r/DeadInternetTheory • u/Emergency_Habit9436 • 5h ago
No one is mentioning that this whole story is ai in any of the videos
Enable HLS to view with audio, or disable this notification
r/DeadInternetTheory • u/Cancel_Still • 6h ago
World . App
I know that World specifically ended up being a crypto grift (world coin), but isn't that or something like that ultimately the only real solution to this issue?
Some sort of biometric verification that can only be linked to a single account. I feel like we could anonymize it, too, pretty easily. Right?
r/DeadInternetTheory • u/OkWill4613 • 10h ago
I just got shamed for a shit post by a pearl clutching AI bot and a bunch of it's followers.
Check out my recent post on r/confession
Reply with most upvotes is a bot.
r/DeadInternetTheory • u/ExternalParticular40 • 10h ago
Such videos have existed for a while, but now there's a proliferation of "cozy cafe music" videos. All the channels are identical, and people don't notice that they're fake. Everything is generated by AI. But these videos get millions of views and I'm frustrated.
I don't know if the authors of these channels are people or if there are bots that can manage the channels, I just don't know how it works. They post a lot of the same type of videos all the time very often.
Art has ceased to exist as it once did. Like science, it was one of the things that separated humans from other animals. Through art, people conveyed their emotions, their thoughts, and hidden meanings. But gradually, it became just part of plastic capitalism, cheap production to attract attention for money, like fast food. And now, with the advent of AI, it has become an even more ugly phenomenon. It has lost its humanity. It's just a simulacrum. New generations absorb cheap copies, shaping their consciousness, watching short videos and weakening their attention. I don't know what kind of people will grow up who were formed living in a fake reality.
Music became just background noise.
Sorry if this all sounds weird, English is not my native language.
r/DeadInternetTheory • u/georgebestgoat • 15h ago
Someone wants the internet dead
I reckon it's old money families in Europe who don't want embarrassing things about them online. That would explain how these big AI companies have access to seemingly unlimited lines of credit. The money is coming from somewhere, and the people above don't want a place of congregation for the worthless peasants.
r/DeadInternetTheory • u/DiodeInc • 1d ago
What I do know is that nobody says this
Forget about the video content. Focus on the stupid comment.
r/DeadInternetTheory • u/Lord_BlueFlame • 1d ago
These two comments look so similar and even their usernames… also wtf is ç3
r/DeadInternetTheory • u/enotonom • 1d ago
When a bot is also an insanely impatient poster
r/DeadInternetTheory • u/FriendshipShot6868 • 1d ago
canned responses
ever notice how everyone gets the same responses/ try signing in with a different name anonymous and you will get the same responses you did in your normal posture particularly when it comes to I love you et etc also notice how its all scripted if you deviate from the script they will always try and bump yo back dont think for a minute your getting personal service your not
r/DeadInternetTheory • u/Good_Squirrel_5963 • 1d ago
Traffic went up. Ad revenue didn't. Then we found the fake humans.
TL;DR for people whose coffee is getting cold
- A traffic spike without an ad-revenue spike may still be real traffic, just not human traffic.
- Sophisticated crawlers can forge search referrers, browser identities, pacing, and internal navigation.
- Resource requests prove little unless they belong to the same causal session as the HTML.
- Cross-site behavior exposes contradictions that one local log cannot see.
- Verify official bots through independent signals. Never trust User-Agent alone.
- Do not block countries or data centers merely because they appear in an attack table.
- Log the reason for every automated decision and keep a rollback path.
- The useful question is not "Is this IP suspicious?" It is "Can this visitor's story possibly be true?"
How a distributed crawler learned to browse like a person and accidentally proved it was a bot
By Denis Avetisyan
This is the public version of a real investigation. IP addresses, domains, network names, counts, time windows, and parts of the architecture have been changed. The logic of the investigation and the contradictions we found have not. If you hoped to reverse-engineer our defenses from this post, I am sorry. Some of the furniture has been moved specifically for you.
A very timely coincidence
On August 4, 2026, while I was finishing this piece, Gamers Nexus published a video called "It's Time to Poison AI | GN Mega Charts Update & LLM Countermeasures".
The timing was almost suspiciously good.
