More than half the accounts that posted on Elon Musk’s X about the rioting in Belfast and the civil disorder in Southampton in June were based outside the UK, an analysis by the Guardian can reveal.

Of the 8,672 accounts whose combined posts about the events exceeded 1,000 views, just 45.3% were shown as from the UK, according to the social media platform’s own location function.

One in six (16.8%) came from the US, 4.5% from Ireland, and about a quarter from all European countries other than the UK.

Seven of the 12 most-read tweets about Belfast and Southampton came from the US – including one from Musk himself and two other US “alt-right” commentators – while an eighth was linked to North America.

The analysis underlines that US rightwing actors are seeking to influence the UK and boost their position on X in moments of disorder – an exploitation of flashpoint events that has only intermittently attracted political attention in Britain.

Nearly a third of all 43,000 posts on X relating to the two incidents contained racist or anti-immigration comments. Almost one in 10 relating to Belfast contained calls for violence or paramilitary or vigilante action.

Imran Ahmed, the chief executive of the Centre for Countering Digital Hate, said the data demonstrated that X had become “a weapon of choice” for hostile foreign actors seeking to manipulate shocking and divisive content.

Their goal, he added, was “to amplify local tragedies and crises, intensify racist narratives, and incite violence in communities they have never set foot in and to whom they have no real connection.”

A post from Musk after the life sentencing of the killer of 18-year-old Henry Nowak, who had been falsely accused of racism by police after being stabbed in Southampton, has been viewed more than 28m times.

“Legacy mainstream media, same ones who wrote about George Floyd millions of times, are dead silent about Nowak,” Musk posted shortly before 3pm on 2 June, in effect promoting his own platform at a time of heightened tension and disorder in the Hampshire port.

Eleven police officers were injured on the night of 2 June in Southampton as people claiming to protest over Nowak’s murder marched to the site of his death. This followed a rally, addressed by the far-right activist Tommy Robinson, outside the city’s main police station.

Musk is based in the US and has not visited the UK since November 2023. A Guardian analysis last month found he posted about race and immigration in the UK twice as often as he did about SpaceX in the run-up to the aerospace company’s initial public offering in June.

Security experts including Fiona Hill, a former adviser to the US and UK governments, have warned that the UK is a soft target for online manipulation by overseas actors because it does not take the idea of civil, or “psychological”, defence seriously.

Dr Julia Ebner, a researcher at the Institute for Strategic Dialogue and the University of Oxford, said flashpoint episodes such as in Southampton and Belfast had become “strategic events” for far-right actors seeking to amplify and exploit them.

“They are using the UK as a negative example, smearing the UK to promote their own narratives of western civilisational decay or social collapse,” Ebner said. “But the other purpose is to influence UK politics, and European politics more widely,” using crisis moments to “promote a strong, strengthened far-right wave across the world”.

Four of the top 12 most-seen tweets came from UK accounts: two were by the leader of the Restore Britain party, Rupert Lowe, whom Musk has endorsed; another was from GB News, while the most popular, with 37.6m views, was written by the “anti-woke” rightwing political commentator Konstantin Kisin.

Other accounts located in the US were anonymous, though familiar. @EndWokeness posted a blurry still image of a black man attacking a white man in Belfast on 8 June, saying the full video was “too graphic” to post. It attracted 16.3m views.

The assault, a stabbing in which the victim, Stephen Ogilvie, lost an eye, prompted three nights of racially motivated rioting targeting non-white people in Belfast. An asylum seeker from Sudan was charged with attempted murder and at least 23 people were arrested.

The @EndWokeness account, which has 3.9m followers, was cited by a parliamentary committee after it amplified a false claim that the 2024 attack in Southport, in which three girls were killed, was carried out by a Muslim man.

The account has been linked by an open source analyst to Jack Posobiec, a rightwing influencer who promoted the Pizzagate conspiracy, a false accusation that leading US Democrats were engaged in satanic child abuse at a child-friendly pizza restaurant in Washington DC.

Another leading poster was the US rightwing influencer Benny Johnson, who accused the New York Times of writing nothing about Nowak and thousands of pieces about the murder of George Floyd in Minneapolis in 2020 – though Nowak was murdered in the UK.

The analysis of the most-viewed accounts did not reveal any posts from Russia or China – both countries that have been behind online disinformation campaigns – though it is possible that posters successfully disguised their locations using virtual private networks (VPNs).

X shows location data for most profiles, inferred by the platform from user IP addresses, though government accounts are excluded. Last November, after the feature was introduced, X’s then head of product, Nikita Bier, said it was more than 99% accurate. When it was launched, it revealed that some pro-Scottish-independence accounts were based in Iran.

But there were signs of inauthenticity in popular posts. Two of the top most-seen tweets came from the US-based C3 (@C_3C_3) account, accusing “legacy media” of not reporting about the Nowak case. Its profile picture is a baby wearing a Make America Great Again cap; the username has changed 14 times previously.

One UK account, which tweeted at least six times about the murder of Nowak, with almost 3,800 combined views, had changed its name more than 400 times. NewsSceneUK – subsequently changed to BritifyFooty – wrote in one tweet about the “huge crowd of patriots outside #Southampton Police Station”.

Accounts posting from overseas that changed their usernames more than 20 times included one in Kenya that wrote after the Belfast stabbing: “When the state fails to protect people, the streets find their own language.” Another, from Europe, described the Nowak case as “a globalized, calculated and malicious evil” affecting “every White person and every White nation”.

Close to a third – about 13,000 – of the Belfast and Southampton tweets, whether from the UK or abroad, were racist or anti-immigrant, according to the Guardian analysis. When analysed separately, a quarter of the posts that were only about Southampton were racist or anti-immigrant, compared with a third of those that were only about Belfast.

One UK-based poster, writing a day after the Belfast stabbing, claimed they hoped the attacker was British-born because “race is the issue, not immigration status”. The post registered 2m views.

Valerie Wirtschafter, an expert on online foreign influence operations from the Brookings Institution, a US thinktank, said she believed violent events such as those in Belfast and Southampton were “a point of exploitation” in which “outside agitators” had an opportunity to make a disproportionate impact.

Their position was helped by X and other social media companies cutting content moderation, she said, but in particular by “algorithms and how they collide with the basic cognitive processes of humans. We are more attracted to things that are shocking.”