Spam based, interested in spam
The tale of a straightforward but large network of fake Bluesky accounts
On Tuesday, April 8th, 2025, someone created a large yet strangely low-effort network of Bluesky spam accounts with extremely similar biographies like "Ireland based, interested in travel", "Netherlands based, interested in fashion", "Turkey based, interested in technology”, and “United Kingdom based, interested in coding”. This network grew very rapidly, with over twelve thousand accounts created in a little over three hours. Almost all of the accounts were subsequently suspended by Bluesky; the network nonetheless makes for an interesting case study of a simple social media botnet.
Prior to being shut down, this spam network consisted of 12048 Bluesky accounts created over the course of roughly three hours on April 8th, 2025. All of the accounts in the network had biographies of the form "<X> based, interested in <Y>", where X is a country and Y a topic of interest. Their handles were 12-character hexadecimal numbers, and their display names were first name/last name combinations, often matching the accounts’ alleged nations of origin. The accounts in the network either followed no accounts or exactly one account, po821.bsky.social (presently suspended); a handful also reposted one of po821.bsky.social’s posts.
The accounts in this spam network constructed their biographies from a set of 21 countries (Australia, Brazil, Canada, Denmark, Finland, France, Germany, India, Iran, Ireland, Mexico, Netherlands, New Zealand, Norway, Serbia, Spain, Switzerland, Turkey, Ukraine, United Kingdom, and United States) and 11 topics (art, books, coding, fashion, gaming, music, photography, science, sports, technology, and travel). All 231 possible combinations of country and topic were used by dozens of spam accounts each, with the most frequently occurring biography, “Brazil based, interested in travel”, appearing 72 times.
Each alleged country of origin appears in the dataset with approximately the same frequency, as does each topic of interest. This state of affairs is consistent with the country and topic having been selected at random for each account in the network. The same appears to be true of the 12-digit hexadecimal numbers used as handles, which contain each of the sixteen hexadecimal digits with roughly equal frequency.
The accounts in the network also used the same profile images over and over, with just 182 distinct avatars across 12048 accounts. These images are a mix of older photographs that have been used online for years (easily found via TinEye), and images that show signs of being AI-generated or otherwise manipulated. The extreme lack of variety in both the images and biographies makes it relatively straightforward to detect the inauthenticity of networks of this sort once a sufficient number of accounts are created.
