STORY UPDATED: check for updates below.

Clickbait

Does the headline on this post correctly summarize the contents? No, that's not true: This video is another example of a clickbait tactic of a spam network that deceptively captures the attention of an American audience with hot-topic headlines that bear little relation to the content of the underlying video. The video is typically a well-produced package lifted from mainstream conservative or even fringe sources. It is posted under a misleading headline to entice viewers to stay tuned in. Animated avatars and other overlays alter it enough to circumvent social media platform rules against copying others' work. The page that posts the clickbait concoction gets a share of the revenue from ads Facebook shows to the audience watching the video, waiting for the content falsely promised in the headline.

In one example, the misleading headline appears on a video published on Facebook by a page called "Flaherty's Honeoye Falls" on September 22, 2021, with this headline:

HANK KUNNEMAN SHOCKING PROPHECY ✅ REVEALED - AZ AUDIT, FRAUDULENT VOTES! ✅ PROPHECY SEP 22, 2021

This is how the post appeared at the time of writing:

(Image source: Facebook screenshot taken on Fri Sep 24 19:09:41 2021 UTC)

It's not clear exactly how many people are involved in this spam network, but the tactics are repeated by many pages and also seen in posts in groups run by the same network. Many of the pages show connections to Vietnam, Indonesia and the Philippines. Many of the pages and profiles used in the network show signs that they were hacked or hijacked. Stealing an active account of a person or a business can be used to lend credibility to the foreign network's activity or to hide the network's origin.

The example video shows a sermon by Pastor Hank Kunneman of Lord of Hosts Church in Omaha, Nebraska, but nowhere in this sermon does Kunneman mention anything about the presidential ballot audit in Maricopa County, Arizona.

The Facebook account that posted the doctored video appears to have been highjacked, too

Flaherty's Honeoye Falls is a restaurant in western New York state. The restaurant launched its Facebook page on August 12, 2011. Shortly after they posted about Labor Day catering on September 3, 2021, the page was somehow taken over. On September 17, 2021, the page profile image was changed to a picture of Pastor Kent Christmas of Regeneration Nashville and the content of the page posts shifted from lunch specials to inspirational Christian memes.

Below are two screenshots to show how the theme of the content posted to the hijacked Facebook account changed over two weeks in September of 2021, with the more recent posts above. On the left are the page photos, and on the right are the videos. At the bottom are some original videos from years ago showing a "Breakfast with Santa" event at the restaurant. Now the page is posting videos with flashy tabloid thumbnails and political clickbait headlines which, like the Arizona audit teaser, misrepresent the video content.

(Image source: Lead Stories composite of Facebook screenshots taken on Fri Sep 24 20:34:34 2021 UTC)

Most of the content found in these spam networks hits political and QAnon conspiracy theory themes. This portion of the spam network is using freebooted videos of sermons. These have been reworked with avatars in the corners, possibly to defeat AI recognition tools. Freebooting is a type of content piracy, taking someone else's content to use to make money without investing the time and production effort. This cuts out the original content creator from potential profits and growth of their audience. Some of the pastors whose content has appeared recycled on these network pages are Kat Kerr, Hank Kunneman, Kent Christmas, Robin D. Bullock, Timothy Dixon, Deborah Williams and Amanda Grace.

Some of the foreign imposters are soliciting funds through the pages. Below is an example asking for page supporters from a page called Kat Kerr Urgent and asking for donations from a page named Robin D. Bullock to a PayPal account with the Vietnamese name phamdung1102.

(Image source: Lead Stories composite of Facebook screenshots taken on Fri Sep 24 22:40:34 2021 UTC)

How to recognize foreign spam pages

The videos

• The video thumbnails have bold tabloid-style graphics
• When playing, animated avatar characters, narrators, animals or flags appear in the corners of the screen
• The title text may include unusual type characters (homoglyphs)
• The titles may include emojis or be completely in capitals
• The videos may have been livestreamed even if they are old
• Some videos are scheduled to stream as "events"
• Poor production quality
• Some videos are just podcast audio with animated human and animal avatars in the corners
• A short video may repeat on a loop several times

(Image source: Lead Stories composite of Facebook screenshots taken on Fri Sep 24 22:49:52 2021 UTC)

Network activity

• Video content is often used to promote a "join group" invitation
• Group content is mostly posted by the same accounts
• Group administration may have foreign profiles and use hacked accounts
• Group content comes from the same handful of pages
• Pages frequently are listed as "Gaming Video Creator"

The page transparency report on the account's home page

• Page managers may be out of the U.S. but reaping ad revenue by attracting an American audience
• Name of the page may have recently changed
• Name of the page may not match the current content
• Page may have been created very recently

(Image source: Lead Stories composite of Facebook screenshots taken on Fri Sep 24 22:57:45 2021 UTC)

Traces of former activity

• Current photos and videos are often inconsistent with the earliest days of the page history
• Not all the older content has been deleted
• "Related Pages" sometimes give away clues that this page is one of several working the same vein

Lead Stories has written about these clickbait video spammers in the past: One page, DannLu, was taken from a Colombian pageant queen; another video claimed that it showed President Joe Biden crying at a press briefing.

(Editors' Note: Facebook is a client of Lead Stories, which is a third-party fact checker for the social media platform. On our About page, you will find the following information:

Since February 2019 we are actively part of Facebook's partnership with third party fact checkers. Under the terms of this partnership we get access to listings of content that has been flagged as potentially false by Facebook's systems or its users and we can decide independently if we want to fact check it or not. In addition to this we can enter our fact checks into a tool provided by Facebook and Facebook then uses our data to help slow down the spread of false information on its platform. Facebook pays us to perform this service for them but they have no say or influence over what we fact check or what our conclusions are, nor do they want to.)

Updates:

• 2021-09-28T16:19:33Z 2021-09-28T16:19:33Z
  Updated to re-organize descriptions of the foreign spam network's activities.