Connect with us


Man behind South African xenophobic tweets identified



lerato pillay exposed



Sifiso Jeffrey Gwala, a former lance corporal with the 121st SA Infantry Battalion in Mtubatuba in coastal KwaZulu-Natal, has been identified as the person behind the “anonymous” Twitter account previously known as @uLerato_pillay, which has been accused of inciting xenophobic tensions in South Africa. In recent weeks, these narratives have bubbled to the surface of mainstream media outlets as public officials from fringe political parties echoed these nationalist sentiments in what appears to be reckless political opportunism.

South Africa has a fatal history of violence against foreign nationals, particularly other Africans. In May 2008, 62 people died as a result of nationwide xenophobic riots that started near Johannesburg, and in April 2015, seven people were killed in similar protests in Durban. South Africa’s high unemployment rate and lackluster service delivery is often blamed on the nearly 4 million foreign nationals staying in South Africa, and unfounded claims that foreign nationals are disproportionally responsible for crime are frequently used to justify these attacks.

As recently as July 30, 2020, communities in Thokoza, south of Johannesburg, forcefully evicted foreign nationals from their homes and burned their possessions in the street. A march to “cleanse” Johannesburg of foreign nationals on September 23 has been orchestrated and amplified by #PutSouthAfricansFirst, a movement that coalesced around Gwala’s online persona.

In this setting, Gwala used the @uLerato_pillay account to sic his more than 60,000 followers against foreign nationals and refugees living in South Africa, usually under the guise of one of several nationalist pro-South African hashtags.


The @uLerato_pillay account was the focus of a DFRLab investigation published on July 3, 2020. Although that investigation correctly identified the name of the person behind the account as “Sfiso J Gwala,” it fell short of identifying a specific individual. In the time since that story was first published, @uLerato_pillay changed its account handle to @PutSAnsFirst_, and has apparently changed hands to a member of the South Africa First political party. Meanwhile, an entirely new account has laid claim to the @uaLerato_Pillay handle.

In the earlier investigation, the DFRLab found that after it was created on November 1, 2019 the @uLerato_pillay account was initially known as @sfiso82648954. The account only adopted the @uLerato_pillay persona — that of an Indian woman from Gwala’s home province of KwaZulu-Natal — sometime around November 6, 2019.

Cached and archived versions of the account as it appeared back then were used to confirm that both of these user handles belonged to the same Twitter user ID. Although a user can change its display name, user handle and profile images, the user ID cannot be changed.

This association was corroborated during the investigation with several interactions between @uLerato_pillay and another Twitter account called @sfisogwala_sa. The latter account claimed to be part of the South Africa First party, a fringe political movement with strong nationalist tendencies that features frequently on @uLerato_pillay’s timeline.
The investigation also linked Gwala to @uLerato_pillay through a petition created in late April 2020. The petition called on DStv, a South African satellite television provider, to drop their subscription prices in response to the COVID-19 pandemic. The petition was created by a user called Sfiso J Gwala.

By comparing the source code of the website with the timestamps of the tweets from @uLerato_pillay and @sfisogwala_sa sharing a link to it, the DFRLab found that @uLerato_pillay shared a link to the petition 93 seconds after it was published by its creator at 11:44:23 A.M. local time. The @sfisogwala_sa account only shared a link to his “own” petition several minutes later.

Own goals

A week after this initial investigation, the DFRLab published an unrelated investigation into a different race-baiting Twitter account which drew significant traction in South Africa mainly due to the involvement of a member of South Africa’s third largest political party, the Economic Freedom Fighters (EFF) in monetizing the racist rhetoric churned out by the account.

The @uLerato_pillay account, seemingly unaware of the DFRLab’s investigation into its own identity, claimed credit for the investigation, and used the opportunity to label the EFF member at the center of the piece a foreign national.

Gwala’s lie was called out using his real name, and within seconds of being named “Sfiso” @uLerato_pillay deleted the tweet and blocked the DFRLab researcher that named him. Later that evening, @uLerato_pillay brigaded its followers to use the hashtag #HandsOffLeratoPillay in support of the “attack” against him.

This reaction stands in contrast to previous attempts to identify the owner of the account, which were met with disdain and ridicule from Gwala.

Further corroboration was soon found when a Facebook profile identified during the earlier investigation, called Sfiso J Gwala, was taken offline. While this Facebook account was identified during the previous investigation and was suspected of being the creator of the petition, it was not included in publications as it could not be conclusively linked to either the @uLerato_pillay or the @sfisogwala_sa accounts, until now.

