FactsLens coordinated activity report — Bluesky templated solicitation network
Staged Spam / scam · confidence high · one campaign · recommended: human review
Forty text clusters and 25 Bluesky accounts share accounts, templates, and a roughly two-hour posting window on 2026-11-14. Every cluster uses the same copy-paste structure ('Hi [name], Please ...') with only the recipient name changed, no cause, beneficiary, amount, link, or verifiable claim, and all accounts show empty profiles, low reach, and minimal activity. The strongest ordinary explanation is a single operator or small team running multiple low-reach Bluesky accounts to send personalized financial solicitation posts to named users. Given cross-cluster account sharing, synchrony, copy_paste, creation_burst, and empty profiles, the activity is judged staged rather than organic. The pushed content is a vague financial-distress / charity scam template, not a political narrative.
Strongest innocent explanation considered: A single person or small group operating several Bluesky accounts to solicit small donations or amplification from individually named users using a copy-paste template; no disclosed bot, newsroom, fan community, or real-world fundraiser is visible in the data.
- All 40 clusters carry the cross_cluster signal and share the same pool of 25 accounts.
- A1 appears in 29 clusters (C2,C3,C4,C6,C9,C11,C12,C13,C14,C15,C16,C19,C20,C23,C24,C25,C26,C28,C29,C31,C33,C34,C35,C36,C37,C38,C39,C40); A2 in 25; A3 in 24; A4 and A5 in 22 each.
- Every cluster uses one of a small set of near-identical templates with only the addressee name swapped (e.g. 'Please share or doante to help us', 'Please help my family survive', 'Please support our fundraiser', 'Can you support my children', 'Please help my little ones', 'Please consider helping us').
- All posts fall within offsets +0h00 to +2h09 on 2026-11-14, with the earliest posts P1 [C40,A17,+0h00], P2 [C40,A19,+0h01], P3 [C40,A20,+0h02] and P7 [C15,A3,+0h09] appearing within seconds of each other across different clusters.
The campaign in 3D
The campaign hub, its clusters, the platforms and websites they use, and the accounts shared between clusters. Drag to rotate, scroll to zoom, hover for details.
state media Telegram independent outlet suspicious cluster red line: contradicts green line: agrees · full legend
Layers, top to bottom: sources · platforms & servers · clusters, stories, campaigns · accounts listed propaganda site website platform / server watch likely organic mentions the story, does not push it story campaign account Lines: pushes a version shared accounts same picture posts on links toLoading the 3D view…
Accounts to review first
| # | Account | Why |
|---|---|---|
| 1 | A1 name for reviewers only | Appears in the most clusters (29: C2,C3,C4,C6,C9,C11,C12,C13,C14,C15,C16,C19,C20,C23,C24,C25,C26,C28,C29,C31,C33,C34,C35,C36,C37,C38,C39,C40), created 799 days ago, 9 followers, 19 posts, empty bio; posted early sample posts P10, P16, P29, P63, P78, P80. |
| 2 | A2 name for reviewers only | Appears in 25 clusters (C5,C7,C8,C10,C13,C14,C15,C16,C17,C18,C19,C20,C21,C22,C25,C26,C27,C28,C29,C33,C34,C35,C37,C38,C39), created 776 days ago, 5 followers, 32 posts, empty bio; posted early P8, P25, P56, P45. |
| 3 | A3 name for reviewers only | Appears in 24 clusters (C9,C10,C12,C13,C14,C15,C16,C18,C19,C20,C22,C23,C24,C25,C26,C28,C29,C31,C32,C33,C34,C36,C37,C39), created 803 days ago, 1 follower, 33 posts, empty bio; posted very early P7, P12, P18, P36, P62, P71. |
| 4 | A17 name for reviewers only | Posted the earliest post in the pack (P1 [C40,+0h00]) and other early posts P4 [C39,+0h09], P10 [C4,+0h11], P32 [C14,+0h45], P34 [C13,+0h45], P42 [C34,+0h48]; appears in 10 clusters (C4,C13,C14,C15,C16,C23,C34,C37,C39,C40), created 584 days ago, 40 followers, 26 posts, empty bio. |
| 5 | A19 name for reviewers only | Posted P2 [C40,+0h01], P5 [C38,+0h09], P19 [C35,+0h19], P39 [C34,+0h46]; appears in 7 clusters (C6,C14,C15,C34,C35,C38,C40), created 725 days ago, 0 followers, 27 posts, empty bio. |
| 6 | A20 name for reviewers only | Posted P3 [C40,+0h02], P35 [C14,+0h45], P37 [C16,+0h46]; appears in 6 clusters (C4,C13,C14,C16,C34,C40), created 344 days ago, 0 followers, 24 posts, empty bio. |
| 7 | A23 name for reviewers only | Newest account in the pack (created 64 days ago), 1 follower, 31 posts, empty bio; appears in C1 and C29, suggesting a fresher synthetic account in the same rotation. |
| 8 | A4 name for reviewers only | Appears in 22 clusters (C4,C7,C13,C14,C15,C16,C17,C18,C20,C21,C22,C23,C25,C27,C28,C29,C30,C32,C36,C37,C38,C39), created 790 days ago, 16 followers, 38 posts, empty bio; posted P6, P15, P27, P49, P50, P55, P66, P70. |
What it pushes
- Vague personal financial distress: the poster's family needs help to survive. C6C9C16C24C26C30C37C39
- Vague personal financial distress: help for the poster's children / 'little ones'. C11C17C19C27C32C35
- Vague fundraiser support request with no stated cause, organizer, amount, or link. C5C12C13C15C21C23C25C31
- Generic 'share or doante to help us' amplification and donation appeal for an unspecified 'us'. C1C2C4C7C8C10C14
- Unsolicited 'Please consider helping us' plea with no context, link, image, or video. C22C34C38
How it is run
- Shared accounts across clusters: the same accounts post in many different clusters, indicating one operator or shared infrastructure rather than independent users. A1A2A3A4A5A6
- Template reuse with name swapping: each cluster is built around one sentence where only the recipient handle changes (e.g. 'Hi Francesc', 'Hi Peter', 'Hi Alexandra' in C40). P1P2P3C40
- Tight timing: all activity occurs between +0h00 and +2h09 on 2026-11-14 UTC, with multiple clusters starting within the same minute (e.g. C40 at +0h00 to +0h02; C38, C39, C15 at +0h09 to +0h11). P1P2P3P4P5P6P7P8
- Platform: all accounts are listed as Bluesky accounts; no Mastodon or Telegram server evidence is present in this pack. A1A2A3
- Links: none of the sample posts or cluster descriptions contain a URL, payment destination, or donation page. P1P4P7C1C15
- Account ages: created between 64 days ago (A23) and 803 days ago (A3), with most accounts roughly 700-800 days old; follower counts are 0-40, follow counts are 1-56, post counts are 0-91, and all bios are empty. A1A3A7A17A19A20A23
- Signals: copy_paste, synchrony, cross_cluster, creation_burst, low_reach, empty_profiles, and repetition appear across nearly all clusters. C1C2C3C4C13C14C15
Clusters in this campaign
C1C2C3C4C5C6C7C8C9C10C11C12C13C14C15C16C17C18C19C20C21C22C23C24C25C26C27C28C29C30C31C32C33C34C35C36C37C38C39C40
nvidia/nemotron-3.5-super-vl-120b-a12b, prompt c1, Sat 10:48 UTC, 1 model call, 10745 prompt tokens (all clusters read at once), 50.8 s. Ids: C cluster, A account (anonymised), P post. References the model was not shown are removed automatically.