The account was suspended only recently, after Ms. Barnes — alerted by The Times — reported it to Twitter. “If you’re using somebody’s photos and name together, then that’s impersonation,” she complained.

Twitter appears to be tracking Devumi’s network of bots. Since the Times investigation was published, dozens of Devumi’s most prominent clients — actors, reality TV stars, authors, business executives and others seeking to buy followers and retweets — have lost more than three million followers. Close to 55,000 impostor accounts sold by Devumi have been restricted or suspended.

Twitter has declined to say whether Devumi’s bots violate its impersonation policy, or how many of its employees are focused on rooting out impersonation. The company’s first line of defense against impersonation is the countermeasures that flag accounts that run afoul of Twitter policies on spam — violations that can be easier for the platform to identify and stop at large scale.

But impostor accounts are still relatively easy to find on Twitter. The Times identified hundreds more of them through Twitter’s own automated “who to follow” feature: When a user views a known impostor account, Twitter routinely recommends other impostor accounts to follow.

One real Twitter account, belonging to Jasmine Artis, a health care worker from North Carolina, was cloned dozens of times. At least 75 of those impostor accounts still exist — though some have recently been restricted — each using her picture, her name and a brief bio that refers to the school she was attending when her account was copied. Most of the clones have made only a handful of posts, some in Russian or Japanese. Ms. Artis said she had not been aware of the accounts.

Even Twitter’s “verified” users, many of them well known, are being impersonated. There are active fake accounts impersonating the Democratic senator Cory Booker of New Jersey, the White House adviser Kellyanne Conway and the journalist April D. Ryan. None appeared to be obvious parodies. Instead, each posted content that mimicked what the real account might tweet.