#QAnon network visualizations
This blog contains network graphs and analytics for several hashtags and accounts that I’ve found in #QAnon networks over several months and aren’t chronological order. #QAnon trends appear to be connected to Twitter rooms, high-volume accounts and a conservative political marketing firm called AppSame.
Certain hashtags in US & European networks tend to have large groups of high-volume accounts that are tweeting hundreds of times per day; more than humanly possible. I generally refer to them as spammers or cyborgs. These high-volume accounts are present in #QAnon hashtags, driving up the quantity of tweets and acting as hubs in the networks.
The high-volume accounts frequently tag many accounts in one tweet or in a photo and then all reply to each other. This activity is similar to methods used by social media marketing accounts that constantly mention each other back and forth and mention a large number of accounts in their tweets. Andy Patel from F-Secure discusses these kinds of accounts in a recent Cyber Sauna podcast. He explains that these methods are sometimes used to game external services attached to social media platforms that rate social media influence (like Klout which is now offline but there are other similar websites).
These communities of high-volume accounts can also be mobilized to bombard a certain Twitter account or hashtag.
I started downloading tweets from #QAnon and a few related hashtags and high-volume accounts on April 27, 2018. Here are some of the hashtags I’ve downloaded:
- 50,413 #QAnon tweets from April 27 to May 3
- 51,437 #QAnon tweets from May 3 to May 11
- 45,150 #QAnon tweets from May 11 to May 17
- 48,241 #TheStorm tweets from April 27 to May 17
These networks are dense and frenetic. I’ve graphed other networks with high-volume/spammer accounts before but they don’t look like these graphs. There is definitely artificial amplification happening in #QAnon trends but I believe there are a lot of real people spreading these hashtags too.
An AP article from August 4 reported on two high-volume accounts that have been mistaken for bots but are actually real people who participate in Twitter rooms, which use the group messaging function on Twitter.
Twitter rooms were first reported by Joe Bernstein from Buzzfeed in April 2017. A troll who goes by the name Microchip called them “retweet groups” or DM groups.
MicroChip added automation to these dedicated DM groups, which he insisted are populated entirely by real people with real accounts. He started using AddMeFast, a kind of social media currency exchange, in which people can retweet or like other tweets in exchange for points that they can then can spend to list their own content (such as pro-Trump hashtagged tweets) to be promoted. You can also buy these points, and an investment of several hundred dollars, according to MicroChip, can yield thousands or even tens of thousands of retweets. — Joe Bernstein
I was able to locate the accounts mentioned in the AP piece, one belongs to a 70 year old grandmother named Nina Tomasieski. Nina told the AP that she participates in about 10 rooms with 50 members each.
Everyone in the room tweets their own material and also retweets everyone else’s. So a tweet that Tomasieski sends may be seen by her roughly 51,000 followers, but then be retweeted by dozens more people, each of whom may have 50,000 or more followers.
Nina averages 73 tweets per day according to Social Bearing as of August 8, 2018. She is connecting to accounts that are tweeting #QAnon hashtags. I made 2 graphs of Nina’s account.
A conservative political marketing firm called AppSame was the top account in the influencer index for Nina’s Twitter handle. Among the various datasets I’ve downloaded over the past few months, AppSame has consistently ranked at the top of the influencer indexes for #TheStorm, #QAnon, #WalkAway, as well as several high-volume accounts.
Both user-to hashtag and user-to-user networks for #QAnon trends have a massive level of activity. The graphs look crazy.
1. 50,413 #QAnon tweets from April 27 to May 3
User to hashtag (u2h) network
Nodes: 22,009
Edges: 73,577
1. 51,437 #QAnon tweets from May 3 to May 11
User to user (u2u) network
Nodes: 20,722
Edges: 57,528
Hubs
I consistently find high-volume accounts that are hubs in Twitter networks. Because of the quantity of tweets and hashtags that they are tweeting, the high-volume accounts are nodes with a high degree; they are nodes that have significantly more edges connecting to them than most other nodes in the network.
In network science, hubs always emerge in scale-free networks and behave exactly like these high-volume accounts on Twitter. Hubs act as bridges between smaller nodes and in communications networks like Twitter, they spread information. In the case of a network of people with a contagious disease, a hub would be a person who has contact with many people and spreads the infection more than other disease carriers. Hungarian physicist, Dr. Albert-László Barabási explains the phenomenon of hubs in an interesting talk called Networks are Everywhere.
The presence of hubs in a network makes the network as a whole more robust and resilient to network failures. Random smaller nodes in the network can fail (or their accounts can be suspended) and the network will remain intact, still connected by the larger hubs.
The high-volume accounts in Twitter hashtag networks form hubs because those accounts are tweeting the hashtags excessively and retweeting other accounts en masse. The POTUS and realDonaldTrump accounts are constantly mentioned in these networks which is why they also consistently appear as hubs.
