Meet @rrvvs, an account that was selling followers, retweets, and other fake engagement back in 2015-2016. (The account is silent now, but we've seen subsequent tweets from other accounts indicating that the operators are still reachable on WhatsApp.)

cc: @ZellaQuixote

To find examples of the accounts that are likely part of the operation, one needs look no further than @rrvvs's own followers, as it seems to have gotten high on its own supply. We'll focus on the batch-created followers for now (the long streaks on the chart).

The batch-created accounts following @rrvvs fall into three distinct groups. All of them follow hundreds of accounts, have few followers of their own, and have rarely if ever liked a tweet.

The first group consists of 17576 accounts created in batches, mostly in early 2016. Many of these accounts have never tweeted; those that have hypothetically sent their few tweets via the Android app.

In addition to bulk following, the accounts in this group also retweeted specific tweets (mostly in English) when they were active, including a 2015 @realDonaldTrump tweet. They didn't like the tweets they retweeted, however, resulting in massively lopsided retweet/like ratios.

The second group of accounts consists of 9430 accounts created in bulk in July and August 2014. Unlike the first group, these accounts haven't retweeted anything, but each one has tweeted a small number of Arabic tweets via Mobile Web (M2), which are repeated across the network.

The third group consists of 48399 accounts, mostly created in the latter half of 2016. Like the first group, these accounts (allegedly) tweeted via Android when active, but unlike the first group all accounts in this group have tweeted at least once.

Like the first group, these accounts appear to have been retweet bots back when they were active, but focused on Arabic rather than English content. Once again, they didn't like the tweets they retweeted, pretty much all of which have far more retweets than likes.

We'll stop there for now, but plan on doing further exploration of this fake engagement network, as based on the follower plots of other accounts it followed, it's likely we've only scratched the surface and there are many more accounts waiting to be found.

Also ICYMI here's a Trump tweet that this botnet amplified back in 2015 that literally got fifteen thousand more retweets than likes.

As we continue to explore the followers of accounts that got followed by portions of this fake engagement network, it's becoming increasingly clear that it is much larger than @rrvvs's 124K followers - we've found 462050 accounts that are likely members and counting. . .

To find more members of this fake amplification network, we examined the followers of 25 largish accounts it follows. We wound up with 848080 accounts that we're reasonably confident are part of the network, and we're probably undercounting.

The accounts in this fake engagement network fall into two categories:

• accounts created in large batches (red streaks)
• accounts created over a wider timespan that followed en masse, with few or none being new at time of follow (purple rectangle)

The accounts created in batches (some discussed in detail earlier in this thread) sent all their tweets via a small set of apps, all official Twitter products. The others, however, used a wide variety of third party apps (13791 total).
https://twitter.com/conspirator0/status/1282827746712924160

Where did the non batch-created accounts come from? One hypothesis, based on the wide variety of apps: these were originally legitimate accounts whose owners were a bit too trusting and added one or more malicious 3rd-party apps to their accounts, resulting in account takeover.

The repeated tweets sent by these accounts offer possible corroboration of the theory that the accounts were compromised - hundreds of thousands of tweets (mostly in Portuguese) promising free followers if you visit some (now-defunct) obscure website.

Most of the content produced by this network is retweets (which makes sense, as retweets are one of the services it offers for sale.) The content amplified is in a variety of languages, most frequently Arabic, English, and Russian.