Fake 'Anonymous' network: a trap of conspiracies, predictions, and misinformation
On July 21, a Bangladesh Air Force F-7 BGI training aircraft crashed into the roof of the Haider Hall building at Milestone School and College in Uttara, Dhaka, during class hours. Soon, the atmosphere turned heavy with the cries of parents searching for their children. Videos circulating on social media showed injured children being rushed to hospitals, some carried on stretchers, others cradled in arms. As the night wore on, the death toll continued to rise. Most of the victims were children.
As the nation grieved, a photo and a post from a masked individual began circulating widely on social media. A Facebook page called Anonymous Main Page had posted the day before: “A school building will collapse leaving lots of kids l!veless. We see a terrible disaster fast coming…” The post quickly gained traction and many users assumed it was connected to the international hacker-activist group “Anonymous,” known for carrying out cyberattacks in response to human rights abuses and political misconduct in various countries, including the United States.
Waves of conspiracy theories followed the viral post, although it did not mention the Milestone school or even Bangladesh. Some questioned whether the Milestone jet crash was merely an accident, or a premeditated attack targeting children. Others asked: If the hacker group had foreknowledge, why didn’t the Bangladesh government act? Within a few hours, the page gained hundreds of thousands of new followers.
Amid speculations on social media, Dismislab began investigating the “Anonymous Main Page.” The investigation identified 25 Facebook pages, including this one, that had posted similar content claiming to have made prophecies about the Bangladesh plane crash. From Facebook’s Page Transparency data, Dismislab found that most of these pages were being operated from Nigeria, although the individuals featured in the photos or videos appeared to be non-African, and in some cases they used Portuguese to communicate. At first glance, it would seem that a Western hacker group or an international force with ‘access to secret information’ is operating behind the page. But it is nothing of the sort, they are rather part of a scam network.
Further investigation revealed that Nigeria-based news outlet HumAngle ran an investigative report in 2024 on such fraudulent groups. The report analyzed 240 similar ‘Anonymous’ pages and tracked down an organized fraud syndicate based in Nigeria. Under the guise of the international hacking movement Anonymous, the network regularly spreads false information, conspiracy theories, and baseless predictions to attract new followers and ultimately sells sports betting tickets with promises of guaranteed wins. Some of the pages that posted false predictions about Bangladesh were also listed in the HumAngle investigation, making it clear that they are part of the same fraudulent network. Dismislab contacted Nigerian journalist Kunle Adebajo, who led the investigation, and he shared that the scam operation was no longer confined to Nigeria but had begun expanding into other countries.
The Guardian explains that conspiracy theories often spread during times of uncertainty or crisis such as war, pandemics, or economic downturns when people are mentally vulnerable and searching for simple explanations. In such moments, individuals may feel the need to blame someone or something, which makes them more likely to believe in hidden plots or secret agendas.
A pseudonymous ‘Anonymous’ spreading conspiracies and false information
On social media, the first post related to an unspecified school building collapse began circulating from Anonymous Main Page on July 21 after the crash. The post had been published a day earlier in multiple anonymous pages (1, 2, 3), on July 20, prior to the plane crash in Uttara. In these posts, an individual calling himself “The Architect” claimed: “A school building will collapse, where many children will lose their lives. We see a terrible disaster approaching.” However, the post made no mention of a plane crash, let alone the Milestone school or Bangladesh. Rather, it stated that the disaster would result from negligence in building maintenance and that efforts were being made to prevent it.
Between 8:30 p.m. and 11:00 p.m. on July 21, the follower count of the page rose from 220,000 to over 320,000. From this page, several pages having similar names were tagged and shared, including Anonymous Architect, Anonymous Web, Anonymous Angels, and Anonymous Ghost. A review of each of these profiles showed identical types of posts, with those from these five pages being shared the most. However, at the time of writing this report in late July, all the five pages were no longer available on Facebook.
On the day of the plane crash, July 21, as news of the crash spread, the pages began releasing a series of ‘prophetic’ posts with statements such as ‘Warnings were given,’ ‘Our warnings are not taken seriously,’ and ‘What happened was never an accident, the plan had been made beforehand to eliminate innocent citizens‘. One post even claimed that a bomb attack would take place in Dhaka’s Gausia Market. According to their posts, Bangladesh and Dhaka were still unsafe, and more disasters were imminent.
In their posts, the group repeatedly identified themselves as ‘Anonymous’. A keyword search of Bangladesh-related content revealed at least 20 other pages were posting identical messages, indicating the presence of a coordinated network. The names of these pages followed similar patterns such as Anonymous Region, Lords of Anonymous, Anonymous Legionist, Dark Web Anonymous and Anonymous Collective, mimicking the branding of the original Anonymous movement.
The group Anonymous is a decentralized international hacktivist collective that emerged on the online forum 4chan around 2003 with no formal leadership. It uses the slogan, “We are Anonymous. We are Legion. We do not forgive. We do not forget. Expect us.” The group gained global notoriety in 2008 with Project Chanology, a campaign of cyber attacks and protests against the Church of Scientology. Since then, the collective has been linked to numerous high-profile hacking campaigns against government agencies, corporations, and other institutions worldwide, typically in defense of free speech or opposition to censorship. The movement’s participants remain largely anonymous, though some figures have been exposed or arrested. For example, hacker Hector Monsegur (alias “Sabu”) was revealed as an FBI informant after his 2011 arrest.
