Fake accounts are the primary means for misuse and abuse of social media platforms, giving rise to coordinated inauthentic behaviors. Despite ongoing efforts to limit their exploitation, ready-to-use fake accounts can be found for sale on several underground markets. For the present study, we devised an innovative approach to detect accounts for sale on an underground market. Between June 2019 and July 2021, we detected more than 60,000 fake accounts, which we continuously tracked for changes in profile information and timeline. Afterward, we focused on the 23,579 accounts that produced at least one tweet in 2020, identifying the main characteristics like the most used names and profile descriptions. Also, we analyzed more than five million interactions, including mentions, replies, retweets, and the use of hashtags and URLs in tweets. These analyses exposed behavioral patterns indicating coordination, like using similar profile names or retweeting the same user. In particular, we spotted four coordinated campaigns, whose behavior ranged from attempting to influence the political debate in Buenos Aires to aggressive spam activity aimed at scamming cryptocurrency users or advertising counterfeit goods.

Keywords: Coordinated inauthentic behavior, Fake account, Social media monitoring, Underground market, Twitter