplify its messaging is concerning, especially with the U.S. midterm election approaching. It will be interesting to see how this network’s behavior evolves over the coming months, along with what steps Bluesky takes to disrupt it.

Subscribe now

An analysis of recent Bluesky discussion of both Democratic candidates shows that a larger proportion of the accounts frequently posting in support of Abdul El-Sayed appear to be based in Michigan than those posting in support of Haley Stevens. To obtain the dataset for this analysis, all Bluesky posts mentioning Abdul El-Sayed by name or handle between May 1st and July 11th, 2026 were downloaded and filtered to the 100 most prolific posters; this process was repeated to find the 100 accounts that mentioned Haley Stevens most frequently by full name or handle. Since some accounts appeared among the top 100 posters for both candidates, this yielded a total of 168 accounts rather than 200. Posts were then manually analyzed to determine which candidate, if any, the poster supported.

Account location was determined based on content of account biographies and posts. Affirmative claims to live or vote in Michigan or a Michigan city were considered sufficient evidence to assign an account to the “Michigan” category, while specific claims to live or vote in other areas, along with claims that contradict Michigan residence (i.e. “I do not live in a swing state”) resulted in assignment to the “not Michigan” category. Accounts meeting none of these criteria were classified as “unknown”. The “unknown” category mostly consists of accounts belonging to news organizations, although a few more unusual accounts turn up as well, such as elitegrifters.bsky.social, which recently threw a tantrum when former Illinois Congressional candidate Kat Abughazaleh ordered fast food, and bsfavourite.bsky.social, an automated account that spams Bluesky with links to right-wing media.

A similar pattern emerges when one studies the individual contributions made to both campaigns. Roughly twice the percentage of the money donated to the Abdul El-Sayed campaign originated from Michigan addresses as that donated to the Haley Stevens campaign. (Campaign contribution data is publicly available from the Federal Election Commission, and is current for both campaigns through March 31st, 2026, as of the time of this writing.)

Money from the AIPAC-linked United Democracy Project PAC, which as of July 13th, 2026, had spent $9.3 million in support of Stevens and $5.7 million in opposition to El-Sayed, likewise largely originated with donors outside of Michigan, as only 1.7% of donations to this PAC are from donors with Michigan addresses. Additionally, many of these donors are neither left-leaning nor liberal; analysis of other contributions made by donors to the United Democracy Project PAC reveals that they give money in roughly equal measure to Republicans, Democrats, and AIPAC-linked groups (specifically “United Democracy Project”, “Elect Chicago Women”, “Affordable Chicago Now”, and AIPAC itself), with donations to Republicans making up the largest share by a small margin.

Both Bluesky activity and FEC donation data show a similar pattern: in each context, the Haley Stevens campaign has received more support from outside Michigan than has the Abdul El-Sayed campaign. While it is hardly unusual for a high-profile election to attract attention and donations from people who do not reside in the region in which the election is held, the difference in degree of outside interest between supporters of the two Democratic candidates is notable.

Subscribe now

Over the last few years, the widespread availability of increasingly sophisticated large language models has served as a boon to spammers who seek to flood the internet with high volumes of low-quality articles. In one recent instance, a network of dozens of topic-specific websites has begun publishing large numbers of highly repetitive articles on a daily basis, each written by an alleged author with an oddly generic biography. The websites in question have multiple similarities suggesting that they are operated by the same person or entity, and all of the sites are linked with varying degrees of frequency by a recently created Bluesky account with a default avatar, bloglink.bsky.social (“Fern Hart”).

This network of spam blogs consists of at least 44 distinct websites, with a wide range of themes including beekeeping, cat care, guitar technique, air fryers, and knife sharpening. The domains were registered in two waves, with the first 26 domains registered between October 16th and November 12th, 2025, and the remaining 18 between May 28th and June 11th, 2026. At the present time, all 44 domains resolve to Cloudflare IP addresses.

Each of the spam blogs publishes quite prolifically, with numerous similarly-titled articles such as “Ultimate Cat Body Language Guide (2025)”, “Ultimate Guide to Reading Cat Body Language (2025)” and “Ultimate Guide to Cat Body Language (2025)” posted per day. Confusingly, many of the titles include the year 2025 despite the associated articles being generated in 2026. The high volume of material, along with the self-similar nature of the content, suggests that the articles are being generated via AI language models using highly repetitive prompts.

In another potential sign of artificial generation, the content of the articles is extremely similar from post to post and from site to site, with certain elements showing up repeatedly regardless of the purported topic. For example, the first paragraph of nearly every article on each of the websites contains a reference to the number of years of experience the alleged author allegedly has in some field of study or work. (“In my twelve years of teaching”, “after 12 years of working with over 800 cats”, etc.) The overall writing style is extremely consistent across all 44 sites.

The alleged authors of each spammy blog have extremely similar biographies with extremely similar formatting. These biographies have links to LinkedIn and Twitter (now known as X) at the bottom, but in a hilarious bit of ineptitude, these links do not work, and many of the supposed Twitter handles exceed the platform’s 15 character username length limit. (Example: @amaraokonkwo_cats.)

The blog posts produced by this spam operation use a mix of AI-generated images and stock photos as preview/thumbnail images. In some cases, however, these images do not match the content of the articles to which they are attached. For example, the thumbnail for a June 10th article about cat body language includes numerous depictions of human body language, and the image for a June 11th metronome guide shows a green apple covered in water droplets. Given the speed at which the articles are published, these mismatches are likely the result of an automated process for selecting header images going off the rails.

Additional evidence of automation surfaces when one examines the posting schedule of bloglink.bsky.social, the Bluesky account that has thus far shared over one thousand links to the various spam blogs in the network over the course of just ten days. This account generally operates around the clock with insufficient gaps for most human operators to sleep, and for the first eight days, its posting activity spiked at precisely the same times each day. The pattern has changed somewhat as of June 12th, with a significant increase in posting volume and more variation in schedule; time will tell whether this change in posting behavior is permanent.

While I was taking screenshots to use in this article, I observed the bloglink.bsky.social account change its display name in real time on June 11th, 2026. The screenshots in the collage above were taken three minutes apart; in the first, the account has the same display name as handle, “bloglink.bsky.social”. In the second screenshot, the display name has been changed to “Fern Hart”, presumably to create the impression that the account is run by a person with that name, rather than merely being an exercise in spam.

