SiioSytri

Siio Sytry

@SiioSytri

nonbinary vampiric dragon

Antifascist! | Pronouns: Any |Age:24| Nonbinary | Furry | Artist | discord: Siio Sytry#7689

log in
SiioSytri
@SiioSytri
chirasul
@chirasul
kojote
@kojote

Something is Wrong on the Furry Internet

It started in July.

Every few days, almost always at just about 12 minutes past 6 in the morning, somebody creates a new account on FurAffinity. That’s probably normal. Except, in this case, the account doesn’t post anything. It doesn’t follow anyone. It doesn’t have any followers. It doesn’t favorite any art. It just sits there, silent. The name is written in all caps. There is, almost always, no avatar. There are never any details.

That’s also probably normal, right? Lots of FA accounts must be empty.

But, that same day, whoever created that account also creates one on SoFurry. And on DeviantArt. And on e621. And, almost but not always, on Reddit, Inkbunny, and Twitter. Sometimes they create an account on Telegram and Mastodon. I first noticed this back in September, when I saw a user named “JARDSKJALFTI.” Then I kept looking. Here is what I’ve found.

Help. I feel like I am staring into madness.

They register at the same time of day. Every single one of those FA registrations was made between 1 and 12 minutes after the hour, and every single e621 registration was made between 1 and 23 minutes after the hour.

There is never any identifying information. They register on multiple platforms—the most recent three names have also registered on “Naughty Machinima,” apparently—but never link to one another.

The names frequently reference bears, and the controlling entity appears to like bears. The names are frequently Icelandic, Alaskan/Northern Canadian First Nations, or Germanic in origin, and when they can be rendered with diacritics, they are rendered in diacritics.

The “Hvittljon” name uses the flag of a Swiss town as an avatar. The “Astædur” and “Braudbjorn” names, however, use what may (?) be machine-generated icons, which as far as I can tell have not ever appeared anywhere on the Internet.

The controlling entity—hereafter CE; my conspiracy-corkboard folder is called “WHO THE FUCK” and the Excel spreadsheet I started is called “the caps name creature”—lists a location on DeviantArt four times. Three times (for Braudbjorn, Astædur, and Tholinmaedi) it is given as “United States.” Once, for Hvittljon, it is given as Chile. The only activity the accounts have ever generated, with one exception, is on Reddit. In two cases. Hvittljon, who has a polar bear in their bio, posted several times on r/elderscrollsonline, saying things like:

Is all in your mind, wise people say something like "everything that manage to makes you angry, is your master". So you need to take that power away from others, or be condemn to never find joy and peace in what you do :].

and

Elves are at the center of EVERY SINGLE PROBLEM IN MOST FANTASY WORLDS!, Elves create this stupid laws and prejudices against minorities like Necromancers to distract us from the real problem, THEM.
To make the world a better place ALL ELVES MUST DIE!, none shall be spare :].

Astaedur posted once, to r/bears, saying:

:]

That’s it, except—like I said—with one exception. On September 30th, someone posted on BAASTHEROX’s FurAffinity shoutbox, asking: “Why are you creating all these profiles? What’s going on?” Ten hours later, BAASTHEROX posted a reply, saying:

What the Dragon does in the privacy of his Lair is his business, and his alone.

When I asked my friends about this back in early September, the consensus was that this was some kind of botnet. The accounts are, presumably, computer-generated because they always register at about the same time, and they register multiple accounts in the exact same way at the exact same time, every time.

It feels like some kind of experiment to me, but one that I cannot understand. They don’t follow anyone. They don’t post comments on anyone’s artwork. With the exception of one FA shout and a few Reddit comments, they generate zero interaction. The Reddit posts seem to have been human-generated, and seem to be mostly on topic. They also seem, from the square-bracket emoji, to be either written by the same person or generated using the same algorithm.

