Thread by @conspirator0

Rather ironically given its stated interest in "healthy conversations online" and "thriving engaged communities", @OpenWebHQ got many of its early followers from a duo of fake follower botnets. We've seen one of these botnets before; here's a look at the other.

cc: @ZellaQuixote

This fake follower botnet consists of 4075 accounts created in large batches in July 2014. All accounts have lowercase names containing underscores, and usually digits as well. All have been dormant since late 2015 but (allegedly) tweeted via "Twitter Web Client" when active.

Who does this fake follower botnet follow? Mostly commercial/promotional accounts belonging to a variety of businesses and entrepreneurs. Most of the accounts followed by the bots tweet primarily in English, although a few Arabic-language accounts turn up as well.

Here are follow order by creation date plots for a bunch of the accounts followed by the botnet. The influx of bot followers shows up as a horizontal streak (highlighted in orange for clarity). Additional streaks related to other botnets are visible in a few of the plots.

The vast majority of this botnet's tweet content is retweets, mostly in English. What little "original" content the network has posted is tweets in Russian that are generally repeated across multiple accounts. (As always, take the Google translations with a grain of salt.)

Who did this botnet retweet back when it was active? As with the accounts it follows, the accounts it retweets are mostly promotional in nature, although they're a different set of accounts than the accounts followed, with something of a focus on tech/social media.

Here's a thread on the other botnet that @OpenWebHQ got some of its early followers from. (Portions of this botnet have been suspended by Twitter.)

https://twitter.com/conspirator0/status/1287724238787547136

Here's a thread on the follow order by creation date plots used in this thread:

https://twitter.com/conspirator0/status/1408589182944124934