Despite posting a large number of links to spammy AI-generated blogs, the bloglink.bsky.social account thus far has not managed to build much of an audience, with only 15 followers as of June 12th, 2026. Even this number is inflated, as the account’s most recent three followers are strangely similar porn spam accounts named “Emma Wilson”.

Subscribe now

In recent months, Facebook has been flooded with U.S. state-themed AI-generated image posts from a swarm of suspiciously similar accounts with names such as “Life in Nevada”, “I grew up in Iowa”, and “Utah Life”. The content posted by these accounts frequently features rural imagery, and is extremely similar regardless of which state any given post is allegedly about; many of the images posted are more or less interchangeable other than the state name. In an ironic twist, this network of U.S.-themed accounts does not appear to be run from within the United States at all; Facebook’s Page Transparency feature indicates that some, and possibly all, of the accounts are actually operated from Bangladesh.

These Facebook accounts are part of a spam network consisting of at least 49 U.S. state-themed Facebook pages, with every state other than Delaware represented. Many are new accounts, and many of the older accounts have been renamed relatively recently. The accounts generally have names of the form “Life in <State>” or “<State> life”; “Just Connecticut Things”, “I grew up in Iowa”, and “Life is Idaho” are exceptions to the rule.

23 of the 49 accounts have location information available via Facebook’s Page Transparency feature; every single one of these 23 accounts has one or more operators in Bangladesh. Two of the accounts have operators in other countries as well; “Louisiana Life” has at least one operator allegedly located in Greece, while “Massachusetts Life” appears to be partially run from Saudi Arabia. Some of the accounts have been renamed, and in a few cases the prior names indicate that the prior content likely had a different theme. Examples include “Life in Ohio”, which was originally named “Rose Shop”, and “Life in Nevada”, which spent about a month with the name “Hello India”.

The content posted by the accounts in this spam network consists largely of memes produced via AI image generation models, and is extremely similar from account to account other than the state referenced. One of the most popular recurring types of content is images of farms with signs expressing opposition to importing food from China. (Example: “Indiana does not need to buy any food from China, Indiana needs to back Indiana farmers”.)

In an ironic twist, another recurring theme of the network’s content is anti-AI data center memes produced with generative AI. These images generally feature aerial views of farms and beaches with messages such as “it’s not worth giving up an inch of this for a data center” emblazoned on the ground in an enormous font, sometimes accompanied by a drawing of the state the account is supposedly based in. In a few cases, the anti-data center message is on a sign instead.

Many of the spam accounts also post anti-property tax memes. These posts consist of an image of a house with a sign in front containing the text “property taxes make no sense on a paid off home if we own it, truly own it” or variations thereupon. Many of the images also include the name or flag of the state theoretically associated with the account that posted the image; in the case of the “Colorado Life” account, this takes the form of a massive “Welcome to Colorado” sign in a random person’s front yard.

Almost every account in this network has posted at least one post claiming that large numbers of earthquakes have just been reported in the account’s alleged state of origin. In reality, seismic activity in the U.S. is not evenly distributed, and the majority of earthquakes in the country take place in either California or Alaska, rendering many of these posts vanishingly unlikely. The earthquake posts all feature maps pinpointing the locations of the alleged earthquakes. Some of these maps, however, are rather inaccurate; for example, Traverse City is on the wrong side of Lake Michigan in the post in the upper left.

Incorrect maps are not the only glitchy aspect of this network’s posts. On multiple occasions, the network operators appear to have forgotten which account they were logged into, resulting in a post about Indiana appearing on the “Wisconsin Life” page, and a map of Maine showing up on the “Utah Life” page. Several posts also include evidence of the prompts used to generate the images and associated text, helpfully corroborating the content’s artificial origin.

While this spam network is in some ways similar to other Facebook generative AI content farms such as those that endlessly post images of nonexistent barndominiums and fictional meals, it has an additional layer of political messaging that these other spam operations lack. The anti-Chinese import, anti-data center, and anti-tax themes are consistently present across the group of accounts, and appear to be largely targeting a rural audience. It will be interesting to see how this network’s activity develops further over time, assuming that Facebook does not intervene and shut it down.

Subscribe now

In spring 2026, a multitude of Bluesky accounts began prolifically posting photographs of various locations near San Francisco, including the three strangely similar posts about Alcatraz featured in the collage above. At first glance, any of the posts in question could theoretically have been posted by a real person who happened to be wandering around California, but numerous problems emerge upon closer inspection. For one thing, the images are plagiarized, with most having appeared on TikTok months or years prior to being posted on Bluesky. Additionally, multiple pieces of evidence indicate that many of the Bluesky accounts posting the stolen photos are themselves stolen.

To find additional accounts of this sort, searches for “San Francisco” and a handful of other recurring terms were performed using the Bluesky API. These search results were then filtered to English-language posts containing four images and no alt text, which were then manually inspected to determine further shared characteristics of the accounts in the network and the content they post. Unfortunately, the Bluesky search feature currently provides no means of filtering search results up front to only those posts containing images; such a feature would have made the data gathering process for this project more efficient, in addition to having other obvious uses.

This spam network consists of at least 22 Bluesky accounts with creation dates ranging from December 2023, when Bluesky was still an invitation-only platform, through February 2026. Every account in the network has a traditionally female display name, and none of the display names match the accounts’ handles. Despite the age of some of the accounts, their posting histories appear to be relatively minimal, with none of the accounts having posted more than a few dozen times.

Each of the accounts in the spam network has posted at least one Bluesky post with multiple plagiarized photographs attached. The photos fall into two general categories: images of food, and outdoor scenes from California, generally in the vicinity of San Francisco. Google reverse image searches reveal that most (and possibly all) of these images were previously posted on Tiktok. Some of the spam accounts copy entire videos from TikTok as well.

Eighteen of the 22 accounts in the spam network were created months or years prior to their first visible post, which for most of the accounts is a post containing multiple plagiarized photographs. Three of the remaining accounts have a handful of early posts followed by one or more image posts after a lengthy pause. The final account (talostecnologia.bsky.social) was created too recently for a significant gap in posting activity to exist.

Although all 22 spam accounts post exclusively in English at present, it wasn’t always so; at least three of the spam accounts (jorgingq.bsky.social, brokenfvm.bsky.social, and giragirac.bsky.social, the latter of which was created during Bluesky’s invitation-only period) posted in other languages around the time they were initially created. Wayback Machine archives for the three accounts indicate that they had different display names and avatars at the time of these early posts. This makeover suggests that the accounts were hijacked, sold, or otherwise transferred and subsequently repurposed.

In addition to the numerous plagiarized photographs, the accounts in this spam network also regularly post links to major news sites from multiple countries. The most frequently linked sites are Reuters, The Guardian, Al Jazeera, and The Washington Post. While most of the sites linked by the network have a left-leaning or centrist bias, the right-leaning New York Post turns up periodically as well.

The accounts in the spam network also periodically repost other Bluesky accounts, primarily those belonging to media organizations, various liberal influencers, and anti-Trump Republicans. The most frequently reposted users are Aaron Rupar, Ron Filipkowski, Forbes, The Tennessee Holler, and George Conway.

It is presently unclear what the ultimate purpose of these spam accounts is; while it is possible that amplifying various liberal and liberal-adjacent influencers and sharing news stories is the goal, it would also be unsurprising if the network’s current activity is merely an effort to build an audience for unrelated future content. Time may, or may not, reveal further information.

Subscribe now

import json
import pandas as pd
import requests
import sys
import time

URL_ROOT = "https://www.courtlistener.com/api/rest/v4/"

def retry (url, api_key, retries=10, backoff=1.8, pause=20, max_pause=900):
    print (url)
    while retries > 0:
        try:
            result = requests.get (url, headers={
                "User-Agent"    : "placeholder",
                "Authorization" : "Token " + api_key
            }, timeout=10).json ()
            if "detail" not in result:
                return result
            else:
                print (result)
        except:
            pass
        retries = retries - 1
        if retries > 0:
            print ("error, sleeping " + str (pause) + " seconds...")
            time.sleep (pause)
            pause = min (max_pause, pause * backoff)
    return None

def courtlistener_docket_entries (docket, api_key):
    results = []
    url = URL_ROOT + "docket-entries/?docket=" + str (docket)
    while url:
        data = retry (url, api_key)
        if "results" in data:
            results.extend (data["results"])
        url = data["next"] if "next" in data else None
        print ("so far: " + str (len (results)))
    return results    

def courtlistener_search (query, api_key, qtype="r", options=None):
    results = []
    url = URL_ROOT + "search?q=" + query + "&type=" + qtype
    if options:
        for k, v in options.items ():
            url = url + "&" + k + "=" + v
    while url:
        data = retry (url, api_key)
        if "results" in data:
            results.extend (data["results"])
        url = data["next"] if "next" in data else None
        print ("so far: " + str (len (results)))
    return results


if __name__ == "__main__":
    if sys.argv[1] == "docket":
        data = courtlistener_docket_entries (sys.argv[3], sys.argv[2])
        with open (sys.argv[4], "w") as file:
            json.dump (data, file, indent=2)
    elif sys.argv[1] == "search":
        if len (sys.argv) > 5:
            options = json.loads (sys.argv[5])
        else:
            options = None
        data = courtlistener_search (sys.argv[3], sys.argv[2], options=options)
        with open (sys.argv[4], "w") as file:
            json.dump (data, file, indent=2)

The above Python code contains wrapper functions for accessing two of the endpoints provided by the CourtListener API, specifically the endpoint used to retrieve a list of docket entries for a given CourtListener docket ID, and the endpoint used to search CourtListener’s database. Both endpoints return records in batches of 20, and provide a pagination mechanism for retrieving additional batches. The above code is relatively basic and could be improved in multiple ways, both by adding support for additional endpoints, and by adapting the general-purpose retry function to be aware of CourtListener’s relevant rate limits.

docket = 67654013
data = courtlistener_docket_entries (docket, api_key)
print (len (data))
with open ("67654013.json", "w") as file:
    json.dump (data, file, indent=2)

The above code snippet downloads all docket entries for docket ID 67654013, “X Corp v. Center for Countering Digital Hate, Inc.”, filed in 2023 in the Northern District of California. The data is returned in JSON format and saved to a local file. (The CourtListener API also provides the option to return the data in XML or HTML format.)

The image above shows one of the 102 records returned by the CourtListener API for docket ID 67654013. The record includes a variety of fields, including the URL for the human-readable version of the same CourtListener record, as well as links to attached documents in PDF format, hosted on both on CourtListener itself and the Internet Archive’s Wayback Machine. The filing date, a brief description, and the plain text of any attached documents are also included, among other data.

query = ""
options = {
    "party_name" : "Scientology"
}
data = courtlistener_search (query, api_key, options=options)
with open ("scientology2.json", "w") as file:
    json.dump (data, file, indent=2)

The search endpoint is slightly more complex, and accepts a variety of options corresponding to those available in the search forms on the CourtListener website. Searches for cases, filings, oral arguments, and judges are all supported via the API. Note that less specific searches may return extremely large numbers of results and thus quickly exhaust request quotas. As a test example, I searched for all cases with the Church of Scientology as a party.

This search yielded a total of 138 distinct federal cases with The Church of Scientology as one of the parties, with filing dates ranging from 1977 to 2026. (Note that this includes only cases filed in federal court, and any state litigation involving the church is therefore absent.) The volume of new cases peaked in the early 1990s, although 2026 has already seen five additional cases filed.

As mentioned earlier, this article only covers a subset of the available functionality provided by the CourtListener API, and the two use cases discussed here are relatively simple. A wide variety of other data is available, and people with a mix of legal knowledge and basic coding skills should be able to come up with numerous interesting applications for the large volume of information stored by CourtListener. (Also, if you use PACER and are interested in expanding CourtListener’s database, you can install the RECAP extension to automatically upload documents you view to CourtListener.)

On an entirely unrelated note, I recently finished an album; you can check it out below if you’re interested.

Subscribe now

For almost any given Reddit URL that displays a human-readable page, there is a corresponding JSON URL that returns the same information in JSON format. While there is some inconsistency in the specifics, the JSON URLs are generally formed by adding .json to the standard URL, along with optional parameters regarding the maximum number of results to retrieve and how to sort them.