I find this weird. It feels like some kind of Cicada 3301 sort of thing. Or like a numbers station, but exclusively furry. Did the CE write those Reddit posts themselves? I was going to say “there has to be someone actively monitoring these accounts, because they replied to someone on FA” but… did they? Was that an algorithm, too?

It is like I am staring into the underlayer of an Internet I did not realize existed. I’m torn between wanting this mystery solved, and knowing beyond a shadow of a doubt that it would be more interesting as a mystery.

…Right? This has to be just some side project nobody expected anyone to notice. And what does it really matter?

For most of September, I kept an eye on new accounts on e621 (where they always register) and SoFurry, and just kept track of it. Honestly, back in early September, I was going to write up a Cohost post, and then I decided it was boring and weird.

The accounts started appearing in July. They’re still being created. That’s it. I decided this was something that I would leave well enough alone, because, like I said, nobody else seems to care and, as activity began to taper off in late September, I figured it was over. I wrote part of the Cohost post, which is what you’ve just read. You might notice that the post keeps going.

That’s because, today, I came across BJARNDYRAKONGUR. And I genuinely almost started crying, because it was like the rabbithole suddenly yawned so wide I no longer had any sense of how far it went.

(And I haven’t been sleeping, but. Y’know. Mostly it’s the bears)

BJARNDYRAKONGUR has an account on SoFurry, FurAffinity, Inkbunny, Twitter, Mastodon, Telegram, e621, and DeviantArt. However, they don’t come from July. They come from August, 2022. That’s right, it didn’t start over the summer. It started last summer, and then the CE went dormant for a year.

They were even more active on Reddit than Hvittljon, at about the same time, posting mostly to r/elderscrollsonline, again generating posts that seem to be coherent, and which use the same :] emoticon. Again with the same hatred of elves. Again with the bears.

But there’s more, because Bjarndyrakongur did something no other account has. They uploaded some artwork. It is the exact same head-on flat-shaded SVG-looking imagery any other of their accounts has ever used, again of a bear. But, for once, it was uploaded well after the account was created, on November 1st. And it was uploaded with this comment:

I have to upload something today at this exact time, so a simple Profile ID should do perfectly :].

I have to upload something today at this exact time. Why? Why today? Why this exact time? Why this image, specifically? Is this like the numbers in Lost? A smiling image of a bear with slightly unsettling eyes has to be uploaded at a particular time, or…

The date was also weird. So I started looking. It looks like this account was the last of a series. Before that, between August and June, the accounts TROTZIGER, TUURNGATSUAK, SIVUNMUURUK, ATKUNAKTUK, BRAVEHORNS, MASHKUAPEU, FORBEARINGNESS, ZORNIGKEIT, WINZIGKEIT, TROTZIGKEIT, ARTIGKEIT, KNUDDELIGKEIT, EISBARENUMARMUNG, and HERZHAFTIGKEIT were also created.

  • All of them are on SoFurry, Reddit, and DeviantArt
  • All of them, this time, are also on FurryNetwork, which is new
  • Some of them, unlike before, link to other profiles (well, specifically, some of them link to Twitter, which in one case goes to a Twitter account that doesn’t exist)
  • Many of them use the exact same bear icon, which is the one at the top of this post
  • All but one, FORBEARINGNESS, are on e621 and FurAffinity also
  • Most of them are on Twitter; no other accounts seem to be on Mastodon or Telegram

It was a pain to build the bullet list last time, but you can get to these accounts the same way as any other, which is to just post the name into DA/IB/Twitter/etc. They never seem to be spelled differently.

Also, for the first time, I found an account that was actually active on Twitter. @ATKUNAKTUK posted three times on July 26th, 2022. Specifically, they posted:

416941

495151

and

104988

So hey you know remember when I said this sounded like a goddamned numbers station? But that’s it. They never posted again. They never replied to anyone. The account has an avatar, but it’s just the first letter of their name (“A”) on a red background.

Eight of the DeviantArt accounts have a location listed. Seven of those list the location as “United States.” The earliest in that list, HERZHAFTIGKEIT, lists their location as “Chile.” It also lists their birthday as May 19th, and their pronouns as “They/Them.”

