lupi

cow of tailed snake (gay)

avatar by @citriccenobite

you can say "chimoora" instead of "cow of tailed snake" if you want. its a good pun.​


i ramble about aerospace sometimes
I take rocket photos and you can see them @aWildLupi


I have a terminal case of bovine pungiform encephalopathy, the bovine puns are cowmpulsory


they/them/moo where "moo" stands in for "you" or where it's funny, like "how are moo today, Lupi?" or "dancing with mooself"



Bovigender (click flag for more info!)
bovigender pride flag, by @arina-artemis (click for more info)



kojote
@kojote

It started in July.

Every few days, almost always at just about 12 minutes past 6 in the morning, somebody creates a new account on FurAffinity. That’s probably normal. Except, in this case, the account doesn’t post anything. It doesn’t follow anyone. It doesn’t have any followers. It doesn’t favorite any art. It just sits there, silent. The name is written in all caps. There is, almost always, no avatar. There are never any details.

That’s also probably normal, right? Lots of FA accounts must be empty.

But, that same day, whoever created that account also creates one on SoFurry. And on DeviantArt. And on e621. And, almost but not always, on Reddit, Inkbunny, and Twitter. Sometimes they create an account on Telegram and Mastodon. I first noticed this back in September, when I saw a user named “JARDSKJALFTI.” Then I kept looking. Here is what I’ve found.


kojote
@kojote

I was not expecting to have this mystery solved at all, to be honest. Nor was I expecting to have it solved so quickly. Nor was I expecting this to explode on Cohost the way it did.

Anyway. I started writing a followup post more or less immediately, because at the time I wrote the post on Sunday, I had already found another block of names—what I referred to as the “Werewolf Era” in a comment. To sum up the additional info, briefly:

Before that (WERWOLFSGRINSEN, WERWOLFSHEILER, WERWOLFSGERUCH, etc.), came a series of names that were just a series of German words (ZORNIGKEIT, WINZIGKEIT, HERZHAFTIGKEIT, etc…) that are formulaic enough that an offhand mention of a name that was the German word for “facetiousness” was enough to identify that, too.

The names that I was able to turn up go back to early February, 2020. To my knowledge, to the extent they have any activity, it’s either a short Twitter follow list (like @WERWOLFSHUNGER) or a few posts on Reddit. Very rarely anything more than that. The first names lack avatars, even.

The further back in time things go, the less likely it is for an account to be present on all possible sites. The more recent accounts, I’ve discovered, are also sometimes present on Pinterest and Steam. I believe this probably started on SoFurry or DeviantArt. The earliest three accounts (URKNAUGG, WROKKKNAUGG, and WRUKKNARGG) I know of only exist on SF, DeviantArt, Twitter, and FurAffinity.

I still don’t know what is going on. But I think the who is now clear.


I would venture to say that the three most common explanations presented in the comments and by my friends were either: 1. some kind of spam or laying the groundwork for a botnet of some kind, 2. an ARG, or 3. a set of accounts created for some unknown but mental-health related issue (for example, paranoia about being followed).

The statement “I have to upload something today at this exact time,” for example, could be encoding something important about the image timestamp (pointing towards option 2) or it could be compulsive (pointing to option 3).

(2) is the option that I’m willing to throw out. My opinion, based on everything I know now, is closer to (1) or a benign (1A) which is that this is some kind of experiment or pet project, the precise scope of which may just be personal edification. I have done much stupider things, so it’s not like I’m going to judge.

But I say experiment or tech project for three reasons.

First is that the account creation process is automated. There were a couple of comments to the effect that the account creation might be scheduled but still manual. It’s possible that was true earlier on. Looking at the timestamps, though, the accounts are set up and then configured in a matter of seconds, the same way each time.

Two is that the accounts aren’t being used. I stopped count at about 80 names, across 500-odd profiles. Of those, maybe 5% have any kind of activity, almost exclusively on Reddit. Out of 74 SoFurry profiles, the sum total of activity is a single shout. The 96 InkBunny and FurryNetwork profiles don’t seem to have ever been used. Only three of the 61 e621 accounts have comments or favorites associated with them.

At the same time, they’re also not being abandoned. In those instances where the accounts do have activity, it often postdates the account creation by months—a year, in a couple of cases. So it’s not simply that they’re being used once and then discarded. They are being kept around and actively maintained. It does not look, to me, like an attempt to evade being blocked, or for that matter followed.

Three is the growing number of other sites that have become part of the automated account creation process over time, and the increasingly streamlined nature of the automation. @WINZIGKEIT, on Twitter, has the bio “Test…” and the display name “SCHWITZIGKEIT.” The latter name, however, seems only to have been created on Reddit.

