Key takeaways:

• The fraudulent Anonymous network pretends to be affiliated with a hacktivist movement that goes by the same name in order to win the trust of potential victims. There are hundreds of pages on Facebook using this tactic. Many of them post the same content.
• The network regularly shares disinformation, conspiracy theories, wild speculations, and manipulated content to attract new audiences and gain credibility. It then asks followers to pay huge sums for sports betting tickets guaranteed to bring significant yields.
• Available evidence indicates that those behind the network are mainly Nigerians and people based in Nigeria.
• The network relies on sock puppet accounts to maintain an aura of legitimacy. These accounts leave flattering comments under its posts and help to plant some of its disinformation.
• Accounts of victims posted on Nairaland and Facebook between December 2020 and March 2023 confirm that many people who fell prey to the network’s tactics were defrauded.

________________________

You, too, can become wealthy overnight. All you have to do is give us a hefty sum to bet on our fixed football matches. Don’t believe us? Then how come we know these many well-kept secrets? How come, sometimes, we are even able to predict the future? Why do so many people send us testimonies of how their lives have turned around since they played our games?

This is the strategy of a scamming network that has spread its tentacles all over Facebook and is passing off as Anonymous, a decentralised movement of hackers that emerged in the early 2000s.

The original Anonymous became a global sensation because of its use of cyber-attacks for activism and anti-establishment stances. It is commonly associated with two things: the Guy Fawkes mask and the tagline, “We are Anonymous. We are Legion. We do not forgive. We do not forget. Expect us.” It has recently protested against the Russian invasion of Ukraine, police brutality in the US, the Israeli occupation of Palestine, and so on. 

Because the group is faceless and leaderless, it can be difficult to authenticate online materials presented in its name. The scamming network on Facebook is exploiting that very loophole. By latching onto the Anonymous brand, it gains credibility in the eyes of its followers, many of whom believe it has the means to somehow correctly predict or influence football matches.

Just how big is it?

Information gathered from the social media website using Instant Data Scraper revealed at least 240 Anonymous pages with similar traits and modes of operation. The pages — most of them created or co-opted between 2022 and 2023 — have a combined 2.89 million followers. While some have become inactive, many of them post several times a day. 

The names are typically variants of the following: Anonymous, Anonymous Collective, Anonymous Ghost, Anonymous Groups, Anonymous Squad, Anonymous Team, Anonymous Tips, etc. They also use the words ‘Legion’ and ‘Hacktivist’ often.

You will find the “We are Anonymous, we are Legion” tagline in many of their bios. Sometimes, they add that they are committed to changing the world and making it better.

The various pages also frequently repost, reference, and follow each other.

Though this report mainly analyses the network’s tactics through posts from this page, such content is often published across multiple pages. HumAngle discovered different cases of copypasta by searching excerpts on CrowdTangle. Many of the posts were published only minutes apart. Sometimes, the same content is posted by as many as 12 pages within the same hour, allowing the network to reach tens of thousands of viewers.

• This post was published on at least 18 pages in the network and attracted 5,732 total interactions (likes, comments, and shares).
• This post was published on at least 16 pages and attracted 3,008 total interactions.
• This post was published on at least 16 pages and attracted 1,568 total interactions.
• This post was published on at least 13 pages and attracted 2,248 total interactions.
• This post was published on at least 12 pages and attracted 5,575 total interactions.

HumAngle and Code for Africa (CfA) have shared our findings and details of the Facebook pages in this network with Meta (the company that owns Facebook) so they can be taken down.

The network, however, wants to appear to its followers as if it is based outside of Nigeria. The most common address on its pages is Honolulu, a city in the US. Accounts in the network constantly share pictures and videos of foreigners who are alleged to be hackers on various Anonymous pages. This is done in a way that suggests the administrators are foreigners who just got some intel they’re working with but do not have the full picture of what’s happening in the country. The pages also misspell or jumble words – likely on purpose to avoid triggering content filters that scan for specific terms associated with scams or misinformation. For example, they write Nusukar instead of Nsukka, Nigerian local money instead of Naira, Kanu Nnamdi instead of Nnamdi Kanu, Ahmad TB instead of Bola Ahmed Tinubu, fuhlanii instead of Fulani, Wike Nyemsome or Wike NY instead of Nyesom Wike, and Accessible Bank instead of Access Bank.