Last year, the CE was much more interested in creating accounts on FurryNetwork, something they did only once (that I can find) in 2023. Other than that, the behavior is the same. They register, and then they do: nothing.

Well, almost the same. Once or twice, they post a comment on e621. Sometimes, the Twitter accounts follow other accounts. Unlike the 2023 versions, they reuse icons between accounts (as opposed to just between names).

But it is the same basic pattern of behavior, which is months of empty profiles being generated for no decipherable reason. So what I know is the same as what you know, which is zilch, except that I am both fascinated and concerned by whatever is happening.

“Why don’t you message them, Sandy?”

Because I am worried that it is a sentient AI that will murder me. Or a hacker collective, or a scammer whose radar I don’t really want to be on. I am probably paranoid. Tell you what, you fall on that sword. Get eaten by the elf-racist polar bear.

Or, I mean. Do not. I don’t think I have to say this on Cohost because you seem to have your heads all on straight, but like... please do not go be weird at or to someone who probably is harmless and possibly does not want the attention. Or possibly does? I guess that part I am still undecided on, but put limits on your creepy stalker tendencies that I do not :P

My assumptions are:

  • This project is 99% computer-mediated and drawing from some list of potential usernames, and the reason some accounts are missing is because the site threw an error and the Controlling Entity didn’t catch or correct it
  • The CE is someone who knows a fair amount about computers but has a unique interest in mythology and roleplaying games
  • The CE is especially into bears, since the names often reference bears and in only one case does the icon seem to be not of a bear. In almost all cases the icon is the same pattern, which is a face-on view of a bear head, rendered with what appear to be vector graphics with no shading
  • The CE is someone whose first language is not English. They might be German, given that the 2022 names were almost all German, or they might be Chilean, given that it’s weird for that to be the only other country that shows up
  • The CE actively monitors at least some of the accounts, so if they had to be registered with an E-mail address, those E-mail addresses are probably valid (and maybe also computer-generated)?
  • There is some purpose to all of this…

…But I don’t know what it is. So I’m inflicting it on y’all instead. Because, as James Bridle put it about weird YouTube kids videos, something is wrong on the Internet.

But what? I am throwing this over the fence to you, Cohost, so that I can barricade myself in my apartment from whatever it is I’ve unearthed and peered upon the face of. I’m staying here until you can tell me:

What the actual fuck is going on?

(EDIT: A followup with the last word, a summary, and the community-provided answer)

You must log in to comment.

in reply to @kojote's post:

RenaKunisaki
@RenaKunisaki

This is 80% likely someone making an Alternate Reality Game, 20% someone making a botnet and fucking around a little. Sure, they haven't posted much, yet. The usual modus operandi is to make a bunch of accounts, leave them alone for a few months so they're no longer brand new, and then use them for spam (or sell them to spammers).

login to reply
xinjinmeng
@xinjinmeng

I would also be concerned about a botnet army. Creating 100 accounts all on one day, from the same IP, makes one a prime target for a ban. Spreading them out over two weeks, always creating during non-peak hours...
Armies sit dormant until someone needs to push the button for something. Mass spamming in the comments of one account? Mass faves to artificially inflate metrics? Selling the army off to another user later?
They may be making lots of accounts, not just furry ones. Astroturf doesn't grow by itself. 🤷

login to reply
secrets
@secrets

An army that all shares a gimmick so idiosyncratic that random other users can spot the pattern before any of the accounts even call attention to themselves isn't exactly undetectable. this is like Batman villain level complicating your capers to make sure everyone knows who did it and how to foil you

login to reply
dogonline
@dogonline

i love this kind of thing. it reminds me of similar sort of strange internet post rabbithole i discovered like, at least 5 years ago at this point that i never managed to get more than a couple people to care about. maybe people would be interested in it here though, i need to get around to writing a long post about it sometime but i'm too lazy augghh. in the meantime for anyone curious google, as a full phrase in quotes, "angelina alaskan malador" and you'll find a bunch of suspiciously similar comments by users with suspiciously similar usernames on a bunch of old, obscure websites about celebrities and media

login to reply
AndreL
@AndreL

The very first one of these I hit, the commenter’s user name was an outgoing link to a website for medical Spanish, making me think it’s an attempt to cheat the page rank.

