QAnon: Moving into Mainstream

Since its inception in 2017, the QAnon conspiracy has become a global phenomenon, impacting every online platform, many politicians and brands. This report will cover the basics of QAnon’s online activities. For a more comprehensive analysis – download the complete whitepaper below.


Since late 2017, the QAnon conspiracy theory has evolved from a series of 4chan posts to a following of hundreds of thousands worldwide that believe President Donald Trump is waging a secret war against Satan-worshipping pedophiles in media, politics, and Hollywood. In 2019, the FBI described “Q” supporters as a domestic terrorism threat.

QAnon supporters use various social platforms to coordinate online campaigns and spread disinformation and conspiracy theories to a global audience. ActiveFence secured direct access to QAnon forums and groups early on to provide insight into their global networks, beliefs, and tactics, and to track migration across platforms.

This report will provide a glimpse into some of our findings, including an overview of QAnon’s online behavior, evasion tactics, and cross-platform campaign coordination. The complete whitepaper, available for download below, will provide additional context and examples.

Who is Q

Q is an individual or group of people that posts alleged classified information on social platforms under the online moniker “Q.” The posts, known in the movement as Q-Drops, espouse pro-Trump conspiracy theories and coordinate operations amongst Q supporters against perceived enemies, including Democratic politicians, companies, journalists, and celebrities. Q’s posts are often vague, which encourages supporters to deduce meaning and take action.

Q supporters use social platforms to spread propaganda and disinformation about polarizing topics in the news, which recently include Covid-19, Black Lives Matter and the US presidential election.

Post from a QAnon group, promoting political activism ahead of the US presidential election

QAnon and Social Media

QAnon supporters view online platforms as “battlefields” where they must share their truth to the wider world. In their eyes, the movement’s survival depends on avoiding bans and removals by platforms whom they see as working against “Q” and President Trump. 

Developing global cross-platform and cross-channel connections, backup pages, and modified hashtags enables QAnon supporters to preserve internal communication and keep track of their data in case of removal. This includes creating multiple accounts across various platforms, using one to coordinate “attacks” that target another. These individuals often use evasion tactics, including referencing modified versions of “QAnon,” a keyword which has been banned across most mainstream platforms. These modifications include “17anon,” “CueAnon,” and “Q4n0n,” alongside references simply to the letter Q, its phonetic, “Cue,” or the letter’s placement in the alphabet (#17).

For specific examples of these activities, download the complete report below.

Global Reach

QAnon supporters are active globally and employ similar ideas, tactics, and hashtags as US-based groups and forums. While the Europe-based groups promote the US-based groups’ content, they also map local far-right positions onto QAnon content. These groups are active both online and off, coordinating protests across many major cities around the world.

QAnon protests in the UK

Inside a QAnon Campaign: #DisneyGate

Q-Drops will often contain messaging that attacks specific brands, accusing them of co-opting with the “Deep State” and aiding in alleged child sex trafficking by the Democratic party. Disney is among the brands targeted by these campaigns.

This section will provide highlights of the August, 2020 QAnon attack against Disney, titled #DisneyGate, with more details available in the report below. This operation targeted Disney for its alleged association with the CIA, ties to Jeffrey Epstein, and its role in trafficking children. The attack was coordinated on various social platforms including 8kun and Twitter, among others, with QAnon followers instructed to post content and hashtags from a shared file.

flyer promoting the qanon campaign disneygate
A flyer shared in QAnon communities, promoting operation Disneygate

As a result, QAnon supporters attacked Disney’s social media accounts with harmful content and accusations of pedophelia over the course of five days, often using co-opted hashtags like #SaveTheChildren.


In recent years, the QAnon conspiracy has been growing in the shadows of alternative social networks while maintaining a presence on mainstream social media through use of ever-evolving evasion tactics. Followers of the conspiracy utilize the anonymity afforded to them on unmoderated platforms, alongside the broad reach achieved on mainstream social networks to coordinate and plan attacks against mainstream social media, brands and the Democratic party.

This report provides a brief description of QAnon’s online activities and tactics, but is not a comprehensive view of their ever-changing strategies. The movement’s sophisticated operations that promote harmful and even dangerous activities, mean that it can no longer be overlooked by any company that seeks to maintain the safety of its users or its brand.

ActiveFence continues to monitor forums and groups that are affiliated with the QAnon conspiracy across all platforms, providing our clients with visibility into their activities and evasion tactics, alongside advance knowledge of upcoming threats against their platform or brand.

Download the complete report below for a more thorough analysis, including examples of QAnon tactics on multiple mainstream online platforms.

For more details and examples, download the complete whitepaper.

I agree to receive emails from ActiveFence about products and services. For more information, please see our Privacy Policy.


    All Research

    Learn About The ActiveFence Approach.

    Contact Us