We previously observed that an account sold for $200 (presently named @mailmemomey, permanent ID 87929075) has a bunch of bogus followers - the first 35000 appear to have been created in batches. We went down the rabbithole and explored the rest of the network.
cc: @ZellaQuixote https://twitter.com/conspirator0/status/1286297233458176000
cc: @ZellaQuixote https://twitter.com/conspirator0/status/1286297233458176000
To find other members of the fake follower network following @mailmemoney, we downloaded the followers of other accounts followed by the fake followers we were aware of and looked for accounts that were created and followed in bulk (the horizontal streaks.)
We found a total of 711727 accounts, created in large batches between December 2011 and March 2014. These accounts have repetitive naming schemes, generally follow far more accounts than they are followed by, and have liked few or no tweets.
The account followed by the largest swath of this fake engagement network (612584 of 711727 accounts, 86.1%) is @RealTonyRocha, a purported "social media consultant" with 1 million followers. The account's most recent tweets are from 2019 and were automated via dlvr(dot)it.
Although @RealTonyRocha was unsearchable at the time we researched this botnet, we located some of its tweets indirectly via replies. It indeed appears to have been in the business of selling followers, corroborated by its (now-defunct) website. Not all customers were satisfied.
The accounts in the @RealTonyRocha fake engagement network are mostly dormant but tweeted either via various Twitter web products or the Android app when active. With a few exceptions, accounts created prior to October 2013 use the website and those created after use Android.
This network tweeted (and retweeted) content in a variety of languages, with English, Japanese, Portuguese, and Indonesian being the most prevalent.
The original tweets produced by this network are quite repetitive, with many having been tweeted verbatim by hundreds or thousands of accounts. The repeated tweets are multilingual and varied in topic.
Who did these accounts retweet back when the botnet was active? It's a mix of humor/meme and commercial accounts, with the most common languages being English and Arabic. The most-retweeted account was @mrfunnytweetz, RT'd a total of 30300 times by 10407 members of this botnet.
Footnote: it's possible that this now-suspended botnet (that followed multiple GOP candidates) we studied earlier was a part of the same operation described in this thread, and we simply didn't make the connection at the time. https://twitter.com/conspirator0/status/1250554200691531777