Below is an example of how this works for listing the posts on a given subreddit (specifically, /r/ExtendedRangeGuitars) in most-recent-first order. The first URL is the standard URL used by human users of the Reddit website; the second returns the same list of posts in JSON form.

https://www.reddit.com/r/ExtendedRangeGuitars/new

https://www.reddit.com/r/ExtendedRangeGuitars/new.json?sort=new&raw_json=1&limit=100

This process can be easily automated using Python (or any other popular programming language, for that matter).

import json
import requests
import sys
import time


def retry (url, retries=10, backoff=1.8, pause=20, max_pause=900):
    print (url)
    while retries > 0:
        try:
            result = requests.get (url, headers={
                "User-Agent" : "placeholder"
            }, timeout=10).json ()
            if "error" not in result:
                return result
            else:
                print (result)
        except:
            pass
        retries = retries - 1
        if retries > 0:
            print ("error, sleeping " + str (pause) + " seconds...")
            time.sleep (pause)
            pause = min (max_pause, pause * backoff)
    return None

def get_subreddit_posts (subreddit):
    base_url = "https://www.reddit.com/r/" + subreddit \
             + "/new.json?sort=new&raw_json=1&limit=100"
    last_id = None
    rows = []
    while base_url is not None:
        url = base_url + "&after=" + last_id if last_id else base_url
        response = retry (url)
        data = response["data"]["children"]
        if len (data) == 0:
            base_url = None
        else:
            rows.extend (data)
            for item in data:
                new_id = item["data"]["name"]
                if last_id is None or new_id < last_id:
                    last_id = new_id
    return rows

def get_thread_detail (permalink):
    base_url = "https://www.reddit.com" + permalink
    if not base_url.endswith ("/"):
        base_url = base_url + ""
    base_url = base_url + ".json?raw_json=1"
    rows = retry (base_url)
    return rows

def get_subreddit_posts_and_detail (subreddit):
    posts = get_subreddit_posts (subreddit)
    for post in posts:
        post["detail"] = get_thread_detail (post["data"]["permalink"])
    return posts

def get_user_info (user):
    base_url = "https://www.reddit.com/user/" + user + \
            "/about.json"
    result = retry (base_url)
    return [] if len (result) == 0 else result["data"]

def get_subreddits_moderated (user):
    base_url = "https://www.reddit.com/user/" + user + \
            "/moderated_subreddits.json"
    result = retry (base_url)
    return [] if len (result) == 0 else result["data"]

if __name__ == "__main__":
    if sys.argv[1] == "subreddit":
        data = get_subreddit_posts_and_detail (sys.argv[2])
        with open (sys.argv[3], "w") as file:
            json.dump (data, file, indent=2)
    elif sys.argv[1] == "user":
        data = get_user_info (sys.argv[2])
        with open (sys.argv[3], "w") as file:
            json.dump (data, file, indent=2)
    elif sys.argv[1] == "moderated":
        data = get_subreddits_moderated (sys.argv[2])
        with open (sys.argv[3], "w") as file:
            json.dump (data, file, indent=2)

The above Python code contains functions for downloading the following four forms of Reddit data:

• a list of all recent posts in a given subreddit

• a hierarchical list of comments in a given thread

• profile information for a given user account

• a list of subreddits moderated by a given user account

This set of functions is far from comprehensive, but is sufficient to demonstrate the concept and can easily be adapted to call additional Reddit JSON endpoints. The JSON calls are rate limited, and in most cases require a pause after roughly 100 calls; this is handled automatically by the retry function in the above code.

As a brief test of the above Python code, I downloaded recent posts from the /r/redditrequest subreddit and took a look at the accounts posting there. For those who are unfamiliar, /r/redditrequest is a forum where Reddit users with accounts in good standing can request control of unmoderated or banned subreddits. While this process does serve a valuable purpose, it is unsurprisingly also abused from time to time by users who are simply seeking to take control of subreddits with desirable names and have no intention of moderating them in good faith.

Downloading recent posts from /r/redditrequest yielded 927 posts from 895 distinct accounts, four of which were suspended before the download process completed. The accounts posting in /r/redditrequest are disproportionately recent creations, with more accounts created in 2025 than in any prior year. This pattern is somewhat more interesting for accounts expressing interest in moderation than it would be for Reddit users as a whole, as the moderators of active subreddits are generally experienced users who have been on the platform for years.

Among the accounts posting to /r/redditrequest are multiple accounts created within the last six months that appear to be attempting to take over as many subreddits as possible. Accounts engaged in this activity generally focus on a specific theme; the above collage shows examples of accounts of this type that are aggressively acquiring Indian celebrity and NSFW subreddits.

This article is intended as a basic introduction to harvesting and examining Reddit data via the Reddit JSON interface. There is substantially more to study in deeper detail, both regarding /r/redditrequest and Reddit data in general, and future articles here will delve further into such topics.

Subscribe now

In recent weeks, a plethora of purported firefighters and home inspectors have used Facebook ads to spread sob stories regarding carbon monoxide, accompanied by claims that such tragedies can only be averted by purchasing a specific carbon monoxide detector from a four-month-old website, trydewlora(dot)com. There are, however, multiple problems, such as the fact that many of the pages running the ads are renamed accounts with AI-generated avatars. Additionally, the current Dewlora website is not the only short-lived website selling carbon monoxide detectors to be promoted by this set of accounts; Meta’s ad library indicates the network has promoted at least five other similar sites since the beginning of 2026.

The spam network promoting the Dewlora website consists of at least 21 Facebook accounts, slightly over half of which were created within the last three months. The accounts have a variety of alleged nations of origin, although certain patterns recur: six of the spam accounts are supposedly based in the Netherlands, and three others have operators spread across the same list of countries (the United States, Spain, and the United Arab Emirates). All of the accounts with the exception of the “official” Dewlora account and “The Firehouse Community” have names consisting of a given name and surname, and most claim to be firefighters, electricians, home inspectors, or other professionals whose work might conceivably involve carbon monoxide detectors.

Eleven of the 21 accounts in the spam network have been renamed at least once, and many have undergone multiple name changes. For example, the account presently named Brian Keller was previously Blake Contreras, the account presently named Amanda Shaw was previously Brian Shaw, and the account presently named Kelly Mexxy was previously Linda (no surname). The “official” Dewlora account has also experienced multiple makeovers, having cycled through the names Beanieluxe, TryNinoe, and Sayaru prior to the current incarnation.

The majority of the accounts in the spam network use AI-generated profile images. While these images are more convincingly photorealistic at first glance than AI-generated images from a few years ago, some of them still contain telltale glitches such as mangled text. Additionally, the AI-generated images used by these spam accounts all contain Google’s invisible SynthID watermark, indicating that they were created or modified using Google generative AI tools.

