Thread by @conspirator0

It's either the second day of spring or fall (depending on where you are), so here's a look at a botnet following the official Twitter account of right wing think tank @Heritage Foundation. #SundaySpam

cc: @ZellaQuixote

This botnet consists of 28971 accounts, created Nov 2013 - Jan 2014. All their tweets were sent via "Twitter Web Client", and none has tweeted since 2014. None has liked a tweet, and all have the same display name as @-name (including lack of space between first and last name).

Who does this botnet follow? The majority of the beneficiaries of its bogus follows are the official accounts of businesses (including some fairly large companies such as @Citibank and @WhiteCastle). The @Heritage Foundation (followed by 2845 of the bots) is a notable outlier.

Here are follower plots for nine of the accounts followed by portions of the botnet, with the portion containing the bots zoomed. In most cases, the botnet seems to have followed the accounts in multiple batches over time, with brief periods of organic follower growth in between.

Unlike many of the astroturfy botnets we've studied, this one doesn't retweet the accounts it follows (or any others). All of its content is brief tweets (generally generic comments on personal relationships) that are frequently duplicated by thousands of the bots in the network.