Here’s what the high-volume hubs look like in 8 days of #QAnon tweets:
#TheStorm user-to-hashtag network looks the same as #QAnon networks; dense and frenetic. Many of the same high-volume accounts in #QAnon networks are hubs in #TheStorm.
#TheStorm — 48,241 tweets from April 27 to May 17
User-to-hashtag (u2h) network
Nodes: 17,191
Edges: 95,752
Filtering the network by degree range 175 reveals the high-volume hubs in #TheStorm. There are many more hubs with different degree ranges.
High-volume accounts
The main high-volume accounts I am finding in #QAnon hashtags are:
PradRachael, 4Freedom4ever, RitosoPita, inittowinit007, IWillRedPillU, MichalDouglas9, LovToRideMyTrek, OutOf666Matrix (now suspended), freenaynow, bhayes2016, barrygibson244 (there are more, but these are frequent flyers).
PradRachael: 549 tweets per day
User-to-user network
18,868 tweets from May 16 to May 21
Nodes: 8533
Edges: 20,729
The user-to-user network graph for PradRachael’s account includes several other high-volume accounts including MareLovesUSA11 whose account has been deleted since I started this blog and KatTheHammer1 whose account appears in several other networks I’ve documented.
AppSame
An interesting detail I found #TheStorm dataset: the top account in the influencer index for this hashtag from April 27 to May 17 was a Conservative Political Marketing Firm called AppSame which has 370,819 followers on Twitter and is also a high-volume account. The top accounts in the influencer index are the accounts with the highest number of followers in a given dataset.
AppSame is tweeting 107 times per day and are retweeting many other high-volume accounts which I’ve documented in a Twitter thread of #MAGA spammers.
There’s one review on AppSame’s Facebook page and it’s just word: “Bots”
AppSame’s website doesn’t have much information about who they are but their recent posts offer essay writing services.
I found a phone number for AppSame on LinkedIn along with a street address in Tampa, FL but couldn’t find an office or storefront on Google Maps at the address listed, just a shopping center. A Google search of the phone number on LinkedIn led me to AppSame on Crunchbase where I learned AppSame stands for “All Political Parties are the Same.”
I called the phone number listed on LinkedIn and Crunchbase. It’s a Google voice number and no one answered. I left a message with my email address and will update if they contact me back.
AppSame has one employee publicly listed on LinkedIn: Eric Stole. I found an “Eric Stole (AppSame)” on Facebook which I assume is him. On LinkedIn, Eric attended University of Tampa and previously worked at Oracle but according to his Facebook he went to Holy Angel University in the Philippines and previously worked at Facebook. His Facebook friends all seem to be located in the Philippines too. I’m not sure if Eric Stole is a real person but I decided to move on for now so I can finish this blog.
Nina Tomasieski (aka: MAGANinaJo)
Nina is the 70 year old grandmother mentioned above from the AP article who is participating in Twitter rooms. I collected 16,232 tweets mentioning her Twitter handle in 3 days, from August 5 to August 8. Her network is extremely active.
The first unusual thing I noticed about Nina’s account, AppSame is the top account in the influencer index for her Twitter handle, in this case it’s the account with the most followers that mentioned her handle.
I doubt Nina knows anything about AppSame but the AppSame account mentioned her at least twice along with other high-volume accounts.
I have to wonder how a 70 year old grandmother ended up mentioned in conversations with a political marketing firm. It feels like somehow this woman is being exploited, although she may disagree.
I tweeted a short thread with graphs of 1,500 tweets that mentioned Nina’s handle. 1500 tweets is a small sample size but this initial graph contains 1380 nodes, 2601 edges, 21 communities and many high-volume accounts.
There are high-volume accounts in every cluster, most of whom are listed in my rolling thread of MAGA spammers. When I filtered Nina’s network by degree range 10, Gephi sorted them into 4 main clusters.
I don’t have a way to confirm without being in the Twitter rooms but if Nina is participating in Twitter rooms with other high-volume accounts and they are retweeting each other’s tweets, then their public tweets would be connected even though the rooms are private. So it’s possible Gephi detected four of the Twitter rooms based on the communities formed by the public tweets of the rooms’ members.
MAGANinaJo — August 5 to August 8
User-to-user graph
Tweets: 16,232
Nodes: 9,538
Edges: 32,416
Communities: 41
The first thing I noticed with MAGANinaJo’s account is that the user-to-user network for 1500 tweets contained 21 communities and 3 days later, the user-to-user graph for 16,232 tweets (a lot of tweets for 3 days) only contained 20 more communities (41 total). This seems like a small number and could indicate the same few groups are coordinating together, which would make sense if they are in the same Twitter rooms.
Many accounts in Nina’s orbit are tweeting hundreds of times per day.
There are high volume accounts scattered throughout the network graph of MAGANinaJo’s account.
Here is Nina’s network filtered by degree range 200. The high-volume accounts are hubs.
Here are the high-volume accounts tweeting 100 times per day or more. There are various accounts that may be bots or real people/cyborgs, and AppSame.
