Answer: they're part of a spam network of unknown purposes, consisting of 23 accounts that tweet on remarkably similar schedules via "Mobile Web (M2)" (early tweets were sent via "Twitter Web App"). 98.9% of the tweets posted by these accounts are replies.
Although these accounts reply mostly in English, a significant minority of their content is in a variety of other languages. The content is all over the map, ranging from random feel-good replies to coupon codes to comments on the present Armenia/Azerbaijan conflict.
This network frequently reuses replies on multiple accounts. The repeated tweets are almost all in English, although many of them are grammatically incorrect. (We're not sufficiently familiar with the other languages it uses to say whether the same is true of all its replies.)
Finally, who does this network reply to? A wide variety of accounts, encompassing corporations, musicians, doctors, cryptocurrency accounts, and seemingly random accounts with almost no followers. We're not sure what the goal of this network is, but plan to keep an eye on it.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
Just for fun, we started digging through the accounts followed by 60 popular verified #MAGA accounts to see what there is to see. We found one weird thing that stuck out like a sore thumb (and will add more if/when we find more). . .
Meet @ScottIngwers. This account has never tweeted, never liked any tweets, has no bio, and uses a default profile pic. Despite this, its 342 followers include @DonaldJTrumpJr, @IvankaTrump, and @EricTrump.
Since the account has no content, there's not really much about @ScottIngwers to analyze, but we did notice that despite the account being totally empty, it's picked up followers in a variety of languages.
If you're looking for Twitter accounts promoting an ad-infested website with a deceptively similar name to UK news agency Sky News, then this botnet's for you. #MondayMotivation#Scamalicious
The real website for Sky News is sky(dot)com (and various subdomains, such as news(dot)sky(dot)com). The fake site is sky-news(dot)co(dot)uk, with a hyphen.
This botnet consists of six accounts, all created on October 11th, 2020. These accounts tweet via automation service IFTTT. All use female profile pics and have bitly links on their profiles that lead to sky-news(dot)co(dot)uk, which is not actually Sky News.
Meet @bmjisoo, a self-described Events & Program Manager, Adventurous Foodie, Global Trotter, and National Park Explorer. Based on its flurry of recent pro-Trump and anti-Biden retweets, it would at first glance appear to be a #MAGA account.
The full story is a bit more complicated. @bmjisoo began its Twitter life as a Korean-language account back in 2014, took a five-year hiatus, and then woke back up in 2020, first retweeting a bunch of Indonesian follower farming spam before assuming its current #MAGA persona.
The account presently known as @bmjisoo also changed names at least once: when it was tweeting in Korean back in 2014, it was named @blbml08t6e. (Its permanent ID is 2287181347, just in case it swaps names again.)
Twitter accounts being sold on dodgy websites frequently have fake followers, and @nokilllogwtmp (permanent ID 529412597) is no exception, with several thousand batch-created accounts following it. We decided to further explore this bulk follow network.
To find more accounts that are part of this bulk follow network, we downloaded the followers of accounts followed by the bogus-looking followers of @nokilllogwtmp, and repeated the process until we hit diminishing returns.
We found 23794 accounts we believe to be part of this bulk follow network. Most were created in batches between 2012 and 2014. Some were not, but we suspect they're part of the network anyway due to the order in which they followed the accounts they follow (among other things).
The first recent #DontBelieveArmenia tweet (sporadic earlier occurrences exist) was sent yesterday (Oct 5 2020) by @CoronaMan19, an account created in March 2020 with 21 tweets and 1 follower. It spiked early this morning (Oct 6 2020), frequently exceeding 200 tweets per minute.
Although the accounts involved in the #DontBelieveArmenia trend aren't provably automated (based on apps/24 hour activity), the content is incredibly repetitive. The repeated tweets include spam directed at @iamcardib, as noted earlier by @josh_emerson.
This pornbot network has grown substantially since we last looked at it. 111 of the accounts we previously found have been removed by Twitter, but 1421 new ones have joined the chorus, for a total of 1813 accounts.
The output of this pornbot network continues to grow as more accounts are added to it, peaking at over 300 tweets per hour. Almost all tweets are (hypothetically, at least) posted via "Twitter Web Client", the old and no longer available version of the Twitter website.
The accounts in this pornbot network all have 8-character names composed of random numbers and lowercase letters. All have liked zero tweets and follow zero accounts. Tweets are in Japanese and encourage users to DM the bots.