It's always nice when automated accounts list the other members of their network in their pinned tweets.
(We looked for more like them anyway but didn't find any.)
cc: @ZellaQuixote
(We looked for more like them anyway but didn't find any.)
cc: @ZellaQuixote
This botnet consists of seven accounts automated via an ever-evolving variety of custom apps that all have links to hospedagemdominiojl(dot)com on their profiles: @1jl4com, @InvestCrypForex, @JoseLuis_14_68, @Marketing_1jl4, @News_1jl4, @bitcoinincoins, and @newstwiteafrica.
Although this botnet crossed our radar due to its frequent inclusion of the word "coronavirus" in its recent tweets, it seems to be primarily cryptocurrency/#bitcoin focused. It's also rather multilingual.
Speaking of multilingual, hospedagemdominiojl(dot)com, the site linked on the profiles of these bots, appears to be a web hosting company (possibly Brazil-based, due to the site being in Portuguese and "Brasil" being the stated location of several of the accounts.)
What sites does the botnet link? The most frequently linked site, cbengine(dot)com, seems to be an affiliate marketing site, and investing(dot)com is a cryptocurrency site. The Daily Mail, Sputnik, and several mainstream Western news sites turn up as well.