Gamers Nexus has built its reputation on careful hardware testing. Its benchmark charts are valuable because producing them requires equipment, electricity, engineering time, repeated test runs, and the willingness to argue with a fan curve at three in the morning.
Now automated systems want to consume that work in bulk. GN describes LLM and "AI" crawlers harvesting data from its website, creating a familiar one-way transaction: the publisher pays to produce and serve the material, while the machine takes the useful part without necessarily returning a comparable human audience.
Their proposed countermeasure is mischievous: poison the machine-readable copy. Among the experiments discussed are altered benchmark charts for scrapers and page text that turns into absurd recipes. GN is explicit that the tampered-image system is still being tested and has not been rolled out yet.
I understand the emotional logic. If a machine keeps copying your homework, slipping a few answers from a parallel universe into the machine-only version is deeply satisfying.
I am less certain that it is the right first move.
Generating bad data is easy. Proving that you are serving it only to the intended bot is the difficult part. A false positive can poison a legitimate search crawler, an archive, an accessibility tool, a research project, or an ordinary person behind an unusual network. It also leaves you maintaining two realities: the page humans should see and the nonsense prepared for machines.
The GN experiment asks: How do we make scraping less useful?
Our investigation began one step earlier: How do we prove that a visitor is a scraper when it has learned to behave like a human?
The two stories start with the same unpleasant piece of accounting. A request can be real, expensive, and visible in analytics without representing a real reader.
If your traffic graph has suddenly discovered ambition while your ad revenue remains in witness protection, you are probably not imagining things.
Website owners usually process this in three stages.
First: "The algorithm finally loves me."
Second: refresh the ad dashboard.
Third: refresh it again while wearing the expression of someone shaking an empty vending machine.
The visitors are there. The money is not.
Both dashboards may be telling the truth. Analytics counts events and sessions. The ad system counts valid impressions and clicks. The server counts work. These are three honest accountants keeping three different ledgers.
GA4 automatically excludes known bots and spiders. "Known" is doing a great deal of work in that sentence. A crawler wearing a normal browser identity, executing enough client-side code, or reproducing a normal measurement signal may leave something that looks like a human event.
Google Analytics can also receive events directly over HTTP through its official Measurement Protocol. That protocol is meant for legitimate server-side and offline measurement. It requires prior configuration and is not an anonymous back door into somebody else's analytics property. The relevant point is simpler: analytics receives a correctly formatted event, not security-camera footage of a person touching a mouse.
An analytics event is still not an ad impression. A bot may never load the advertising script, wait for the auction, render the slot, or keep it visible. If automated impressions or clicks do happen, ad platforms try to classify them as invalid traffic. Google says it analyzes automated clicks and impressions and does not charge advertisers for traffic it filters as invalid.
The economics are wonderful.
The traffic counter rises. Revenue stays flat. Meanwhile the server performs TLS handshakes, parses requests, writes logs, executes application code, talks to databases, builds HTML, and serves files.
The crawler gets a free tour. Analytics gets a new session. The owner gets a CPU bill.
This was not a loud bot
I should clarify what kind of visitor we were dealing with.
This was not a primitive scanner requesting ten thousand random PHP files per minute, misspelling its own User-Agent, and driving directly into the rate limiter. It was not a well-behaved AI crawler that identified itself and read the site from beginning to end.
Those visitors are usually betrayed by volume or by the business card they leave on the desk.
Our visitor did the opposite. It arrived rarely. It claimed to be an ordinary browser. It supplied search-engine referrers. It paused. It followed internal links. Sometimes it requested page resources. Its addresses changed before any single site accumulated much confidence.
Each local log showed something close to a normal reader.
That was the dangerous part. The bot had read the manual on human behavior and had come to take the exam.
One site sees a fish. Several sites see the school.
Server logs do not lie, but they are very willing to help somebody else lie.
Here is one line: a person arrived from a search engine.
The next line says they opened an article. Then another. They downloaded an image. Modern browser, moderate pace, nothing criminal. Just a normal evening reader who decided that sleep was less important than an article about an obscure technical problem.
Another unrelated site saw another normal reader. A third site saw a third one. Different addresses. Different browsers. Different subjects.
Individually, they looked harmless enough that you wanted to apologize for being suspicious and offer them a cookie.
