Perhaps it is a botnet trying to locate all of its clients.
Each client has his/her own UUID(the tweet) and the geolocation is where the client is located.
It seems as though the googuns_staging was the trial, all fake/useless location and googun_prod(as the name suggests) is the actual "in-the-wild" run of locating all of its clients
Also interesting is at the moment there are many tweets ending in either a350000000 or baf200000000 but that may just be coincidence based on some counter thats incrementing
It can't be the geolocation of compromised machines unless some of them happen to be on boats or planes. Some of the geolocation coordinates are in the middle of the ocean.
True, or it could be geolocations that it failed to resolve.. but then again it would likely be the same geolocation for every time it fails to resolve
Each client has his/her own UUID(the tweet) and the geolocation is where the client is located.
It seems as though the googuns_staging was the trial, all fake/useless location and googun_prod(as the name suggests) is the actual "in-the-wild" run of locating all of its clients
Also interesting is at the moment there are many tweets ending in either a350000000 or baf200000000 but that may just be coincidence based on some counter thats incrementing