Oh look, someone is trying to sell a cryptocurrency account (@wag_crypto, permanent ID 327020861) that has a bunch of fake followers. The ones in the circled portion are part of a network we haven't previously encountered.
cc: @ZellaQuixote
cc: @ZellaQuixote
We looked at the accounts followed by a sample of 200 of @wag_crypto's bogus followers. As it turns out, there are 22 accounts they all follow. One is @ARTEM_KLYUSHIN, and 12 of the others are dormant bots with tens of thousands of fake followers that also follow @ARTEM_KLYUSHIN.
We found 77064 accounts that we believe to be part of the network. All were created prior to 2014, follow far more accounts than they are followed by (including @ARTEM_KLYUSHIN), and have liked at most 4 tweets (most have liked none).
The accounts in this network are presently mostly dormant, but were quite active in the 2013-2015 timeframe and tweeted via a mix of various Twitter web products and a vast array of custom apps (5685 apps total). Tweets are mostly in Russian but a variety of languages turn up.
Do the accounts in this network have repetitive tweets? They sure do - mostly tweets in Russian accompanied by the hashtags #android, #androidgames, and #gameinsight.
Who and what has this botnet retweeted? @ARTEM_KLYUSHIN is the most-retweeted account; the rest mostly look like promotional accounts. Similarly, content is largely advertising, although @ARTEM_KLYUSHIN's #Euromaidan tweet and the "Free Instagram Followers" thing are interesting.
(more on the account sales website that led us down this rabbithole)