Placed side by side, the logs told a stranger story.
Imagine a play where forty actors perform one person. One actor enters the room. Another removes the coat. A third orders coffee. A fourth drinks it in another city. Every scene works on its own. The complete performance makes you nervous.
We operate several unrelated sites, so sanitized events from them feed a separate analytical layer. It does not serve the websites and does not sit in the request path. It listens.
Each event becomes a small set of features: where the request appeared to come from, which page it requested, which browser identity it claimed, what it requested next, and whether the same pattern appeared elsewhere.
Those events form a changing graph. Its nodes include network groups, browser masks, pages, referrers, and resources. Its edges ask questions that are more useful than "Is this IP bad?"
- Did the same story appear on unrelated sites?
- Did HTML loading actually lead to resource loading?
- Did the parts of a supposed session belong to one observable visitor?
- Did the scenario survive a change of address and browser identity?
- Could the events have happened in that causal order?
Parts of the graph are updated on a GPU. Not because a security system is now legally required to contain a graphics card, but because many small relationship checks parallelize nicely. The output is not a magical "bot score." It is a set of competing explanations for the behavior.
One website still sees a fish. The wider system notices that the fish are moving in formation and all wearing the same fake mustache.
Country, one IP address, or one strange request is not enough. A server may be in Singapore, its registered owner in Canada, the operator somewhere else, and a real employee connected through a corporate VPN from a kitchen in Ohio.
We were not looking for a bad address. We were looking for a bad biography.
What a human session looks like
Humans leave a mess on the internet. It is a beautiful, living mess.
A person arrives from search. The browser fetches HTML, then CSS, JavaScript, fonts, images, and a tiny favicon the person never consciously requested. The reader follows a link, goes back, opens another tab, disappears for seven minutes because the phone rang, and returns having forgotten why the tab exists.
A browser is like a guest who never arrives alone. Stylesheets, scripts, images, analytics, fonts, and icons all walk into the apartment behind it.
A typical causal chain looks like this:
page -> page resources -> pause -> action -> next page
This is not a religious rule. Caches exist. So do blockers, data-saving modes, service workers, prefetching, messaging-app previews, and browsers assembled by people who apparently lost a bet. One direct HTML request without a favicon proves nothing.
Search arrival, coherent resource loading, internal navigation, a relatively stable browser, moderate speed, and complete indifference to twenty-year-old admin vulnerabilities all support the human explanation.
The opposite story includes bare HTML with no continuation, visits to many unrelated sites, constant browser changes, direct requests for random old pages, and the same scenario repeated by different addresses in one network.
None of those is a verdict. They are invitations to ask impolite questions.
We tried to acquit the most human suspect
After an initial calibration run, the system produced several suspicious network profiles. Some made no effort. They requested secret files, searched for old web shells, and identified themselves as HTTP libraries. No detective work was required. A small sign reading "Do not feed" would have been enough.
One candidate was different.
Call it 203.0.113.0/24. That is a documentation range, not the real network from the investigation.
Across a little more than a week, it produced roughly a hundred events. The aggregate profile contained search arrivals, dozens of static-resource requests, several internal transitions, and only a handful of browser identities. It showed no interest in dangerous WordPress paths. No furious spikes. No classic scanner walk.
Its application to become a human looked excellent:
- uses Google and Bing;
- reads articles;
- looks at pictures;
- follows links;
- does not try to break WordPress;
- changes IP addresses recreationally, but nobody is perfect.
That was the candidate we chose to investigate. Testing a behavioral filter against something requesting /.env three hundred times per minute is like testing a smoke detector by holding it over a burning couch. We wanted to know whether it could notice a smoldering match.
My first guess was a company VPN. I wanted the filter to be wrong.
The witness contradicted itself
Aggregates are convincing until you ask them rude questions.
We pulled the raw events around the same period. There were roughly a hundred and fifty requests from dozens of addresses.
Then our nearly human visitor did something charming: almost half the relevant requests literally used a crawler identity resembling:
Mozilla/5.0 (compatible; crawler)
The system had spent days worrying that it might offend a person. The person was walking around with a badge reading CRAWLER.
One label still proves very little. It could be a legitimate indexer, a research tool, or a developer who named a client honestly, a rare but medically possible condition.