login to reply
mouri-sunlight
@mouri-sunlight

this sounds like someone with some fairly strong psychotic paranoia remaking the accounts they use on the websites they go on, on a schedule, to try to mitigate an assumption of being monitored. a few friends of mine engage in similar behaviour. likely benign.

login to reply
kojote
@kojote

I go back and forth on whether or not it's benign.

I'm a content mod on a furry website; we have a fair amount of material reported that is weird but not really threatening and, like, I'm very "you do you" on that. If I was mostly sure it was somebody with a bear quirk and some kind of hangup about never using the same account more than once, I'd have kept my yap shut.

I hadn't considered the "avoiding monitoring," although to springboard from what someone else noted in the comments, it doesn't do much good to avoid being monitored if anyone can look at new accounts on e621, find the person with the all-caps Nordic looking name, check to see if that name also just registered on FA, and if so know exactly their ID on a half-dozen other sites.

The long span but broken and the clear automation to it, though, tilted my assumption towards either laying the groundwork for some kind of social engineering, or a project that, even if it is benign, is still weird and worth shining light on.

But that's just a tilt.

login to reply
mouri-sunlight
@mouri-sunlight

well, yeah, often the anti-monitoring behaviour can be contradictory or pointless in nature. things like speaking in some sort of code that you also give to people freely and openly, leaving and rejoining discord servers you like while fully-aware that doesn't get rid of your messages there, or like modifying the colour space on videos of your front lawn to try to hide where you live, despite that being a perfectly-reversible operation.

imo, probably someone very paranoid ending up doing this in their low months mental-health-wise. the automation is done fairly easily; you can set alarms or a cron job on your main computer / a home server. with the latter approach you might not even need to be aware of the account change. I get bad like this when mentally-impeded myself, usually from ED cycles or hypothermia, and tbh? this exact account-cycle thing is something I've considered a few times for reddit and e6. Obviously, for someone only paranoid when they're unable to think that's not going to be gone through with successfully, but for someone severely paranoid in a more normal state they'll probably get it done.

login to reply
anfael
@anfael

here's my 15-second reckon to add to the pile: something like this could be used for automating some activity on websites that either require a user account, or omit key functionality without one. this could range from relatively benign like a site preview enhancer like fxraffinity.net (as an example only, not suggesting they're behind this specific mystery), or something a bit more dubious like mass scraping. i guess this is not so different from the 'botnet' hypotheses other people have posted, but for reading site content rather than adding to it

login to reply
kojote
@kojote

Huh. Yeah, that's an interesting possibility. I hadn't considered that, and I'm not sure exactly how one would go about seeing what their activity was if it was purely consuming content.

...Hmm. That doesn't explain the Telegram, Twitter, and Mastodon profiles, though.

login to reply
garudina
@garudina

my money is on "accounts to continue DMing people who have blocked me" and the rest is just psychological self-play. maybe it's all psychological self-play. the six digit numbers I specifically suspect might be passing an MFA code between devices, or some similarly antipattern behavior.

EDIT: took a slightly closer look. the hour and minute of registration seem to be the same for each FA account. the e621 times are playing with similar patterns in 24 hour time, it seems. unclear if this is only apparent in PST or what

login to reply
kojote
@kojote

The six-digit numbers are odd. You're right, in that they do outwardly resemble some kind of MFA thing, but why only the one account? Why only the one day?

One thing I will say, which contributed strongly to the initial “this is weird” and that makes me skeptical that it's as simple as block evasion, is that the accounts do nothing, in any way that I can tell. Like, without revealing too much, they have accounts on a site where I'm a mod, so at least there, I am very certain they're inactive.

