BotShark

Blog / Bot types

9 July 2026 · BotShark Team

The account wearing its third name this year

A sockpuppet wears its third name this year. Real people change a display name for fun; they almost never change the actual handle two or three times while posting at a pace no human keeps up.

Person holding a black mask

Display names change all the time — people add emoji, swap in a pun, rebrand for a bit of fun around a holiday or an event. That's normal and means nothing. The handle — the actual @username — is a different story. Most people pick one and keep it, maybe change it once if they really need to. So when you find an account that's changed its handle multiple times, and it's posting at a pace that's hard to square with one person doing it by hand, you're likely looking at what researchers call a sockpuppet: an account identity that's been recycled, relabeled, and put back into circulation.

What it's actually doing

The term comes from a well-studied piece of academic research: a Stanford-led team analyzing nine major online discussion communities found that sockpuppets — fake identities controlled by someone hiding behind them — reliably differ from ordinary accounts in measurable ways. They tend to write shorter posts, start fewer original discussions, use more first-person language, and, tellingly, pairs of sockpuppets run by the same person are far more likely to show up interacting in the same discussion at the same time than two random ordinary accounts would be (Kumar, Cheng, Leskovec & Subrahmanian, "An Army of Me: Sockpuppets in Online Discussion Communities," WWW 2017). The "recycled" version of this pattern we look for is specifically about accounts that have had their identity changed, sometimes repeatedly — often a sign the account is being reused: cycle through a handle, burn through its reputation on one campaign, then rename it and start over with the follower base and account age still intact.

The signature here is narrower than most of the other types, but fairly distinct when it shows up:

  • The handle itself has changed more than once — not the display name, the actual username, which is a much bigger and rarer move for a genuine individual account.

  • That handle churn is paired with a posting pace well beyond what's realistic for a person typing by hand, sustained over time rather than a single busy day.

Wearing its third name this year
Wearing its third name this year
Handle changes stacked with an inhuman posting pace.

Why this pattern exists at all

Renaming and reusing an account is cheaper than building a new one, and it lets an operator distance the account from whatever it was doing — and being called out for — under its previous name. Security researchers tracking sockpuppet networks describe a consistent set of features that give these operations away when you look across many accounts at once: shared infrastructure, coordinated timing, signs of automation baked into an account's metadata, overlapping social connections, and repeated or similar content across the whole network (Gen Digital, "Identifying Sockpuppet Accounts on Social Media Platforms"). It's cheaper to relabel an account that already has age and a follower base than to build a new one from nothing — the same economic logic that shows up everywhere else in this taxonomy, just applied to identity instead of content.

How BotShark spots it

We check whether an account's username has changed more than once, and weigh that alongside its actual posting pace — specifically, whether it's sustaining a rate that's genuinely difficult to produce by hand, the kind of volume that research into labelled bot and human accounts consistently associates with automation rather than a person typing on their phone. Either signal alone is thin. Together, a churned identity and an inhuman pace, they point toward the same conclusion: this isn't one continuous, single person's account.

What to do if you spot one

Treat the account's apparent history and reputation with real skepticism. Whatever trust or context built up under a previous handle doesn't necessarily transfer to whoever — or whatever — is running the account under its current name. A renamed account is, functionally, a new operator wearing an old account's clothes.

Sources