There is, otherwise, a mechanical regularity. When the DeviantArt profiles have a location listed, it is either Chile or the United States. There is no pattern to which, temporally, but if Chile is listed, there is almost always a birthday given. If the United States is listed, there is never a birthday given.

So. I don’t know what is going on, although I am no longer convinced it’s a hacking collective. But I think I do know who. In the comments of the last post, @drakegator identifies the artist as Dakota-Bear, based on the art style. I agree that the art style is a dead ringer; Dakota-Bear also happens to live in Chile.

So. Massive thanks to Drake Gator for that steer. I consider the circumstantial evidence they provided to be pretty compelling. The user’s FA profile went dark about ten years ago, and I don’t know what they’ve been doing since. Getting better at scripting, apparently. Based on their Reddit posts, I guess they seem to be doing okay, or at least no more weird than I am.

Thank you all for your help and your ideas. I have received some anonymous feedback through the ask box, which I have been kind of tapdancing around based on the nature of that feedback, so, if you are still reading this: I am not ignoring you, I just don’t have a way to reply to you >.>

But in any case, modulo any more startling news or a capsbear-themed ARG actually materializing, that would seem to be that, an odd corner of the Internet that had me briefly startled but is probably (?) nothing to worry about.

…Say, do any of you want to try dredging Lake Michigan for an abandoned lifeboat prototype?


You must log in to comment.

in reply to @kojote's post:

This is 80% likely someone making an Alternate Reality Game, 20% someone making a botnet and fucking around a little. Sure, they haven't posted much, yet. The usual modus operandi is to make a bunch of accounts, leave them alone for a few months so they're no longer brand new, and then use them for spam (or sell them to spammers).

I would also be concerned about a botnet army. Creating 100 accounts all on one day, from the same IP, makes one a prime target for a ban. Spreading them out over two weeks, always creating during non-peak hours...
Armies sit dormant until someone needs to push the button for something. Mass spamming in the comments of one account? Mass faves to artificially inflate metrics? Selling the army off to another user later?
They may be making lots of accounts, not just furry ones. Astroturf doesn't grow by itself. 🤷

An army that all shares a gimmick so idiosyncratic that random other users can spot the pattern before any of the accounts even call attention to themselves isn't exactly undetectable. this is like Batman villain level complicating your capers to make sure everyone knows who did it and how to foil you

i love this kind of thing. it reminds me of similar sort of strange internet post rabbithole i discovered like, at least 5 years ago at this point that i never managed to get more than a couple people to care about. maybe people would be interested in it here though, i need to get around to writing a long post about it sometime but i'm too lazy augghh. in the meantime for anyone curious google, as a full phrase in quotes, "angelina alaskan malador" and you'll find a bunch of suspiciously similar comments by users with suspiciously similar usernames on a bunch of old, obscure websites about celebrities and media

The very first one of these I hit, the commenter’s user name was an outgoing link to a website for medical Spanish, making me think it’s an attempt to cheat the page rank.

this sounds like someone with some fairly strong psychotic paranoia remaking the accounts they use on the websites they go on, on a schedule, to try to mitigate an assumption of being monitored. a few friends of mine engage in similar behaviour. likely benign.

I go back and forth on whether or not it's benign.

I'm a content mod on a furry website; we have a fair amount of material reported that is weird but not really threatening and, like, I'm very "you do you" on that. If I was mostly sure it was somebody with a bear quirk and some kind of hangup about never using the same account more than once, I'd have kept my yap shut.

I hadn't considered the "avoiding monitoring," although to springboard from what someone else noted in the comments, it doesn't do much good to avoid being monitored if anyone can look at new accounts on e621, find the person with the all-caps Nordic looking name, check to see if that name also just registered on FA, and if so know exactly their ID on a half-dozen other sites.

The long span but broken and the clear automation to it, though, tilted my assumption towards either laying the groundwork for some kind of social engineering, or a project that, even if it is benign, is still weird and worth shining light on.

