Username Squatting on Online Social Networks: A Study on X

TL;DR

This work is the first systematic study of username squatting on online social networks, focusing on X. It introduces UsernameCrazy to generate tens of thousands of plausible squatted usernames from top accounts and presents SQUAD, an end-to-end framework that combines variant generation with a supervised classifier to detect suspicious squatted accounts. The measurement study reveals widespread prevalence, online confusion via typo-mentions and search amplification, and a substantial presence of bots and impersonation among active squatted accounts. The evaluation shows UsernameCrazy achieves broad coverage and the classifier reaches about 94% F1 on a small labeled dataset, enabling scalable screening and targeted investigation. The findings motivate platform-level mitigations and provide a practical tool for account owners and regulators to curb impersonation and misinformation driven by username squatting.

Abstract

Adversaries have been targeting unique identifiers to launch typo-squatting, mobile app squatting and even voice squatting attacks. Anecdotal evidence suggest that online social networks (OSNs) are also plagued with accounts that use similar usernames. This can be confusing to users but can also be exploited by adversaries. However, to date no study characterizes this problem on OSNs. In this work, we define the username squatting problem and design the first multi-faceted measurement study to characterize it on X. We develop a username generation tool (UsernameCrazy) to help us analyze hundreds of thousands of username variants derived from celebrity accounts. Our study reveals that thousands of squatted usernames have been suspended by X, while tens of thousands that still exist on the network are likely bots. Out of these, a large number share similar profile pictures and profile names to the original account signalling impersonation attempts. We found that squatted accounts are being mentioned by mistake in tweets hundreds of thousands of times and are even being prioritized in searches by the network's search recommendation algorithm exacerbating the negative impact squatted accounts can have in OSNs. We use our insights and take the first step to address this issue by designing a framework (SQUAD) that combines UsernameCrazy with a new classifier to efficiently detect suspicious squatted accounts. Our evaluation of SQUAD's prototype implementation shows that it can achieve 94% F1-score when trained on a small dataset.

Figures (9)

• Figure 1: Typo-mention: CNN mistakenly mentions @cnnnbrk, a squatted user of the official @cnnbrk profile.
• Figure 2: Taxonomy of UsernameCrazy's generation models. The blue-shaded boxes indicate models which are not supported by existing tools. In boldface are username examples which cannot be generated by existing tools.
• Figure 3: Squatted accounts in the top search recommendations grouped by edit distance.
• Figure 4: Number of actual tweets that mention at least one username variant grouped by the variants' edit distance with their original accounts.
• Figure 5: Classification of the confusing accounts.