Thread by @conspirator0

It's a Wednesday in July, and a multitude of cryptocurrency/forex trading accounts have been posting identical tweets (with some variance in the hashtags they attempt to hijack). #Spamtastic

cc: @ZellaQuixote

This network of cryptocurrency spammers appears to be centered on @Liam_steve1 and @James_bitcoin1, both of whom are Stock Market Experts, social workers, forex traders at Bitinvests Organization, and per time (sic) brokers at CCCBOT Organization.

We found 34 additional accounts that copied some of @Liam_steve1 and @James_bitcoin1's bitcoin/forex trading tweets verbatim, bringing the total size of the network to 36. Most tweet primarily via Android. With one exception, tweet schedules don’t clearly indicate automation.

Every account in this network has cloned at least two of @Liam_steve1 or @James_bitcoin1's tweets. The accounts toward the center look very similar and are likely sockpuppets of the same entity (we're less certain of this with the accounts that only cloned a couple tweets).

In addition to copying tweets from each other, many of these accounts copied their profile pics from elsewhere on the internet. We had little luck with Tineye reverse image search with this group, but Google or Yandex came through for most of the accounts.

Update: unlike many of our threads, this one was well received by its subject.