The network’s target audience is mostly Nigerians, but recently, the pages have released posts targeting people in other African countries, such as Kenya and South Africa.

Meanwhile, two characters prominently appear in the pages’ posts: Bolívia Zica and Commander X.

Bolívia Zica (spelt by the network as Zika Bolivia) is a Brazilian sports analyst, former Desimpedidos channel presenter, and a brand influencer for KTO (an online sport-betting company), who famously wears a white mask. The Anonymous network profusely uses his pictures and videos, portraying him as one of their tipsters. It streams pre-recorded videos of Bolívia Zica speaking in Portuguese, where he says he will discuss “what to expect” during the games. HumAngle translated some of these videos into English using ElevenLabs and saw that he was merely discussing football match prospects for KTO Brazil. He does not claim to fix matches, nor does he ever mention the Anonymous network. Instead, when he talks about his betting choices, he uses doubtful expressions such as “pretty likely,” “I believe this team will win again,” and “we might even see a draw.” 

HumAngle contacted Bolívia Zica through email, as well as direct messages on Facebook and Instagram, to inquire if he was aware of his content being used fraudulently. However, by the time this article was published, he had not responded.

On the other hand, Commander X wears a moustachioed Guy Fawkes mask. He occasionally does live streams, where he mostly bobs his head to music. The nickname was initially used by Christopher Doyon, a U.S. citizen and a prominent figure in the original Anonymous movement, who was arrested in 2011 and again in 2021. He pleaded guilty to conspiracy to cause intentional damage to a protected computer and jumping bail in 2022 and is presumed to still be in custody.

Other fixed match tipster accounts who are suspiciously linked to the network are Darl Kroos, Lavelle Alexandra, Louis Beneventi, and Zedicus Gurufix Tipster.

Lavelle Alexandra uses the same tactics (e.g. clinging to the Guy Fawkes brand, promising prosperity, claiming to have access to fixed games, and sharing pictures and videos of Bolívia Zica) on his account, which was created on June 10, 2020. The account posts links that trace back to a Telegram channel called AnonymousW68. On  Oct. 1, 2021, this Telegram channel changed its name to Darl Kroos. Then, on Oct. 3, 2021, it was renamed to Anonymous. It has repeatedly shared links to this Telegram account (username: anonymous123450, name: Catch me if you can).  It has also shared links to two other channels: Wilburn Moore (previously Janny Moore) and Darl Kroos. (A Telegram channel named Darl Kroos has been flagged as a “big scammer” by at least one of its victims.)

In addition, Lavelle’s Facebook page follows seven pages from the Anonymous network. It also follows MR.NOFACE and Davies Kelvin — two other Anonymous-branded tipsters showing the Guy Fawkes mask on their display picture or header image, which are equally following pages in the fraudulent Facebook network.

Zedicus Gurufix is yet another “fixed match” tipster account followed by an Ânonymous page. He uses tactics similar to those of the fraudulent network (praise-singing comments, suspicious video testimonials, etc). And then there is the Louis Beneventi Fixed account, which follows two Anonymous pages and is followed back by at least two.

Using foreign people as the face of the network gives an air of credibility (because of the real Anonymous group’s country of origin) and helps to assuage the fears of prospective victims. It also serves as a great misdirection, shifting attention away from local participants. 

Meanwhile, there seems to be a predominance of pro-Biafra Nigerians at the backend of the scheme as much of the content posted is framed in the style of the Indigenous People of Biafra (specifically the Directorate of State faction), a separatist group agitating for the breakaway of southeastern and south-southern Nigeria. They consistently refer to Nigeria as “the former country”. They suggest that former President Muhammadu Buhari is dead and was replaced by a look-alike. They idolise IPOB founder Nnamdi Kanu and call for his release. They condemn Simon Ekpa, who leads the rival Autopilot faction, and stir up fear about “fuhlanii terror groups” planning to attack the southeastern region. 

While checking for cases of copypasta, HumAngle also found various instances of IPOB-affiliated pages retweeting content from the Anonymous network.

