Follow order by creation date scatter plots can be a useful diagnostic tool for finding anomalies in the followers of Twitter accounts. Here's Python source code for generating such a plot based on a follower list in CSV format.
One sign of inauthentic followers is groups of batch-created accounts that followed en masse. These groups manifest as horizontal streaks on the scatter plot, as seen here with @TWReloaded's followers. (This plot is June 2020 and @TWReloaded's fake followers are now suspended.)
(June 2020 thread on the @TWReloaded fake follower network)
Large spans of an account's followers that have 0 likes or 0 tweets can also be a sign of inorganic follow activity. @ARTEM_KLYUSHIN's follower plot has several of these, some of which also contain horizontal streaks indicative of batch account creation.
Here are some analyses of fake followers that use follow order by creation date scatter plots combined with other patterns in the accounts (similar names/stats/set of accounts followed etc) as corroborating evidence.
Once one has identified networks of fake followers, one can then check various accounts one runs across to see if they acquired followers from them. For example, @realchrisrufo and @AppSame both have followers from at least one of the fake follower linked in the previous tweet.
(previous threads on the @rrvvs and @ARTEM_KLYUSHIN botnets mentioned in the previous tweet)
In what is quite possibly one of the least necessary crossovers ever, here's a botnet that mostly spams propaganda about #Xinjiang but very occasionally tweets porn too .
This botnet consists of 183 accounts created between December 2020 and March 2021, mostly in batches. Nearly all of their tweets contain random four letter codes, which we've also seen in a previous Xinjiang propaganda botnet (now suspended):
The accounts in this botnet post almost all of their tweets via Twitter Web App, with very occasional tweets posted via Twitter for Advertisers. All of the Twitter for Advertisers tweets are Arabic-language porn tweets.
The aforementioned six accounts are part of an astroturf botnet consisting of 2841 similarly-named Twitter accounts with repetitive biographies created in May 2021. These accounts (allegedly) send all of their tweets via Twitter for iPhone.
All 2841 accounts in this network use GAN-generated face pics as their profile images.
(GAN = "generative adversarial network", the AI technique used by thispersondoesnotexist.com and similar tools to generate fake face pics.)
How does one find astroturf networks? One method is to choose a word or phrase, plot a histogram of the creation dates of accounts tweeting that word/phrase, and look for spikes. Several such spikes show up among accounts with recent tweets containing "casino".
If the spikes in creation dates are the result of someone creating making en masse, batches of similar-looking accounts will show up when one looks at the accounts created during the spikes. Here are some examples from the casino dataset, with possible batches highlighted in red.
The late February and early March batches from the casino dataset all use the same naming scheme, tweet using the same app ("Twitter Web App"), retweet many of the same tweets, and tweet identical tweets on multiple accounts, so these accounts are likely a single operation.
Pro-Bolsonaro accounts are spamming follow trains under a variety of hashtags. Here's a quick look at the network (or network of networks, rather). #PlatformManipulationMonday
To map out Bolsonaro trains, we began with one train hashtag (#ArqueirosPatriotas) and explored the networks of accounts using it to find more. We wound up with 12 hashtags (often used in combination), 16969 trains, and 229795 retweets of trains between April 1 and June 13 2021.
We considered any non-reply tweet containing at least one of the follow train hashtags, at least 10 tags of other accounts, and no substantive additional text content to be train tweets. Over half of the volume (56.1%) is trains listing at least 20 accounts or retweets thereof.
If you woke up this morning hoping that somewhere in the world there was a Twitter botnet advertising multiplayer games by replying to tweets (many of them several years old) that have nothing to do with video games, this spam network's for you. #SundaySpam
This network consists of 45 accounts created between February and June 2020. Almost all of their content (23574 of 24125 tweets, 97.7%) is repetitive replies promoting video games, most of which link to gameexp(dot)com.
At least 23 (probably 25) of the accounts in this network use GAN-generated profile pics. (GAN = "generative adversarial network", the AI technique behind the fake faces produced by thispersondoesnotexist.com etc.) Many have had their colors edited, and 10 have been resized/cropped.
We found 1311 Instagram accounts with GAN-generated face pics, account names beginning with "alex-", and biographies containing "GET +10000 FOLLOWERS NOW" accompanied by random emoji. (Due to Instagram's lack of a public API, this was done via the website's search future.)
As is the case with unmodified GAN-generated face pics (so far), the major facial features (especially the eyes) are in the same position on each of the 1311 images. This anomaly becomes visually apparent when the images are blended.