Would you buy a used Twitter account for $900? At first glance, @Droopy735 (permanent ID 84861619) looks like a well-established, popular account - it's over a decade old and has over 100 thousand followers, after all. What's not to like? (As it turns out, a lot.)
Despite being created in 2009, @Droopy735 gained almost all of its 104K followers in November 2021, and none of these newly-created followers has ever liked a tweet.
The swarm of newly-created accounts that followed @Droopy735 are part of a fake follower botnet consisting of (at least) 197134 accounts, all created in November 2021. None has ever tweeted or liked a tweet, and there are definite patterns in the account names.
As is a relatively common practice with mass-created accounts, the accounts in this botnet use plagiarized profile pics, many of which appear to be swiped from social network VKontakte.
Who has this botnet mass-followed? Mostly cryptocurrency accounts, with @Droopy735 at the top of the list with 104,770 followers from the botnet. 20 accounts have received at least 40,000 followers from this fake follower network.
Here's a slideshow of follow order by creation date scatter plots for the 20 accounts that got the largest infusions of followers from the botnet. The fake followers show up as horizontal streaks (highlighted in red).
Ghislaine Maxwell's trial begins next week, and a Twitter account named @TrackerTrial (ID 1327007938821709826) has gone viral with a false claim that major media is not covering the case (which it of course wants everyone to follow on its Substack instead).
The claim that major media organizations are ignoring the Maxwell trial is easily refuted with a simple Google search, which reveals that AP, The New York Times, Bloomberg, NPR, Reuters, The New York Post, and CNN (among others) have all covered the trial within the last week.
Interestingly, despite having been created back in November 2020, @TrackerTrial's first tweet is from November 2021, a year later. Things are not quite as they seem, however. . .
The spammy #metaverse tweets are from a network consisting of (at least) 741 accounts with handles and display names consisting of lowercase letters and random numbers, created in batches from August to November 2021.
These accounts amplify a variety of large cryptocurrency/blockchain accounts via a combination of quote tweets, replies, and retweets. The quote tweets and replies are frequently duplicated verbatim by dozens of accounts in the network.
Follow order by creation date scatter plots can reveal interesting things about the history of popular Twitter accounts. Case in point: almost all of @maureen_bannon's first few thousand followers are accounts that primarily tweet in Chinese.
These early Chinese-language followers all followed @maureen_bannon over a relatively short span of time: specifically, the first two weeks of October 2020, roughly a month prior to the 2020 US Presidential election.
Although the Chinese-language accounts do not show obvious signs of being automated or fake, they differ from @maureen_bannon's English-language followers in one key way: they frequently link Guo Wengui/Steve Bannon propaganda sites GNews and GTV.
As it turns out, this is not @TheTexianDM's first encounter with an astroturf botnet. Here's a thread on an old botnet from which @TheTexianDM got a couple hundred retweets each on a set of #Texit tweets and about 3000 fake followers back in 2018.
This network consists of 36374 now-dormant accounts created in early 2018. Almost all of the accounts in the network either retweet or follow accounts; very few do both. All have either 0 tweets/0 likes or fewer likes than tweets.
None of the accounts in this network has been active since 2018. Back then they tweeted (allegedly) via a mix of the Twitter Web Client and Twitter for Android (iPhone is entirely absent).
How did this tweet from #Texit supporter and lieutenant governor candidate @TheTexianDM get more retweets than likes, mostly from accounts with GAN-generated profile pics?
Answer: @TheTexianDM's tweet was retweeted by an botnet consisting of (at least) 1081 accounts created in September, October, or November 2021. All 1081 accounts tweet exclusively via the Twitter Web app, and almost all of their tweets are retweets. #astroturf
The accounts in this network mostly retweet cryptocurrency/blockchain/NFT content, but there are exceptions - gaming accounts, musicians, and political accounts turn up as well.
This "account vetting guide" has been floating around Twitter on and off for a couple of years. As both a disinformation researcher and a Twitter user, I find multiple aspects of it problematic and therefore do not adhere to it.
First, the "bot detection" criteria are nonsense that will tell you nothing about whether or not a given account is automated. (All accounts are new and have few tweets at some point, plenty of humans tweet hundreds of times a day and make profuse spelling/grammar errors, etc.)
(Longer thread with more information on the detection (and misdetection) of bots, for those who are interested in more detail on the topic: