Connect with us


Man behind South African xenophobic tweets identified



lerato pillay exposed



Sifiso Jeffrey Gwala, a former lance corporal with the 121st SA Infantry Battalion in Mtubatuba in coastal KwaZulu-Natal, has been identified as the person behind the “anonymous” Twitter account previously known as @uLerato_pillay, which has been accused of inciting xenophobic tensions in South Africa. In recent weeks, these narratives have bubbled to the surface of mainstream media outlets as public officials from fringe political parties echoed these nationalist sentiments in what appears to be reckless political opportunism.

South Africa has a fatal history of violence against foreign nationals, particularly other Africans. In May 2008, 62 people died as a result of nationwide xenophobic riots that started near Johannesburg, and in April 2015, seven people were killed in similar protests in Durban. South Africa’s high unemployment rate and lackluster service delivery is often blamed on the nearly 4 million foreign nationals staying in South Africa, and unfounded claims that foreign nationals are disproportionally responsible for crime are frequently used to justify these attacks.

As recently as July 30, 2020, communities in Thokoza, south of Johannesburg, forcefully evicted foreign nationals from their homes and burned their possessions in the street. A march to “cleanse” Johannesburg of foreign nationals on September 23 has been orchestrated and amplified by #PutSouthAfricansFirst, a movement that coalesced around Gwala’s online persona.

In this setting, Gwala used the @uLerato_pillay account to sic his more than 60,000 followers against foreign nationals and refugees living in South Africa, usually under the guise of one of several nationalist pro-South African hashtags.


The @uLerato_pillay account was the focus of a DFRLab investigation published on July 3, 2020. Although that investigation correctly identified the name of the person behind the account as “Sfiso J Gwala,” it fell short of identifying a specific individual. In the time since that story was first published, @uLerato_pillay changed its account handle to @PutSAnsFirst_, and has apparently changed hands to a member of the South Africa First political party. Meanwhile, an entirely new account has laid claim to the @uaLerato_Pillay handle.

In the earlier investigation, the DFRLab found that after it was created on November 1, 2019 the @uLerato_pillay account was initially known as @sfiso82648954. The account only adopted the @uLerato_pillay persona — that of an Indian woman from Gwala’s home province of KwaZulu-Natal — sometime around November 6, 2019.

Cached and archived versions of the account as it appeared back then were used to confirm that both of these user handles belonged to the same Twitter user ID. Although a user can change its display name, user handle and profile images, the user ID cannot be changed.

This association was corroborated during the investigation with several interactions between @uLerato_pillay and another Twitter account called @sfisogwala_sa. The latter account claimed to be part of the South Africa First party, a fringe political movement with strong nationalist tendencies that features frequently on @uLerato_pillay’s timeline.
The investigation also linked Gwala to @uLerato_pillay through a petition created in late April 2020. The petition called on DStv, a South African satellite television provider, to drop their subscription prices in response to the COVID-19 pandemic. The petition was created by a user called Sfiso J Gwala.

By comparing the source code of the website with the timestamps of the tweets from @uLerato_pillay and @sfisogwala_sa sharing a link to it, the DFRLab found that @uLerato_pillay shared a link to the petition 93 seconds after it was published by its creator at 11:44:23 A.M. local time. The @sfisogwala_sa account only shared a link to his “own” petition several minutes later.

Own goals

A week after this initial investigation, the DFRLab published an unrelated investigation into a different race-baiting Twitter account which drew significant traction in South Africa mainly due to the involvement of a member of South Africa’s third largest political party, the Economic Freedom Fighters (EFF) in monetizing the racist rhetoric churned out by the account.

The @uLerato_pillay account, seemingly unaware of the DFRLab’s investigation into its own identity, claimed credit for the investigation, and used the opportunity to label the EFF member at the center of the piece a foreign national.

Gwala’s lie was called out using his real name, and within seconds of being named “Sfiso” @uLerato_pillay deleted the tweet and blocked the DFRLab researcher that named him. Later that evening, @uLerato_pillay brigaded its followers to use the hashtag #HandsOffLeratoPillay in support of the “attack” against him.