The Dewlora website, trydewlora(dot)com, also makes use of AI-generated images. These include images of the alleged product and associated packaging, with mangled text such as “Qes & CO Detector” rather than “Gas & CO Detector” visible on the detector itself. The chemical formula C₁H₁ on the packaging is also written incorrectly (should be simply CH), and the associated chemical (methylidyne) is additionally highly unstable under normal conditions and would not persist long enough in the air to be detected or pose a threat.

On a final note, the Dewlora website is far from the only fly-by-night carbon monoxide detector website promoted by this spam network. Others include truesafety(dot)com, swirlasbrand(dot)com, truststeadfast(dot)com, bysecurenest(dot)com, and airshield(dot)store. The websites all look relatively similar, and the tragic tales used to advertise them are sometimes duplicated verbatim to advertise different sites.

While spammy activity of this sort is hardly new, the use of generative AI makes it substantially easier to conduct campaigns of this nature. AI-generated avatars are now of sufficient quality to effectively reinforce the illusion that the (likely fictional) sob stories in the ads are coming from a real person with a real life, and the replies to the ads from regular users generally indicate that people are buying the stories. Given the level of duplication involved in the text content and the obvious similarities between the accounts, it would be trivial for Meta to identify this activity as spam and shut it down, and it is thus curious that they have not as of yet done so.

Subscribe now

In two articles in late 2025, I analyzed a network of TikTok spam accounts posting extremely similar AI-generated videos of nonexistent Black people, interspersed with occasional commercial spam. Although the majority of the accounts in this network ceased posting around the end of the year, many have subsequently resumed (and a few never stopped). As of March 28th, 2026, roughly half of the accounts in this network have been recently active, and their content has evolved further.

40 of the 76 known accounts in the network have posted at some point in 2026, and all of them have pivoted in some fashion from their initial content lineup. Unlike the videos from fall 2025, which featured the same three hashtags in the description of every video, most of the new posts from the network contain no hashtags whatsoever, and generally lack text captions as well. The recent posts are all very similar and fall into one of two broad categories: dating-themed AI-generated videos, and advertising in multiple languages. Thus far, no account has posted content from both categories.

In recent weeks, many of the accounts in this spam network have posted three different variations on repetitive AI-generated videos asking male viewers whether they would date a woman of a given race. The three types of videos include, with varied wording:

• video of a woman seated in a car, asking “would you date a Black woman?”

• video of a group of women outdoors, asking “would you kiss a Black woman outside?”

• video of a woman standing in front of a neutral background, asking “I’ve heard men in the U.S. don’t like Brazilian women, but what about you?”

As can be seen in the montage above, the quality of the video and audio is inconsistent from post to post, with some videos showing obvious signs of their artificial origin and others being far more realistic. The AI-generated videos set in vehicles are, in general, more obviously inauthentic than the other two variants.

The remaining accounts in the spam network have largely changed focus to various forms of advertising. Most of the advertising posts are of one of two types: photorealistic English-language videos showcasing clothing, accompanied by background music, and cartoonish Spanish-language videos advertising various dietary supplements. Both types of video bear signs of being synthetically generated, and some include watermarks from popular AI video generation tools. Unlike the dating-themed videos, some of the advertising videos include hashtags.

Although many of the accounts have deleted all of their older content, a handful have not, making the sudden change in focus obvious when scrolling through their post histories. In most cases, there is a gap of weeks or months between the older videos and the current material. In several cases, the account operator also appears to have forgotten to update the avatar after changing an account’s focus, as a handful of the accounts have avatars that do not look like the AI-generated people in the videos currently posted by the account, but do resemble previous rounds of spam.

The fact that a significant portion of the network has at this point pivoted to commercial spam strongly suggests that this spam is the primary goal of the network. That being said, there are still unanswered questions; while it is possible the AI-generated videos about dating are simply a method to grow the accounts’ audience, the discoverability of these videos is somewhat undermined by the lack of hashtags and textual descriptions, and it is possible the operators of the network have other goals as well. Time, and further observation, may well reveal more.

Subscribe now

TikTok, like all popular social media platforms, has attracted the attention of the operators of various shady services that sell bogus social media engagement. Simply searching TikTok itself for phrases such as “buy followers” turns up numerous accounts purporting to offer services of this nature. One example is @buyfollowersinstant, a Tiktok account with zero videos posted or reposted, a link to an SMM (social media management) panel in its profile, and over four thousand eerily similar looking followers.

A quick stroll through @buyfollowersinstant’s 4328 visible followers reveals a streak of 4210 followers in a row with the same naming scheme. (The account’s most recent followers appear to be authentic.) Each of these accounts has the same handle as display name, and each name consists entirely of lowercase letters, digits, periods, and underscores — no capital letters whatsoever. Since authentic TikTok users employ a variety of naming schemes, and often use a different display name than handle, this anomaly is a clear indicator of bulk account creation and bulk follow activity orchestrated by a single entity.

The TikTok accounts in the fake follower network following @buyfollowersinstant have other traits in common beyond the telltale naming scheme. Each account has relatively few followers of its own but follows dozens or hundreds (and in some cases, thousands) of other accounts. The vast majority also have never posted; those which have generally have a handful of generic videos that do not in any way depict the account operator. The network is likely larger than the 4210 accounts following @buyfollowersinstant, but due to the lack of an easily accessible public API for retrieving TikTok data, the present analysis is limited to this set of fake accounts.

The accounts in this fake follower network utilize a variety of profile images, including several dozen with default avatars. Among the fake accounts are several with StyleGAN-generated faces, which remain perennially popular among spammers despite the availability of far more sophisticated AI image generation tools. The accounts in this spam network also reuse profile images, with the same (plagiarized) profile photos sometimes being used by multiple accounts.

The @buyfollowersinstant TikTok account’s profile contains a link to smmseven(dot)com, an SMM (social media marketing) panel that sells followers, likes, views, reposts, and other various forms of artificial amplification for a variety of social media platforms, including but not limited to TikTok. The maximum order size of one million followers is an additional data point suggesting that the network of fake TikTok accounts associated with the site is far larger than the 4210 fake accounts following @buyfollowersinstant. Like many SMM panels, smmseven(dot)com offers an API, allowing customers to automate orders.

The set of accounts followed by the spam network is widely varied, encompassing everything from personal accounts to business accounts to accounts advertising other spammy social media services. Many of these accounts appear to have few or no genuine users following them whatsoever.

This network is far from the only one of its kind presently active on TikTok; as mentioned earlier, finding additional examples of follower sales operations requires nothing more than searching TikTok itself for “buy followers”. It will be interesting to monitor how this situation evolves (or devolves) with the recent change in ownership of TikTok’s U.S. operations.

