Over the past 5-6 months, I’ve been noticing a lot of new accounts spinning up that look like this format:

  • https://instance.xyz/u/gmbpjtmt
  • https://instance.xyz/u/tjrwwiif
  • https://instance.xyz/u/xzowaikv

What are they doing?

They’re boosting and/or downvoting mostly, if not exclusively, US news and politics posts/comments to fit their agenda.

Edit: Could also be manipulating other regional news/politics, but my instance is regional and doesn’t subscribe to those which limits my visibility into the overall manipulation patterns.

What do these have in common?

  1. Most are on instances that have signups without applications (I’m guessing the few that are on instances with applications may be from before those were enabled since those are several months old, but just a guess; they could have easily just applied and been approved.)
  2. Most are random 8-character usernames (occasionally 7 or 9 characters)
  3. Most have a common set of users they’re upvoting and/or downvoting consistently
  4. No posts/comments
  5. No avatar or bio (that’s pretty common in general, but combine it with the other common attributes)
  6. Update: Have had several anonymous reports (thanks!) that these users are registering with an @sharklasers.com email address which is a throwaway email service.

What can you, as an instance admin, do?

Keep an eye on new registrations to your instance. If you see any that fit this pattern, pick a few (and a few off this list) and see if they’re voting along the same lines. You can also look in the login_token table to see if there is IP address overlap with other users on your instance and/or any other of these kinds of accounts.

You can also check the local_user table to see if the email addresses are from the same provider (not a guaranteed way to match them, but it can be a clue) or if they’re they same email address using plus-addressing (e.g. [email protected], [email protected], etc).

Why are they doing this?

Your guess is as good as mine, but US elections are in a few months, and I highly suspect some kind of interference campaign based on the volume of these that are being spun up and the content that’s being manipulated. That, or someone, possibly even a ghost or an alien life form, really wants the impression of public opinion being on their side. Just because I don’t know exactly why doesn’t mean that something fishy isn’t happening that other admins should be aware of.

Who are the known culprits?

These are ones fitting that pattern which have been identified. There are certainly more, but these have been positively identified. Some were omitted since they were more garden-variety “to win an argument” style manipulation.

These all seem to be part of a campaign. This list is by no means comprehensive, and if there are any false positives, I do apologize. I’ve tried to separate out the “garden variety” type from the ones suspected of being part of a campaign, but may have missed some.

[New: 9/18/2024]: https://thelemmy.club/u/fxgwxqdr
[New: 9/18/2024]: https://discuss.online/u/nyubznrw
[New: 9/18/2024]: https://thelemmy.club/u/ththygij
[New: 9/18/2024]: https://ttrpg.network/u/umwagkpn
[New: 9/18/2024]: https://lemdro.id/u/dybyzgnn
[New: 9/18/2024]: https://lemmy.cafe/u/evtmowdq
https://leminal.space/u/mpiaaqzq
https://lemy.lol/u/ihuklfle
https://lemy.lol/u/iltxlmlr
https://lemy.lol/u/szxabejt
https://lemy.lol/u/woyjtear
https://lemy.lol/u/jikuwwrq
https://lemy.lol/u/matkalla
https://lemmy.ca/u/vlnligvx
https://ttrpg.network/u/kmjsxpie
https://lemmings.world/u/ueosqnhy
https://lemmings.world/u/mx_myxlplyx
https://startrek.website/u/girlbpzj
https://startrek.website/u/iorxkrdu
https://lemy.lol/u/tjrwwiif
https://lemy.lol/u/gmbpjtmt
https://thelemmy.club/u/avlnfqko
https://lemmy.today/u/blmpaxlm
https://lemy.lol/u/xhivhquf
https://sh.itjust.works/u/ntiytakd
https://jlai.lu/u/rpxhldtm
https://sh.itjust.works/u/ynvzpcbn
https://lazysoci.al/u/sksgvypn
https://lemy.lol/u/xzowaikv
https://lemy.lol/u/yecwilqu
https://lemy.lol/u/hwbjkxly
https://lemy.lol/u/kafbmgsy
https://discuss.online/u/tcjqmgzd
https://thelemmy.club/u/vcnzovqk
https://lemy.lol/u/gqvnyvvz
https://lazysoci.al/u/shcimfi
https://lemy.lol/u/u0hc7r
https://startrek.website/u/uoisqaru
https://jlai.lu/u/dtxiuwdx
https://discuss.online/u/oxwquohe
https://thelemmy.club/u/iicnhcqx
https://lemmings.world/u/uzinumke
https://startrek.website/u/evuorban
https://thelemmy.club/u/dswaxohe
https://lemdro.id/u/efkntptt
https://lemy.lol/u/ozgaolvw
https://lemy.lol/u/knylgpdv
https://discuss.online/u/omnajmxc
https://lemmy.cafe/u/iankglbrdurvstw
https://lemmy.ca/u/awuochoj
https://leminal.space/u/tjrwwiif
https://lemy.lol/u/basjcgsz
https://lemy.lol/u/smkkzswd
https://lazysoci.al/u/qokpsqnw
https://lemy.lol/u/ncvahblj
https://ttrpg.network/u/hputoioz
https://lazysoci.al/u/lghikcpj
https://lemmy.ca/u/xnjaqbzs
https://lemy.lol/u/yonkz

