True this is likely some botnet coordinating where/who the C&C is currently. I wonder if this can be reverse engineered.

EDIT: I wonder if it does some sort of transform on the number to get an IP addr? perhaps its part of a IPv6 Addr?

Perhaps its a distributed brute-force on a password or checksum being carried out by a botnet? Its interesting distributed this is, too bad we dont have IP addrs associated with the posts

Interesting to note is that all tweets from https://twitter.com/googuns_staging have random Lat/Long coordinates associated with it..

see: https://twitter.com/googuns_staging/status/22294385659595980...

https://maps.google.com/maps?q=-20.73906235%2C-145.82847672&...

Or perhaps the GPS numbers are not random but do contain 'information'? Perhaps totally unrelated to geolocation?

Perhaps it is a botnet trying to locate all of its clients.

Each client has his/her own UUID(the tweet) and the geolocation is where the client is located.

It seems as though the googuns_staging was the trial, all fake/useless location and googun_prod(as the name suggests) is the actual "in-the-wild" run of locating all of its clients

Also interesting is at the moment there are many tweets ending in either a350000000 or baf200000000 but that may just be coincidence based on some counter thats incrementing

It can't be the geolocation of compromised machines unless some of them happen to be on boats or planes. Some of the geolocation coordinates are in the middle of the ocean.

True, or it could be geolocations that it failed to resolve.. but then again it would likely be the same geolocation for every time it fails to resolve

Seems so. If we take literally f.e. 1773f27ba0000000, drop off the zeroes (see, most contains zeroes), it's an IP address.

not quite there is one too many digits for it to be an IPv4 addr

17 73 f2 7b a0 00 00 00

23 115 242 123 160 00 00 00

As noted the elsewhere,

On staging, all posts end in ba0000000. On prod, all posts end in 200000000 or 350000000. Since these sequences are repeated, it seems likely they could be disregarded.

hex:fb 92 83 a3 50 00 00 00 dec:251 146 131 163 80 0 0 0

hex:10 37 ba f2 00 00 00 00 dec:16 55 186 242 0 0 0 0

they do indeed look like IP addresses. The extra number is the port(maybe). what's weird is that it's sometimes zero.

The second is a valid US ip address, owned by HP 16.55.186.242, the first is in the E-Block.

Why would a botnet use such a public C&C channel instead of IRC? And why wouldn't the C&C tweets be encoded in a less suspicious format such as comments about cats or whatever?

My bet is C&C instructions.

IRC traffic is commonly blocked, but HTTP traffic directed to Twitter is generic enough to get through most locked down networks. I doubt whoever is behind this cares if it's public data and that people see what's being posted. Public access just means any newly compromised computer can access it without anything more than a single HTTP request.

If we had access to the IP(s) posting the tweets, it'd be pretty easy to get an idea if they were malicious or not. But where's the fun in that