But also, I caught one of the Telegram accounts shortly after it was registered. At that point, I was aware of three of them, and their "last seen" date all exactly matched the creation date of the other accounts. So it's possible that they're staging the accounts for a future of block evasion, but not created concurrently to further it.

login to reply
Osmose
@Osmose

Re: Chile, Google Cloud opened a data center in Santiago in 2015. Amazon did too but that was late 2022/early 2023 so it's less likely they used that.

Weird that there'd be a one off, and even weirder that there'd be multiple but they're not evenly spread out, but I'd guess that's mild evidence of automation running on GCP.

login to reply
kojote
@kojote

Huh! Okay, that's an interesting datapoint.

I'm agnostic about how much of anything is either accurate, or intended to be read as accurate. Like, the May birthdate could also have been when the account was created, and it's just a joke? Some of the very early accounts weren't created literally within minutes of one another, and maybe that process was more manual.

So like, is "Chile" because the controlling entity lives in Chile? Or because they're using a Chilean datacenter? Or because they were testing autopopulating the location field when creating a DeviantArt account, and their geolocation service tagged them as being Chilean?

?????????

login to reply
Osmose
@Osmose

I don't really use my account there much so I can't say for sure, but my country field is set in my user profile, although I'm fairly sure I wouldn't bother to set that unless it was required, so perhaps they either added it later or auto populate on registration, which almost always means they're geolocating via IP address and would get the country of wherever the data center running the script is (usually).

login to reply
kojote
@kojote

That's a good question.

I don't (well, didn't) have an account on some of those sites, to be honest. I found the Reddit, Inkbunny, FurryNetwork, and Naughty Machinima accounts by plugging the usernames into Google. It just so happens that they seem to be very focused on furry sites, but it's also possible that they will widen their reach and the names will appear elsewhere.

(That is, I didn't see the name and then start plugging it in to every furry-specific site I'm aware of. Although I guess I should do that)

login to reply
TangoBunny
@TangoBunny

My immediate assumption is someone is using bots/neural networks for future-planning scams just because it seems most probable. I occasionally get DMs from suspicious accounts on Twitter offering to sell commissions, but they never have a page on FurAffinity or anything like that, and it feels like their sample artwork is stolen, so I just don't respond.

So, my theory is that in a year or two, they're going to try scamming people through DMs, and when asked for their FA page, they'll quickly upload their fake samples to one of these old accounts and say, "Look, see, I've been on FA since 2023. I'm even on InkBunny!"

I'm especially interested in the "What the Dragon does in the privacy of his Lair is his business, and his alone" response because it seems like an individual person typed that. But I get the impression it could also be a ChatGPT answer, where someone wrote, "How would a dragon enthusiast respond in a single sentence to this question without actually answering it?" There's no way of knowing from one reply by itself, so at this point, I almost want it to reply to more people's questions to see if there are any linking traits.

login to reply
kojote
@kojote

Yeah, agreed. When I first saw that reply, I thought: "wait, what the fuck? Someone's watching this?"

But, like... that's also the only mention of dragons, I think? So I don't think they're necessarily into dragons; it's probably just intended as a metaphor. Is the reply intended to sound mysterious and weird? If it's intended to sound mysterious and weird, that goes more to the ARG hypothesis of, like, "okay, I want to know more about this thing."

But if it's just LLMed into existence, then what was the prompt? Who prompted it? Was that fully automated?

I think that some, and perhaps all, of the Reddit posts were made by a human. I wasn't certain about that with just the Hvittljon posts, which tend to have been downvoted as if other Redditors didn't see the relevance. But some of the others are on topic and express opinions about a video or image that demonstrate they're actually responding to that video or image.