Prophecies and abracadabra

The network is able to keep scamming people because not only does it promise them a mountain of riches, but it also uses a wide range of tricks to maintain an aura of credibility. One of those tricks is using conspiracy theories, prophecies, and speculations that pose them as all-knowing, ever-present. 

The pages portray themselves as watchdogs monitoring evil acts to uncover them and call these expositions. They give vague warnings of looming disasters, or after something has happened, they claim that they knew all along and had warned about it.

For example, in August, during the #EndBadGovernance demonstrations in Nigeria, they claimed that the government was planning to “entirely ban social media”, that those who participated online would be tracked and picked up, that ₦15 billion was shared with people across the country to thwart the protests, and that ₦150 million was given to thugs in Lagos to cause chaos — all without evidence.

The pages issue warnings to popular figures to draw attention, like in August when they said some people were coming for Ahmed Isah, an Abuja-based radio personality famously known as Ordinary President. “They claim that you’ve crossed your boundaries and must be taken down,” the posts stated. Similar expositions were released about Zenith Bank CEO Adaora Umeoji, actor and content creator Debo Adedayo (aka Mr Macaroni), and others. If nothing happened to these people after a while, the network would say it was because they heeded its warning.

Some of the expositions are extremely vague, such as when the network claimed an agendist (a term roughly used to mean the bad guy or a socio-political conspirator) would be killed through poison in the coming days or weeks or when it simply wrote, “Nigerian entertainment industry will be hit with terrible news in the coming weeks.”

Sometimes, the expositions are so far-fetched that a team of genius hackers is not enough to explain them away. In April, for example, the network posted a picture of a middle-aged white man with the Ukrainian flag edited in and claimed that he had stage one cancer. “Hello Krystov Pandev, we saw your comment and immediately got a message for you. Please leave all you are doing and immediately go for diagnosis,” the pages said. “Please immediately swing into action and save yourself.” One of the posts was liked by over 1,600 people and gathered 810 comments, many of which thanked the page for saving Krystov’s life. The same month, it claimed to know that one Anyaegbu was poisoned by a jealous friend. It ventures to predict when the poison would take effect but staggers between different possibilities: six months, less than a year, two years. At another time, it said — in the typical fashion of prophets and soothsayers — that one Christiana Luka (who) was being abused by her fiance and that he would never change and if she went ahead to get married to him, he would beat her to death. 

Another common trick the network has adopted is to claim it had accurately predicted tragic events after those events occurred. The network did this in April when Nigerian actor Junior Pope died in a boat accident. Its first post on the issue was at 9:38 p.m. on April 10, the same day the incident happened. Three days later, it shared a screenshot of what was supposed to be the original exposition dated Aug. 22, 2023 — but there is no post with that publication date on the timeline.

It used the same script following the death of former Access Bank CEO Herbert Wigwe, sharing a screenshot dated Oct. 30, 2023, on March 14. There were, in fact, no posts from this date on the timeline and a search for an excerpt from the screenshot on Facebook returned no result. Again, the same pattern can be seen in posts regarding the collapse of Saints Academy, a school in central Nigeria, in July. This time around, it used a sock puppet account to plant the screenshot in its inbox.

It has managed to cover its tracks by claiming that Facebook deletes some of its posts because of censorship or an agenda.

Disinformation as a tool

HumAngle has identified numerous instances of easily verifiable disinformation in the posts shared by the network.

On Aug. 2, it declared, “A Russian Aircraft is scheduled to crash in the early hours of Saturday. The airplane conveying some top Russian KGB agents would be taken down by the US as they look to neutralise Russia nuclear Brains.” On Aug. 3, the network published a video of a burning plane in Russia and passengers rushing to exit. “Few injuries but no death recorded yet,” it stated. “The media would do anything possible to suppress the news as it is a failed attempt by the US. WW3 is looming.” 

The facts couldn’t be more different. The incident at the Moscow Airport happened in May 2019 and caused 41 deaths. The plane had been struck by lightning and suffered an electrical failure that forced it to land. The landing gear collapsed, and fuel spilled out, leading to the fire.