Running interference

Within hours after the earlier DFRLab investigation was syndicated by local news publication Daily Maverick, attempts were made to destroy key evidence linking Gwala and the @uLerato_pillay account.

First, the Sfiso J Gwala Facebook account identified earlier was either deactivated or made private and could no longer be found when searching for either the username or the Facebook user ID of the account. The date of this is undetermined, but it was first noticed on July 11.

Second, the author of the DSTV petition attempted to close and delete the petition later on the same evening — peculiar timing considering that months had passed with no new updates. The page source code shows that changes were made at 10:08 P.M. local time on July 13, 2020.

Lastly, the @uLerato_pillay account tweeted at 6:47 P.M. local time on July 13, 2020, in an attempt to distance itself from Sfiso Gwala. This tweet not only displayed intimate knowledge of Gwala’s suspended accounts (who’s only known personal account was suspended months earlier) and political affiliations, but also claimed that Gwala had never hidden his identity. The tweet was later deleted, although archived copies are still available.

Around the same time, the name of the creator of the DStv petition changed. Archived versions of the original petition show that Sfiso J Gwala created the petition, whereas a more recent visit to the petition now shows that “Themba Mthiya” is the creator.

But a review of the webpage source code shows that this was still the same user account. Both Themba Mthiya and Sfiso J Gwala share the same user ID, as evidenced when comparing the archived version of the page with the current version of the page.

This also means that the Sfiso J Gwala Facebook account had been renamed to Themba Mthiya. uses a person’s Facebook credentials to authenticate its users: when creating or signing a petition, each user is required to link their Facebook account with This means that when Sfiso J Gwala changed their name to Themba Mthiya, this change was reflected on the DStv petition and resulted in the name change.

The same “Themba Mthiya” also posted updates on the status of the petition on July 13, and was also only the second person to sign a different petition shared by the @uLerato_pillay account on May 1, 2020, which called for the mass deportation of foreign nationals from South Africa.

These attempts to hide or destroy evidence linking Gwala, the DStv petition and @uLerato_pillay stand in contrast to the claims the Gwala has never hidden his identity. The timing of these attempts shortly after the investigation, coupled with the earlier links between Gwala and @uLerato_pillay, suggested that the name of this individual was right on the mark.

Mayday Radio

The DFRLab tracked down the radio interview mentioned by @uLerato_pillay in his tweet of July 13. Gwala was interviewed about his DStv petition on Saturday, May 2, 2020, on the PowerFM breakfast show. The @uLerato_pillay account promoted the interview early on the morning of the broadcast.

Gwala ended the interview by directing listeners to his @SfisoGwala_SA Twitter account, but before that, he also made several statements that could be traced back to @uLerato_pillay.

First, Gwala stated that he was asked by a Twitter user called “Malambane” to create the petition. On April 22, 2020, the day before the petition was created, the @uLerato_pillay account raised the issue of DStv’s high prices during the COVID-19 outbreak with a Twitter user called @uMalumbaneZN. Second, Gwala stated at 03m40s that “the day before yesterday [April 30, 2020] we initiated another tag #DSTVMustFall.” According to an analysis using social media monitoring tool Brandwatch, the #DSTVMustFall hashtag during this time was most aggressively promoted by @uMalambaneZN and @uLerato_pillay. @SfisoGwala_SA was not among those that started or amplified this hashtag. Lastly, Gwala told the hosts that DStv, as a South African company, needed to prioritize South Africa for payment holidays. At 04:10, Gwala capped this off with “As they say, charity begins at home,” a phrase used verbatim by @uLerato_Pillay two days before the interview.

Individually, any of these statements could be dismissed. But taken into consideration with the rest of the evidence linking Gwala to @uLerato_pillay, this ever-expanding series of coincidences become ever more unlikely.

General indication

It was Gwala’s early tweets as @uLerato_pillay that identified his links to the South African military and eventually led to confirmation of his identity. Examples of this could be found in tweets as far back as December 2019, which showed that the person behind the account had an excellent grasp of South African military culture, insignia, and deployments.

During March 2020, the SANDF was deployed to assist the South African government during the implementation of a nationwide lockdown in response to COVID-19. Several SANDF soldiers tweeted selfies of themselves during the deployment, to which @uLerato_pillay responded by correctly identifying their ranks and deployments based on their insignia and beret colours.

Other tweets praised the SANDF, particularly infantry and paratroopers, discussed their deployments and notable victories during peacekeeping missions, or displayed knowledge of their training regimens. The account also attempted to solicit a job for a “32-year-old former SANDF driver” in one of its earliest tweets.

