#QAnon network visualizations

This blog contains network graphs and analytics for several hashtags and accounts that I’ve found in #QAnon networks over several months and aren’t chronological order. #QAnon trends appear to be connected to Twitter rooms, high-volume accounts and a conservative political marketing firm called AppSame.


Certain hashtags in US & European networks tend to have large groups of high-volume accounts that are tweeting hundreds of times per day; more than humanly possible. I generally refer to them as spammers or cyborgs. These high-volume accounts are present in #QAnon hashtags, driving up the quantity of tweets and acting as hubs in the networks.

The high-volume accounts frequently tag many accounts in one tweet or in a photo and then all reply to each other. This activity is similar to methods used by social media marketing accounts that constantly mention each other back and forth and mention a large number of accounts in their tweets. Andy Patel from F-Secure discusses these kinds of accounts in a recent Cyber Sauna podcast. He explains that these methods are sometimes used to game external services attached to social media platforms that rate social media influence (like Klout which is now offline but there are other similar websites).

These communities of high-volume accounts can also be mobilized to bombard a certain Twitter account or hashtag.


I started downloading tweets from #QAnon and a few related hashtags and high-volume accounts on April 27, 2018. Here are some of the hashtags I’ve downloaded:

  1. 50,413 #QAnon tweets from April 27 to May 3
  2. 51,437 #QAnon tweets from May 3 to May 11
  3. 45,150 #QAnon tweets from May 11 to May 17
  4. 48,241 #TheStorm tweets from April 27 to May 17

These networks are dense and frenetic. I’ve graphed other networks with high-volume/spammer accounts before but they don’t look like these graphs. There is definitely artificial amplification happening in #QAnon trends but I believe there are a lot of real people spreading these hashtags too.

An AP article from August 4 reported on two high-volume accounts that have been mistaken for bots but are actually real people who participate in Twitter rooms, which use the group messaging function on Twitter.

Twitter rooms were first reported by Joe Bernstein from Buzzfeed in April 2017. A troll who goes by the name Microchip called them “retweet groups” or DM groups.

MicroChip added automation to these dedicated DM groups, which he insisted are populated entirely by real people with real accounts. He started using AddMeFast, a kind of social media currency exchange, in which people can retweet or like other tweets in exchange for points that they can then can spend to list their own content (such as pro-Trump hashtagged tweets) to be promoted. You can also buy these points, and an investment of several hundred dollars, according to MicroChip, can yield thousands or even tens of thousands of retweets. — Joe Bernstein

I was able to locate the accounts mentioned in the AP piece, one belongs to a 70 year old grandmother named Nina Tomasieski. Nina told the AP that she participates in about 10 rooms with 50 members each.

Everyone in the room tweets their own material and also retweets everyone else’s. So a tweet that Tomasieski sends may be seen by her roughly 51,000 followers, but then be retweeted by dozens more people, each of whom may have 50,000 or more followers.

Nina averages 73 tweets per day according to Social Bearing as of August 8, 2018. She is connecting to accounts that are tweeting #QAnon hashtags. I made 2 graphs of Nina’s account.

A conservative political marketing firm called AppSame was the top account in the influencer index for Nina’s Twitter handle. Among the various datasets I’ve downloaded over the past few months, AppSame has consistently ranked at the top of the influencer indexes for #TheStorm, #QAnon, #WalkAway, as well as several high-volume accounts.


Both user-to hashtag and user-to-user networks for #QAnon trends have a massive level of activity. The graphs look crazy.

1. 50,413 #QAnon tweets from April 27 to May 3

User to hashtag (u2h) network 
Nodes: 22,009
Edges: 73,577

u2h graph of 50,413 #QAnon tweets — April 27 to May 3
u2h graph of 50,413 #QAnon tweets — April 27 to May 3

1. 51,437 #QAnon tweets from May 3 to May 11

User to user (u2u) network
Nodes: 20,722
Edges: 57,528

u2u graph of 51,437 #QAnon tweets — May 3 to May 11
u2u graph of 51,437 #QAnon tweets — May 3 to May 11

Hubs

I consistently find high-volume accounts that are hubs in Twitter networks. Because of the quantity of tweets and hashtags that they are tweeting, the high-volume accounts are nodes with a high degree range. They are nodes that have significantly more edges connecting to them than most other nodes in the network.

