I arrived at those criteria after upwards of a decade on Twitter, observing the behavior of bots and trolls and looking at their profiles?
On Twitter, all or any comination of a generic avi, a scanty or absent bio, random numerals in the username, <100 followers, and a join date of less than a year ago are all red flags, and an almost certain indication of a bot or troll account. It's worked very well for me.
I report 'em on sight.