Selling followers where the skies are blue

Sketchy follower sales sites are (unsurprisingly) expanding to Bluesky

we are totally real people with stolen photos and identical biographies

As Bluesky approaches the 30 million user mark, operators of services that sell bogus social media engagement have been escalating their attempts to take advantage of the relatively new platform’s increasing popularity. Purveyors of bogus follows, likes, and shares require large armies of accounts in order to ply their trade, and these accounts can often be detected by their behavior. In this article, we’ll take a look at a network of fake Bluesky accounts associated with a service that sells followers for X/Twitter, Instagram, YouTube, TikTok, and Telegram, as well as Bluesky itself.

most of the accounts were created in large batches in mid-December 2024

This fake follower network, which was flagged at several points by the firehose monitoring process described in this previous article, consists of (at least) 8070 Bluesky accounts created between November 30th and December 30th, 2024, mostly in large batches in mid-December. Thus far, none of the accounts in this network has posted anything, although a few have reposted other accounts’ posts on occasion. Most follow somewhere in the neighborhood of a dozen accounts.

the spam accounts have repetitive Portuguese biographies

Almost all of accounts’ biographies are in Brazilian Portuguese; a handful of accounts have biographies consisting of brief strings of emoji instead. Many of the biographies used by the network are repeated verbatim across dozens of accounts. The biographies are very similar in style, making frequent references to the alleged occupations and astrological signs of the fake accounts. Some contain references to locations in Brazil.

commas and emoji, what more do you need?

In cases where the biographies are not duplicated exactly, they are assembled from shorter recurring phrases, separated by commas. In some cases, this process seems to have failed, resulting in biographies beginning with multiple unnecessary commas or consisting entirely of punctuation. The glitchy biographies are likely an indicator that the biographies were generated by automated means, but could also be the result of a human operator making a mistake while copying and pasting text.

most of these accounts have almost no real followers

Although the accounts in this fake follower network present as Portuguese-speaking Brazil-based users, most of the accounts they follow post in English or, occasionally, Greek. Many of these accounts gained almost all of their audience from the spam network and have almost no genuine followers whatsoever. The accounts with massive numbers of followers from the network are largely promotional or business accounts; roughly a fourth of the spam accounts follow the official @bsky.app account.

as always, buying followers is unwise

Among the accounts followed by the spam accounts is @jujingwebs.bsky.social, which gained almost all of its 1100-ish followers from the network. This account’s biography links to a website described as “one of the largest fans and like providers in the world”, which sells followers for a variety of social media platforms. According to the @jujingwebs.bsky.social account and the associated website, these platforms include Bluesky, Instagram, Telegram, TikTok, Twitter/X, and YouTube. The Bluesky fake follower network is likely just one component of this spam-for-hire operation’s infrastructure; similar networks are presumably present on the other platforms serviced as well.

the spam accounts repost different accounts than they follow

In addition to following users en masse, some of the accounts in the fake follower network also repost content here and there. Unlike the accounts followed by the network, the accounts reposted are mostly Brazilian accounts that post in Portuguese (matching the language of the spam accounts’ biographies), with a Brazilian Taylor Swift news account at the top of the list. There is very little overlap between the set of accounts reposted by the network and the set of accounts followed.

plagiarized photos: the hallmark of sincerity

Large spam networks often make use of stolen profile photos (although images produced via generative AI are an increasingly popular option), and this fake follower network is no exception. Most of the images used as profile images by the spam accounts have previously been posted dozens of times in various places on the Internet. A few of the accounts have default avatars, possibly due to errors in automated account creation.