Corporal punishment

The earliest mention of the SANDF by @uLerato_pillay was in December 2019, when Gwala quoted a tweet from another anonymous influencer in reference to the SANDF.

Both tweets share a background. In 2015, the SANDF was deployment to the Democratic Republic of the Congo as part of a joint United Nations peacekeeping force. Several SANDF soldiers part of this deployment were repatriated and eventually dismissed after they broke curfew and could not account for their whereabouts.

After this initial tweet, @uLeratoy_pillay tweeted about these soldiers and the state’s appeal proceedings on March 6, 2020. When Naledi Chirwa, an MP for the Economic Freedom Fighters, accused some SANDF members on March 30 of perpetrating rape and sexual abuse during the same deployment, @uLerato_pillay attacked her in a series of tweets leveraging her status as a foreign national. Similar tweets about these soldiers were made on May 6 and again on June 16, calling on the Minister of Defense to drop the legal defense. An emphatic plea on June 15 sought help for “Xola,” one of the soldiers that had apparently reached out to @uLerato_pillay.

This legal challenge, lodged in the Gauteng division of the High Court, sits at the center of these 34 soldiers’ status as paid SANDF members. It is also within these court documents that the reason behind @uLerato_pillay’s advocacy becomes clear.

Listed among the names of these 34 soldiers is a familiar name: Sifiso Jeffrey Gwala. Xola, on the other, hand, does not appear among these 34 names.

These documents provided Gwala’s address, telephone number and base of operations, which was 121 SA Infantry Battalion at Matubatuba near Richardsbay in KwaZulu-Natal. @uLerato_pillay has mentioned this specific infantry base twice before.

Gwala’s phone number has been used to create multiple Twitter accounts and matches the phone number linked to @uLerato_pillay’s Twitter account around early June 2020. The same phone number matched the recovery number for both email addresses that could be linked to @uLerato_pillay as well.

Both email addresses — one hosted at and another at — could be matched to the name Sfiso Gwala. The Gmail address in question ends with *88, which is also Gwala’s year of birth.

Although the Sfiso J Gwala Facebook profile identified earlier is no longer accessible, a woman that appears to be Gwala’s partner did not immediately do the same. Her profile still contained several photos of both herself and Gwala. Although she is not affiliated with the SANDF herself, her profile indicated she liked the Facebook page of SANDU, the union taking up the legal challenge of the 34 soldiers.
This provided three photographs identifying Gwala clearly.

The DFRLab reached out to Gwala for comment using his phone number and both his email addresses but has received no response.


In a country with a history of fatal violence directed at foreign nationals, incitement along xenophobic lines carries a very real risk. Besides the blatant disregard this has for human rights and the South African constitution, these protests quickly shift away citizenship to xenophobia and tribalism once it hits the ground.

Amid this, an influential yet anonymous account has the ear of opportunistic politicians that, while allegedly unaware of its identity, are keen to tap into the popular support its xenophobia generates.

In identifying the individual behind the account, there is a possibility that, when the powder keg next ignites, institutions such as the Human Rights Commission and law enforcement will know where to start looking for the one holding the match.

Jean Le Roux is a Research Associate, Southern Africa, with the Digital Forensic Research Lab and is based in Cape Town.

The article was published by DFRlab on Medium

Continue Reading
Click to comment

You must be logged in to post a comment Login

Leave a Reply


Watch: South Africans give notice to foreigners to leave SA before June 16



With no sign of economic hardships disappearing in Zimbabwe, those who have escaped to South Africa are living in fear as locals have threatened to chase them if they don’t leave on their own accord.

Warnings of an operation to get South Africa rid of foreign nationals on the 16th of June continue to circulate.

Recently, a video surfaced on social media showing the ogarnisers of the operation dubbed, OPERATION DUDULA serving seven day notices to some foreign nationals to vacate the country.


– reads the notice.

While the poster specifies that illegal foreigners will be targeted it however does not state that documented ones will be spared.

Such attacks, as occurred before, ended up targeting all immigrants regardless of their status.

Dudula which means “push” brings horrific and sad memories of xenophobic attacks that happened in the country in 2015. Many people were killed, some burnt alive, while some were left homeless as their homes were destroyed.

Just like it happened before, the South African Police Services (SAPS) ignored warnings of imminent attacks on immigrants which then led to the bloodshed.

Similarly, at this point, the SAPS or any government have not said anything about the threats on foreign citizens in their country.