But that's just a tilt.

well, yeah, often the anti-monitoring behaviour can be contradictory or pointless in nature. things like speaking in some sort of code that you also give to people freely and openly, leaving and rejoining discord servers you like while fully-aware that doesn't get rid of your messages there, or like modifying the colour space on videos of your front lawn to try to hide where you live, despite that being a perfectly-reversible operation.

imo, probably someone very paranoid ending up doing this in their low months mental-health-wise. the automation is done fairly easily; you can set alarms or a cron job on your main computer / a home server. with the latter approach you might not even need to be aware of the account change. I get bad like this when mentally-impeded myself, usually from ED cycles or hypothermia, and tbh? this exact account-cycle thing is something I've considered a few times for reddit and e6. Obviously, for someone only paranoid when they're unable to think that's not going to be gone through with successfully, but for someone severely paranoid in a more normal state they'll probably get it done.

here's my 15-second reckon to add to the pile: something like this could be used for automating some activity on websites that either require a user account, or omit key functionality without one. this could range from relatively benign like a site preview enhancer like fxraffinity.net (as an example only, not suggesting they're behind this specific mystery), or something a bit more dubious like mass scraping. i guess this is not so different from the 'botnet' hypotheses other people have posted, but for reading site content rather than adding to it

Huh. Yeah, that's an interesting possibility. I hadn't considered that, and I'm not sure exactly how one would go about seeing what their activity was if it was purely consuming content.

...Hmm. That doesn't explain the Telegram, Twitter, and Mastodon profiles, though.

my money is on "accounts to continue DMing people who have blocked me" and the rest is just psychological self-play. maybe it's all psychological self-play. the six digit numbers I specifically suspect might be passing an MFA code between devices, or some similarly antipattern behavior.

EDIT: took a slightly closer look. the hour and minute of registration seem to be the same for each FA account. the e621 times are playing with similar patterns in 24 hour time, it seems. unclear if this is only apparent in PST or what

The six-digit numbers are odd. You're right, in that they do outwardly resemble some kind of MFA thing, but why only the one account? Why only the one day?

One thing I will say, which contributed strongly to the initial “this is weird” and that makes me skeptical that it's as simple as block evasion, is that the accounts do nothing, in any way that I can tell. Like, without revealing too much, they have accounts on a site where I'm a mod, so at least there, I am very certain they're inactive.

But also, I caught one of the Telegram accounts shortly after it was registered. At that point, I was aware of three of them, and their "last seen" date all exactly matched the creation date of the other accounts. So it's possible that they're staging the accounts for a future of block evasion, but not created concurrently to further it.

Re: Chile, Google Cloud opened a data center in Santiago in 2015. Amazon did too but that was late 2022/early 2023 so it's less likely they used that.

Weird that there'd be a one off, and even weirder that there'd be multiple but they're not evenly spread out, but I'd guess that's mild evidence of automation running on GCP.

Huh! Okay, that's an interesting datapoint.

I'm agnostic about how much of anything is either accurate, or intended to be read as accurate. Like, the May birthdate could also have been when the account was created, and it's just a joke? Some of the very early accounts weren't created literally within minutes of one another, and maybe that process was more manual.

So like, is "Chile" because the controlling entity lives in Chile? Or because they're using a Chilean datacenter? Or because they were testing autopopulating the location field when creating a DeviantArt account, and their geolocation service tagged them as being Chilean?

?????????

I don't really use my account there much so I can't say for sure, but my country field is set in my user profile, although I'm fairly sure I wouldn't bother to set that unless it was required, so perhaps they either added it later or auto populate on registration, which almost always means they're geolocating via IP address and would get the country of wherever the data center running the script is (usually).

That's a good question.

I don't (well, didn't) have an account on some of those sites, to be honest. I found the Reddit, Inkbunny, FurryNetwork, and Naughty Machinima accounts by plugging the usernames into Google. It just so happens that they seem to be very focused on furry sites, but it's also possible that they will widen their reach and the names will appear elsewhere.

(That is, I didn't see the name and then start plugging it in to every furry-specific site I'm aware of. Although I guess I should do that)

My immediate assumption is someone is using bots/neural networks for future-planning scams just because it seems most probable. I occasionally get DMs from suspicious accounts on Twitter offering to sell commissions, but they never have a page on FurAffinity or anything like that, and it feels like their sample artwork is stolen, so I just don't respond.

So, my theory is that in a year or two, they're going to try scamming people through DMs, and when asked for their FA page, they'll quickly upload their fake samples to one of these old accounts and say, "Look, see, I've been on FA since 2023. I'm even on InkBunny!"

I'm especially interested in the "What the Dragon does in the privacy of his Lair is his business, and his alone" response because it seems like an individual person typed that. But I get the impression it could also be a ChatGPT answer, where someone wrote, "How would a dragon enthusiast respond in a single sentence to this question without actually answering it?" There's no way of knowing from one reply by itself, so at this point, I almost want it to reply to more people's questions to see if there are any linking traits.

Yeah, agreed. When I first saw that reply, I thought: "wait, what the fuck? Someone's watching this?"

