Thread by @conspirator0

We've previously documented that the "Round Year Fun" apps ("My Twitter Family" etc) force you to follow other accounts without your knowledge. Interestingly, the main Round Year Fun website shares an IP address with a website that sells Twitter followers.

cc: @ZellaQuixote

The follower sales website in question (realactivefollowers(dot)com) offers a trifecta of shady Twitter-related services: you can buy followers, likes, and even developer accounts (which enables aspiring botmakers to bypass the normal approval process, among other things).

Realactivefollowers(dot)com also offers a free trial of 50 followers. We had @DrunkAlexJones take advantage of this offer with the goal of testing the hypothesis that the followers being sold on this website are unwitting users of the Round Year Fun apps.

Within a few hours, @DrunkAlexJones experienced an infusion of new followers, most of which indeed have tweets posted via one or more of the Round Year Fun apps. (We were unable to check a few of the accounts as they are presently in protected status.)

If you've already used one or more of the Round Year Fun apps, here are instructions on how to revoke their access to your account:

Final opsec note: we regard both of the websites mentioned in this thread as potentially unsafe and used Tor to visit both of them. We recommend anyone researching sites that may be malicious take similar precautions.

Update - both Round Year Fun and the realactivefollowers(dot)com were offline briefly after losing their original domain registration and hosting. Unfortunately, both sites are now back and hosted by @DreamHost.

(typo, got an unnecessary "the" in there somehow)

Here's a table of the accounts with the largest number of recent (and involuntary) Round Year Fun followers, based on the last 48 hours' worth of Round Year Fun tweets. There's a lot of variety, but cryptocurrency does seem to be a repeated theme.

Update: found some posts on Black Hat World forums related to Round Year Fun/realactivefollowers(dot)com. A user named silentwandererr is promoting realactivefollowers(dot)com and claims to "have an unlimited amount of Twitter API keys".