Thread by @EJGibney

Seeing potentially a few hundred of these scam Bitcoin bots using Elon as a promo code. Not sure if the tools still exist to get a good read on total numbers.

Cc: @conspirator0

This was the search query used:
twitter.com/search?q=%22bi…

Came across this network after being tagged in one of their tweets. Interestingly, the account that tagged me links to a different url than the others which could indicate a larger network.

Remember when Elon declared bots on Twitter dead?

That was fun.

The bot plot thickens. Found this NFT account using the same "promo code". It has over 6,000 quote tweets. I think that's our network size (at least).

As for origin, I feel pretty comfortable saying this botnet is operated out of Myanmar. I've found four url's shared by accounts connected to the network via screenshots and direct links. Two (qanbytrade[.]com and coinstrivex[.]com) show a Myanmar connection in WhoIs data.

In searching through the text of the "about us" page of qanbytrade[.]com, I found 3 other domains possibly connected. Two inactive domains via Reddit posts warning of scams and one active domain "tantobit[.]com".

Looks like this group has been active for some time.

So far that's a total of 7 past/present domains in this scam network:

coinstrivex[.]com (found via botnet)

The trio:
(qanbytrade[.]com tanbytrade[.]com lanbytrade[.]com)

tantobit[.]com (ACTIVE - same 'About us' as QANBY)

karbytrade[.]com (INACTIVE)
loberbit[.]com (INACTIVE)

The "Bitcoin Airdrop" scam botnet is currently active and tagging hundreds of accounts. Each tweet says "Check profile". Doing as the tweet says, I viewed a profile and found a new (and 8th) domain connected to this group, bitforgex[.]com.

The Bitforgex domain is a copy of Qanbytrade and follows the same naming style as one of the other previous domains, Coinstrivex, where we see two words followed by "x".

The WhoIs data shows a registrar named NiceNic LTD, a Hong Kong company with a reputation for hosting scams.