Cyber-security experts said the fake website and report did not require a high level of skill. The domain name was registered anonymously and it may take months for authorities to determine who created the site, said Rob Sadowski, director of technology solutions at cyber-security company RSA.
The report appeared on a site named bloomberg.market, rather than bloomberg.com. The bloomberg.market account was suspended at mid-afternoon Tuesday.
The website carrying the false report was registered on July 10, according to a domain search on the Internet Corporation for Assigned Names and Numbers.
The domain was registered in Panama to WhoIsGuard, a company which puts its own information as a web site registrant to mask the identity of the actual owner.
Twitter options were heavily traded on Tuesday with overall options activity surging to 330,000 contracts, or more than twice normal volume, according to Trade Alert data.
A large buyer appears to have bought 12,000 near-dated call options across multiple strikes at 11:37 am ET as the fake report went out and the shares started rising. Calls betting on shares rising above $37 by Friday were bought across multiple exchanges.
“If I am an attorney at the SEC, I want to contact that person to ask about the reasoning behind the large positioning in the short-dated contracts,” said Steven Spencer, partner at proprietary trading firm SMB Capital in New York.
The report came weeks after one of Twitter’s earliest investors, Chris Sacca, said Twitter would be an “instant fit” for Google if it were to acquire the microblogging site.
Shortly after Sacca’s comments, former Chief Executive Officer Dick Costolo abruptly stepped down amid increasing scrutiny of the company’s slow user growth and inability to attract advertisers at the same rate as its competitors.