Subscribe now

Meet “Tech News World”, a Facebook page that recently pivoted from spamming the platform with AI-generated movie posters to spamming the platform with AI-generated fake videos of warfare in the Middle East. The page in question has been repurposed multiple times over its three years of existence, as is common with engagement farming efforts; prior themes include puppies and Gal Gadot. Unsurprisingly, “Tech News World” is not the only spammy content farm that has elected to exploit the current war for clicks and views, and the phenomenon is not limited to Facebook.

The majority of the recent videos posted by “Tech News World” purport to show scenes of destruction from the war currently taking place in the Middle East, and generally feature AI-generated versions of locations in Iran and Israel. There are multiple problems with these videos; for example, explosions are unrealistically colorful and crisp, and frequently leave no damage to structures behind in their wake. Some videos also include nonexistent military technology, such as the “massive, glowing blue directed-energy beam” mentioned in the middle post in the above collage.

Prior to the recent glut of fake war footage, the operator(s) of “Tech News World” made various attempts at garnering engagement with other types of repetitive content. The earliest posts still visible feature photos of dogs, generally engaged in cute dog behaviors; these photos are all plagiarized from other social media accounts and websites. In late 2024, the account pivoted from stolen dog photos to AI-generated movie posters, some of which contain obvious glitches such as incorrectly rendered titles. The final batch of movie posters to date was posted on March 2nd, 2026; all content since has been AI-generated material related to the war in Middle East.

As mentioned earlier, “Tech News World” is far from the only Facebook page posting AI-generated fake war footage. At present, AI-generated videos of the war in the Middle East are frequently served up by Facebook’s recommendation algorithms, particularly in the “Reels” section. Incongruously, despite allegedly taking place in countries where English is not the primary language, many of the AI-generated war videos feature bystanders speaking fluent English, generally with common US accents.

As with “Tech News World”, many (not all) of the other Facebook pages posting AI-generated videos of warfare have been repeatedly renamed and repurposed. This is a common pattern with content farm accounts, in some cases due to an account changing hands, and in others as the result of the page operator’s desire to try new engagement farming tactics. New accounts created in 2026 also turn up somewhat frequently among the pages posting bogus war footage.

Similar AI-generated war videos, and in some cases the exact same clips, can be found on other social media platforms as well. The above collage includes a few examples from X (formerly Twitter); the same type of content also turns up on Instagram, TikTok, YouTube, and elsewhere. Unfortunately, as long as such material is rewarded with clicks and views, the trend of content farmers exploiting war and other tragedies for social media engagement will likely continue to evolve with available technology.

Subscribe now

Over on Facebook, a page by the name of “Beautiful USA” has been making its way into people’s feeds by posting an endless stream of United States-themed posts featuring exaggerated patriotic imagery. The page’s posts primarily consist of surreal AI-generated images laden with contextually inappropriate US flags, although plagiarized photos of iconic US locations also turn up here and there. Despite the page’s self-stated claim to be based in Los Angeles, Facebook’s Page Transparency feature indicates that it is actually operated from Romania.

The “Beautiful USA” page follows several other large United States-themed content farm pages that post similar, and in some cases identical, material. Recursively mapping the accounts followed by the pages in question yields a set of 20 US-themed content farm/spam pages run from a variety of countries. (Several of the US-themed pages also follow similar pages focused on individual US cities; these pages are excluded from the present analysis.)

The 20 US-themed content farm pages have administrators in a variety of countries, including Sri Lanka, Greece, Pakistan, Finland, Australia, Bangladesh, Estonia, Ireland, Romania, Sweden, and the United States, per Facebook’s Page Transparency feature. Only four of the 20 pages (20%) have a US-based administrator, and one of these (“USA America Facts”), also has three administrators in Bangladesh. Several of the page names are reused, with “Explore USA” being particularly popular. In one case (“Amazing America”), the page administrator’s country of origin has been hidden.

Much of the material posted by these spam pages features AI-generated patriotic imagery, frequently involving gratuitous and unrealistic displays of the US flag, such as the Old Glory-encrusted locomotive belching red, white, and blue smoke seen in the leftmost post in the above collage. Trucks, trains, and other vehicles are a recurring theme of this artificially generated content. Other types of AI-generated images, including scenery and memes, turn up as well, as do plagiarized photographs of major US cities and landmarks.

As mentioned earlier, the same posts sometimes end up being posted by more than one of the spam accounts. In most cases, the duplicate posts are pilfered photographs or AI-generated images, but there are exceptions. For example, at least three of the pages have posted visually similar posts with links to a low-effort listicle with the title “Americans Are Leaving These 11 States Faster Than Ever”.

Most of the US-themed content farm pages make prolific use of hashtags, frequently cramming five or more into each post. In some cases, the spam pages have managed to flood specific hashtags with unrelated content; for example, a significant portion of the search results for #CaliforniaRealEstate at the time of this writing are posts from “Beautiful USA” that have nothing whatsoever to do with California real estate. This hashtag flooding is likely an attempt to artificially increase engagement by piggybacking on popular hashtags.

Several of the spam pages periodically post political content, and this political content is biased in a rightward direction. Posts praising deceased Turning Point USA founder Charlie Kirk and his widow Erika turn up repeatedly, including a surreal AI-generated image of Kirk, Jesus Christ, and a US flag worn as a garment. Other political posts include anti-immigrant material, such as a racist meme insinuating that multiple elected U.S. Representatives should be ineligible for public office based on their countries of origin. The presence of this political content, and the consistency of the political stances therein, suggests that pushing conservative political views, rather than simply serving up image spam, may be the primary goal of these pages.

Subscribe now

For the last few years, Tanya Shpachuk, the operator of a guitar repair business in Kyiv, Ukraine, has posted various videos of guitar restoration and repair on multiple social media platforms, primarily YouTube and TikTok. A series of videos documenting the process of restoring a Les Paul damaged by a Russian drone strike went particularly viral, and was featured in a recent article on guitarplayer.com. Not all of the social media accounts allegedly associated with Shpachuk or her business are legitimate, however; over on Facebook, the most popular “Tanya Shpachuk” page appears be a fake account operated from Cambodia.