Edit: If you see anyone from your instance on here, please please please verify before taking any action. I’m only able to cross-check these against the content my instance is aware of.

  • bdonvr@thelemmy.clubEnglish
    1·
    3 months ago

    Sigh…

    I’ll look into it. Thanks for pointing them out.

    Edit: I’ve banned some obvious ones. I’ll have to look into it more when I get home.

    • Coelacanth@feddit.nuEnglish
      2·
      3 months ago

      I believe “Russian Bot Farm Presence” is the preferred metric of social network relevance in the scientific community.

      • Admiral Patrick@dubvee.orgOPEnglish
        1·
        3 months ago

        Lol, that sounds like a Randall Munroe unit of measurement, and I love it. If there’s not already an xkcd for that, there should be.

    • abff08f4813c@j4vcdedmiokf56h3ho4t62mlku.srv.usEnglish
      0·
      3 months ago

      What surprises me is that these seem to be all on other instances - including a few big ones like just.works - rather than someone spinning up their own instance to create unlimited accounts to downvote/spam/etc.

      • schizo@forum.uncomfortable.businessEnglish
        1·
        3 months ago

        Not really: if you’re astroturfing, you don’t do all your astroturfing from a single source because that makes it so obvious even a blind person could see it and sort it out.

        You do it from all over the places, mixed in with as much real user traffic as you can, and then do it steadily and without being hugely bursty from a single location.

        Humans are very good at pattern matching and recognition (which is why we’ve not all been eaten by tigers and leopards) and will absolutely spot the single source, or extremely high volume from a single source, or even just the looks-weird-should-investigate-more pattern you’d get from, for example, exactly what happened to cause this post.

        TLDR: they’re doing this because they’re trying to evade humans and ML models by spreading the load around, making it not a single source, and also trying to mix it in with places that would also likely have substantial real human traffic because uh, that’s what you do if you’re hoping to not be caught.

  • Otter@lemmy.caEnglish
    1·
    3 months ago

    I think what we need is an automated solution which flags groups of accounts for suspect vote manipulation.

    We appreciate the work you put into this, and I imagine it took some time to put together. That will only get harder to do if someone / some entity puts money into it.

    • Admiral Patrick@dubvee.orgOPEnglish
      1·
      3 months ago

      Yeah, this definitely seems more like script kiddie than adversarial nation-state. We’re not big enough here, yet anyway, that I think we’d be attracting that kind of attention and effort. However, it is a good practice run for identifying this kind of thing.

    • Admiral Patrick@dubvee.orgOPEnglish
      1·
      3 months ago

      I strongly advise verifying first, but yes.

      I can only verify them based on the posts/comment votes my instance is aware of. That said, I do have sufficient data and enough overlap to establish a connection/pattern.

  • TheObviousSolution@lemm.eeEnglish
    1·
    3 months ago

    Users could also be doing and reporting the checking up - if votes were transparent - and they would be able to do it on far wider scale. Oh those leopards, eating your faces, vote obfuscation proponents.

  • dethada@lemmy.zipEnglish
    0·
    3 months ago

    Is there any existing opensource tool for manipulation detection for lemmy? If not we should create one to reduce the manual workload for instance admins

    • johannesvanderwhales@lemmy.worldEnglish
      0·
      3 months ago

      If there were, upbotters would use it to verify that new bottling methods weren’t detectable. There’s a reason why reddit has so much obfuscation around voting and bans.