AppSame network visualizations
I was curious what the network surrounding the AppSame account looked like so I collected 2,477 tweets mentioning the AppSame Twitter handle overnight from August 8 to August 9 (about 12 hours).
Here are the hashtags the account was tweeting during that time period.
The heavy edge connecting to #WalkAway is an account called TrumpMyPres, which is currently tweeting 88 tweets per day. The accounts in this network are also injecting content into various apolitical hashtags like #CMAfest, #BREAKING, #WednesdayWisdom and #ThursdayThoughts.
The user-to-user network of AppSame’s account revealed activity from a network of high-volume accounts that bombarded the Twitter account of a movie theater in Florida, CinepolisUSA, which temporarily suspended viewing of Dinesh D’Souza’s new movie.
User-to-user network
August 8 to August 9, 2018 (about 12 hours)
Tweets: 2,477
Nodes: 1,885
Edges: 11,993
Communities: 13
The orange cluster in this user-to-user network contains the theater that temporarily suspended screenings of Dinesh D’Souza’s movie “Death of a Nation” and was brigaded.
The accounts in the orange cluster were mentioned together in a tweet that received thousands of retweets overnight about the theater pulling D’Souza’s film.
I don’t know if the brigading of CinepolisUSA was organized in a Twitter room but it seems logical that networks of high-volume accounts and communities of people coordinating in Twitter rooms can be mobilized to target certain accounts or hashtags.
Influencer Index
Looking back through the datasets I collected for #QAnon, I found that the political marketing firm AppSame has previously been among the top accounts of the influencer index for this hashtag.
Here’s the influencer index for #QAnon from April 27 to May 3:
Influencer index for #QAnon from May 4 to May 11:
AppSame is also at the top of the influencer index for PradRachael, one of the high-volume hubs I graphed above that is tweeting #QAnon hashtags.
AppSame is also in the top of the influencer index for #WalkAway which I didn’t blog about but I tweeted a thread with some graphs.
AppSame appears again at the top of the influencer index for another high-volume account I collected in March 2018. KatTheHammer1 is a frequent hub in many hashtags including #QAnon.
Conclusion
At the time of publishing I’ve documented a total of 63 high-volume accounts that have at least 10,000 followers each and are tweeting 100 times per day or more.
Many of the #MAGA spammers in my thread are tweeting hashtags like #QAnon, #WalkAway. Many of the same high-volume accounts are tagging each other in tweets and connecting to a conservative political marketing firm. Nina Tomasieski’s account is also connecting to the same conservative political marketing firm (or the political marketing firm is connecting to her account) and we know from the AP article that Nina is in about 10 Twitter rooms containing 50 people each.
It all seems like a giant clusterfuck (it is) but from what I’ve seen so far, the following components are consistently connected in several networks: Twitter rooms, high-volume hub accounts and a conservative political marketing firm.
I believe #QAnon, #WalkAway and other political hashtags are being boosted by Twitter rooms that contain a combination of real people tweeting from high-volume accounts, bots and political operatives.
It would be beneficial to have real people participating because they would have a real phone number to add to their accounts and make them appear less bot-like.
The presence of hubs makes the networks robust, resilient and super-spreaders of whatever trends they are tweeting.
Twitter’s blog post from June 26, 2018 seems like it should address the behavior of these kinds of accounts.
Expansion of our malicious behavior detection systems
We’re also now automating some processes where we see suspicious account activity, like exceptionally high-volume Tweeting with the same hashtag, or using the same @username without a reply from the account you’re mentioning. These tests vary in intensity, and at a simple level may involve the account owner completing a simple reCAPTCHA process or a password reset request. More complex cases are automatically passed to our team for review.
The only loophole I can see why these high-volume accounts might eek past Twitter’s TOS is the fact that they are replying to each other, although they are also using the handles for POTUS and realDonaldTrump who is not replying to any of them.
Related hashtags
The #QAnon spammers are also tweeting in other hashtags. I published a separate blog about #OperationBackyardBrawl which contains some of the same accounts.
I made a thread about #WalkAway which also contains some #QAnon spammers (note: this hashtag has been attributed by some to Russian bots but I have no way to prove or disprove that claim).
Some of these same high-volume accounts tweeted #KateSteinle hashtags back in December 2017 which I also published about. I called them “cyborgs” in this blog and the high-volume accounts were hubs in those hashtags too.
Dates: I started this post on May 20, 2018 and have been updating it periodically all summer. It was published publicly on August 9, 2018.
Gephi graphs in this blog were created using OpenOrd combined with Force Atlas 2 layout algorithms and tweets were collected using Tweet Archivist.
Tweets per day (TPD) cited above are via Social Bearing as of June 6 to June 12, 2018 and those metrics can fluctuate over time. TPD is calculated by the total number of tweets an account has tweeted divided by the number of days the account has been online. This metric can change if an account stops tweeting for a period of time or deletes tweets en masse.
