How to spot a Twitter (X) bot in 2026 (the 30 signals our checker scores)

Estimates run from "rounding error" to "most of the platform," which tells you the honest answer is that nobody agrees, and the number depends entirely on how you count. For years, Twitter's own SEC filings pegged spam and fake accounts at under 5% of monetizable daily active users. Independent researchers put it higher.

A 2025 study in Scientific Reports measured bot participation at 15–44% inside political and entertainment conversations. A separate 2025 paper in Nature found that roughly 20% of the chatter around major global events came from automated accounts. The older academic baseline — 9–15% of active accounts — has held up reasonably well since the 2017 work that established it.

Then there are the outliers. One January 2024 analysis of 1.27 million accounts claimed 64% were "potentially" bots. The math is weak there: "potentially" is doing most of the work, and traffic-based counts inflate the figure because a small number of high-volume bots generate a disproportionate share of posts. The useful takeaway is not a precise percentage. It is that on any viral thread, a real slice of the replies are not people — enough that spotting them is a practical skill, not paranoia. If you run brand or competitor monitoring, that slice is exactly what clogs your mention queue, which is why our social media monitoring guide treats bot filtering as a first-class problem rather than an afterthought.

The most common mistake is treating one red flag as a conviction. A new account is not a bot; everyone's account was new once. One em-dash is not AI. A crypto handle is not automatically a scam. Real people trip individual signals all the time.

What separates a bot from an enthusiastic human is the stack. Bots fail several tests at once, across categories that are hard to fake simultaneously. When we built BotBlock, the scoring engine behind ReplySocial's free bot checker, that became the whole design: every account starts at zero, each signal adds weight, and a few positive signals — an account that is five years old, ten thousand real followers — subtract. The total lands in one of three tiers: human (under 3), suspicious (3 to 8), or spam (8 and up), across 30-plus signals in four groups.

A score forces you to weigh signals instead of reacting to one. A 12-day-old account with a default avatar that replies every 18 seconds with "this is so true" is not a judgment call. A 12-day-old account that posts thoughtfully about its niche is just new. Same age, completely different stacks. The four layers below are where the signals live. Read the accounts you are unsure about against all four, not one.

The fastest layer to check, because it is all visible before you read a single post.

1. Account age under 30 days. The single strongest age signal. Bot farms are created and burned in waves, so a flood of accounts born in the last month replying to the same thread is a pattern, not a coincidence. Accounts 30–90 days old are a milder flag; anything past two years is a point in their favor.

2. A lopsided follower-to-following ratio. Following 3,000 accounts while followed by 40 is classic follow-bot behavior. The ratio is noisy at small numbers — plenty of real new users follow a lot before building an audience — so it matters most when the following count is in the thousands.

3. Default avatar or no real photo. The egg is gone, but the default gray silhouette still ships with every new account, and bots rarely bother to replace it.

4. An auto-generated username. Patterns give the generator away:FirstnameLastname8462, word_word_91023, or a handle ending in five or more digits. Humans pick handles; scripts append numbers until one is free.

5. A bio stuffed with AI or crypto buzzwords. "AI enthusiast," "web3," "prompt engineer," "DeFi," "NFT," "digital nomad" stacked together is less a personality than a keyword salad. Eight or more emojis in the bio is its own flag.

6. A paid checkmark on a brand-new account. A blue check no longer means vetted — it means $8/month. A paid checkmark on a five-year-old account with real followers is meaningless; a paid checkmark on a three-week-old account with a generated handle is one more weight on the stack.

7. Inhuman posting volume. Fifty or more posts a day, every day, is almost always automation. Even 30 a day is a yellow flag once it is sustained. To sanity-check raw numbers — posting frequency, follower mix, engagement — paste a handle into our free X analytics tool.

This is the layer most "how to spot a bot" lists skip entirely, and it is now the most useful one. Bots stopped posting broken English years ago. The tell is no longer bad writing — it is writing that is suspiciously polished in a specific, machine-shaped way.

8. The dead-giveaway phrases. If a reply literally contains "as an AI language model," "I cannot provide," or "I'm sorry, I can't generate," you are reading a script that forgot to strip its own scaffolding. These are rare but conclusive on their own.

