We found 110 batch-created accounts (made in 2011) among @SamyDindane's early followers. To find the rest of the network, we downloaded the followers of other accounts followed by those 110 accounts and looked for additional batch-created accounts from the same time period.
The batches show up as horizontal streaks on follow order by creation date plots of the accounts they follow. This slideshow shows some examples, with the batch-created accounts highlighted in red.
We wound up with exactly 300 accounts that appear to be part of the network, created in April and May 2011. All have been dormant since 2013 but tweeted exclusively via "Twitter Web Client" when active, all follow similar numbers of accounts, and none have ever liked a tweet.
This network's content is mostly in French, with English as the second most frequent language, and is extremely repetitive. Most tweets appear to be ads for various tech products and services.
Along with the repetitive tweets, this network also reuses profile pics across accounts. Profile pics are a mix of cartoon drawings of people and graphics that look like logos.
Who does this network actually follow? Mostly smaller French-language accounts, although a few larger French accounts such as @paramountfr turn up as well. Many but not all appear to be accounts with a focus on technology.
(more info on the follow order by creation date plots used in this thread + source code)
OK, time to create a @DrunkAlexJones account on yet another MAGA social media site and stuff. This feature to "import copies of your Twitter" content looks interesting, will definitely test that out.
Suggested follows include NewsMax (which somehow has 905K followers on a platform that just started?) and the verification checkmark appears to be red because of course.
So far it looks like a pretty literal clone of Twitter's user interface (much more similar than Gab or Parler).
It's a Tuesday in June, and a whole ducking lot of newly-made Twitter accounts are "requesting faucet funds on the #Goerli#Ethereum test network" in a spammy repetitive fashion. #TuesdayAstroturf
These tweets are from a network of (at least) 1281 accounts created between June 22 and June 29, 2021. Each account has tweeted exactly once, and all tweets are identical other that the cryptocurrency wallet address. All tweets were (allegedly) sent via the Twitter Web App.
Each account in the network posted its one and only tweet shortly after being created, with an average of 74 seconds and median of 68 seconds between account creation and tweet time. The longest gap between creation and tweet was slightly over ten minutes.
Follow order by creation date scatter plots can be a useful diagnostic tool for finding anomalies in the followers of Twitter accounts. Here's Python source code for generating such a plot based on a follower list in CSV format.
One sign of inauthentic followers is groups of batch-created accounts that followed en masse. These groups manifest as horizontal streaks on the scatter plot, as seen here with @TWReloaded's followers. (This plot is June 2020 and @TWReloaded's fake followers are now suspended.)
(June 2020 thread on the @TWReloaded fake follower network)
In what is quite possibly one of the least necessary crossovers ever, here's a botnet that mostly spams propaganda about #Xinjiang but very occasionally tweets porn too .
This botnet consists of 183 accounts created between December 2020 and March 2021, mostly in batches. Nearly all of their tweets contain random four letter codes, which we've also seen in a previous Xinjiang propaganda botnet (now suspended):
The accounts in this botnet post almost all of their tweets via Twitter Web App, with very occasional tweets posted via Twitter for Advertisers. All of the Twitter for Advertisers tweets are Arabic-language porn tweets.
The aforementioned six accounts are part of an astroturf botnet consisting of 2841 similarly-named Twitter accounts with repetitive biographies created in May 2021. These accounts (allegedly) send all of their tweets via Twitter for iPhone.
All 2841 accounts in this network use GAN-generated face pics as their profile images.
(GAN = "generative adversarial network", the AI technique used by thispersondoesnotexist.com and similar tools to generate fake face pics.)
How does one find astroturf networks? One method is to choose a word or phrase, plot a histogram of the creation dates of accounts tweeting that word/phrase, and look for spikes. Several such spikes show up among accounts with recent tweets containing "casino".
If the spikes in creation dates are the result of someone creating making en masse, batches of similar-looking accounts will show up when one looks at the accounts created during the spikes. Here are some examples from the casino dataset, with possible batches highlighted in red.
The late February and early March batches from the casino dataset all use the same naming scheme, tweet using the same app ("Twitter Web App"), retweet many of the same tweets, and tweet identical tweets on multiple accounts, so these accounts are likely a single operation.