A quick look at the Page Transparency info for the most popular “Tanya Shpachuk” page on Facebook, which has 37K followers as of the time of this writing, reveals that the page was created on January 1st, 2024, and is managed from Cambodia and the United States. This is odd for a page allegedly belonging to someone in Kyiv, Ukraine, which is located nowhere in the vicinity of either of these two countries, and makes the absence of an administrator in Ukraine particularly notable. Unlike the YouTube and TikTok accounts, this Facebook page is not linked from Shpachuk’s official website.

Although the majority of the content posted by the fake “Tanya Shpachuk” Facebook page consists of guitar repair videos lifted from the real Shpachuk’s YouTube and TikTok accounts, additional problems crop up as one scrolls through the account’s photos. Back in December 2025, the account posted an AI-generated image of a house previously posted on an AI house spam page (“Log Cabin Vibes”), accompanied by a portion of the text from the original post. One possible explanation is that the operator of the fake Shpachuk page operates one or more AI image spam pages as well, and posted this image to the wrong account.

The fake “Tanya Shpachuk” Facebook account also occasionally plagiarizes guitar-related content from sources other than the real Shpachuk’s social media accounts. Over a six hour period on February 20th, 2026, the account posted three different photographs of guitars plagiarized from elsewhere on the Internet. At least two were copied from Instagram, and contain some or all of the text from the original Instagram posts. This behavior is similar to that of another fake Facebook account, “Maya Jordan”, which prolifically posts guitar photographs pilfered from Reddit.

On a final note, a January 2026 post from what appears to be Shpachuk’s genuine Facebook account includes a screenshot of the fake page, accompanied by a request that users report the fake to Facebook. Unlike the fake page, the Shpachuk page posting the warning is run by someone based in Ukraine (per Facebook’s Page Transparency feature), and is linked from other social media accounts associated with Shpachuk’s guitar repair work. Taken together, these pieces of evidence strongly indicate that the Cambodia-based “Tanya Shpachuk” page is inauthentic, and it is unclear why Facebook has not removed it after a month and a half of reports.

Subscribe now

Over the last three months, 27 Bluesky accounts belonging to prominent technology reporters and news organizations experienced a rapid uptick in follows from newly-created accounts with little or no content. While it is not unusual for new Bluesky users to follow well-known journalists and media outlets, this sudden large increase in follow activity from new accounts is notable and anomalous. The shift in follower growth pattern corresponds to the journalists and news outlets being added to a starter pack created in October 2025 by an obscure account that has yet to post anything whatsoever.

As it turns out, there is a Bluesky starter pack comprised of the exact set of 27 tech media accounts that experienced the October 2025 shift in follower growth patterns. This starter pack, with the name “Tech News”, was created on October 1st, 2025, by @bskystarterpack.bsky.social, a Bluesky account with a default profile image and zero posts. While every single account added to this pack is already listed in dozens or hundreds of other starter packs, only this one appears to have been accompanied by a corresponding influx of low quality followers.

The “Tech News” starter pack is far from the only starter pack created by @bskystarterpack.bsky.social. As of the time of this writing, the account has created 24 themed starter packs, with titles ranging from “Economics” to “Bluesky Comedians” to “Animals & Wildlife”, and everything in between. There is some overlap between the starter packs; for instance, Wired’s official Bluesky account has been added to both the “Tech News” and “Major News Outlets” packs.

19 of the 24 starter packs created by @bskystarterpack.bsky.social were created over the span of exactly an hour on October 1st, 2025, with the remaining five created between October 2nd, 2025, and January 24th, 2026. While most users that create starter packs also post links to them, the operator of the @bskystarterpack.bsky.social account has yet to promote any of their starter packs, or indeed post anything at all. The majority of these starter packs have also never been shared on Bluesky by any other user.

The effect of these starter packs on the follower growth patterns of the accounts listed in the packs is significant. In the case of all but two of the @bskystarterpack.bsky.social starter packs (“Writers & Authors” and “Major News Outlets”), addition to the starter packs was accompanied by drastic increases in back-to-back follows from new accounts and accounts created within an hour of one another. In many cases, these new followers have few or no posts, either presently or at the time of their creation.

As often happens with spammy social media operations, some of the low quality followers associated with the shady starter packs use plagiarized profile photos. Many of these images have repeatedly been used for fake accounts on a variety of websites, and some are even inventoried on sites that maintain lists of photographs frequently used for scams. Depending on the image, both Google and TinEye were occasionally useful in tracking down other occurrences of the photos used by the accounts.

Although many of the followers associated with the starter packs have no posts at all, some have posted, and some of their posts contain additional evidence of spam and inauthenticity. Account sales operations are a recurring theme, with available merchandise ranging from social media and email accounts to verified accounts with payment processing platforms such as Paypal and Cashapp; aged Gmail accounts seem to be a particularly common piece of merchandise. In some cases, these account sales services are advertised using the same graphics by multiple accounts.

The post-starter pack followers also contain several clusters of link spam accounts: groups of similar-looking accounts which post little or no original content and instead simply spam Bluesky with links to obscure websites, posted in the same order by each account. The above collage of posts linking to wealthhg(dot)com is representative of the phenomenon; similar posting patterns revolving around other websites turn up as well.

Obvious scams also turn up among the posts from the low quality followers summoned by the starter packs. These scams include a variety of posts inviting the reader to comment on what they would do if they suddenly received a large sum of money, presumably for the purpose of luring potential marks into providing financial account information. Anecdotal evidence from users indicates that similar scam attempts are also being made via direct message.

The presence of a variety of different types of spam suggests that, rather than all belonging to a single network operated by a single individual, the various low quality accounts following the major accounts listed in the starter packs include a variety of spam networks, potentially operated by a variety of entities.

Subscribe now

As Bluesky continues to grow in popularity, automated posting features from services such as dlvr.it have seen a corresponding increase in adoption. Tools of this sort are often used to create automated news feeds, frequently aggregated from multiple news sources and media websites, and have long been utilized for this purpose on older platforms such as X (formerly Twitter). While some of these automated feeds are operated by news organizations themselves, others are run and curated by random individuals. Among these is one of the most prolific sources of links to low quality right-wing news sites on Bluesky, an account that recently changed names from “Ian Hansen” to “BS Favourite AI Bot”.

