1/45
Conspirador Norteño
Every public action on Bluesky is available via a stream of events known as the firehose. By monitoring the firehose for repeated text, it is sometimes possible to quickly detect groups of spam accounts as they spawn.
https://video.bsky.app/watch/did:pl...ae6l2jc5jq4vcvbg6kchka7oebvyy64/playlist.m3u8
2/45
Conspirador Norteño @conspirator0.bsky.social
Monitoring the Bluesky firehose for duplicate biographies over the course of 5 days yielded 2234 fake accounts of various types, including porn, crypto spam, and account selling operations. Over half of the spam accounts detected belong to a single network.
3/45
Conspirador Norteño @conspirator0.bsky.social
The largest network detected by monitoring the firehose consists of (at least) 1155 accounts with 80 distinct biographies of the form "passionate about <A> in the field of "<B>". To date, none of the accounts in this network has posted.
4/45
Conspirador Norteño @conspirator0.bsky.social
All of the accounts in this network were created between November 30th and December 3rd, 2024. Most of the accounts in the network follow a handful of real accounts; thus far, there is no discernible pattern to the accounts that the spam accounts follow.
5/45
Conspirador Norteño @conspirator0.bsky.social
This experiment turned up several smaller networks as well, such as this group of followback patriots named "Daisy" with stolen profile photos and two distinct repeated biographies.
Conspirador Norteño (@conspirator0.bsky.social)
6/45
Conspirador Norteño @conspirator0.bsky.social
Some of the detected spam accounts are for sale. In one case, the sales tactics border on extortion, in the form of 25 accounts named after major corporations with the repeated biography "message for a handle transfer fee or your competitor’s advertisements will be posted".
7/45
Conspirador Norteño @conspirator0.bsky.social
Finally, some of the spam networks detected by monitoring the Bluesky firehose are just plain weird, such as this set of 19 accounts with the biography “Because One Checkmark Just Isn’t Enough” and checkmarks in every color of the rainbow as avatars.
8/45
Conspirador Norteño @conspirator0.bsky.social
Substack post with more detail, as well as the Python code used for this experiment:
Spam in the firehose
9/45
Conspirador Norteño @conspirator0.bsky.social
General info on the Bluesky firehose:
Firehose | Bluesky
Github repo for the atproto Python module, used in this experiment:
GitHub - bluesky-social/atproto: Social networking technology created by Bluesky
10/45
Conspirador Norteño @conspirator0.bsky.social
Since it's apparently necessary, I just want to clarify that I do understand that the rainbow check accounts are a joke making fun of X's silly "verification" system.
My decision to include them here was likewise intended as humor, not a demand for Bsky to take them down.
Conspirador Norteño (@conspirator0.bsky.social)
11/45
nancyspantsbelt.bsky.social @nancyspantsbelt.bsky.social
Glad to find you!
12/45
Bsky Hub @bskyhub.com
Hey mate, awesome work! Bots are becoming a real nuisance on Bluesky. Lmk if you'd like to collab and find a way to help deal with them.
13/45
APH @aph757.bsky.social
What about a rudimentary script that compiles accounts with say less than 5 followers, less than 5 posts, and 5 or more other accounts who blocked it - and this list dynamically updates and becomes a widely applied proactive bot blocker…
14/45
APH @aph757.bsky.social
I feel it’s easier to work off count thresholds… unless some logic can be applied to the firehouse data to parse out the “too similar” accounts based on their other attributes
15/45
Bsky Hub @bskyhub.com
Yeah I'm thinking something along those lines..
I think you could use a variety of techniques to catch them. i.e. if it is just follower count they might all start following each other.
16/45
Bsky Hub @bskyhub.com
But the yes, create an automated labelling system or giant list of accounts that anyone can subscribe to so users can these accounts en masse.
17/45
Chilly Gills @chillygills.bsky.social
I'm willing to make financial donations to people that properly curate bot block lists based on this information.
18/45
Rick@Cincy @woessner.us
Same I think it’s worth investing in a positive internet
19/45
Dave Durazzo @seatosierras.bsky.social
Same!
