As of June 25, all these accounts had been suspended, confirming that this was a botnet, and a clumsily-handled one. Their appearance was not Mexican, but there was insufficient evidence to judge whether they were rented bots, as in the Facebook case, or pseudo-American bots run from Mexico.

A separate post gave a little more evidence. This was posted on November 7, 2016, and reported that Donald Trump had won the US election in Florida.

Retweets of the Victory Lab Florida post, archived on June 25, 2018. note, again, the number of protected users. (Source: Twitter / @Victory_Lab)

Once more, 98.5 percent of the amplifiers had hidden their accounts. However, four remained visible, and these did appear botlike. The first was @mrrmidxasxsegr, screen name Валерия Киселева (Valeriya Kiseleva), an account with a very suspicious behavior pattern.

Profile page of @mrrmidxasxsegr. Archived on June 6, 2018. (Source: Twitter / @mrrmidxasxsegr)

Created in July 2016, this account had posted over 9,000 tweets and 4,000 likes by June 2018, but was not following a single account, and only had twelve followers. It had a Russian bio, but posted retweets in multiple languages, including Arabic, Romanian, French, and English.

Retweets by @Mrrmidxasxsegr in Arabic, Romanian and English. (Source: Twitter / @Mrrmidxasxsegr)

Between the retweets, it posted apparently authored posts in English, colloquial English, Portuguese, Korean and French, among other languages.

All of these posts had been made by other accounts before, suggesting that the account was automated to scrape comments from other users, to make its behavior appear more human, and thus escape Twitter’s anti-bot algorithm.

Left, posts by the talented @Mrrmidxasxsegr in formal English, informal English, Portuguese, and Korean, all archived on June 25, 2018. (Source: Twitter / @mrrmidxasxsegr) Right, the same posts by other users before. (Source: Twitter / @JustineDepomp / @LALA_Bitch21 / @KatysKettle / @wldydrla)

Much the same applied to two of the other visible retweeters, @tamishaandrieu1 and @TameshaKiraly. Both accounts posted retweets in a wide range of languages and alphabets, together with apparently scraped posts from other users.

Multilingual retweets by @tamishaandrieu1 and @TameshaKiraly, archived on June 25, 2018. (Source: Twitter / @tamishaandrieu1 / @TameshaKiraly)

Like the deleted accounts which retweeted the Victory Lab work proposal, these appear to be bots. However, their posting histories reveal more: they appear to be commercial bots, rented out to the highest bidder to promote whatever content the bidder wants.

It is, of course, possible that Victory Lab itself ran the bots, using them to make money on the side. However, it is at least equally possible that these were simply commercial bots which Victory Lab hired from abroad in order to amplify its messaging.

If so, that would suggest that Merlo’s working practice on Twitter is similar to that on Facebook, hiring in external amplification, rather than creating it.

Twitter Followers

Victory Lab’s Twitter following reinforces the impression of “bots for hire,” rather than the network of at least four million accounts which Merlo claimed to command. Many of its 34,000 followers were faceless, and had apparently Asian names, such as Adi, Sunaryanto, and 이원재.

Accounts following @Victory_Lab as of June 25, 2018. Note @Sunarya92398543, top center, @ibm34j, bottom left, and the number of other faceless followers. (Source: Twitter / @Victory_lab)

These accounts appear to have been follower bots. 이원재, for example, was created on December 9, 2017. By June 2018, it had posted just four tweets, but followed over 5,000 other accounts. These covered a wide range of subjects and languages, including Japanese and Korean, and also followed Welsh club rugby.

Accounts followed by @ibm34j, from a screenshot taken on June 6, 2018, and archived the same day. Note the mix of Japanese, Korean, and Welsh rugby, and the disparity between the number of accounts followed (over 5,000) and tweets (4). (Source: Twitter / @ibm34j)

Verified accounts which it followed included a large number of Turkish users, and the Spanish-language account of industry giant Siemens.

More of the accounts followed by @ibm34j, from the archived version, which shows verified accounts first. Note the preponderance of Turkish names. (Source: Twitter / @ibm34j)

Another faceless follower, @Sunarya92398543, was created the following day. By June, it had tweeted just nine times, but followed 363 accounts, most of them salacious, if not pornographic, and many with Indonesian names. For an Indonesian account to follow Indonesian porn is easily explained; the fact that it also follows Victory Lab renders it unusual.

Accounts followed by @Sunarya92398543; note the salacious profiles and the Indonesian names. Archived on June 25, 2018. (Source: Twitter / @Sunarya92398543)

Other followers of Victory Lab on Twitter appeared to have other nationalities, including Russian and Indian.

More of the accounts following @Victory_Lab as of June 25, 2018. Note @vesmasva (bottom left) and @GoldenHiCare (bottom center). (Source: Twitter / @Victory_Lab)

The account @vesmava, with a Russian-language profile, also followed accounts in a range of languages, and followed far more accounts than it had posted tweets. On June 26, it was suspended.

Accounts followed by @vesmasva as of June 25, 2018, archived the same day. Note the variety of languages. (Source: Twitter / @vesmasva)

Yet another follower was Indian pest-control service @GoldenHiCare, which very largely followed Indian accounts, but somehow slipped Victory Lab into the mix.

Accounts followed by @GoldenHiCare as of June 25, 2018, archived the same day. Note the Indian theme. (Source: Twitter / @GoldenHiCare)

Three things are of interest here. First, the focus of these follower accounts lies far away from Mexico; they followed hundreds of Asian accounts, but very few in Latin America. This suggests to us that they are Asian-based accounts for hire, which Victory Lab hired to boost its follower count.

Second, the appearance of Indian and Indonesian accounts — the same geographies which amplified Victory Lab on Facebook — suggests that the Twitter and Facebook boosts may have been acquired from the same organizations, as well as the same countries.

Third, this pattern again suggests that Victory Lab’s practice is to buy in amplification from abroad for its own posts. While this may be a way of hiding Victory Lab’s own purported army of bots, it is an unusual feature, and a highly distinctive one — sufficiently distinctive to merit a search for similar foreign amplification of Mexican election-related traffic.

Same Pattern, Different Pages

An initial search for election-related Facebook content turned up a number of pages, including one called “Contra AMLO,” or “against AMLO” (the usual abbreviation for Lopez Obrador).

On April 23, this page posted a comment on the presidential debate happening at that time. Most of the page’s previous posts only had a handful of likes, but this one garnered 734 likes, no other reactions, and a number of Spanish-language comments from users registered in Brazil.

Note the number of likes, the Brazilian location, and the hashtag #AMLOcuras. Archived on June 25, 2018. (Source: Facebook / NOalPeje1)

This resembled the amplification of Victory Lab; so did the amplifiers. They were dominated by non-Mexican names, such as Nilesh Bhardwaj, Muhamad Syawal Rudin, and ﺷﻴﺮ ﺑﭽﻪ ﻫﺎﻱ ﻣﺰاﺭ (an account which gave its location as Mazar-e-Sharif, Afghanistan).