In one of the videos circulating online, the pro Dudula Operation people can be heard blaming the loadshedding on illegal connections supposedly done by foreign nationals.

Local truck drivers have been at loggerheads with their foreign counterparts accusing them of stealing their jobs and accepting low wages and inhuman working conditions.

The situation has left the Zimbabwean and other foreign drivers prone to abuse even when they are legally in the country.

Members of a local drivers organisation, well known for violent attacks on drivers and trucks, have been targeting foreign drivers sjamboking them while recording videos which are then spread online.

They do this to humiliate their victims and instill fear on their colleagues.

No reports of arrest of the perpetrators have been made yet.

For the Zimbabweans and other foreigners in the country, it remains to be seen if they will still call South Africa home after the June 16 2021.

The date concides with South Africa’s youth day when they commemorate the heroics of the youths of 1976 who were massacred by the army after revolting against apartheid.

Continue Reading


Fraudster arrested after swipping for $390 000 groceries



A fraudster has been arrested after he swiped for groceries worth more than $398 000 at OK Supermarket in Hwange using a bank card that had been tampered with.

The man, Brian Pedzisa of Chitungwiza, was arrested on Thursday and is suspected to be among a gang of people who have been using cloned cards and other bank card related tactics to con various retail shops across the country.

Detectives on Thursday pounced on Pedzisa at the supermarket, moments after he was about to get out after swiping for groceries worth $396 384.

Matabeleland North provincial police spokesperson Inspector Glory Banda confirmed the incident and said police were now looking for two other people linked to the sca

“On 10 June 2021 a gang of three fraudsters tried to defraud OK Hwange Supermarket of groceries worth $396 384.

One of the fraudsters successfully used an electronic Visa card to make purchases but before he could make off he was arrested by a team of watchful detectives who were working on a tip-off. Upon being interviewed the suspect revealed that he was working with two other accomplices who are still at large,” said Insp Banda.

He said the gang had used the same strategy to defraud OK Mart Victoria Falls of an undisclosed amount in groceries. He appealed to members of the public to assist with information leading to their arrest.

“The two accomplices are on the run anyone with information that could lead to the arrest of these two criminals can report at the nearest police station,” said Insp Banda.

He called on shop owners to enhance security to avoid such incidents which were on the rise in the country.

“As police we would like to implore shop owners to enhance security at their premises through use of alarm systems and Closed Circuit Television. Retailers should examine electronic cards and do necessary verifications before processing of electronic transactions. For the record some fraudsters misrepresent themselves as humanitarian workers.”

According to sources privy to the incident, the gang would approach the supermarkets seeking a quotation for groceries pretending that the transaction wanted would be effected from a nostro account. Later one of the gang members would return to make purchases using a Visa card whose microchip would have been tampered with. Sunday News

Continue Reading


Gutu Inter-Africa bus and Honda Fit accident victims all from same family



GUTU- Police has announced names of the Gutu accident victims who were involved in a Honda Fit – Bus collision along the Gutu- Chivhu Highway yesterday.

The five were killed when their vehicle collided head-on with an Inter-Africa Bus near Matizha Business Centre in Gutu.

National Police Spokesperson Insp Paul Nyathi announced the names of the deceased family members who were travelling from Harare as Francis Chagweda (33)the driver, Mavis Chagweda (61), Lloyd Chagweda (31), Viola Chagweda (35) and Keresensia Mapaaona (28).

According to a family member, Oscar Chagweda the now deceased were travelling to Chiwara in Gutu for a family function when the tragedy happened.

An eyewitness told I ZIM that the accident occured after the Inter-Africa bus tried to overtake another bus. “It then encroached onto the lane of the oncoming Honda fit which swerved to avoid collision,” said the witness.

The Honda fit reportedly swerved off the road but the bus did the same resulting in the head on collision.

Only one person from the car survived the horific accident and was taken to Matizha clinic before she was transferred to Gutu Rural Hospital for treatment.

During the covid-19 induced Lockdown, government banned private kombis allowing only those registered under ZUPCO to operate resulting in little non-commercial vehicles overloading passengers.

Yesterday, Vice President Constantino Chiwenga who doubles as the Health and Child Care Minister announced another Covid -19 regulations which gave a waiver to public transport operators.

However, the transport sector is also now dominated by “mushikashika” vehicles some of which include Toyota Wish and Honda fit vehicles who have the capacity to carry 4 or 5 passengers , however some of these vehicles end up carrying as many as nine passengers.

Continue Reading


Copyright © 2021 I ZIM. For Zimbabweans By Zimbabweans