We found what appears to be a network of 51 Arabic-language pornbots. All were created over the span of less than three hours on April 9th, 2020, and all tweet via IFTTT. Each bot pushes a specific website. 
The websites linked by the pornbots appear to be blogspot blogs with random 5 character names. We decided to check them out via Tor (as always, DO NOT click links to dodgy sites without taking precautions to avoid tracking/malware.)
Curiously, clicking the blogspot video links in the pornbots' tweets leads neither to blogs nor adult video content. Rather, it leads to yllix(dot)com, an affiliate marketing website hosted in Slovakia.
How are the operators of this botnet disguising their website links as porn? They're using screenshots of porn videos as preview images, which results in a blurry play "button" as opposed to the crisp button used in actual video tweets.
#YesFakePornIsARealThingOnTheInternet
#YesFakePornIsARealThingOnTheInternet
(it's apparently that sort of Sunday so here's a thread on a separate and probably unrelated IFTTT pornbot network)
