To find spam networks, go where the spammers are

One can often map out networks of social media spam accounts by using information that the spammers themselves provide to advertise their services

despite the alleged demise of spam bots on X, stuff like this is easy to find

How does one go about finding spam networks on social media platforms? Sometimes, the direct approach is best — simply go where spammers are advertising or discussing their services and start poking around. In this article, we’ll use a BlackHatWorld post advertising “X NFT Followers” as a starting point and follow the trail to a group of cryptocurrency-focused spam accounts operating on social media platform X (formerly Twitter).

you probably shouldn’t pay money for any of this

The BlackHatWorld post offering “X NFT followers” includes a link to the website dmister.com, which offers a variety of illicit social media services. These services are mostly focused on X and include likes, mentions, reposts/retweets (both terms are used on the site), quote posts, comments (also known as replies), followers, and Spaces listeners, with a specific focus on amplifying cryptocurrency/NFT giveaway posts. The site also offers a few spamtastic services for Instagram and Discord, including likes, reactions, and followers.

tip: when viewing Google docs from untrusted parties, use a dummy Google account (or stay logged out entirely if possible)

The dmister.com website conveniently provides a Google spreadsheet containing a list of example spam accounts from the dmister.com network, presumably so that prospective customers can get an idea of what they’re buying before making a purchase. This list also provides an opportunity to study the network and search for more accounts based on the characteristics of the example accounts. There are multiple ways of going about this; for the purposes of this analysis, additional accounts were located by searching for other accounts posting exact duplicates of recent non-trivial posts from the example accounts. Accounts with multiple duplicate posts were considered potential members of the network, and obvious false positives were manually removed.

this set of 496 accounts is likely incomplete

This process resulted in 496 potential spam accounts, which is likely only the tip of the iceberg given the inefficiency of exploring a network like this without a robust means of data collection such as the now-removed free X/Twitter API. The creation dates of these accounts range from 2009 to 2023, with the vast majority of the accounts having been created in 2022 or 2023. The accounts are small, with most having only a few dozen followers. Almost all of the accounts follow substantially more accounts than follow them; the average following:followers ratio for the spam accounts is 4:1 and the median ratio is 10:1.

these spam accounts repost crypto content (and Elon Musk)

The dmister.com site advertises the amplification of cryptocurrency/NFT giveaway posts as one of its primary services, and the spam accounts indeed amplify content of this sort frequently. Almost all of the accounts most frequently reposted by the network are crypto-themed, with the notable exception of SpaceX/Tesla CEO and X owner Elon Musk’s @elonmusk account. Whether the latter is a deliberate attempt to astroturf Musk’s posts or an effort to make the accounts blend in by sharing content from an already popular influencer is unclear from the available evidence.

if none of the sentences in the posts in this table mean anything to you, you’re probably better off

These spam accounts do not solely repost content; they also post and reply. These posts and replies are highly repetitive, with many having been posted verbatim hundreds of times by dozens or hundreds of accounts. As with the reposts, the accounts’ repetitive posts and replies are pretty much all cryptocurrency themed (although some of the crypto tokens being offered, such as $TRUMP, have obvious political overtones).

nothing to see here, just a bunch of accounts posting duplicate content