In June 2024, the network shared a picture collage of a certain “Mrs Sandra,” a military girl who was allegedly poisoned by her close friend who was jealous of her marriage. “You know the funny thing, she came out on Facebook to troll the anonymous, just like the young man, Linus did. It is very clear, when you doubt, you pay dearly,” the post said. However, the woman in the pictures is not Sandra. It was Kenyan journalist Njambi Koikai who was hospitalised in the US in 2018 because of endometriosis. She passed away on June 3, 2024, due to the same condition.

Another example is this video of what appears to be members of a militia hurrying off somewhere, some of them wearing military fatigues and armed with assault rifles. The network claims the video was recorded in northern Nigeria, which had now become a “den of wolves”. However, we have confirmed that this claim is false. The footage was, in fact, recorded during the Tigray War in Ethiopia, which ended in November 2022. The evidence for this includes the spoken language (Tigrinya) and the display of the Tigrayan flag.

There are more instances, too.

On May 12, the network shared screenshots of a direct message from one Maya Edward, who said he bought a fancy house and car weeks ago after investing with Anonymous. He even attached three pictures showing himself and his fiance posing in front of the house and car. “It’s impossible to be here with us for more than three months and remain poor… [As] long as you pay the little price for access? Leave the rest to us, we shall make you successful absolutely,” read the caption. While we could not find where the pictures were originally uploaded online, we found several cases of them being used for similar scams, which had called Maya a different name. Examples are this post from September 2023 and these two from March 2024.

Some of the other examples of disinformation are even more dangerous.

The pages have been touting Neem trees as a cure-all solution for all kinds of diseases. In March, they claimed it cures HIV/AIDS and cancer. “The WHO [World Health Organization] doesn’t want you to know this [because] they make money from your sickness,” they added. AFP has fact-checked this claim and found it to be false.

Another similar campaign pushed by the network is the depopulation narrative. It has made many posts claiming that labs for biological weapons are being set up by Americans in parts of Nigeria, Ghana, and Kenya with the aim of wiping out the local population. “A biolab in the Kano region of the country Nigeria is now set to release food with cancerous cells in them. You must now be careful of the kind of food you purchase from the market and you must remember that this cancerous foods [sic] would be distributed nationwide,” one of the pages stated in a post on June 22. The previous month, it claimed the World Health Organization (WHO) sent 50 people to over 17 countries in Africa to infect people with the monkeypox virus. Each time there is a disease outbreak (such as cholera or Mpox), it latches onto the news as proof of the existence of these labs. What the network does not forget to emphasise is this: “Do not forget your neem remedy.”

The network also claims to be launching cyber attacks against these labs to uncover the identities of those involved and permanently delete their research, but it does not provide specific details that can be verified.

Russia’s Ministry of Defence has pushed a similar narrative about the establishment of laboratories for biological weapons in Ukraine and Nigeria by the US. HumAngle fact-checked these claims in May 2022 and found them to be misleading.

Imposters

While it is clear that the network’s aim is to make money off its followers, it still presents itself as a group of activists seeking to give Nigerians financial liberation. 

The network posts announcement (press statements) videos made in the style of the original group and posts videos of alleged hacking. In May, it shared screenshots of what was supposedly an intercepted WhatsApp conversation between a bio lab worker (who fearfully quit because of a cyberattack) and someone called “KGB Frank”.

In late July, during the build-up to the scheduled #EndBadGovernance protests in Nigeria, the pages referenced the 2020 OpNigeria incident, where members of the real Anonymous hacked various government websites in solidarity with Nigerians protesting police brutality. “We are ready for yet another cyberattack,” they stated. Four days later, they claimed the Nigerian authorities were only able to foil their attacks because they emptied their databases.

The network also rewrites news articles and forcefully inserts itself into real-world cases of crime. It would claim, for instance, that certain criminal masterminds were only caught because of the intelligence it provided to law enforcement agents. “Good work with the swift actions taken after receiving precise intel from the Anonymous. Our fight against corruption is now on!” It was written in July in reaction to news of the arrest of gunrunners in Plateau, central Nigeria.