In network science, hubs always emerge in scale-free networks and behave exactly like these high-volume accounts on Twitter. They are larger nodes and have a high degree range. Hubs act as bridges between smaller nodes and in communications networks like Twitter, they spread information. In the case of a network of people with a contagious disease, a hub would be a person who has contact with many people and spreads the infection more than other disease carriers. Hungarian physicist, Dr. Albert-László Barabási explains the phenomenon of hubs in an interesting talk called Networks are Everywhere.

The presence of hubs in a network makes the network as a whole more robust and resilient to network failures. Random smaller nodes in the network can fail (or their accounts can be suspended) and the network will remain intact, still connected by the larger hubs.

The high-volume accounts in Twitter hashtag networks form hubs because those accounts are tweeting the hashtags excessively and retweeting other accounts en masse. The POTUS and realDonaldTrump accounts are constantly mentioned in these networks which is why they also consistently appear as hubs.

Here’s what the high-volume hubs look like in 8 days of #QAnon tweets:

u2u graph of 51,437 #QAnon tweets — May 3 to May 11 — filtered by degree range 103
u2u graph of 51,437 #QAnon tweets — May 3 to May 11 — filtered by degree range 103 — high-volume accounts highlighted

If you like what I do please consider supporting my work on Patreon

#TheStorm user-to-hashtag network looks the same as #QAnon networks; dense and frenetic. Many of the same high-volume accounts in #QAnon networks are hubs in #TheStorm.

#TheStorm — 48,241 tweets from April 27 to May 17

User-to-hashtag (u2h) network
Nodes: 17,191
Edges: 95,752

#TheStorm — u2h graph of 48,241 tweets from April 27 to May 17
#TheStorm — u2h graph of 48,241 tweets from April 27 to May 17

Filtering the network by degree range 175 reveals the high-volume hubs in #TheStorm. There are many more hubs with different degree ranges.

#TheStorm — u2h graph of 48,241 tweets from April 27 to May 17 filtered by degree range 175
#TheStorm — u2h graph of 48,241 tweets from April 27 to May 17 filtered by degree range 175

High-volume accounts

The main high-volume accounts I am finding in #QAnon hashtags are:

PradRachael, 4Freedom4ever, RitosoPita, inittowinit007, IWillRedPillU, MichalDouglas9, LovToRideMyTrek, OutOf666Matrix (now suspended), freenaynow, bhayes2016, barrygibson244 (there are more, but these are frequent flyers).

PradRachael: 549 tweets per day

User-to-user network
18,868 tweets from May 16 to May 21
Nodes: 8533
Edges: 20,729

PradRachael u2u network — 18,868 tweets from May 16 to May 21

The user-to-user network graph for PradRachael’s account includes several other high-volume accounts including MareLovesUSA11 whose account has been deleted since I started this blog and KatTheHammer1 whose account appears in several other networks I’ve documented.

PradRachael u2u network — 18,868 tweets from May 16 to May 21
PradRachael u2u network — 18,868 tweets from May 16 to May 21 filtered by degree range 19

AppSame

An interesting detail I found #TheStorm dataset: the top account in the influencer index for this hashtag from April 27 to May 17 was a Conservative Political Marketing Firm called AppSame which has 370,819 followers on Twitter and is also a high-volume account. The top accounts in the influencer index are the accounts with the highest number of followers in a given dataset.

Source: Tweet Archivist

AppSame is tweeting 107 times per day and are retweeting many other high-volume accounts which I’ve documented in a Twitter thread of #MAGA spammers.

There’s one review on AppSame’s Facebook page and it’s just word: “Bots”

Source: Facebook

AppSame’s website doesn’t have much information about who they are but their recent posts offer essay writing services.

I found a phone number for AppSame on LinkedIn along with a street address in Tampa, FL but couldn’t find an office or storefront on Google Maps at the address listed, just a shopping center. A Google search of the phone number on LinkedIn led me to AppSame on Crunchbase where I learned AppSame stands for “All Political Parties are the Same.”

I called the phone number listed on LinkedIn and Crunchbase. It’s a Google voice number and no one answered. I left a message with my email address and will update if they contact me back.

AppSame has one employee publicly listed on LinkedIn: Eric Stole. I found an “Eric Stole (AppSame)” on Facebook which I assume is him. On LinkedIn, Eric attended University of Tampa and previously worked at Oracle but according to his Facebook he went to Holy Angel University in the Philippines and previously worked at Facebook. His Facebook friends all seem to be located in the Philippines too. I’m not sure if Eric Stole is a real person but I decided to move on for now so I can finish this blog.