      • dethada@lemmy.zipEnglish
        0·
        3 months ago

        Good point, but is it then possible to come up with detection algorithms that makes it hard for upbotters even if they know the algorithm? I think that would be more ideal than security through obfuscation but not sure how feasible that is

        • johannesvanderwhales@lemmy.worldEnglish
          1·
          3 months ago

          I don’t know honestly. Really, with AI it would be pretty difficult to be foolproof. I’m thinking of the MIT card counting group and how they played as archetypal players to obscure their activities. You could easily make an account that upvoted content in a way that looked plausible. I’m sure there are many real humans that upvote stories positive to one political party and downvote a different political party. Edit: I mean fuck, if you wanted to, you could create an instance just to train your model. Edit 2: For that matter, you could create an instance to bypass any screening for botters…

  • ericbomb@lemmy.worldEnglish
    0·
    3 months ago

    But this is SOO tedious. The annoying bit is it could just be one person who set it up over a weekend, has a script that they plug into when wanting to be a troll, and now all admins/mods have to do more work.

    You’re fighting the good fight! So annoying that folks are doing it on freaking lemmy.

    • Buddahriffic@lemmy.worldEnglish
      0·
      3 months ago

      I wonder if there’s a way for admins to troll back. Like instead of banning the accounts, send them into a captcha loop with unsolvable or progressively harder captchas (or ones designed to poison captcha solving bots’ training).

      • curry@programming.devEnglish
        0·
        3 months ago

        Not sure if shadowbanning can work here. Wasting each instance’s limited pool of resources is not what we want to encourage.

        • Buddahriffic@lemmy.worldEnglish
          1·
          3 months ago

          Yeah not to mention it’s not that hard to detect a shadowban if you’re aware of the possibility. Lemmy doesn’t even fuzz vote totals, so it would be trivial to verify whether or not votes are working.

  • Linkerbaan@lemmy.worldEnglish
    01·
    3 months ago

    In case people are wondering these bots are advocating for Kamala Harris.

    Dessalines is the developer of Lemmy and occasionally notifies users their posts are being botted

    Dessalines notified me on two of my own posts that they were heavily downvoted by low /zero content accounts in the past as well.

    • el_abuelo@programming.devEnglish
      0·
      3 months ago

      Just beware the bias here. Only pointing this out for people working against their agenda doesn’t mean there isn’t the same going on for the other side…just that they aren’t going to point it out as it doesn’t help their agenda.

      • SirDerpy@lemmy.worldEnglish
        0·
        3 months ago

        Trump lacks the numbers, the budget, and the leadership. Much has changed in 8 years.

        • RememberTheApollo_@lemmy.worldEnglish
          0·
          3 months ago

          It isn’t trump’s people pushing the buttons. The people running around before Biden dropped out yelling “Genocide Joe” almost definitely weren’t under trump’s control, and were possibly paid foreign actors. The same was true 8 years ago.

          • SirDerpy@lemmy.worldEnglish
            01·
            3 months ago

            The USA kills lots of people: Native Americans, African Americans, Arabs, Asians. We’re still doing it, now even to whites in Ukraine. It’s all to feed the military industrial complex, just as Eisenhower warned. War is why capital reserves for banks have been raised and why the Fed speaks of lowering the borrow rate. Admitting it is the difference between a patriot and a nationalist.

      • Linkerbaan@lemmy.worldEnglish
        01·
        3 months ago

        If Left wing content was upbotted I’m quite sure the Lemmy.World admins would notice and point it out very quickly.

      • Linkerbaan@lemmy.worldEnglish
        01·
        3 months ago

        Their entire agenda hangs on people not jumping ship because everybody just loves Democrats so much and the alternatives are not popular enough.

        Nobody is even arguing that they like Democrats anymore, it’s just yapping about how Biden (and now Kamala) is the only viable option to win. If it turns out alternatives are actually popular enough that enough people are willing to jump ship the entire narrative sinks.

        • SirDerpy@lemmy.worldEnglish
          0·
          3 months ago

          Consider the alternative of putting the Green platform on every ballot in 2028, overcoming the first and largest obstacle maintaining duopoly. It takes only 5% of the GE popular. Then, watch as Democrats panic to maintain the “big tent” for four years.

          I’m a triple minority. I’ve suffered assholes my whole life. Things got worse under Trump. But, that damage is already done. In this facet nothing changes for me if it’s Trump once again. I’m not afraid. We must think in terms much greater than four years.