This reaction stands in contrast to previous attempts to identify the owner of the account, which were met with disdain and ridicule from Gwala.

Further corroboration was soon found when a Facebook profile identified during the earlier investigation, called Sfiso J Gwala, was taken offline. While this Facebook account was identified during the previous investigation and was suspected of being the creator of the petition, it was not included in publications as it could not be conclusively linked to either the @uLerato_pillay or the @sfisogwala_sa accounts, until now.

Running interference

Within hours after the earlier DFRLab investigation was syndicated by local news publication Daily Maverick, attempts were made to destroy key evidence linking Gwala and the @uLerato_pillay account.

First, the Sfiso J Gwala Facebook account identified earlier was either deactivated or made private and could no longer be found when searching for either the username or the Facebook user ID of the account. The date of this is undetermined, but it was first noticed on July 11.

Second, the author of the DSTV petition attempted to close and delete the petition later on the same evening — peculiar timing considering that months had passed with no new updates. The page source code shows that changes were made at 10:08 P.M. local time on July 13, 2020.

Lastly, the @uLerato_pillay account tweeted at 6:47 P.M. local time on July 13, 2020, in an attempt to distance itself from Sfiso Gwala. This tweet not only displayed intimate knowledge of Gwala’s suspended accounts (who’s only known personal account was suspended months earlier) and political affiliations, but also claimed that Gwala had never hidden his identity. The tweet was later deleted, although archived copies are still available.

Around the same time, the name of the creator of the DStv petition changed. Archived versions of the original petition show that Sfiso J Gwala created the petition, whereas a more recent visit to the petition now shows that “Themba Mthiya” is the creator.

But a review of the webpage source code shows that this was still the same user account. Both Themba Mthiya and Sfiso J Gwala share the same user ID, as evidenced when comparing the archived version of the page with the current version of the page.

This also means that the Sfiso J Gwala Facebook account had been renamed to Themba Mthiya. uses a person’s Facebook credentials to authenticate its users: when creating or signing a petition, each user is required to link their Facebook account with This means that when Sfiso J Gwala changed their name to Themba Mthiya, this change was reflected on the DStv petition and resulted in the name change.

The same “Themba Mthiya” also posted updates on the status of the petition on July 13, and was also only the second person to sign a different petition shared by the @uLerato_pillay account on May 1, 2020, which called for the mass deportation of foreign nationals from South Africa.

These attempts to hide or destroy evidence linking Gwala, the DStv petition and @uLerato_pillay stand in contrast to the claims the Gwala has never hidden his identity. The timing of these attempts shortly after the investigation, coupled with the earlier links between Gwala and @uLerato_pillay, suggested that the name of this individual was right on the mark.

Mayday Radio

The DFRLab tracked down the radio interview mentioned by @uLerato_pillay in his tweet of July 13. Gwala was interviewed about his DStv petition on Saturday, May 2, 2020, on the PowerFM breakfast show. The @uLerato_pillay account promoted the interview early on the morning of the broadcast.

Gwala ended the interview by directing listeners to his @SfisoGwala_SA Twitter account, but before that, he also made several statements that could be traced back to @uLerato_pillay.

First, Gwala stated that he was asked by a Twitter user called “Malambane” to create the petition. On April 22, 2020, the day before the petition was created, the @uLerato_pillay account raised the issue of DStv’s high prices during the COVID-19 outbreak with a Twitter user called @uMalumbaneZN. Second, Gwala stated at 03m40s that “the day before yesterday [April 30, 2020] we initiated another tag #DSTVMustFall.” According to an analysis using social media monitoring tool Brandwatch, the #DSTVMustFall hashtag during this time was most aggressively promoted by @uMalambaneZN and @uLerato_pillay. @SfisoGwala_SA was not among those that started or amplified this hashtag. Lastly, Gwala told the hosts that DStv, as a South African company, needed to prioritize South Africa for payment holidays. At 04:10, Gwala capped this off with “As they say, charity begins at home,” a phrase used verbatim by @uLerato_Pillay two days before the interview.

