In my experience analyzing these sorts of things for my skunkworks project, the "source" (client or app) and too-quick-to-be-human retweet brigades are dead giv

In my experience analyzing these sorts of things for my skunkworks project, the "source" (client or app) and too-quick-to-be-human retweet brigades are dead giveaways, and I'd imagine they're part of this algorithm. I also started tracking "visual hashes" of avatars (blurred and reduced to a 32x32 grid) in an effort to find re-used or stock profile pics, which has shown some promise as a spammer/bot/brigade signal. As well, existing known signals such as "user with default background color" or "no verified email address" could be part of it. For example, IFTTT was recently shown to be used by a pro-Trump "retweet brigade" attempting to boost the "Uranium One" campaign with old "RT-style" retweets that look like new tweets but all have the same text. That group wasn't terribly smart, since they all looked the same, and were broadcast in relatively short order by hundreds of accounts. I know these are guesses; Twitter likely won't ever share their secret sauce recipe.