[photorized]

Those are the least sophisticated spam networks, based on what we've seen. Following each other and properly retweeting makes it easy to plot the network and relationship within.

The bigger (and more effective) ones designed around a few rules, we found:

- accounts they "follow" are often a diversion, they are usually selected at random

- who they truly "follow" (i.e. actively listen to) is defined outside of Twitter

- they don't do "retweets" correctly, because that would also make connections visible; instead, they post messages fed to them externally as their own original tweets

- IFTTT plays a big role in simplifying automation while keeping the true relationships "invisible" to Twitter and people using Twitter APIs