Individually, any of these statements could be dismissed. But taken into consideration with the rest of the evidence linking Gwala to @uLerato_pillay, this ever-expanding series of coincidences become ever more unlikely.

General indication

It was Gwala’s early tweets as @uLerato_pillay that identified his links to the South African military and eventually led to confirmation of his identity. Examples of this could be found in tweets as far back as December 2019, which showed that the person behind the account had an excellent grasp of South African military culture, insignia, and deployments.

During March 2020, the SANDF was deployed to assist the South African government during the implementation of a nationwide lockdown in response to COVID-19. Several SANDF soldiers tweeted selfies of themselves during the deployment, to which @uLerato_pillay responded by correctly identifying their ranks and deployments based on their insignia and beret colours.

Other tweets praised the SANDF, particularly infantry and paratroopers, discussed their deployments and notable victories during peacekeeping missions, or displayed knowledge of their training regimens. The account also attempted to solicit a job for a “32-year-old former SANDF driver” in one of its earliest tweets.

Corporal punishment

The earliest mention of the SANDF by @uLerato_pillay was in December 2019, when Gwala quoted a tweet from another anonymous influencer in reference to the SANDF.

Both tweets share a background. In 2015, the SANDF was deployment to the Democratic Republic of the Congo as part of a joint United Nations peacekeeping force. Several SANDF soldiers part of this deployment were repatriated and eventually dismissed after they broke curfew and could not account for their whereabouts.

After this initial tweet, @uLeratoy_pillay tweeted about these soldiers and the state’s appeal proceedings on March 6, 2020. When Naledi Chirwa, an MP for the Economic Freedom Fighters, accused some SANDF members on March 30 of perpetrating rape and sexual abuse during the same deployment, @uLerato_pillay attacked her in a series of tweets leveraging her status as a foreign national. Similar tweets about these soldiers were made on May 6 and again on June 16, calling on the Minister of Defense to drop the legal defense. An emphatic plea on June 15 sought help for “Xola,” one of the soldiers that had apparently reached out to @uLerato_pillay.

This legal challenge, lodged in the Gauteng division of the High Court, sits at the center of these 34 soldiers’ status as paid SANDF members. It is also within these court documents that the reason behind @uLerato_pillay’s advocacy becomes clear.

Listed among the names of these 34 soldiers is a familiar name: Sifiso Jeffrey Gwala. Xola, on the other, hand, does not appear among these 34 names.

These documents provided Gwala’s address, telephone number and base of operations, which was 121 SA Infantry Battalion at Matubatuba near Richardsbay in KwaZulu-Natal. @uLerato_pillay has mentioned this specific infantry base twice before.

Gwala’s phone number has been used to create multiple Twitter accounts and matches the phone number linked to @uLerato_pillay’s Twitter account around early June 2020. The same phone number matched the recovery number for both email addresses that could be linked to @uLerato_pillay as well.

Both email addresses — one hosted at and another at — could be matched to the name Sfiso Gwala. The Gmail address in question ends with *88, which is also Gwala’s year of birth.

Although the Sfiso J Gwala Facebook profile identified earlier is no longer accessible, a woman that appears to be Gwala’s partner did not immediately do the same. Her profile still contained several photos of both herself and Gwala. Although she is not affiliated with the SANDF herself, her profile indicated she liked the Facebook page of SANDU, the union taking up the legal challenge of the 34 soldiers.
This provided three photographs identifying Gwala clearly.

The DFRLab reached out to Gwala for comment using his phone number and both his email addresses but has received no response.


In a country with a history of fatal violence directed at foreign nationals, incitement along xenophobic lines carries a very real risk. Besides the blatant disregard this has for human rights and the South African constitution, these protests quickly shift away citizenship to xenophobia and tribalism once it hits the ground.

Amid this, an influential yet anonymous account has the ear of opportunistic politicians that, while allegedly unaware of its identity, are keen to tap into the popular support its xenophobia generates.

In identifying the individual behind the account, there is a possibility that, when the powder keg next ignites, institutions such as the Human Rights Commission and law enforcement will know where to start looking for the one holding the match.

