We found 448 tweets from 448 accounts linking fastsalesproduct(dot)com, which in turn redirects to masks2020(dot)us. All 448 tweets were supposedly sent via the Twitter website, which is unusual - normal Twitter traffic consists of a mix of the website and the smartphone apps. 
The masks2020(dot)us site itself supposedly sells face masks and respirators, although we refrained from placing an order. Interestingly, despite using a .us domain, the website is registered in Singapore.
The fastsalesproduct(dot)com/masks2020(dot)us spam is mostly from older accounts, although most have few tweets and seem to have been reawakened to push the site - 272 of 448 (60.7%) have tweeted 10 or fewer times. Other than face mask spam, they don't look similar.
We've continued to monitor the face mask spam over the last couple of days. The operators of the network are hopping from domain name to domain name, likely in an attempt to keep ahead of Twitter's spam filtering, but the content remains largely the same.
Many of the accounts tweeting the face mask spam appear to be established accounts that have been active for years. Can we find evidence that these accounts have been compromised and that the face mask tweets are coming from someone other than the original owner? #coronagrift
One possible avenue of investigation: tweet IDs contain a variety of information, including which of Twitter's datacenters processed the tweet in question.
As it turns out, almost all of the face mask spam tweets were processed by the same datacenter. This is not true of the other tweets these accounts have sent in 2020, suggesting that the face mask tweets were sent from a different location than the rest of the accounts' tweets.