Most of these fraudulent pages that Dismislab investigated were created between 2022 and 2025, with follower counts ranging from a few hundred to several hundred thousand. For instance, the Anonymous 𝗚𝗿𝗼𝘂𝗽š had over 300,000 followers. The majority of the pages listed Nigeria as the admin location, though in some cases, the location was hidden. Others showed addresses in the United States, Canada, Cyprus, the United Kingdom, or Australia. Taken together, the names, locations, and posting patterns suggest that these pages are clones of each other or part of the same gang.
The pages frequently shared images and posts using names such as “The Architect,” “Commander X,” “The Professor,” and “Zica Bolivia.” Among these, the character ‘Commander X’ appears to be inspired by Christopher Doyon, who is known as ‘Commander X’ and is affiliated with the hacktivist collective Anonymous. He pleaded guilty in 2022 to federal cyberattack charges. Additionally, one individual regularly identified himself as “The Architect”, a name that has also been associated in the past with the Anonymous movement.
The pages have also been seen posting videos using the name and masked persona of Bolívia Zica, a popular Brazilian YouTuber and football analyst. It is unclear whether he is directly connected to the network. Similarly, a person identified as “The Professor” appears in videos of trading Q&A or mentorship sessions. Upon investigation, we found that the videos of “The Professor” were taken from Day Trade Professor, a trading influencer and professional trader. On his website, he clearly states: “The Professor only has 1 Instagram, 1 TikTok, and 1 YouTube channel, and does not offer signals or portfolio management of any kind…The internet is filled with scams—please be smart.”
Dismislab contacted both Bolívia Zica and The Professor via email to verify whether they were aware of their identities being used in these videos. Only The Professor responded, clarifying that he does not operate any Facebook pages.
A common characteristic of these pages is that whenever a major accident or criminal incident occurs somewhere in the world, they claim to have issued a prior warning about it. For example, on July 13, a plane bound for the Netherlands caught fire and crashed shortly after takeoff from Southend Airport in London, killing four people. Facebook page The Legion shared a video of the crash and wrote: “We feel really bad for expositions being neglected. We sent this warning clearly to the UK Airlines.”
We checked the page for any actual warnings made beforehand and found only a speculative post from May 6 stating, “We see a plane crash.” However, the post contained no specific time, date, location, or warnings. However, crashes have indeed been frequent. Statistics show that by mid-2025, there have already been at least eight commercial aircraft incidents worldwide, along with numerous private and military aircraft crashes.
These pages have also been found to spread outright false claims. The Anonymous Groups page, which has over 300,000 followers, the highest among the seemingly coordinated network, shared a video of a church fire, claiming that a Muslim man named “Ali” had deliberately set the church on fire and had been arrested by the police. Upon verification, this claim was found to be false. The incident occurred on July 17 in Quebec, Canada, where a historic church built in 1880 caught fire during a storm due to a lightning strike. Strong winds caused the fire to spread rapidly. Reports from local authorities and media confirmed that the fire was caused by lightning.
HumAngle report: how the scam operates
In September 10, 2024, investigation by the Nigeria-based news outlet HumAngle uncovered at least 240 active pages under the name “Anonymous”, all with similar names, content, and activities. Collectively, these pages had around 2.89 million followers, and most of them were created between 2022 and 2023.
Dismislab reviewed the 20 most-followed pages among the 240 and found that four of them had posted the same false predictions related to Bangladesh. These four pages were also on Dismislab’s page review list. Among the 20 pages reviewed, 11 were inaccessible during the investigation.
Most of these pages were also operated from Nigeria. According to the HumAngle report, in order to boost their credibility, these pages regularly shared various types of conspiracy theories, predictions, and fake hacking videos. They would then claim to have inside information about certain “fixed football matches” whose outcomes were allegedly predetermined. Using promises of guaranteed wins, they sold tickets for sports betting. These tickets were typically offered on Wednesdays and Sundays each week. While the price was not always disclosed in the posts, many victims told HumAngle that the tickets could cost up to $3,200. In some cases, the network even offered installment payment options.
To enhance their credibility, the pages shared fake reviews from individuals claiming to have won bets. Using various sock puppet accounts, they posted fabricated screenshots and images of betting slips. However, the slip numbers or any verifiable information were intentionally cropped out, making it impossible for others to verify their authenticity. The report also included testimonies from several Nigerian victims who described their experiences of being scammed by the network.
This network also used fake comments and sock puppet accounts to praise itself in its own comment sections. HumAngle analyzed 909 comments across 20 posts between August 11 and 15, 2024, and found that 55 percent of the comments were repetitive and came from specific accounts—many of which carried “Top Fan” or “Rising Fan” badges. These fake comments often drowned out genuine complaints from real victims. In some cases, when users posted critical remarks, the network retaliated by spreading false information about them. The report also documented the experiences of such targeted victims.
The investigation into this scam network was led by Nigerian journalist Kunle Adebajo for HumAngle. When contacted by Dismislab, Adebajo confirmed that the operation had expanded beyond Nigeria into other countries. “It is the kind of trick that would work anywhere in the world where people are rich enough to pay a few hundred dollars for sporting tickets,” he said in an email, “but also desperate and ignorant enough to fall for money-doubling scams relying on cheap propaganda and fabrication of testimonials.” He added that the network had already reached countries like Tanzania and South Africa, adapting its content to local audiences. “All the scamming network needs to do is add relevant local contexts to their disinformation campaigns or sponsor ads targeting the demographic.”
