Thread by @conspirator0

Here's an interesting account: @VishalAParmar, created in May 2021. All but two of its 688 followers were also created in May 2021, over a period of less than 12 hours. #SaturdaySpam

cc: @ZellaQuixote

These followers are part of a fake follower botnet created between April 30th and May 29th, 2021. This botnet consists of (at least) 20684 accounts, none of which has ever tweeted. The accounts have random-looking but more or less pronounceable names, usually in all lowercase.

Who does this botnet follow? There's a lot of variety, although most are promotional/commercial accounts of some type. Cryptocurrency/blockchain accounts are a bit of a theme.

Here are follow order by creation date plots for the accounts followed by the largest swathes of the botnet, with the bot followers colored in green. Some of the smaller accounts appear to have almost no genuine followers whatsoever.

Although this botnet has not as of yet posted any tweets of its own, it does like tweets here and there. The majority of the tweets it likes are cryptocurrency tweets, with occasional porn, coupon spam, and a random tweet from the band Chevelle turning up as well.

The accounts in this botnet have repetitive biographies, some of which are used on dozens of accounts (1279 distinct biographies for 20864 accounts, or an average of ~16 accounts with each biography).

As is common with fake follower botnets, the accounts in this network use stolen profile pics. TinEye was generally more effective than Google or Yandex for tracking down other uses of this botnet's pics.