Reply-bot phishing: why blocking one account is not enough

Some of you have probably noticed this already: under certain accounts, almost every crypto-related tweet gets one of these bot replies within seconds.

You block it. Next tweet, different account. You block that one. Another appears.

I get them too. They’re almost always the first replies under my tweets, lmao.

What you should know is that this is not random spam. It is part of a much more organised scam infrastructure.

The current version often imitates the visual language of Grok. Fake or manipulated “Answer by Grok” cards, familiar buttons, familiar formatting, then some garbage about ETH arbitrage, MEV bots, passive income or making $1,000 a day.

The point is obvious: wrap an old scam in something users already recognise and trust.

The account replying to you is usually disposable. Bot farms can operate hundreds or thousands of accounts, rotate them constantly and monitor keywords such as ETH, crypto, trading, arbitrage or specific high-reach accounts.

Automation allows them to reply seconds after a post goes live. Blocking 1 account therefore solves almost nothing because the infrastructure behind it is still running.

The interesting part is what happens after the reply.

The spam itself is usually just the entrance.

The victim gets pushed towards a profile link, video, Telegram channel or website advertising some supposedly profitable arbitrage or MEV strategy.

A common variant eventually asks the user to deploy code, connect a wallet or fund a contract with ETH.

And that is where an annoying bot reply can turn into an actual wallet drain.

These scams are not new.

Fake Ethereum arbitrage and MEV bots have circulated for years. What changes is the packaging. First it was YouTube tutorials.

Then fake influencers, AI voices and cloned websites.

Now scammers increasingly borrow the appearance and authority of AI products such as Grok.