Thread by @conspirator0

In a fascinating coincidence, @Exposer (permanent ID 18934770), a 2009-era account being sold for $200, has five followers that look very similar to each other, also created in 2009. Can we find the rest of the network? #SaturdayShenanigans

cc: @ZellaQuixote

We began by filtering all accounts with 2009 creation dates to those meeting the following criteria:

• default profile pic
• name ends in 3 digits
• 0 likes
• < 10 tweets
• following 100+ accounts
• following at least 5 times as many accounts as followed by

Next, we downloaded tweets from the accounts in question and removed likely false positives, leaving us with 5295 accounts that we believe to be part of the network. All were created in late 2009, mostly in batches, and posted what few tweets they have via "Twitter Web Client".

The majority of the tweets posted by the members of this dormant botnet consist of fragments of text (some, possibly all, appear to be plagiarized from books or elsewhere on the Internet), generally accompanied by dead links to various URL redirection services.

Weirdly (and unlike other fake follower networks we've studied) this network mostly follows smaller accounts (dozens or hundreds of followers as opposed to hundreds of thousands), and only contributes a few followers to each account followed.

(previous thread explaining how we accumulated a dataset of older Twitter accounts that we eventually expanded to include all accounts with 2009 creation dates, which we used for this thread)