Many of the Anonymous branding content on the pages are notably lifted from other platforms. For example, in March, it posted a video showing dozens of hooded people wearing the iconic Guy Fawkes mask and working on laptops. A reverse image search revealed that the video was originally posted on TikTok by a cybersecurity/ethical hacking account (@m10m550) on Jan. 30, 2024. It appeared to have been shot in the Middle East. The caption included hashtags like #الامن_سبراني (Cybersecurity), #جامعه_اشور (Assyrian_community), and #هكرررررررررر (Haikrisrrrrrrrrrr), with background music by a Turkish musician. The account name ابن ارشد (Ibn Arshad) and the specific reference to the Assyrian community added credibility to its Middle Eastern origin. 

The fraudulent network has also repeatedly used pictures and videos released by members of Anonymous Voice of the Voiceless, an animal rights campaign group that does street demonstrations using Guy Fawkes masks. On Feb. 22, 2024, it shared this video announcing a march scheduled to take place in Amsterdam “on September 2nd this year” — except they meant Sept. 2nd, 2023, because the original video was released in February 2023.

How the fraud happens

What is the point of the disinformation campaigns, prophecies, and conspiracy theories? They tend to attract a larger audience and more engagements, which the pages convert for fraudulent purposes. Such posts also build trust among unsuspecting users of the social media platform.

The network makes money from this approach by convincing people to pay money to bet on fixed football matches (that is, sports matches whose scores have been predetermined or manipulated, usually through bribery).

The concept of “fixed matches” has been used to scam countless people around the world for many years. It is understood that even though some sporting matches are fixed, such knowledge is often restricted to a small circle. But there are many fraudsters who have perfected a way to sell the fantasy to people.

However, this Anonymous network claims to be an exception.

It sells tickets for football matches on Wednesdays and Sundays, claiming the matches have been fixed with “absolutely zero failure chances”. Though it doesn’t explicitly say how much the tickets go for, there are indications they run into hundreds and thousands of dollars as per victims who shared their private conversation (as high as $3,200). It also sells “mini tickets” and gives the option of instalment payments. 

Here’s your chance to become a millionaire, it says. All you have to do is pay the price, it says. “Once you !NVEST in our F!XED match tickets? Your life must be transformed positively.” And it’s got many testimonials to prove it — never mind that they are often curiously phrased in the same style.

One “grateful customer” narrated through a direct message how she got a loan of $1,000 to pay for the ticket, which changed her life, and offered to donate $8,000 to the network’s orphanage. Another customer said she won over ₦5.4 million, which she used to pay for her mother’s surgery.

There are many video testimonials on the pages from people who say they just bought a real estate property or car after buying the tickets, but they are full of red flags. 

First, they all follow the same script. It is also obvious that the narrative voices were often superimposed on pre-recorded videos of property tours. This is clear from scenes where the face of the person handling the camera shows and they are not speaking, despite the voiceover, and from the monotony in the voice even during sharp, strenuous movements. In some of them, you can even hear the actual voice of the videographer. Some of the testimonials also have the same unnaturally nasal or guttural foreign narrative voice (which is likely a distorted version of the voice here, as many of the other videos show signs of heavy editing). When the network posts some of the testimonials, it tags sock puppet accounts such as Mania Johnson, Emmanuel David, and Simeon John as the people who sent them. The accounts are usually either empty shells or have been inactive for many years.

Another way the network propagates its scam is by uploading bet slips meant to show the huge wins recorded from their games. This one shows the player allegedly winning over $56,200 from just betting $610. Here, they cashed out over €26,000 after staking only €100. Another one reports returns of £35,000 from a £350 stake. This one in Naira shows a win of ₦21.4 million from a ₦100,000 stake.

Online scammers have been fabricating such slips—and easily, too—for many years now. They use various element editor apps that edit the text on actual pages and then screenshot the manipulated versions. Another thing to note is that the screenshots are cropped to remove crucial information like the bet slip numbers, making it impossible to verify their authenticity.

Lamentations of victims

But if they’re a fraudulent group, why don’t you find many people complaining in the comments?

First, it’s common to find instances where administrators restrict who can comment on certain posts, and it’s likely that unfavourable comments are frequently deleted.

Second, the network repeatedly announces this odd policy of not allowing customers to comment on its posts.