20/45
Kitty of Caerbannog @caerbannogkitty.bsky.social
it's probably too much on your own to handle but if someone could create a block list for such events automatically it would kick ass - wonder if it's possible - API's and stuff are sorta out of my wheelhouse
21/45
Alexander R @alexanderr.fellas.social
It should be relatively simple for an AI pro to write a routine that detects and automatically flags these accounts, something Bluesky should invest in.
22/45
The Climate Informant @monewsdaily.bsky.social
AI is creating the bots that this doesn't catch...
23/45
gen x rants @genxrants.bsky.social
Holy….wow. This must’ve taken a lot of work, I’m gobsmacked by the dedication. Then again, what do I know. I’m so naïve, you could be a fake person and I wouldn’t know.
If you are real, thanks for taking the time to document all of this.
If you are fake, beep boop bop.
24/45
maj0rmattmas0n.bsky.social @maj0rmattmas0n.bsky.social
What about repeated pictures? I see the same photos repeatedly in some of the accounts that try to follow me.
25/45
Ben J. Clarke @benjclarke.me
This is fantastic. I just subscribed to the newsletter.
26/45
It is I, Idris Arslanian! @rikabel69.bsky.social
This is amazing, bravo.
Paul Frazee (@pfrazee.com)
27/45
depado @depa.do
Would it be possible to have a labeller or an automated blocklist for such accounts? I remember over on the cursed platform being followed relentlessly by these kind of account and it was so tiring.
28/45
jacksonr08.bsky.social @jacksonr08.bsky.social
How do we block them all?
29/45
joocifer @joocifer.bsky.social
Not only spam accounts, it’s possible to do any type of data analysis you’d like using firehose data.
30/45
joocifer @joocifer.bsky.social
(I wrote this before seeing the rest of your thread, thx for the python examples and the rest of it.)
31/45
Amy Dentata @amydentata.bsky.social
I've been saying for a long time that companies should be able to autodetect and take down botnets, using all the data available on their end. Waiting for them to actually do it
32/45
Random Thaughts @randomthaughts.bsky.social
Many companies, especially financial areas constantly under attack and doing just what you’re talking about.
Unfortunately, them talking about what they are doing gives bad guys more info on how to get around it.
It’s truly whackamole
33/45
Steve Townsend @stevetownsend0.bsky.social
are you detecting repeated text on the fly, or noticing ad hoc and then filtering for it?
34/45
Conspirador Norteño @conspirator0.bsky.social
On the fly, and then reviewing it manually every now and then to remove stuff like accounts with the default biography or biographies that are otherwise insignificant.
35/45
Steve Townsend @stevetownsend0.bsky.social
Nice, thanks for the write-up
36/45
Honey in Aotearoa @honeyinaotearoa.bsky.social
I honestly have no clue what this all means… but you sound very smart and kind. I am clapping 🩵🩵🩵
37/45
CocoM80 @cocom80.bsky.social
Is that Rage Against the Machine musak?
38/45
Chad Everett Miller @chadeverett.bsky.social
Are you saying we can track and get rid of bots?
39/45
Kitty =^.^= @pixelbuttz.bsky.social
Oh that's cool!
40/45
DrRamblings @drramblings.bsky.social
Great tip! Definitely going to try that out.
41/45
mlf. @mlf.one
plz put your code on GitHub or similar, I know it's in the Substack post but I sense I'm not alone in wanting to experiment with forking/iterating on your basic workflow.
42/45
Oldboy Bebop @dadbod.bsky.social
Another banger, good shyt
43/45
Grolaw @grolaw-me.bsky.social
Brilliant! Thanks for your insight.
44/45
Rune @readerofforbidden.bsky.social
//G o o d
45/45
Kat@KatlandKat @katlandkat.bsky.social
Just today notice two MAGA accounts spouting nonsense and insults here. Left TwitterX due to spending all my time blocking people and not getting any worthwhile news
Hate to go through that again personally j/s
To post tweets in this format, more info here: https://www.thecoli.com/threads/tips-and-tricks-for-posting-the-coli-megathread.984734/post-52211196