Exposing a Brazilian network which trades clicks for cash

Ahead of Brazil’s presidential elections, a group of apparently young Brazilians is running a network of Twitter, Instagram, and Facebook accounts to trade engagement — likes, followers, and pages — for cash.

The network was involved in boosting partisan, election-related content in Mexico. With Brazil’s own election due on October 7, this network has the potential to reproduce its Mexican operations much closer to home.

Meddling in Mexico

@DFRLab has already reported how one so-called “fake news king” in Mexico promoted his content with hundreds of reactions from foreign users on both Twitter and Facebook. Many of the Facebook users claimed to be located in Brazil.

A large number — over 100 — of the Facebook accounts claimed to work for a Brazilian Facebook page called “Frases & Versos” (archived here). Most appeared to be very young, some of high school age, some of university age; many were created in September 2017. We reproduce the profiles of three of them here, for illustrative purposes.

This was not organic traffic. The reactions to two highly-partisan Mexican posts — one each from pages called NOalPeje1 and Hablando de Politica — not only came from Brazilian accounts: they came from the same Brazilian accounts, reacting in the same order (albeit with some accounts reacting to the first post but not the second), as this image shows.

In addition, one of the first accounts to like these posts, “Viitor Sillva” used, as its profile picture, a photo of actress Chantal Goya. Borrowing profile pictures in this way is a common method of masking false or automated accounts.

To see so many reactions, all of the same sort, from accounts in a different country suggests that the likes were not the result of organic interest, but some form of transaction. To see so many accounts doing the same thing in the same order strongly suggests that they were automated.

The reactions to the Mexican post therefore seem to have come from a Brazilian operation which specializes in providing artificial boosts to Facebook posts. Such an arrangement is commonly called a “like farm.” This like farm appears associated with the Frases & Versos page.

Trading in Brazil

Frases & Versos is a curious page. Its “About” section says that it offers poetry and humor; its profile page says it is dedicated to agriculture. Rather than posting its own content, most of its historic posts shared stories from other sources, apparently clickbait ones.

Despite the lack of original humorous or romantic content, or even agriculture, the page had over five million likes by July 5, 2018. For comparison, the Brazilian Football Confederation has 12 million likes.

As in the Mexican case, a remarkable number of Frases & Versos’ likes came from apparently Asian accounts, especially in India, reinforcing the impression of artificial amplification.

Part of the explanation can be gleaned by studying the page’s managers. For one thing, two of them have the same name, “Anderson Leite.” The username of one is Leitenovinho — or “new Leite” — suggesting that the user previously held another account; the other is Leitereserva2 — or “Leite reserve 2” — suggesting that the same user had at least one other backup. This appears to be a breach of Facebook’s community standards, which state that it is against the rules to maintain multiple accounts.

The “new Leite” account lists, in its profile page, the letters PCSD. Searching for this combination on Facebook led to a whole network of pages:

• A verified page, PCSDOFICIAL (archived here);
• A backup page, OficialPCSD (archived here);
• A closed group page for administrators, SemprePCSD (archived here);
• A page for trades, RegistroDeTrocasPCSD (archived here);
• A page for “assessors,” AssessoriaSemprePCSD (archived here).

As of July 7, 2018, the two “official” pages were inactive for almost a year. The closed group was apparently hyperactive, recording 687 posts that day, and over 10,000 in the past year. It defined its goal:

“To bring together all Facebook page managers to exchange knowledge, negotiations and profits using the social network.”

The reference to “negotiations and profits” clearly marks this as a commercial venture.

The RegistroDeTrocasPCSD, “PCSD register of trades,” was a remarkable page. With stunning openness, this featured posts from members of the group, describing how they traded various Facebook, Instagram, and Twitter likes, shares, and pages for money, Paypal payments, or other pages.

Some users even posted photos of bank receipts, giving their personal details, to prove that they had made the sale, and how much they had cashed in. The post below is one example; we have anonymized the image.

The trades make fascinating reading. For example, on September 13, 2017, user Andre Junior posted a screenshot of part of a conversation with one João Pedro Peixoto. The accompanying description recorded it as selling a Facebook share; in the screenshot, Peixoto named the link to the piece to be shared, and asked for a specific comment to be made.

Searching on Facebook led to this share by an ostensible humor page called “Biscatiane,” with the exact comment requested by Peixoto. The original article led, in turn, to this post from a page called “anastomosepoesia.” According to this page’s About section, Peixoto was one of its contact addresses.

The evidence therefore suggests that Andre Junior’s post recorded a genuine transaction: money in return for a like by the Biscatiane page, which had over one million likes by July 5, 2018.

Another post by the same user registered the sale of a Facebook share to one “Raquel Oliveira.” Again, the link led to the Biscatiane page, and a share of a story from a news website called br.blastingnews. The original story was written by one “Rakel Liver;” the profile picture on her author page was identical to the profile picture shown in Andre Junior’s screenshot.

Many Users, Many Platforms

The group did far more than simply selling Facebook shares. Several of their posts recorded the sale of entire pages, such as this one, by one Wesley Rodrigues.

This post spoke of selling a page (presumably, though not conclusively, a Facebook one) to a customer called “Raoni Souza.” The post did not tag the customer, but a Facebook search brought up this account; one of its previous profile pictures was a perfect match with the profile picture shown in Rodrigues’ post.

The Rodrigues post did not disclose which page Souza had bought.

A second page sale by one Renato Machado was less detailed, but did name “Cintia Canário” as the intermediary. An account of that name was one of the managers of the Frases & Versos page, together with a number of other pages which had a suspiciously high number of likes for their content.

