Twitter accounts being sold on dodgy websites frequently have fake followers, and @nokilllogwtmp (permanent ID 529412597) is no exception, with several thousand batch-created accounts following it. We decided to further explore this bulk follow network.
To find more accounts that are part of this bulk follow network, we downloaded the followers of accounts followed by the bogus-looking followers of @nokilllogwtmp, and repeated the process until we hit diminishing returns.
We found 23794 accounts we believe to be part of this bulk follow network. Most were created in batches between 2012 and 2014. Some were not, but we suspect they're part of the network anyway due to the order in which they followed the accounts they follow (among other things).
The accounts in this bulk follow network fall into three categories:
• accounts with no tweets
• mostly batch-created accounts that tweeted exclusively with Twitter web products
• non-batch-created accounts that tweeted via hundreds of custom apps (shown in word cloud)
These accounts are largely dormant today, but back when they were active they tweeted in a variety of languages, with Russian and English being the most common. Many tweets were repeated across accounts, these are mostly in German, Russian, and Ukrainian.
These accounts also retweeted a variety of accounts back when they were active. Most of the accounts retweeted tweet in English, with Russian accounts making up a significant minority, including perennial fake engagement aficionado @ARTEM_KLYUSHIN.
This network follows a very different set of accounts than it retweeted, mostly English-language promotional/commercial accounts. @XHNews, the English-language Twitter feed of Chinese state news agency Xinhua, is one of the more interesting inclusions.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
Meet @bmjisoo, a self-described Events & Program Manager, Adventurous Foodie, Global Trotter, and National Park Explorer. Based on its flurry of recent pro-Trump and anti-Biden retweets, it would at first glance appear to be a #MAGA account.
The full story is a bit more complicated. @bmjisoo began its Twitter life as a Korean-language account back in 2014, took a five-year hiatus, and then woke back up in 2020, first retweeting a bunch of Indonesian follower farming spam before assuming its current #MAGA persona.
The account presently known as @bmjisoo also changed names at least once: when it was tweeting in Korean back in 2014, it was named @blbml08t6e. (Its permanent ID is 2287181347, just in case it swaps names again.)
The first recent #DontBelieveArmenia tweet (sporadic earlier occurrences exist) was sent yesterday (Oct 5 2020) by @CoronaMan19, an account created in March 2020 with 21 tweets and 1 follower. It spiked early this morning (Oct 6 2020), frequently exceeding 200 tweets per minute.
Although the accounts involved in the #DontBelieveArmenia trend aren't provably automated (based on apps/24 hour activity), the content is incredibly repetitive. The repeated tweets include spam directed at @iamcardib, as noted earlier by @josh_emerson.
This pornbot network has grown substantially since we last looked at it. 111 of the accounts we previously found have been removed by Twitter, but 1421 new ones have joined the chorus, for a total of 1813 accounts.
The output of this pornbot network continues to grow as more accounts are added to it, peaking at over 300 tweets per hour. Almost all tweets are (hypothetically, at least) posted via "Twitter Web Client", the old and no longer available version of the Twitter website.
The accounts in this pornbot network all have 8-character names composed of random numbers and lowercase letters. All have liked zero tweets and follow zero accounts. Tweets are in Japanese and encourage users to DM the bots.
In the wake of Donald Trump's positive COVID-19 test and subsequent hospitalization, #MAGA Twitter has been abuzz with conspiracy theories attributing his diagnosis to an assassination attempt by various entities such as China, Biden, Pelosi, and Alexei Navalny.
We downloaded tweets containing the word "assassination" subsequent to Trump's announcement of his positive test, and filtered out some obvious false positives (tweets about the Jamal Khashoggi assassination, for example). Very little of the traffic appears to be automated.
Tweets theorizing that Trump's COVID-19 diagnosis was actually part of an assassination attempt began appearing a scant 3 minutes after his positive test was announced (Oct 1 2020), starting with a reply from 4-month old account @Freddie111112 to CNN reporter @mkraju.
If you're looking for an automated military patriot mom who is sick of politics as usual and spams links to Gateway Pundit articles via IFTTT, @PatriotMomNDJ just might be the Twitter account for you. #SaturdaySpam
All of @PatriotMomNDJ's recent tweets are sent via IFTTT, but this account has utilized other Twitter automation tools in the past, mainly SocialOomph. Almost all of its original tweets are automated (140161 of 140110, 99.96%), so this account is definitively a bot.
Similarly, @PatriotMomNDJ currently only links Gateway Pundit, but in the past it varied its spam lineup. Right-wing news site The Blaze was a frequent flier until late 2018, and commercial spam (Amazon, staged(dot)com, and others) was a major portion of its early content.
We've done a decent amount of digging into various bulk follow botnets over the last couple of years, and decided to aggregate all of our threads on the topic. Some botnets are still online, while others have been shut down by Twitter.