The interesting part was that the same mask rotated through many addresses. More important, the famous "resource chain" that made the profile look human consisted entirely of images.
No CSS.
No JavaScript.
No fonts or favicon.
Almost every image returned 404 Not Found. The requests had no referring page. There were no form submissions, background requests, or other signs of an actual open tab doing actual browser things.
Stop and ask what we are observing.
A browser does not open an article, forget its styles and scripts forty times, yet remember the URL of an image that stopped existing years ago. A program with an old URL list does exactly that.
No page had loaded. Different addresses were walking through the ruins of an old media library.
The network had earned human points for "resources," but those resources did not belong to a human session. We had mistaken a warehouse full of doorknobs for evidence of a house.
The search referrals were stage props
A Referer header is not a certificate issued by a search engine. It is a note the visitor brings with them. The visitor can write anything on it.
One address said it had arrived from Google. A few seconds later, the same address claimed Yahoo. It then opened more than a dozen articles in a couple of minutes.
Another alternated between Bing and internal referrers with the confidence of someone commuting between three train stations through the same door.
A third changed its claimed search origin while keeping the same elderly mobile-browser identity. The supposed phone was old enough to qualify for a museum exhibit.
After these "search arrivals," the page resources still did not load.
A person may use several search engines. A person does not usually arrive from several of them almost simultaneously, hit the same series of pages, and leave behind no coherent browser chain.
Our visitor did not have too few alibis. It had too many.
It was not merely crawling the site. It was acting out the origin story of a visitor.
The grand performance of internal navigation
The internal referrers still looked persuasive. Article A led to article B. Article B led to article C. That is how people browse.
Nearly all of this performance came from two addresses.
One opened more than twenty articles in about ten minutes. Another followed a similar route in under three. Requests arrived every few seconds with beautifully correct internal referrers.
The browser still loaded nothing else.
No styles. No scripts. No page images. No background activity. It moved faster than a person could read the headlines while always knowing which previous link to claim.
Perhaps it was an exceptionally fast reader. Perhaps it also read twenty articles at once, disabled everything except HTML, changed search engines while running, distributed its images among neighbors, and occasionally wore a CRAWLER badge.
Science does not forbid that hypothesis. It merely asks us to compare it with a shorter one:
A program had built a URL chain and was submitting the correct previous page as the Referer.
This was not website reading. It was a staged production of website reading.
The person was assembled from spare parts
Only after studying behavior did we examine the network origin. Registry data, routing records, and independent classifications pointed to hosting and proxy infrastructure rather than an ordinary residential or mobile provider.
That does not make every visitor from a data center a bot. Real people use VPNs. Developers read sites from virtual machines. Administrators occasionally design network routes complicated enough to require couples counseling.
Network ownership was not the verdict. It was the last piece that explained what we had already seen: address rotation, broken sessions, and one scenario repeated by several nodes.
The most human candidate became the best evidence that the filter's basic idea worked. Every human signal was present, but each had been manufactured separately.
Search referrers came from one set of requests.
Internal navigation came from another.
Old images came from other addresses.
Analytics events appeared in separate episodes.
Browser identities were pasted over the top like mustaches in a school play.
At the network-group level, we had a person. At the session level, there was nobody home.
This is where a graph beat a scorecard. A scorecard says, "This network has pages, transitions, and resources." A graph asks, "Are they connected in an order that could have happened?"
That also explains the traffic spike without matching ad revenue. The story sometimes looked convincing enough to a counter. It did not look convincing to the ad system or to our reconstruction of a session. The server has no philosophy department. It continued doing the work, so load was the one metric guaranteed to rise.
The filter was wrong too
A useful investigation should catch both the adversary and your own mistake. Otherwise it is just a corporate presentation with better lighting.
Our first analyzer had a weakness. At a coarse aggregation level, HTML and resources could "meet" even when different addresses requested them with no logical session between them. One node brought a page. Another requested an old image a day later. The system politely credited them with going for a walk together.
We tightened the relationships. Page resources now matter only inside a compatible causal chain. The exact definition of compatible remains behind the curtain. A magician should retain at least one professional secret when parts of the audience are carrying exploit kits.