Sources: LinkedIn & Facebook

Nina Tomasieski (aka: MAGANinaJo)

Nina is the 70 year old grandmother mentioned above from the AP article who is participating in Twitter rooms. I collected 16,232 tweets mentioning her Twitter handle in 3 days, from August 5 to August 8. Her network is extremely active.

The first unusual thing I noticed about Nina’s account, AppSame is the top account in the influencer index for her Twitter handle, in this case it’s the account with the most followers that mentioned her handle.

Source: Tweet Archivist

I doubt Nina knows anything about AppSame but the AppSame account mentioned her at least twice along with other high-volume accounts.

Source: Twitter

I have to wonder how a 70 year old grandmother ended up mentioned in conversations with a political marketing firm. It feels like somehow this woman is being exploited, although she may disagree.

I tweeted a short thread with graphs of 1,500 tweets that mentioned Nina’s handle. 1500 tweets is a small sample size but this initial graph contains 1380 nodes, 2601 edges, 21 communities and many high-volume accounts.

1500 tweets mentioning the Twitter handle MAGANinaJo on August 5, 2018
1500 tweets mentioning the Twitter handle MAGANinaJo on August 5, 2018

There are high-volume accounts in every cluster, most of whom are listed in my rolling thread of MAGA spammers. When I filtered Nina’s network by degree range 10, Gephi sorted them into 4 main clusters.

1500 tweets mentioning the Twitter handle MAGANinaJo on August 5, 2018 filtered by degree range 10

I don’t have a way to confirm without being in the Twitter rooms but if Nina is participating in Twitter rooms with other high-volume accounts and they are retweeting each other’s tweets, then their public tweets would be connected even though the rooms are private. So it’s possible Gephi detected four of the Twitter rooms based on the communities formed by the public tweets of the rooms’ members.

MAGANinaJo — August 5 to August 8

User-to-user graph 
Tweets: 16,232
Nodes: 9,538
Edges: 32,416
Communities: 41

The first thing I noticed with MAGANinaJo’s account is that the user-to-user network for 1500 tweets contained 21 communities and 3 days later, the user-to-user graph for 16,232 tweets (a lot of tweets for 3 days) only contained 20 more communities (41 total). This seems like a small number and could indicate the same few groups are coordinating together, which would make sense if they are in the same Twitter rooms.

16,232 tweets mentioning MAGANinaJo — August 5 to August 8
16,232 tweets mentioning MAGANinaJo — August 5 to August 8
16,232 tweets mentioning MAGANinaJo — August 5 to August 8

Many accounts in Nina’s orbit are tweeting hundreds of times per day.

16,232 tweets mentioning MAGANinaJo — August 5 to August 8

There are high volume accounts scattered throughout the network graph of MAGANinaJo’s account.

16,232 tweets mentioning MAGANinaJo — August 5 to August 8

Here is Nina’s network filtered by degree range 200. The high-volume accounts are hubs.

16,232 tweets mentioning MAGANinaJo — August 5 to August 8 filtered by degree range 200

Here are the high-volume accounts tweeting 100 times per day or more. There are various accounts that may be bots or real people/cyborgs, and AppSame.

16,232 tweets mentioning MAGANinaJo — August 5 to August 8 filtered by degree range 200
16,232 tweets mentioning MAGANinaJo — August 5 to August 8 filtered by degree range 200

AppSame network visualizations

I was curious what the network surrounding the AppSame account looked like so I collected 2,477 tweets mentioning the AppSame Twitter handle overnight from August 8 to August 9 (about 12 hours).

Here are the hashtags the account was tweeting during that time period.

User-to-hashtag network for 2,477 tweets mentioning AppSame
User-to-hashtag network for 2,477 tweets mentioning AppSame

The heavy edge connecting to #WalkAway is an account called TrumpMyPres, which is currently tweeting 88 tweets per day. The accounts in this network are also injecting content into various apolitical hashtags like #CMAfest, #BREAKING, #WednesdayWisdom and #ThursdayThoughts.

User-to-hashtag network for 2,477 tweets mentioning AppSame

The user-to-user network of AppSame’s account revealed activity from a network of high-volume accounts that bombarded the Twitter account of a movie theater in Florida, CinepolisUSA, which temporarily suspended viewing of Dinesh D’Souza’s new movie.