Jean Le Roux is a Research Associate, Southern Africa, with the Digital Forensic Research Lab and is based in Cape Town.

The article was published by DFRlab on Medium

Continue Reading
Click to comment

You must be logged in to post a comment Login

Leave a Reply


Legendary Footballer George Shaya Dies At Age 77



Legendary Footballer George Shaya Dies At Age 77

George ‘Mastermind’ Shaya, a five time Soccer Star of the Year and one of the most celebrated soccer legends has died.

He was 77.

Shaya died early on Tuesday morning at his home in Glen Norah A, Harare.

Shaya is among some of the most celebrated yesteryear footballers to have played for Dynamos FC and the Zimbabwe national team.

Popularly known as Mastermind, Shaya turned out for Dynamos during his playing days.

In his illustrious career, Shaya won the Soccer Star of the Year five times; 1969, 1972, 1975, 1976, and 1977, a record which is still to be replicated by any player in history.

The Mastermind passed on barely two weeks after it was announced that a documentary of his legendary career, as one of the most celebrated yesteryear footballers, would be premiered.

At the time of his death, Shaya was walking with the aid of crutches after his left leg was amputated last year.

Continue Reading


Chinese firm unveils US$20m Mining, Agric Loan Facility in Zimbabwe



Chinese firm unveils Us$2om Mining, Agric Loan Facility in Zimbabwe

Chinese firm, Lovol International Construction Machinery Group, has unveiled a US$20 million equipment loan facility to benefit youths and women in the mining and agricultural sectors.

Lovol, represented by its regional director for East and Southern Africa Mr Terry Song, signed a memorandum of Understanding with the Affirmative Action Group (AAG) represented by its president Mr Mike Chimombe to provide mining and farming equipment, including tractors, electric tricycles, combine harvesters, planters, irrigation equipment, solar systems and electric cars.

The company showcased some of the machinery during the signing ceremony in Harare yesterday.

Mr Song said the company will be supporting the Government of Zimbabwe in growing the country’s economy in line with Vision 2030.

“We have the appetite to change the complexion of the economy and we realise that Zimbabweans have got a lot of potential and a missing link was the equipment. Hence we brought in the solution in terms of the equipment. The equipment that we have will certainly be able to give the solution. We have brought equipment that works for agriculture, mining and even road construction. These MoUs we have signed will go a long way in achieving vision 2030.

“Lovol is one of the biggest group in China. We have all kinds of equipment be it mining, agriculture, energy and green power as well. We intend to invest in Zimbabwe to complement Government’s efforts to achieve vision 2030 through capacitating the productive sectors of the country’s economy. Zimbabwe has abundant resources which are untapped, hence the need to bring the equipment to harness the vast mineral resources.”

Mr Terry said China was committed to make Zimbabwe an economic hub. “Together we can make Zimbabwe great.”

He also said that his company will also bring experts to Zimbabwe to service the machinery.

AAG sourced the equipment on behalf of the youths and women in mining and agriculture and will identify the particular individuals and groups who qualify for the equipment.

AAG vice president in charge of operations Mr Munyaradzi Kashambe said: “The signing of the MoU is in line with Vision 2030 .

“As the AAG we are of the strong conviction that the dream of an upper middle income economy by 2030 is indeed achievable earlier than that if we as Zimbabwe remain united and put all hands on deck and support our President. The AAG also believes in the potential of mining and agriculture as the backbone of our economy,” said Mr Kashambe.


Get the latest in African news delivered straight to your inbox

Top HeadlinesMiningZimbabwe
[email protected]
By submitting above, you agree to our privacy policy.

The coming in of Lovol is one of the fruits of President Mnangagwa’s engagement and re-engagement thrust and the policy of ensuring Zimbabwe is open for business.

“Let us all support the President’s Vision 2030 and make Zimbabwe great as per his dream. We urge all entrepreneurs to take advantage of the unending opportunities which the Second Republic has unveiled across all sectors.

“Through this partnership the US$12 billion mining economy by 2023 is indeed achievable. This deal benefits all women, youths and every Zimbabwe who are serious about the country’s economic development and Vision 2030 in general.