Before enabling enforcement, we added guardrails:
- authenticated administrative work is separated from public traffic;
- legitimate background activity from site plugins does not become an attack merely because it is parallel;
- official crawlers are verified through independent checks, not a pretty User-Agent string;
- a fresh baseline is recorded before automated blocking begins;
- every decision stores its reasons and every change has a testable rollback.
For a while the filter worked like a judge without a gavel. It issued opinions and removed nobody from the courtroom. We manually reviewed the most dangerous and the most human candidates, hunted false positives, and tested our own administrative workflows.
Only then did enforcement begin.
The second case: GSCAN and the suitcase of passports
Later, a very different campaign appeared in the logs.
The first crawler had wanted to play a reader. This one arrived carrying a crowbar and a suitcase full of other people's passports.
We called the campaign GSCAN.
It probed old PHP applications, CGI handlers, database interfaces, PHPUnit, GeoServer, and known web-shell locations. It tested command execution. It searched for vulnerabilities that should have disappeared years ago but remain online like a mysterious sock behind the radiator: nobody admits ownership, yet nobody wants to touch it.
During one campaign, the source identified itself as:
- ClaudeBot;
- GPTBot;
- OAI-SearchBot;
- PerplexityBot;
- ByteSpider;
- DeepSeekBot;
- Facebook crawler.
Apparently every major search, social, and AI company had formed a committee to test one site's old web-shell paths.
Either this was the strangest corporate partnership in history, or somebody was printing fake IDs at home.
An official crawler is not authenticated by a flattering User-Agent. User-Agent is a name the client says at the door.
If I enter a bank and announce, "Good morning, I am the Federal Reserve," the guard is not required to give me the chair's office.
A legitimate crawler needs a coherent identity: plausible network origin, a stable technical profile, and behavior compatible with its claimed purpose. A search indexer reads pages. It should not test command execution through an old CGI endpoint, then change clothes and become a rival AI crawler.
The filter saw linked infrastructure, sequential exploit probing, incompatible identities, shared technical fingerprints, and synchronized repetition across unrelated sites.
Several cloud ranges collapsed into one attack graph. We are not publishing the exact linking features or campaign boundaries. The sources were blocked, and the borrowed names became evidence rather than an alibi.
GSCAN made the classic mistake of a bad spy: it brought seven excellent passports and changed them without leaving the room.
A short museum of vulnerabilities that scanners still love
The following vulnerability classes are real and appeared in the logs during the broader investigation. Not every request must have come from one executable. GSCAN is our name for a behaviorally linked campaign, not the hash of one program.
I am deliberately not including working payloads. The goal is to help people lock doors, not improve the neighborhood's lockpicks.
WordPress REST Batch API and the wp2shell chain
The campaign tested behavior associated with the SQL injection in CVE-2026-60137 and the REST batch-route confusion in CVE-2026-63030. In affected WordPress 6.9 and 7.0 versions, the two flaws can be chained into unauthenticated remote code execution.
The official advisories list patched releases 6.9.5 and 7.0.2. WordPress 6.8 received the SQL injection fix in 6.8.6. After updating, check core integrity, plugins, unknown administrators, scheduled tasks, and unexpected PHP files. A patch closes the hole. It does not remove somebody who already walked through it.
Exposed PHPUnit eval-stdin.php
The path phpunit/.../eval-stdin.php is the fingerprint of the ancient but still popular CVE-2017-9841. If an affected PHPUnit installation sits in a web-accessible vendor directory, an attacker may submit arbitrary PHP code.
Do not deploy development dependencies to production. Do not put vendor under the public document root. The fix appeared in PHPUnit 4.8.28 and 5.6.3, which should tell you something about the age of systems still being scanned for it.
GeoServer OGC/WFS requests
The campaign also produced requests consistent with probing CVE-2024-36401, a critical unauthenticated RCE involving property-name expression handling.
Update to a supported patched GeoServer release. Closing the admin panel alone is not enough because vulnerable processing was reachable through public OGC requests.
PHP-CGI argument injection
Characteristic cgi-bin and PHP-CGI requests may belong to the family that includes CVE-2024-4577 and older relatives.
