The account info cards of these UK political scam profiles are fascinating. They indicate a variety of distant and far-flung countries, including: Mauritius, Eritrea, Iceland, Mauritania, Senegal, Montenegro, Ukraine, Qatar, UAE, Yemen, Spain, Japan, United States, and Canada. Anywhere but the UK!
Notably, X reports that the country or region may not be accurate because the user may be connecting via a VPN or proxy, which cloak the user's IP and geolocation.
This means the country you see is most certainly entirely wrong, as X does not have visibility of the real IP and country. The attack campaigns probably actually originate from a small number of location clusters, likely colocated and coordinated.
The threat actors are utilising many different connection-terminating countries and IPs, constantly changing their IP address and apparent geolocation, all to evade detection.
X likely has a blocklist of abusive and scam-linked IPs, using it extensively to fight the attacks.
Bad actors see an easy workaround. An IP not present on a blocklist — a fresh benign IP, one you don't know about — doesn't indicate safety.
X should be scrutinising these signals narrowly and holistically, because they provide key indicators of fradulent activity: VPN use, rapid country switching, and the use of exotic and faraway countries — which bear no relevance in the context of UK politics.
There's so many signals here for X (and other social media firms) to use in blocking these scams! Let me help you!