Short answer
Reply spam in 2026 falls into a handful of families: fake support accounts that answer customer complaints, crypto wallet drainers dressed as airdrops or refunds, follower and engagement sellers, adult bots that point to their profile, copied replies that farm engagement, and generic praise written to look human. The first four are easy to filter by phrase and link; the last two need duplicate detection and human review.
Key takeaways
- Fake support replies target people who complain publicly, often within minutes.
- Wallet-drainer spam uses words like claim, airdrop, refund and connect your wallet.
- Copied replies repeat an earlier reply word for word to borrow its engagement.
- Generic praise replies carry no bad words; the payload is in the profile.
- Duplicate detection catches campaigns that word lists miss.
What are the main kinds of reply spam?
Six families cover most of what moderators see, and each leaves different fingerprints in the text.
| Family | Typical wording | Fingerprint | Filter with |
|---|---|---|---|
| Fake support | "Please DM our support team", "contact the help desk" | Brand words in a handle that isn't yours, a link or a contact handle | Hold rule on "support team", link inspector |
| Wallet drainers | "Claim your airdrop", "refund available", "connect your wallet" | Crypto words plus a link, often a look-alike domain | Reject phrases, wallet address regex |
| Follower and engagement sellers | "Grow your account fast", "DM for promo" | Caps, emoji, shorteners, link-in-bio | Spam scorer, reject phrases |
| Adult bots | "Check my profile", "you won't regret it" | Short, emoji-heavy, profile is the payload | Hold rule on profile-bait phrases |
| Copied replies | A word-for-word copy of an earlier reply | Exact duplicate under the same post | Duplicate detection |
| Generic praise | "So true! This is exactly what people need to hear" | Polite, vague, fits any post | Human review, account checks |
How do fake support accounts work?
They watch for people complaining about a company and reply as "support", steering the person to a DM, a form or a phone number.
The display name usually includes the company name plus "Help" or "Care", and the profile picture copies the logo. The goal is login details, card numbers or remote access to a device. If you run a support account, the best defense is public: pin a post that says exactly which handles and channels are real, and say that you'll never ask for passwords in DMs. Check any link these replies use with the link inspector; a brand name in the wrong domain is the most common sign.
What do wallet-drainer replies look like?
They promise free tokens, refunds or rewards and send people to a site that asks them to connect a crypto wallet.
Connecting the wallet and approving a transaction gives the site permission to move funds. The wording repeats: "claim", "airdrop", "eligible", "connect your wallet", "limited time". Some include a wallet address and ask for a small payment to "unlock" a larger one. The spam scorer flags wallet addresses and this vocabulary; a regex rule like \b0x[a-f0-9]{40}\b in the rule builder rejects posts with Ethereum-style addresses outright.
Why do accounts copy other people's replies?
Copying a reply that's already getting likes is a cheap way to collect engagement and make a new account look active.
The copy usually appears under the same post minutes or hours later, sometimes with one word changed. Word lists can't catch it because the text is, by definition, acceptable. Duplicate detection can: paste the replies under a post into the spam scorer and exact or near-identical pairs get flagged together. Then look at the later account.
How do I deal with generic praise replies?
Look at the account, not the reply: these are built to pass any text filter, and the profile is where the spam lives.
These replies are vague enough to fit under any post ("Absolutely agree, more people need to see this"). Since 2023 they've become easier to produce in bulk, and they tend to arrive in bursts from accounts with similar names and profile styles. A single one costs you nothing; a thread full of them buries real conversation. Hide them when they pile up, and if you run a social wall, hold posts from accounts you don't recognize.
Which signals are the most reliable?
Duplicates, wallet addresses, brand names in the wrong domain and shorteners combined with urgency are the most dependable text signals.
Single signals mislead: lots of emoji is normal for excited fans, and a link is normal for a partner. Combinations are what matter. "Shortened link + urgency word + support claim" is very rarely legitimate. That's why the spam scorer adds points per signal instead of judging any one of them alone.
Common questions
Why do spam replies appear so quickly after I post?
Many spam accounts are automated and watch for keywords, big accounts or trending topics. A complaint that mentions a bank, an airline or a crypto exchange is a common trigger for fake support replies.
Should I reply to spam to warn others?
Usually not. Replying boosts the spam reply in the thread. Hide it, report it, and if a scam is targeting your customers, post a separate warning from your account that explains how to recognize real support.
How do I prove an account is impersonating us?
Collect screenshots with the URL visible, note the account's handle and ID, and use X's impersonation report. Point customers to your verified handle and the support channels listed on your website.