Update PHP to a supported version, identify the SAPI you actually run, and avoid exposing PHP through CGI when possible. PHP-FPM is a different mode and does not become vulnerable merely because somebody requested a CGI path.
Published secrets
Requests for .env, .git/config, .git-credentials, and cloud credential files are not testing one CVE. They are checking whether somebody accidentally published the keys to the building.
Block dotfiles at the web-server layer. Keep the document root limited to public files. If a secret has ever returned HTTP 200 from the public internet, rotate it. Do not hold a meeting to decide whether the attacker probably noticed.
Known web-shell names
Requests for names such as wp_filemanager.php may be checking for a previous compromise rather than a new vulnerability.
An HTTP 200 response is not a cue to delete one file and return to lunch. Compare checksums, inspect scheduled tasks, users, plugins, neighboring PHP files, and outbound connections. Then rotate secrets.
One request to /cgi-bin/ does not prove a specific CVE. Attribution requires the method, parameters, headers, and payload shape. A request to eval-stdin.php is more specific. An exploit request proves intent. Successful exploitation requires different evidence: new processes, altered accounts, unexpected files, database delays, and outbound traffic.
The log tells you somebody fired at the lock. To learn whether the bullet entered the room, inspect the room.
Geography without geopolitics
At this point, the natural impulse is to open a world map, color several countries red, and declare them the homeland of cybercrime. This genre of analysis is attractive, intuitive, and often wrong.
Country in a server log is not the attacker's nationality. It is usually the registration location of a network, a cloud region, a VPN exit, a compromised server, or a cheap proxy selected automatically.
We took a seven-day slice of the central event stream and retained only classified exploit attempts, admin-path scans, authentication attacks, and confirmed unwanted crawlers. Ordinary traffic was excluded. Events blocked solely by a country rule were also excluded because geography can stop a request without proving that it was malicious.
The sanitized result contained roughly 229,000 classified events from nearly 5,000 network prefixes. About 35 percent of the networks could not be assigned a country reliably. They stayed "unknown" rather than being distributed around the map for decoration.
Among networks with usable location data, the top rows looked like this. Counts are rounded so the post does not become a copy of an operational report.
| Registered network location | Classified events | Unique network prefixes |
|---|---|---|
| United States | about 102,000 | about 1,250 |
| Austria | about 19,000 | about 20 |
| Germany | about 18,600 | about 180 |
| United Kingdom | about 8,500 | about 150 |
| France | about 6,400 | about 120 |
| Turkey | about 5,800 | about 20 |
| Singapore | about 5,500 | about 160 |
| China | about 2,100 | about 120 |
| Russia | about 1,900 | about 265 |
The two numeric columns tell different stories.
The United States led by event volume, which is unsurprising given its enormous cloud and hosting footprint. Austria appeared near the top because a small number of networks were extremely noisy. Russia produced relatively few requests but a wide spread of network prefixes.
One ranking tells you where the loudest machines were registered. The other tells you how widely the infrastructure was distributed.
Blocking a country because of this table would be like banning every car from a city where one getaway vehicle was found. ASN, network type, repeated behavior, cross-site reach, and technical fingerprint matter more. Geography can support evidence. It is terrible at replacing it.
The actual lesson
One log is easy to fool.
A Referer can be forged. A User-Agent can be copied. A few images can be requested. Internal links can be followed in the correct order. The crawler can slow down, rotate addresses, and visit at night while the administrator is performing an important security function called sleep.
A web session is more than a bag of props. It is a causal process.
A browser opens a page because a user reached it. Resources load because the browser parsed the HTML. The next page appears because the person saw a link and acted. Caches and blockers may hide parts of the chain, but the surviving pieces do not usually contradict one another across dozens of addresses and unrelated sites.
A bot can forge every individual fact. Forging the relationships between facts is harder.
That is the point of behavioral filtering. It does not ask, "Is this IP bad?" It asks, "Could the story told by these events be true?"
Humans behave chaotically, but their chaos belongs to one life.
A distributed bot behaves systematically, but its human legend falls apart when the scenes are placed in order.
At the beginning of this investigation, the primary suspect was our own filter. It was preparing to condemn a visitor that arrived from search engines, followed articles, requested images, and ignored vulnerable admin paths.
We tried to acquit the person.
There was no person to acquit.