A search performed on January 8th, 2026 for the most recent 50000 Bluesky posts containing dlvr.it links yielded posts from 960 distinct accounts, with the most prolific having posted hundreds of times via dlvr.it during that time period. The most frequent dlvr.it posters include accounts based in a variety of countries posting news and updates on a variety of topics, with the most active account being a UK-based flood alert feed. The second most frequent user of dlvr.it is a bit more interesting, however…

With 832 dlvr.it posts over the course of four days, the account @bsrussianbot.bsky.social (“BS Favourite AI Bot”) is one of the highest-volume users of dlvr.it on Bluesky. Almost all of this account’s posts are automated via dlvr.it, and almost all of the automated posts are links to right-wing media sites such as Gateway Pundit and Newsmax. Despite the high posting volume, most of the content gets very little engagement, and the account has thus far only accumulated a few hundred followers.

The “bot” portion of the @bsrussianbot.bsky.social account’s name is highly accurate, as almost all of the account’s posts are in fact automated. 95077 of 95658 posts to date (99.4%) were posted automatically via dlvr.it, with almost all of the automated posts being links to various conservative media sites. At peak times, the account exceeded 300 posts per day; the posting level generally fell off somewhat on weekends due to the underlying news sites publishing less content on Saturdays and Sundays.

The websites most frequently linked by the @bsrussianbot.bsky.social account are Breitbart, Newsmax, and Red State, with a smorgasbord of right-wing media sites filling out the remainder of the list. This account is among the most abundant sharers of English-language right-wing media on Bluesky, with tens of thousands of links to the most frequently linked sites. Note that these posts do not presently come up in Bluesky searches for the sites’ own domain names; instead, they appear under searches for “domain:dlvr.it”.

As mentioned earlier, the Bluesky account currently named @bsrussianbot.bsky.social (“BS Favourite AI Bot”) was recently renamed. Prior to January 8th, 2026, the account had the handle @ianhansen.bsky.social and the display name “Ian Hansen” (per contemporaneous screenshots). It is unclear whether this name has anything to do with the account operator, but given that the account’s content has been almost entirely automated all along, revising the name to include “bot” is a (perhaps unintentional) increase in honesty.

Subscribe now

Movies and TV shows are full of fictional scenes where characters use computers to “enhance” images and videos, magically filling in details that are in no form present in the originals. With the rise of AI image and video generators in recent years, social media users have been attempting to use these tools to perform such enhancements on real photographs and footage of major news events, such as the recent killings of Minneapolis residents Renée Good and Alex Pretti by federal immigration agents. This technique does not work, however, as the additional details in the “enhanced” images and videos are fabricated based on the AI models’ training data, and are often provably at odds with reality.

On January 7th, 2026, in the immediate aftermath of the shooting death of Renée Good by the ICE agent eventually identified as Jonathan Ross, numerous social media users made attempts to use generative AI tools to remove the face mask from photographs of the shooter. This process resulted in a variety of images that neither show the actual killer nor even depict the same imaginary person, making the output quite useless for the purpose of identifying the shooter. This outcome is not surprising, as image generation models have no way of “knowing” what the face behind the mask actually looks like, and are simply filling in the masked area with details mathematically interpolated from images in their training data.

A quick experiment with Grok highlights another obvious issue with using AI models to “enhance” images: the output is inevitably guided by the prompt used to generate it. In the case of this photograph, Grok complied with requests to add specific features such as facial hair and tattoos to the unmasked image. The ability to trivially influence the resulting image in a given direction is one more reason why using generative AI to enhance images is not a suitable technique for identifying unknown individuals.

A bit over two weeks later, Alex Pretti was deliberately shot and killed by as-yet-unidentified federal agents, and, as with the shooting of Renée Good, social media users made various efforts to use generative AI tools to enhance photographs and videos of the shooting. One popular “enhancement” includes several frames where the gun removed from Pretti by an agent appears to fire at the ground while in the agent’s hand. This is entirely an act of digital fiction, however; no such discharge occurs in the real video. Additionally, the gunshot depicted in the “enhanced” video is unrealistic in multiple ways; no recoil is evident, and the blast includes a jet of flame more reminiscent of a flamethrower than a typical firearm.

Other images circulated after Pretti’s killing include numerous attempts to use AI to increase the resolution of individual frames from various videos of the shooting. As with the previous “enhancements” described in this article, this technique simply does not work, as the AI models are filling in the missing detail with information derived from their training data rather than anything to do with the actual incident depicted. Unfortunately, based on the degree of engagement garnered by inaccurately “enhanced” images and videos of the recent Minneapolis shootings, we can expect major news events to be accompanied by similarly misleading AI-enhanced depictions for the foreseeable future.

Subscribe now

As Bluesky continues to grow in popularity, various providers of illicit social media marketing services have made use of the platform to advertise their offerings with increasing frequency. These services, known as “SMM panels” (social media marketing panels), sell followers, likes, reposts, and other forms of engagement for a variety of social media platforms, despite this being a violation of most sites’ terms of service. Over the course of the last year, dozens of accounts promoting these panels and their services have popped up on Bluesky.

Many of the Bluesky accounts promoting SMM panels follow each other and repost one another’s content. This amplification, along with the fact that some of the accounts promote the exact same websites, strongly indicates that at least some of the SMM panel accounts are operated by the same entity. Similarities between the various SMM panel websites suggest that the sites themselves also may share operators or developers.

In addition to selling followers, likes, reposts, and other forms of engagement directly through their own websites or Telegram channels, many SMM panels also offer APIs (application programming interfaces). This allows customers to automate the process of purchasing the panels’ services, reducing the amount of human effort required to procure spammy amplification on an ongoing basis, and allowing engagement from banned accounts to be easily replaced. The APIs offered by the various SMM panels are all extremely similar, which further indicates that at least some of the panels are run by the same individuals or groups.

Among the more unusual efforts to promote an SMM Panel on Bluesky is an apparently abandoned network of dozens of empty accounts with duplicate biographies. Each of these accounts has the biography “Bluesky SMM Panel t.me / ibbepanelbot”, a default profile image, and no posts whatsoever. The link in the repeated biography leads to a Telegram bot allegedly associated with an SMM panel, but as of the time of this writing the bot does not appear to be operational, making it difficult to evaluate the panel’s offerings.

The network promoting this SMM panel consists of 136 Bluesky accounts created over the course of roughly six hours in June 2025. Thus far, none of these 136 accounts has actually posted anything and, as mentioned earlier, the Telegram-based ordering system for this particular SMM panel appears to be offline. This does not, however, mean that this set of accounts is irrelevant or permanently inactive; it is not uncommon for swarms of dormant spam accounts to be suddenly reactivated and repurposed, and it would not be surprising to see these accounts reused for additional astroturfing at some point in the future.

Subscribe now