Bet Bot: Gambling spam network

This case study was originally published in OpenAI’s October 2024⁠(opens in a new window) report.

We banned a set of accounts using our API to generate conversations with users on X and send them links to gambling sites. This activity accessed our models via an Israel-based startup. Given the operation’s focus on sharing links to gambling sites and its large-scale use of what were likely automated accounts on X, we have dubbed it operation “Bet Bot”.

Like operations “Bad Grammar” and “A2Z”, this operation leveraged our models to manage different fake personas for use on social media. For example, it generated bios, researched social media accounts to follow, analyzed posts and comments, and drafted replies in English. The replies were then posted on X. The accounts on X typically featured AI-generated profile pictures, had sports-themed banners and bios, in some cases claimed to be based in bastions of UK soccer like Manchester and Liverpool, and were largely created in December 2023 or June 2024.

Even though some of these accounts featured AI-generated profile pictures—which are designed to appear unique—the operation sometimes reused those images across multiple accounts. Some also had suspicious, improbable names, such as “KobeBryantJohnson”. Even in a relatively intricate operation such as this, the operators sometimes took shortcuts that potentially undermined their own effectiveness.

The operation’s completions were of two types. Some were designed and deployed as public comments on X. Typically, the operation would pick a short conversation from X where more than one person had already engaged, and generate a comment in reply. One of its fake personas would then post that reply in the comment thread.

Other completions appear to have been designed as direct messages (DMs). In such cases, the operation’s inputs resembled messages from real users, and its outputs were crafted as replies. Since DMs are a restricted service and non-public, we cannot confirm whether the replies were sent; however, in some instances the operation’s prompts suggest that a conversation including multiple exchanges did take place. All the fake personas we identified on X had very low follower counts, usually in the single or low double digits. Typically, each fake account followed half a dozen to a dozen of its peers, so that even these low follower numbers were artificially inflated. However, a few accounts did also attract a few apparently authentic followers.

Most of this operation’s public-facing content dealt with various sports, especially soccer, but also baseball, basketball, softball, football and hockey. Typically, a few posts by each fake account on X would reference politics in the United States or United Kingdom. These did not show a consistent ideology or back a single candidate or party.

The content likely intended for DMs almost never dealt with politics. Rather, it consistently referenced gambling. On some occasions, it included URLs from publicly available link shortening services like bit[.]ly. All the links that we investigated led to online gambling sites. In effect, this operation appears to have been a content-generation pipeline that used public comments about sport, and occasionally politics, to disguise its fake accounts, and then used direct messages to spam people with gambling links.

This does not appear to have been an influence operation aimed at manipulating political outcomes, but rather a modern-day spam network trying to lure people to gambling sites. However, it represents a unique set of tactics, techniques and procedures (TTPs), including apparent direct messaging. Given the apparent use of non-public messages, and the lack of insights into how many—if any—people clicked on the gambling links, the evidence for our assessment is partial, and based on the operators’ completions. Some prompts suggested that a conversation including multiple exchanges did take place, but these often included real people expressing skepticism about the gambling links, or saying that they did not gamble online. The fake accounts also had very low follower numbers, implying that their potential audience was limited. However, our evidence does suggest that at least a few of the operation’s accounts found a way to engage people on X via DM, for at least long enough to be able to send them a link. This represents an ability to break out from the fake personas’ own echo chamber. As such, using the Breakout Scale, we would assess this activity as belonging in Category 2, marked by activity on one platform, with some evidence that some real people were engaging with it.