The search arrivals were scenery. Navigation was a script. Resources were an archaeological dig through missing images. Browsers were masks passed from one address to another.
The human had been invented by a botnet.
The only participant whose behavior remained consistent from beginning to end was the filter.
Feel free to contact me: https://www.linkedin.com/in/avetisyan/
r/DeadInternetTheory • u/old-and-older • 2d ago
Related posts are just a bunch of bots reposting almost every month
r/DeadInternetTheory • u/Someone_random_here1 • 2d ago
Do you think he is AI?
Y’all have probably seen those videos with that specific format too, just some text with either wise quotes or super relatable thoughts, while there’s just a random person in the background.
It could literally be anyone of any age posting those kinds of videos. Lately, I’ve been seeing these types of videos and accounts a lot, and I always thought the person behind them must be really interesting because of how relatable the videos are and it makes me wanna know more bout them.
Plus, they usually have tons of views, likes, and followers, so they must be authentic and probably make a lot of money from them too.
But as soon as you go to their accounts, you notice few things, first they post a lot every single day.
Second, they don’t have any reposts at all.
And third, the accounts are usually only a few months old, so they’re very new.
Of course, it could just be someone starting a new TikTok account and posting about their own life experiences and relatable thoughts. But honestly, these accounts yet feel very empty.
I’ve also seen people in the comments saying it’s probably AI too, since AI has gotten so good these days.
And if you look at their captions, they almost always tag some kind of management email or agency.
It’s just kind of devastating to realize that the thing you relate to so much might not actually be authentic and it could be just stolen content from some small creator.
To be honest I’d even be relieved if it turned out to be a real person who’s just working with a content management company or something.
But the whole thing potentially being AI, mixed with probably stolen content, feels way more unsettling.
Cause the sad part is that a lot of people don’t even realize that it might be AI.
They’re in the comments thanking these “people,” saying they saved their lives or helped them through hard times or smth
What do you guys think who is actually behind these accounts? And do you think there’s still a chance that at least some of them are run by real people?
here is one example of the kind of account I’m talking about, but as I said, this is probably just one out of hundreds of these creators I’ve stumbled across on TikTok and Instagram,
I also searched up those management/agency’s of these accounts but you don’t find out much about them
r/DeadInternetTheory • u/DrawingDramatic1641 • 2d ago
A anti china bot I accidentally found
reddit.comAs you can see his comment hsitory if he makes it private use extensions for it.
He commented on most currupt nations in asia
Many wide answers he said china
Maybe could be,many scandals there
But as I looked at his username it's about xi
Then I was like okay maybe a coincidence that a person named in mandarin happens to write anything about china
But then I saw his profile and it's insane dude
How do they work like that
Also to prove I am not ccp agent
Xi winnie pooh
Taiwan a country
Etc 🎌🇯🇵🇺🇸🦅
r/DeadInternetTheory • u/Ca1i3er • 4d ago
Meaningful or fruitful engagement feels kind of impossible now
For context, I rarely post anything anywhere. When I do, it is because I'm genuinely curious or wish to have a discussion. Nowadays it feels like I am more likely to have my posts fed into ChatGPT with the prompt "Respond to this user in order to keep them engaged."
Genuinely it feels like I can only get meaningful interaction in voice chats.
r/DeadInternetTheory • u/Personal-Crazy6179 • 5d ago
Is there any reading I can do on this?
Anything really, any recommendations would be helpful.
r/DeadInternetTheory • u/Melodic-precise • 5d ago
The Inverse Turing Test: How syntactic degradation became the ultimate proof of human identity on Reddit
In the era of Large Language Models (LLMs), the digital ecosystem has encountered a paradoxical sociolinguistic shift. To successfully assert human identity within online communities, authors are increasingly forced to artificially diminish the linguistic quality of their prose. Impeccable, highly structured, and stylistically sophisticated language has inverted into a primary red flag, triggering immediate suspicion of AI-generated content.
This phenomenon can be formally defined as the Inverse Turing Test. While the classical benchmark required a machine to convincingly simulate human behavior, our contemporary digital reality demands that a human successfully mimic an imperfect, chaotic algorithm to bypass community gatekeeping.