But, like... that's also the only mention of dragons, I think? So I don't think they're necessarily into dragons; it's probably just intended as a metaphor. Is the reply intended to sound mysterious and weird? If it's intended to sound mysterious and weird, that goes more to the ARG hypothesis of, like, "okay, I want to know more about this thing."

But if it's just LLMed into existence, then what was the prompt? Who prompted it? Was that fully automated?

I think that some, and perhaps all, of the Reddit posts were made by a human. I wasn't certain about that with just the Hvittljon posts, which tend to have been downvoted as if other Redditors didn't see the relevance. But some of the others are on topic and express opinions about a video or image that demonstrate they're actually responding to that video or image.

...Also the :] thing.

i have what i think is objectively the funniest suggestion here:

what if you made one of those alts? the timing is consistent, so you could maybe try to scope out any new alts they create on these websites, and then you can try creating one with the same name somewhere before they get to do it.

if as you say they register on FurAffinity within 12 minutes and e621 within 23 minutes, then that means with some luck, you could have 11 minutes to make your account there. that seems reasonable. heck, maybe you could keep an account creation page for every single platform they use in a bunch of separate tabs. you said sometimes they don't use all of them, so maybe that makes it even easier to get an account in where they haven't yet.

if this is is his business and his alone, then that means you should just become him, right?

also

Because I am worried that it is a sentient AI that will murder me. Or a hacker collective, or a scammer whose radar I don’t really want to be on. I am probably paranoid. Tell you what, you fall on that sword. Get eaten by the elf-racist polar bear.

you can create an alt or get someone else to ask them

interesting tidbit - and i really don't know if it means anything - but i don't think they're german either.

look at the username EISBARENUMARMUNG (Polar Bear Hug). they replaced the ä in Eisbär with an a. that's not really how that's done and i would argue that most if not all german speakers would know and use the correct "ae" instead.

not sure what that implies but it def makes me think all the german looking usernames don't really tell us much abt the person behind the accounts except that they might be a polar bear enthusiast.

Yeah, I think that is probably a safe bet. After I posted this last night and discovered an earlier era dominated by German words, but I think they were possibly just generated via something like Google Translate. The polar bear thing seems to be a constant now, but before the German names was the Werewolf Era so I remain puzzled.

What's interesting to me is that the profile ID in the Bjarndyrakongur account is depicting the same character as their user icon, which doesn't seem to be machine generated? Granted I don't have the best eye for this sort of thing, but the art seems to be too consistent for it to be machine generated.

I don't recognize the character, so I'm not sure if the image was taken from elsewhere or if it's just an OC. Either way, them being a scammer seems unlikely to me. (after all, why go all the trouble to create a fursona just to use on this one account?)

Agreed, for the most part; the Bjarndyrakongur character in both images is also accurate, I guess, as some kind of unicorn-bear.

Early on in September I was thinking that the images might have been machine-generated, or something like it, but they are pixel-for-pixel mirror symmetric and I don't think Stable Diffusion will do that for you?

At the same time, they look slightly off to me? Like they're mechanical permutations on a common theme, the way you'd do if you were making NFTs.

Honestly I got a weird vibe from the profile pic too, it does look like it was cobbled together a bit maybe?

.....Although, now I went back to check it only to find out that they changed the image???? Now the X is thicker, and the horn is glowing.

I had opened the image link on a new tab when I made my first comment on this post, and that link still goes to the old image, because Furaffinity seems to keep old profile pics on their server (at least for a little while) This is what it used to look like: https://a.furaffinity.net/1697382816/bjarndyrakongur.gif

You might have unearthed some obscure ARG after all,, or maybe they just change their profile pic regularly too for some reason. (The shading on the bear's neck seems to look a little cleaner in the new one)

I thought the numbers might be some sort of cipher thing but like turning them to corresponding letters and it's just like nothing even running it through a caesar unless there's a key they used to cipher it further but like GOD I WANNA KNOW THE ANSWER TO THE PUZZLE

I mean, don't discount the possibility that it is the internet equivalent of a numbers station. Someone sending coded messages in a cipher that can only be deciphered by someone who has the full list of potential services for the user to be created on?

Or a furry contributing to a hacker CTF challenge (which is essentially an ARG)

That, or someone with moderately severe paranoia and/or obsessive-compulsive disorder.

in reply to @kojote's post:

at least it probably wasn't the FBI creating furry infrastructure infiltration units this time!

but given how empty but maintained twitter accounts will probably be valuable soon, maybe bot makers like this are sitting on gold and don't even know it

i wonder if it's someone using or testing a tool to capture usernames on as many sites as possible. several services exist online that do this for you (or at least check for available usernames) so it could be like that. it would be strange for them to be monitored afterwards though