Third, the network has an interesting way of dealing with naysayers — it accuses them of being criminals. This young man, Chukwuma Echenwune, is allegedly the “brain behind many shootings and killings” in southeastern Nigeria. Joy Omalicha allegedly trafficked young girls to Mali. Gilead Michael is hinted as a criminal, too, though his offence is not stated. Meanwhile, it looks like these are all people who criticised the network in the past, and this was its way of scaring them and discouraging dissent. Both Gilead and Chukwuma have denied the allegations. Joy’s account, on the other hand, is locked.

Chukwuma stated in July that he was wrongly accused because he observed on the page that they were backdating some posts “to suit there [sic] propaganda and deceive there gullible followers”. In another post, he shared a screenshot of his conversation with one of the groups where the administrator warned him, saying, “Be careful with the comments you make on this page.”

For good measure, the network also appears to manufacture its own naysayers just so it can humble them. It happened with this apparent sock puppet account, Chindy Charles. You brag too much and don’t know anything about anybody, the account teased. Oh but how come we know your birthday, your real name, and the fact that your uncle died the same day you were born? Anonymous replied. “I am scared now,” Chindy said, acting shocked. “I have never disclosed any of this to anyone online.” 

In addition, there is a glaring case of coordinated inauthentic behaviour in the comment sections with the use of dozens of sock puppet accounts to drown any legitimate feedback. As a result, the replies were usually mechanical and boot-licking.

HumAngle scraped comment data from 20 posts shared between Aug. 11 and 15, 2024. We found that as many as 352 out of the 909 comments on the posts were made by accounts that had “top fan” and “rising fan” badges, which are used to distinguish frequent engagers. That means for every ten comments, four were made by such accounts. We also found that 501 (55 per cent) of the comments were posted by recurring accounts. Some of the names, like Cworld and Blessing Innocent, came up as many as 17 and 16 times, respectively.

Sometimes, you would find the administrators tagging top fan accounts in the comment section as a call to action.

It is nearly impossible to find any negative feedback on the Anonymous pages from scammed people because of the coordinated deluge of favourable comments and tight content moderation. However, victims have found other platforms to vent their grievances — especially Nairaland, Nigeria’s largest internet forum.

Akpan Okon, one of the victims, created a Facebook page in 2020 to “inform the innocent Nigerian citizens about anonymous scam”. There, he shared evidence of his payment to the network both in Naira and Bitcoin and how he was eventually blocked.

“[They] are nothing but scammers,” another victim warned on Nairaland in July 2021.

“What they do is that they bring out two games and claim they sold it to customers who are bar[r]ed from commenting on their page, and they will be making comments following the games as they are playing…. whatever the game ends, they will claim that was exactly what they predicted. They are very smart criminals.”

They added that their brother paid them some money but was not given any prediction. Instead, they demanded more money and eventually blocked him.

A few months later, another person confirmed that the network’s agents would block you once you paid in Bitcoin through their Telegram channel. Someone else then shared how he lost $500 to the scheme while also attaching screenshots of the transactions.

“Disregard all anonymous fixed games lies. They will defraud you of your hard-earned money and disappear into thin air,” one victim wrote in June 2023. “They also use Bitcoin and Ethereum. They are Nigerians living in Ghana, Malaysia and other parts of [the] world.”

Several Nigerian agents identified by previous scam victims include Haske Bright, Muhammed Nurudeen Ajayi, Okwor Cyril, Onyedikachi MacGodwin Ogbonna, and Raven Okechukwu Attah.

Last year, another victim narrated how he lost $1,200 to the network.

“I observed that the individuals whom I had privately contacted were also the same ones consistently commenting on every game, encouraging people to participate. It’s apparent that this is a well-planned scam, and I’m amazed at how effectively they have executed it,” he noted. 

“Despite the growing number of people getting duped daily, with over 144k followers and counting, nothing has been done to expose them.”

— At least, not until now.

This article was produced through a collaboration between HumAngle and Code for Africa’s AAOSI programme. The AAOSI initiative is a collaborative effort to empower media and NGOs in African countries to combat disinformation and propaganda through training and resources, aiming to strengthen information integrity and foster collaboration among investigators in the region.