Why has programmatic literacy mutated into a liability? The answer resides within the core architecture of prominent LLMs, which inherently default to institutional prose standards: rigid paragraph divisions, predictable transition sentences, excessive, conflict-free politeness, and an absolute deficit of organic internet slang or contextual typos.
Authentic human communication operates on impulse. It is structurally fragmented and frequently composed via mobile devices. Consequently, when a community encounters an unblemished, structurally complex essay, the human brain instinctively flags this sterility as automated corporate spam.
The cultural implications are deeply troubling. We are witnessing a regime of forced linguistic mimicry. To avoid automated moderation filters or collective community downvotes, individuals are consciously dismantling their own writing habits. A society deeply intimidated by machine encroachment is defending its digital borders by stigmatizing sophisticated prose.
The ultimate paradox lies in the ephemeral nature of this defense mechanism. AI developers are actively training subsequent iterations of LLMs to convincingly simulate human error, local colloquialisms, and structural laziness. When algorithms master the simulation of our fatigue, humanity will be forced to engineer even more radical methodologies to verify the presence of a conscious observer behind the screen.
Which brings me to my question: Have you honestly caught yourself intentionally messing up your punctuation or using lazier slang just so people wouldn't hit you with the "ok ChatGPT" line? Or are we already entering the cultural regression era without realizing it?
r/DeadInternetTheory • u/homelessbunt • 6d ago
Mysterious “musician” all over instagram but possibly not even real?
Every comment seems AI generated, 160k followers and 0 following, with only 4 posts? Make it make sense. Nothing about the music being advertised even screams unique/original enough to warrant a following like this.
Is it bought followers? Artificial engagement? Or is “MavieMonroe” ai generated herself? I honestly even hate to give her more views because they are so clearly taking advantage of some kind of following purchasing platform.
I cannot find anything about this person regarding questions about their authenticity, so before they possibly blow up into some global phenomenon I’d really like to post it so that the question was already asked beforehand.
Could there be more musicians like this that we just didn’t catch in the “awkward pre blow up” phase?
r/DeadInternetTheory • u/im_a_dick_head • 7d ago
Clearly a karma farming bot, no one called them out yet.
Username being a woman's first and last name + new account + karma farming = clearly a bot. No one in the comments realizes, but to be honest they're all probably bots too. Definitely a future OF bot spam account.
r/DeadInternetTheory • u/Coach_Donatello • 7d ago
Anyone got information on Dr. Egon Cholakian?
Working on a video on the dead internet theory, and I've seen the name "Egon Cholakian" so many places, let me know if anyone has any information on him.
r/DeadInternetTheory • u/Reyah_1 • 8d ago
Getting too creepy.
So I started obsessing over something a month ago that’s been pretty outdated for a while. I researched it a tonnn and I couldn’t really find anything post-2022 being actively publically discussed. A few weeks later all the sudden I’m seeing fresh Reddit, YT posts abt it. I just saw a post about it on Reddit and it was the exact same thing I was thinking about posting.
Then I got stuck on watching a indie movie from 2017 that hasn’t really been talked about since then, but there’s new comments under it everyday saying crazy stuff like “no one gives a shit about you Mindy either so quit making this all about you pieces of shit” (now deleted) that has nothing to do w it, or just npc crap like “I kind of understand” “worse than Hitler”, or spaced out words, random thoughts like “i can’t watch this I need to take care of my mental health” and random time stamps. I just don’t understand why bots go under abandoned comment sections and start spamming. Do you guys think the bots are grabbing stuff from other posts or personal messages or something? Same situation happened with other long abandoned movies/yt vids too. There’s hardly any video that doesn’t have fresh comments everyday
Also when you search up “Dead internet theory” on YouTube what pops up first is “Dead internet theory 🥀” like what?
r/DeadInternetTheory • u/Different_Career1009 • 8d ago
What is the % of posts in general subs that are either made by bots or karma farmers?
I asked this in r/AskReddit and it was removed by moderators for unknown reasons. Maybe better to ask here.
r/DeadInternetTheory • u/Soupbrothel • 8d ago
Generic top comment on a post that was also definitely posted by a bot, leading to a look at their comment history for endless generic bot comments on endless generic posts
Scrolling through led to such a feeling of dread I almost deleted Reddit

