In this work, a model has been developed for detecting popular tags belonging to suspicious group using shares of active hackers and followers on Twitter social network. Term frequency-inverse document frequency (tf-idf) is reinterpreted with the number of favorite and re-tweet to detect popular tags belonging to suspicious group. The obtained feature space is used for detecting the most strongly suspected which are similar to the target hackers. The results show that suspected profiles, which are detected by our model, have been closed by Twitter with course decision.