This reinforced the impression of a tight-knit community, clustered around the PCSD group, but with Frases & Versos as one of its associated pages.

Another post was more definitive, recording the February 3 sale of a page called “Eu e você amor,” listed as having 121,000 likes, for 300 reals ($93.96 USD on that date). Searching the name brought up this page, which had 128,508 thousand likes as of July 6, 2018.

Likes themselves were also monetized. One post recorded the sale of 10,000 Facebook likes to one Leandro Oliveira, for $60.00 USD. The screenshot named the target page as a community called “Desimpedida.” A search for a page of that name led to this page, which listed 14,000 likes as of July 4, 2018. On that date, the page’s “About” section listed “Leandro Oliveira II” as a team member; the information was removed by July 7.

Twitter and Instagram also provided commercial opportunities. This post (archived here) recorded the sale of the user’s own Twitter account, which it named as @maikkwe, to a user whose screen name was Higor José. The same user also claimed to have sold her Instagram page.

When checked on July 4, 2018, the Twitter page had only been used to post once, but had the biographical note, “ Tô no @higorduxo” (“I’m at @higorduxo”). This led to a parody Twitter account with over 50,000 followers; that, in turn, pointed to an Instagram account which had only posted once, but had over 11,000 followers.

The discrepancy in the number of posts and followers suggests that the Instagram followers had also been bought.

This post recorded the trade of a page (presumably on Facebook) for an Instagram account with a user named “Débora Mirson.” That name belonged to a Facebook page which linked, in turn, to an Instagram account. The Facebook and Instagram pages had the same profile picture.

As of July 4, 2018, the Instagram account had never been used to post, but already counted over 1,000 followers. Again, this was extremely unlikely to be the result of real-life organic interest; it was far more likely to be the result of PCSD’s work.

This post even recorded a transaction of cash dollars against a PayPal payment, suggesting a black-market currency trade.

In yet another twist, a number of recent posts on Frases & Versos tagged an Indian Facebook user called Mohd Ameen.

As of July 6, 2018, this user had a disproportionately large number of Brazilian and Portuguese-speaking followers, including at least one from Mozambique.

While more evidence is needed for certainty, this suggests that the tagging by Frases & Versos, on posts which had nothing to do with Ameen or with India, was a way of steering Brazilian users to follow him.

Who Will Fake The Fakers?

The extent of the PCSD community’s organization became apparent from their internal policing. A separate page, AssessoriaSemprePCSD (“the assessory of Sempre PCSD”), listed members who had been suspended for violations.

One of those members was named as Giovanni Pellegrini (archived here), another of the Frases & Versos managers, who was banned for allegedly failing to follow through on a trade.

Translated from Portuguese:

Status: #Banned

Name: Giovanni Pellegrini/Giovanne Alves

ID: 100018894727196/
URL: /eugiovanne /originalmenteoriginal

Return: Undetermined

Motive: He had a deal to place 30k on Wilson Carlos’ pages. He did not pay, does not respond to messages, says he is blocked but is posting to his profile. He was also selling/exchanging “shares” with pages from the “eternally banned” .

Condition: Pay Wilson, stop being a piece of shit, and explain the situation with the “eternally banned”’s pages.

Another was called Erlon Ó Lôñ or Erlon Nsc, and was banned for attempted theft.

Translated from Portuguese:

Status: #Banned

Name: Erlon Ó Lôñ / Erlon Nsc

ID: 100012989170503 / 100022549892203
URL: /erlon.limaa /eo.lon.9

Return: Eternal

Motive: Banned from other PCSD’s for several robbery attempts. To this day, he is still trying to steal.

Condition: None.

These posts showed both a degree of transparency, and a strong degree of community organization, befitting a large-scale network which functions on trust.

Conclusion

The network around PCSD and Frases & Versos is highly active, unusually well structured, and apparently international in reach. Accounts associated with the network amplified election-related polemics in Mexico; they may have provided extra followers for a user in India.

It is also remarkably open. PCSD’s transactions, its register of transgressors, and even the bank details of some of the users, are open posts. Administrators used multiple accounts under the same name to run their pages.

This monetized network of large-scale likes, page sales and commercial shares has the potential to distort the online debate in Brazil’s election campaign, allowing customers to create a false impression of popularity by providing them with spurious likes and followers, as was seen in Mexico.

The network also shows how far the social networks have to go in tackling this sort of business online. Selling pages is banned under Facebook’s rules; selling likes and shares on an industrial scale is, at the very least, questionable, given the emphasis which Facebook places on authentic content. Similar questions arise over the group’s behavior on Instagram and Twitter.

The group went out of its way to make its activity public: some of its posts, though not all, detailed the exact accounts, numbers and sums of money involved, and users who did not post screenshots as proof were reprimanded. Despite this, it appears to have been active for well over a year, operating with apparent impunity.

This is a crucial lesson for the platforms to take away; and time is short. Brazil’s election is in October, the U.S. midterms in November, and the South African and Indian elections next year. The social media companies have begun to tackle the problem of fake stories and accounts, but they have a long way to go before they catch up with the groups which are operating on their platforms in broad daylight.

---

Maria Fernanda Perez Arguello is a Project Associate with the Adrienne Arsht Latin America Center at the Atlantic Council.

Jose Luis Peñarredonda is a Digital Forensic Research Assistant at @DFRLab.

#ElectionWatch Latin America is a collaboration between @DFRLab and the Adrienne Arsht Latin America Center at the Atlantic Council.

Follow along for more in-depth analysis from our #DigitalSherlocks.