9. AI vocabulary. Words that almost never appear in casual replies but saturate model output: "delve," "tapestry," "landscape," "multifaceted," "robust," "leverage," "pivotal," "groundbreaking." Two or more in a single short reply is a strong signal.

10. Sycophantic openers. "Couldn't agree more." "This is so true." "Spot on." "Amazing thread." "Beautifully written." Engagement bots are tuned to flatter so the original poster replies and boosts the bot's reach. Real agreement usually says something specific; bot agreement is generic praise with no content.

11. Em-dash abuse and uniform sentences. A reply that is one-third em-dashes, or three sentences of nearly identical length and rhythm, reads as generated because it is. Humans write lumpy. Models write smooth.

12. Hidden Unicode and look-alike characters. Scam accounts swap Latin letters for Cyrillic or Greek look-alikes (an "а" that is not an "a") to dodge keyword filters, and slip in zero-width characters you cannot see. Copy a suspicious reply into a plain-text editor and the disguise often falls apart.

Timing is the one layer a bot cannot dress up. You can write a convincing bio and a convincing reply, but you cannot make a script read, think, and sleep like a person.

13. Replies fired faster than anyone reads. A median gap of under 30 seconds between consecutive replies is machine-gun fire — the strongest single signal in our entire model. Under 60 seconds is almost as damning. Nobody reads a thread and composes a thoughtful reply in 18 seconds, twelve times in a row.

14. Activity around the clock. An account posting across 14 or more distinct hours of the day, day after day, is not keeping a human schedule. People cluster their activity; they also sleep.

15. The same reply, pasted everywhere. Copy-paste spam shows up as the identical text appearing across many threads. If a third of an account's recent posts are word-for-word duplicates, it is running a script.

16. Reply floods. Fifteen-plus replies crammed into a 30-minute window is density no human sustains. This is the behavior that buries a real conversation under noise the moment a post starts to trend, and the reason bot-amplified outrage is now a standard part of any crisis-response plan.

The final layer is narrow but high-confidence. These signals are so specific to scams that a single one is close to conclusive, where the earlier layers need to stack.

17. Impersonating Elon Musk (or the Musk family). A handle or display name containing "musk," "elon," or "maye" on an unverified account with few followers is one of the most common crypto-scam templates on the platform. The same goes for a bio that claims to run two or more of Tesla, SpaceX, Neuralink, Starlink, and xAI at once. Nobody does.

18. A Telegram or WhatsApp call to action. "DM me on Telegram," "message me on WhatsApp," or a t.me/ link in the bio is the move that pulls you off-platform where there are no guardrails. Legitimate people occasionally link Telegram; scam bots build their entire funnel around it.

19. A display name that is a full sentence. Real names are short. When the display name reads "INBOX ME VIA THE LINK ON MY BIO FOR CRYPTO," the name field has been repurposed as ad copy.

20. A retweet-only account. An account whose recent activity is 80%-plus retweets, with almost no original posts or replies, exists to amplify, not to talk. A pure-retweet account with nothing of its own is built for boosting.

The remaining signals our checker scores fill in the edges of these four layers — graduated weights for account age, dampening for small follower counts, positive credit for genuinely established accounts — which is the part a manual eyeball check cannot do consistently.

For a single account you are unsure about, run the layers in order of speed:

• Profile first (10 seconds). Account age, follower ratio, avatar, handle, bio. Two or more flags here and you keep going.
• Then the writing (20 seconds). Read three recent replies. Generic flattery, AI vocabulary, or the dead-giveaway phrases tip the scale.
• Then the timing (20 seconds). Scroll the reply timestamps. Replies seconds apart, around the clock, or duplicated text close the case.
• Scam tells override everything (10 seconds). Musk impersonation, a Telegram CTA, or a sentence-length display name is block-on-sight.

That works for one account. It does not scale. Checking account age, ratio, and bio by hand eats 30–40% of your monitoring time once reply volume climbs, which is the honest reason most teams either stop filtering or stop monitoring. Automated scoring removes that overhead — the same scoring runs across every reply in a brand-monitoring queue so the bots are filtered before you ever see them. ReplySocial Pro is $25/month flat, with bot filtering on the free plan too. For one-off checks, the bot checker below is free and needs no signup.