“As the AAG we are thankful to the visionary leadership of President Mnangagwa and will not leave any stone unturned in supporting the great vision he has for our country,” he said.

Speaking at the same occasion, AAG vice president for women and minorities Ms Anastancia Ndhlovu said the MOU was a game-changer so far as the empowerment of women, and girls and students was concerned.

“They can now access equipment and be active participants in the lucrative male dominated mining and agriculture sectors and so contribute to the country’s economic revival agenda in line with Vision 2030 and the NDS1. I urge all women and students to take advantage of this facility to set up or grow their businesses,” said Ms Ndhlovu.

Read the original article on The Herald.

Continue Reading


Marange teen mother’s parents face arrest



POLICE yesterday said they had arrested Hatirarami Momberume, also known as Evans Momberume (26), following the alleged death of a 14-year-old minor on July 15 while giving birth at the Johane Marange Apostolic sect shrine in Mafararikwa, Manicaland.

Momberume is facing charges of rape or alternatively contravening section 70 of the code.

The police also said the minor’s parents were facing arrest for faking identity documents of their deceased daughter in a bid to conceal the crime.

The minor died after developing complications while giving birth at the shrine and the matter was concealed until early this month. According to police investigations, the deceased’s first name was Anna Machaya (15) although, she had been previously identified as Memory Machaya.

Police spokesperson Assistant Commissioner Paul Nyathi yesterday said that the deceased’s first name was Anna and not Memory as indicated in documents submitted by her parents.

Nyathi said girl’s parents sought to defeat the course of justice by submitting the birth certificate of deceased’s 22-year-old cousin, Memory in a vain attempt to protect the minor’s “rapist” husband Momberume.

Momberume was supposed to appear at Mutare Magistrates Court yesterday, but the matter was postponed to today.

Nyathi said police were pressing criminal charges against the deceased’s mother, Shy Mabika (36) and father Edmore Machaya (45) for obstructing the course of justice.

“Memory Machaya (22) is alive and is actually married to a man called Lameck Makonye alias Sigodhla (54) in Mhondoro. We want to tell Zimbabweans that the person who died is not Memory Machaya. The person who died is Anna Machaya. Memory is alive,” Nyathi said.

“It is clear they were hiding information and it is clear that they also produced fake documents in a bid to hide the death of Anna Machaya. Information that was being presented was now indicating as if Anna was born in 1999, meaning to say that the person by now is an adult, yet in actual fact, she was born in 2006 meaning to say by now she is 15 years old and was married off when she was a minor.

“The parents lied to the police that Anna Machaya was born on January 2, 1999. The mother went on to give police investigators a national identity card in a bid to prove that she was born on January 2, 1999. This was false. Investigations have revealed that the identity card produced to the police belonged to a namesake of the late minor, who is a daughter to Ernest Machaya. This is an uncle to the late Anna Machaya. It is through school records in Mhondoro that the police proved that the late Anna Machaya was born on July 5, 2006 to Edmore Machaya and Shy Mabika. The police have obtained the correct birth certificate copies in respect of Memory Machaya (22) and the late Anna Machaya (15). These are two different people.”

Nyathi appealed for more information on Johane Marange sect members marrying off minor children.

Machaya’s death triggered a global outcry from child rights defenders with the United Nations and several other non-governmental organisations calling on government to end child marriages. Yesterday, different girls from Johane Marange and Johane Masowe Apostolic sects pleaded with stakeholders during a virtual discussion by the Female Students Network to intervene and end early child marriages.

Apostolic sect member Moline Mukomawasha, a University of Zimbabwe student, opened up, saying she had witnessed several girls in the sect being married off.

“Sexual exploitation and the practice of cultural processes happen at apostolic sects, especially the Johane Marange sect,” Mukomawasha said.

“There is also the issue of the virginity tests which is done using unhygienic methods where fingers are inserted into a girl’s reproductive parts. Those that have lost their virginity are forced into marriage with the people that would have impregnated them.”

She said some young girls fell prey to older men during prayer sessions held at the shrines.

Continue Reading


Copyright © 2021 I ZIM. For Zimbabweans By Zimbabweans