User-to-user network
August 8 to August 9, 2018 (about 12 hours)
Tweets: 2,477
Nodes: 1,885
Edges: 11,993
Communities: 13

User-to-user network of 2,477 tweets mentioning AppSame from August 8 to August 9

The orange cluster in this user-to-user network contains the theater that temporarily suspended screenings of Dinesh D’Souza’s movie “Death of a Nation” and was brigaded.

User-to-user network of 2,477 tweets mentioning AppSame from August 8 to August 9
User-to-user network of 2,477 tweets mentioning AppSame from August 8 to August 9

The accounts in the orange cluster were mentioned together in a tweet that received thousands of retweets overnight about the theater pulling D’Souza’s film.

Source: Twitter

I don’t know if the brigading of CinepolisUSA was organized in a Twitter room but it seems logical that networks of high-volume accounts and communities of people coordinating in Twitter rooms can be mobilized to target certain accounts or hashtags.

Influencer Index

Looking back through the datasets I collected for #QAnon, I found that the political marketing firm AppSame has previously been among the top accounts of the influencer index for this hashtag.

Here’s the influencer index for #QAnon from April 27 to May 3:

Source: Tweet Archivist

Influencer index for #QAnon from May 4 to May 11:

Source: Tweet Archivist

AppSame is also at the top of the influencer index for PradRachael, one of the high-volume hubs I graphed above that is tweeting #QAnon hashtags.

Source: Tweet Archivist

AppSame is also in the top of the influencer index for #WalkAway which I didn’t blog about but I tweeted a thread with some graphs.

Source: Tweet Archivist

AppSame appears again at the top of the influencer index for another high-volume account I collected in March 2018. KatTheHammer1 is a frequent hub in many hashtags including #QAnon.

Source: Tweet Archivist

Conclusion

At the time of publishing I’ve documented a total of 63 high-volume accounts that have at least 10,000 followers each and are tweeting 100 times per day or more.

Many of the #MAGA spammers in my thread are tweeting hashtags like #QAnon, #WalkAway. Many of the same high-volume accounts are tagging each other in tweets and connecting to a conservative political marketing firm. Nina Tomasieski’s account is also connecting to the same conservative political marketing firm (or the political marketing firm is connecting to her account) and we know from the AP article that Nina is in about 10 Twitter rooms containing 50 people each.

It all seems like a giant clusterfuck (it is) but from what I’ve seen so far, the following components are consistently connected in several networks: Twitter rooms, high-volume hub accounts and a conservative political marketing firm.

I believe #QAnon, #WalkAway and other political hashtags are being boosted by Twitter rooms that contain a combination of real people tweeting from high-volume accounts, bots and political operatives.

It would be beneficial to have real people participating because they would have a real phone number to add to their accounts and make them appear less bot-like.

The presence of hubs makes the networks robust, resilient and super-spreaders of whatever trends they are tweeting.


Twitter’s blog post from June 26, 2018 seems like it should address the behavior of these kinds of accounts.

Expansion of our malicious behavior detection systems
We’re also now automating some processes where we see suspicious account activity, like exceptionally high-volume Tweeting with the same hashtag, or using the same @username without a reply from the account you’re mentioning. These tests vary in intensity, and at a simple level may involve the account owner completing a simple reCAPTCHA process or a password reset request. More complex cases are automatically passed to our team for review.

The only loophole I can see why these high-volume accounts might eek past Twitter’s TOS is the fact that they are replying to each other, although they are also using the handles for POTUS and realDonaldTrump who is not replying to any of them.


Related hashtags

The #QAnon spammers are also tweeting in other hashtags. I published a separate blog about #OperationBackyardBrawl which contains some of the same accounts.

I made a thread about #WalkAway which also contains some #QAnon spammers (note: this hashtag has been attributed by some to Russian bots but I have no way to prove or disprove that claim).

Some of these same high-volume accounts tweeted #KateSteinle hashtags back in December 2017 which I also published about. I called them “cyborgs” in this blog and the high-volume accounts were hubs in those hashtags too.


Dates: I started this post on May 20, 2018 and have been updating it periodically all summer. It was published publicly on August 9, 2018.

Gephi graphs in this blog were created using OpenOrd combined with Force Atlas 2 layout algorithms.