...Also the :] thing.

login to reply
idadeerz
@idadeerz

i have what i think is objectively the funniest suggestion here:

what if you made one of those alts? the timing is consistent, so you could maybe try to scope out any new alts they create on these websites, and then you can try creating one with the same name somewhere before they get to do it.

if as you say they register on FurAffinity within 12 minutes and e621 within 23 minutes, then that means with some luck, you could have 11 minutes to make your account there. that seems reasonable. heck, maybe you could keep an account creation page for every single platform they use in a bunch of separate tabs. you said sometimes they don't use all of them, so maybe that makes it even easier to get an account in where they haven't yet.

if this is is his business and his alone, then that means you should just become him, right?

login to reply
dedusmulntxt
@dedusmulntxt

also

Because I am worried that it is a sentient AI that will murder me. Or a hacker collective, or a scammer whose radar I don’t really want to be on. I am probably paranoid. Tell you what, you fall on that sword. Get eaten by the elf-racist polar bear.

you can create an alt or get someone else to ask them

login to reply
clip
@clip

interesting tidbit - and i really don't know if it means anything - but i don't think they're german either.

look at the username EISBARENUMARMUNG (Polar Bear Hug). they replaced the ä in Eisbär with an a. that's not really how that's done and i would argue that most if not all german speakers would know and use the correct "ae" instead.

not sure what that implies but it def makes me think all the german looking usernames don't really tell us much abt the person behind the accounts except that they might be a polar bear enthusiast.

login to reply
kojote
@kojote

Yeah, I think that is probably a safe bet. After I posted this last night and discovered an earlier era dominated by German words, but I think they were possibly just generated via something like Google Translate. The polar bear thing seems to be a constant now, but before the German names was the Werewolf Era so I remain puzzled.

login to reply
deimosphoibus
@deimosphoibus

What's interesting to me is that the profile ID in the Bjarndyrakongur account is depicting the same character as their user icon, which doesn't seem to be machine generated? Granted I don't have the best eye for this sort of thing, but the art seems to be too consistent for it to be machine generated.

I don't recognize the character, so I'm not sure if the image was taken from elsewhere or if it's just an OC. Either way, them being a scammer seems unlikely to me. (after all, why go all the trouble to create a fursona just to use on this one account?)

login to reply
kojote
@kojote

Agreed, for the most part; the Bjarndyrakongur character in both images is also accurate, I guess, as some kind of unicorn-bear.

Early on in September I was thinking that the images might have been machine-generated, or something like it, but they are pixel-for-pixel mirror symmetric and I don't think Stable Diffusion will do that for you?

At the same time, they look slightly off to me? Like they're mechanical permutations on a common theme, the way you'd do if you were making NFTs.

login to reply
deimosphoibus
@deimosphoibus

Honestly I got a weird vibe from the profile pic too, it does look like it was cobbled together a bit maybe?

.....Although, now I went back to check it only to find out that they changed the image???? Now the X is thicker, and the horn is glowing.

I had opened the image link on a new tab when I made my first comment on this post, and that link still goes to the old image, because Furaffinity seems to keep old profile pics on their server (at least for a little while) This is what it used to look like: https://a.furaffinity.net/1697382816/bjarndyrakongur.gif

You might have unearthed some obscure ARG after all,, or maybe they just change their profile pic regularly too for some reason. (The shading on the bear's neck seems to look a little cleaner in the new one)

login to reply
shadetavish
@shadetavish

I thought the numbers might be some sort of cipher thing but like turning them to corresponding letters and it's just like nothing even running it through a caesar unless there's a key they used to cipher it further but like GOD I WANNA KNOW THE ANSWER TO THE PUZZLE

login to reply
upthorn
@upthorn

I mean, don't discount the possibility that it is the internet equivalent of a numbers station. Someone sending coded messages in a cipher that can only be deciphered by someone who has the full list of potential services for the user to be created on?

Or a furry contributing to a hacker CTF challenge (which is essentially an ARG)

That, or someone with moderately severe paranoia and/or obsessive-compulsive disorder.

login to reply
Pinned Tags